diff --git a/.golangci.yml b/.golangci.yml index 0e8bf1a63b..b170dea3ca 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -25,6 +25,12 @@ linters: - common-false-positives - legacy - std-error-handling + rules: + # Dot imports are allowed. + - linters: + - staticcheck + text: 'ST1001: should not use dot imports' + source: '\. "github\.com/onsi/(ginkgo(/v2)?|gomega)"' paths: - third_party$ - builtin$ diff --git a/api/v2/checluster_types.go b/api/v2/checluster_types.go index 0176c6d14e..e9b02a6310 100644 --- a/api/v2/checluster_types.go +++ b/api/v2/checluster_types.go @@ -347,23 +347,8 @@ type CheClusterSpecNetworking struct { // +optional // +kubebuilder:default:={gateway: {configLabels: {app: che, component: che-gateway-config}}} Auth Auth `json:"auth"` - // NetworkPolicy configures NetworkPolicy resources for the Che namespace - // and user workspace namespaces. For OpenShift clusters only. - // When enabled, the following policies are created: - // In the Che namespace: - // - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - // - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - // - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - // - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - // - allow-from--operator: allows ingress traffic from the operator pod to Che components. - // - allow-all-egress: allows all egress traffic from Che pods. - // In each user workspace namespace: - // - allow-from-: allows ingress traffic from the Che namespace. - // - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - // - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - // - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - // - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - // - allow-all-egress: allows all egress traffic from workspace pods. + // NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + // such as the gateway, the server, the dashboard and the registries. // +optional NetworkPolicy *NetworkPolicy `json:"networkPolicy,omitempty"` } @@ -372,13 +357,62 @@ type DevEnvironmentNetworking struct { // External TLS configuration. // +optional ExternalTLSConfig *ExternalTLSConfig `json:"externalTLSConfig,omitempty"` + // NetworkPolicy defines configuration options for the NetworkPolicies provisioned + // for each DevWorkspace by the DevWorkspace Operator. + // + // When enabled and no ingress rules are specified, the Operator sets the default + // DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + // from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + // CheCluster namespace). If custom ingress rules are specified, only those rules apply + // and the rule allowing traffic from Che operands is not added automatically; if Che + // operands need to communicate with the workspaces, a corresponding ingress rule must be + // explicitly included. + // + // When enabled and no egress rules are specified, the Operator sets the default + // DevWorkspace Operator egress rules. If custom egress rules are specified, only + // those rules apply. + // + // When `enabled` is not set here, it falls back to the Che-wide + // `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + // is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + // keeping the NetworkPolicies for the Che components. + // +kubebuilder:validation:Optional + NetworkPolicy *controllerv1alpha1.NetworkPolicyConfig `json:"networkPolicy,omitempty"` } -// NetworkPolicy configuration settings. +// NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, +// such as the gateway, the server, the dashboard and the registries. // +k8s:openapi-gen=true type NetworkPolicy struct { - // Enabled controls whether the operator creates NetworkPolicy resources. - // +optional + // Enabled determines whether the NetworkPolicies are provisioned for Eclipse Che. + // The policies are created in the namespace where the `CheCluster` custom resource is created + // and apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` only. + // Disabled by default. When set to `false`, the NetworkPolicies previously created + // by the Operator are removed. + // + // On OpenShift, the following NetworkPolicies are created in the `CheCluster` namespace: + // - `allow-from-same-namespace` : from the Che operands themselves. + // - `allow-from-openshift-ingress` : from the OpenShift ingress controller. + // - `allow-from-openshift-host-network` : from the pods that use the host network, for example + // the OpenShift router. + // - `allow-from-openshift-monitoring` : from the OpenShift monitoring stack, to scrape metrics. + // - `allow-from-workspaces` : from the users' workspace namespaces. + // - `allow-from-che-operator` : from the Operator pods in the Operator namespace. + // - `allow-all-egress` : allows all egress traffic from the Che operands. + // + // On Kubernetes, only the `allow-all-ingress` and `allow-all-egress` NetworkPolicies are created, + // allowing all ingress and egress traffic, since the namespace of the cluster's ingress controller + // is not known to the Operator. Enabling this setting on Kubernetes does not restrict any traffic + // by itself: administrators are expected to provision their own NetworkPolicies. + // + // This setting also drives workspace isolation when `spec.devEnvironments.networking.networkPolicy` + // does not define `enabled`: setting this field to `true` additionally enables the NetworkPolicies + // that the DevWorkspace Operator provisions for each DevWorkspace. To protect the Che components + // without isolating the workspaces, explicitly set + // `spec.devEnvironments.networking.networkPolicy.enabled` to `false`. + // + // +kubebuilder:default:=false + // +kubebuilder:validation:Optional Enabled *bool `json:"enabled,omitempty"` } @@ -1403,8 +1437,14 @@ func (c *CheCluster) IsDevEnvironmentExternalTLSConfigEnabled() bool { } func (c *CheCluster) IsNetworkPoliciesEnabled() bool { - return c.Spec.Networking.NetworkPolicy != nil && - ptr.Deref(c.Spec.Networking.NetworkPolicy.Enabled, constants.NetworkPolicyEnabled) + if c.Spec.Networking.NetworkPolicy == nil { + return constants.DefaultNetworkPolicyEnabled + } + + return ptr.Deref( + c.Spec.Networking.NetworkPolicy.Enabled, + constants.DefaultNetworkPolicyEnabled, + ) } func (c *CheCluster) IsOAuthProxyImageResolutionFromImageStreamEnabled() bool { diff --git a/api/v2/zz_generated.deepcopy.go b/api/v2/zz_generated.deepcopy.go index 5c09b4cc97..82359e3921 100644 --- a/api/v2/zz_generated.deepcopy.go +++ b/api/v2/zz_generated.deepcopy.go @@ -892,6 +892,11 @@ func (in *DevEnvironmentNetworking) DeepCopyInto(out *DevEnvironmentNetworking) *out = new(ExternalTLSConfig) (*in).DeepCopyInto(*out) } + if in.NetworkPolicy != nil { + in, out := &in.NetworkPolicy, &out.NetworkPolicy + *out = new(v1alpha1.NetworkPolicyConfig) + (*in).DeepCopyInto(*out) + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DevEnvironmentNetworking. diff --git a/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml b/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml index 4237961f06..d219f71251 100644 --- a/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml +++ b/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml @@ -86,7 +86,7 @@ metadata: categories: Developer Tools certified: "false" containerImage: quay.io/eclipse/che-operator:next - createdAt: "2026-10-01T12:19:13Z" + createdAt: "2026-10-16T09:11:33Z" description: A Kube-native development solution that delivers portable and collaborative developer workspaces. features.operators.openshift.io/cnf: "false" @@ -108,7 +108,7 @@ metadata: operatorframework.io/arch.amd64: supported operatorframework.io/arch.arm64: supported operatorframework.io/os.linux: supported - name: eclipse-che.v7.123.0-1079.next + name: eclipse-che.v7.124.0-1087.next namespace: placeholder spec: apiservicedefinitions: {} @@ -931,6 +931,7 @@ spec: verbs: - create - delete + - deletecollection - get - update - patch @@ -1201,7 +1202,7 @@ spec: name: openvsx - image: quay.io/sclorg/postgresql-16-c9s:20260319 name: openvsx-postgres - version: 7.123.0-1079.next + version: 7.124.0-1087.next webhookdefinitions: - admissionReviewVersions: - v1 diff --git a/bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml b/bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml index 68883c4efc..78b534b76e 100644 --- a/bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml +++ b/bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml @@ -136,7 +136,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -295,7 +297,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -458,7 +462,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -617,7 +623,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1052,7 +1060,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1247,7 +1257,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1675,7 +1687,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1897,7 +1911,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2126,7 +2142,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2408,7 +2426,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4464,7 +4484,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4871,10 +4893,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5217,6 +5250,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5250,6 +5290,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5337,6 +5384,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5408,6 +5462,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5426,6 +5487,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5519,8 +5592,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5565,7 +5638,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6140,6 +6212,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6241,6 +6320,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6282,6 +6368,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6387,6 +6480,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6495,6 +6595,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6555,6 +6662,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6604,6 +6718,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6812,6 +6933,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6845,6 +6973,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7052,7 +7187,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7459,10 +7596,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7805,6 +7953,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7838,6 +7993,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7925,6 +8087,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7996,6 +8165,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8014,6 +8190,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8107,8 +8295,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8153,7 +8341,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8728,6 +8915,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8829,6 +9023,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8870,6 +9071,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8975,6 +9183,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9083,6 +9298,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9143,6 +9365,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9192,6 +9421,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9400,6 +9636,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9433,6 +9676,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9606,7 +9856,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -10013,10 +10265,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10359,6 +10622,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10392,6 +10662,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10479,6 +10756,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10550,6 +10834,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10568,6 +10859,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10661,8 +10964,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10707,7 +11010,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11282,6 +11584,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11383,6 +11692,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11424,6 +11740,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11529,6 +11852,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11637,6 +11967,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11697,6 +12034,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11746,6 +12090,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11954,6 +12305,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11987,6 +12345,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12229,7 +12594,9 @@ spec: ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12641,10 +13008,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12991,6 +13369,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -13024,6 +13409,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13112,6 +13504,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13186,6 +13585,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13204,6 +13610,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13297,8 +13715,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13343,7 +13761,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13923,6 +14340,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -14026,6 +14450,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14067,6 +14498,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14178,6 +14616,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14286,6 +14731,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14346,6 +14798,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14395,6 +14854,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14605,6 +15071,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14638,6 +15111,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14849,7 +15329,9 @@ spec: ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15261,10 +15743,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15611,6 +16104,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15644,6 +16144,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15732,6 +16239,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15806,6 +16320,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15824,6 +16345,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15917,8 +16450,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15963,7 +16496,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16543,6 +17075,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16646,6 +17185,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16687,6 +17233,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16798,6 +17351,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16906,6 +17466,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16966,6 +17533,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17015,6 +17589,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17225,6 +17806,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17258,6 +17846,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17426,7 +18021,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17833,10 +18430,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18179,6 +18787,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18212,6 +18827,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18299,6 +18921,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18370,6 +18999,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18388,6 +19024,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18481,8 +19129,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18527,7 +19175,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19102,6 +19749,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19203,8 +19857,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19244,6 +19905,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19349,6 +20017,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19457,6 +20132,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19517,6 +20199,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19566,6 +20255,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19774,6 +20470,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19807,6 +20510,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21967,7 +22677,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22365,10 +23077,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22513,7 +23236,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22785,6 +23510,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22898,6 +23628,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22980,6 +23715,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23038,6 +23780,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23195,6 +23942,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23253,6 +24007,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23708,6 +24467,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23766,6 +24532,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23906,10 +24677,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which + the volume should be mounted. type: string mountPropagation: description: |- @@ -24027,6 +24809,437 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -24098,7 +25311,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24496,10 +25711,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24868,11 +26094,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25436,7 +26659,9 @@ spec: ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25848,10 +27073,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26198,6 +27434,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26231,6 +27474,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26319,6 +27569,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26393,6 +27650,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26411,6 +27675,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26504,8 +27780,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26550,7 +27826,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27130,6 +28405,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27233,6 +28515,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27274,6 +28563,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27385,6 +28681,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27493,6 +28796,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27553,6 +28863,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27602,6 +28919,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27812,6 +29136,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27845,6 +29176,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -28071,27 +29409,44 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies\ + \ are provisioned for Eclipse Che.\nThe policies are created\ + \ in the namespace where the `CheCluster` custom resource\ + \ is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org`\ + \ only.\nDisabled by default. When set to `false`, the\ + \ NetworkPolicies previously created\nby the Operator\ + \ are removed.\n\nOn OpenShift, the following NetworkPolicies\ + \ are created in the `CheCluster` namespace:\n - `allow-from-same-namespace`\ + \ \t: from the Che operands themselves.\n - `allow-from-openshift-ingress`\ + \ \t: from the OpenShift ingress controller.\n -\ + \ `allow-from-openshift-host-network` \t: from the pods\ + \ that use the host network, for example\n the OpenShift\ + \ router.\n - `allow-from-openshift-monitoring` \t\ + : from the OpenShift monitoring stack, to scrape metrics.\n\ + \ - `allow-from-workspaces` \t: from the\ + \ users' workspace namespaces.\n - `allow-from-che-operator`\ + \ \t\t: from the Operator pods in the Operator namespace.\n\ + \ - `allow-all-egress` \t: allows all\ + \ egress traffic from the Che operands.\n\nOn Kubernetes,\ + \ only the `allow-all-ingress` and `allow-all-egress`\ + \ NetworkPolicies are created,\nallowing all ingress and\ + \ egress traffic, since the namespace of the cluster's\ + \ ingress controller\nis not known to the Operator. Enabling\ + \ this setting on Kubernetes does not restrict any traffic\n\ + by itself: administrators are expected to provision their\ + \ own NetworkPolicies.\n\nThis setting also drives workspace\ + \ isolation when `spec.devEnvironments.networking.networkPolicy`\n\ + does not define `enabled`: setting this field to `true`\ + \ additionally enables the NetworkPolicies\nthat the DevWorkspace\ + \ Operator provisions for each DevWorkspace. To protect\ + \ the Che components\nwithout isolating the workspaces,\ + \ explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled`\ + \ to `false`." type: boolean type: object tlsSecretName: diff --git a/config/crd/bases/org.eclipse.che_checlusters.yaml b/config/crd/bases/org.eclipse.che_checlusters.yaml index 392d68b1e4..38bc6b9358 100644 --- a/config/crd/bases/org.eclipse.che_checlusters.yaml +++ b/config/crd/bases/org.eclipse.che_checlusters.yaml @@ -119,7 +119,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -278,7 +280,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -441,7 +445,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -600,7 +606,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1033,7 +1041,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1228,7 +1238,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1656,7 +1668,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1876,7 +1890,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2103,7 +2119,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2383,7 +2401,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4429,7 +4449,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4834,10 +4856,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5178,6 +5211,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5211,6 +5251,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5298,6 +5345,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5368,6 +5422,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5386,6 +5447,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5479,8 +5552,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5525,7 +5598,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6099,6 +6171,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6200,6 +6279,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6241,6 +6327,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6344,6 +6437,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6451,6 +6551,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6511,6 +6618,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6560,6 +6674,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6767,6 +6888,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6800,6 +6928,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7006,7 +7141,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7411,10 +7548,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7755,6 +7903,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7788,6 +7943,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7875,6 +8037,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7945,6 +8114,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -7963,6 +8139,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8056,8 +8244,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8102,7 +8290,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8676,6 +8863,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8777,6 +8971,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8818,6 +9019,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8921,6 +9129,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9028,6 +9243,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9088,6 +9310,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9137,6 +9366,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9344,6 +9580,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9377,6 +9620,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9549,7 +9799,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -9954,10 +10206,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10298,6 +10561,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10331,6 +10601,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10418,6 +10695,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10488,6 +10772,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10506,6 +10797,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10599,8 +10902,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10645,7 +10948,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11219,6 +11521,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11320,6 +11629,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11361,6 +11677,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11464,6 +11787,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11571,6 +11901,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11631,6 +11968,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11680,6 +12024,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11887,6 +12238,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11920,6 +12278,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12159,7 +12524,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12568,10 +12935,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12915,6 +13293,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -12948,6 +13333,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13036,6 +13428,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13110,6 +13509,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13128,6 +13534,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13221,8 +13639,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13267,7 +13685,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13844,6 +14261,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -13947,6 +14371,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13988,6 +14419,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14098,6 +14536,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14206,6 +14651,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14266,6 +14718,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14315,6 +14774,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14524,6 +14990,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14557,6 +15030,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14766,7 +15246,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15175,10 +15657,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15522,6 +16015,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15555,6 +16055,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15643,6 +16150,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15717,6 +16231,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15735,6 +16256,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15828,8 +16361,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15874,7 +16407,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16451,6 +16983,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16554,6 +17093,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16595,6 +17141,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16705,6 +17258,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16813,6 +17373,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16873,6 +17440,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16922,6 +17496,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17131,6 +17712,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17164,6 +17752,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17331,7 +17926,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17736,10 +18333,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18080,6 +18688,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18113,6 +18728,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18200,6 +18822,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18270,6 +18899,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18288,6 +18924,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18381,8 +19029,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18427,7 +19075,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19001,6 +19648,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19102,8 +19756,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19143,6 +19804,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19246,6 +19914,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19353,6 +20028,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19413,6 +20095,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19462,6 +20151,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19669,6 +20365,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19702,6 +20405,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21857,7 +22567,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22255,10 +22967,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22403,7 +23126,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22674,6 +23399,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22787,6 +23517,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22869,6 +23604,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -22927,6 +23669,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23084,6 +23831,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23142,6 +23896,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23597,6 +24356,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23655,6 +24421,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23795,10 +24566,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -23916,6 +24698,433 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -23986,7 +25195,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24384,10 +25595,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24756,11 +25978,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25321,7 +26540,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25730,10 +26951,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26077,6 +27309,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26110,6 +27349,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26198,6 +27444,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26272,6 +27525,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26290,6 +27550,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26383,8 +27655,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26429,7 +27701,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27006,6 +28277,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27109,6 +28387,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27150,6 +28435,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27260,6 +28552,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27368,6 +28667,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27428,6 +28734,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27477,6 +28790,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27686,6 +29006,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27719,6 +29046,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27945,27 +29279,41 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies + are provisioned for Eclipse Che.\nThe policies are created + in the namespace where the `CheCluster` custom resource + is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` + only.\nDisabled by default. When set to `false`, the NetworkPolicies + previously created\nby the Operator are removed.\n\nOn OpenShift, + the following NetworkPolicies are created in the `CheCluster` + namespace:\n - `allow-from-same-namespace` \t: + from the Che operands themselves.\n - `allow-from-openshift-ingress` + \ \t: from the OpenShift ingress controller.\n - `allow-from-openshift-host-network` + \t: from the pods that use the host network, for example\n + \ the OpenShift router.\n - `allow-from-openshift-monitoring` + \ \t: from the OpenShift monitoring stack, to scrape metrics.\n + \ - `allow-from-workspaces` \t: from the users' + workspace namespaces.\n - `allow-from-che-operator` \t\t: + from the Operator pods in the Operator namespace.\n - `allow-all-egress` + \ \t: allows all egress traffic from the + Che operands.\n\nOn Kubernetes, only the `allow-all-ingress` + and `allow-all-egress` NetworkPolicies are created,\nallowing + all ingress and egress traffic, since the namespace of the + cluster's ingress controller\nis not known to the Operator. + Enabling this setting on Kubernetes does not restrict any + traffic\nby itself: administrators are expected to provision + their own NetworkPolicies.\n\nThis setting also drives workspace + isolation when `spec.devEnvironments.networking.networkPolicy`\ndoes + not define `enabled`: setting this field to `true` additionally + enables the NetworkPolicies\nthat the DevWorkspace Operator + provisions for each DevWorkspace. To protect the Che components\nwithout + isolating the workspaces, explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled` + to `false`." type: boolean type: object tlsSecretName: diff --git a/config/rbac/cluster_role.yaml b/config/rbac/cluster_role.yaml index 3d2aa5243e..af4fb5d008 100644 --- a/config/rbac/cluster_role.yaml +++ b/config/rbac/cluster_role.yaml @@ -403,6 +403,7 @@ rules: verbs: - create - delete + - deletecollection - get - update - patch diff --git a/controllers/che/checluster_controller.go b/controllers/che/checluster_controller.go index 41e3ca0444..fce834e31b 100644 --- a/controllers/che/checluster_controller.go +++ b/controllers/che/checluster_controller.go @@ -22,7 +22,7 @@ import ( "github.com/eclipse-che/che-operator/pkg/common/reconciler" agentsandbox "github.com/eclipse-che/che-operator/pkg/deploy/agent-sandbox" "github.com/eclipse-che/che-operator/pkg/deploy/metrics" - "github.com/eclipse-che/che-operator/pkg/deploy/networkpolicies" + "github.com/eclipse-che/che-operator/pkg/reconciler/networkpolicy" monitoringv1 "github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1" "k8s.io/utils/ptr" "sigs.k8s.io/controller-runtime/pkg/controller" @@ -109,10 +109,7 @@ func NewReconciler( reconcilerManager.AddReconciler(tls.NewTlsSecretReconciler()) reconcilerManager.AddReconciler(devworkspace.NewDevWorkspaceConfigReconciler()) reconcilerManager.AddReconciler(rbac.NewGatewayPermissionsReconciler()) - - if infrastructure.IsOpenShift() { - reconcilerManager.AddReconciler(networkpolicies.NewNetworkPoliciesReconciler()) - } + reconcilerManager.AddReconciler(&networkpolicy.NetworkPoliciesReconciler{}) // we have to expose che endpoint independently of syncing other server // resources since che host is used for dashboard deployment and che config map diff --git a/controllers/usernamespace/usernamespace_controller.go b/controllers/usernamespace/usernamespace_controller.go index dca33fb85d..e7da54bca7 100644 --- a/controllers/usernamespace/usernamespace_controller.go +++ b/controllers/usernamespace/usernamespace_controller.go @@ -24,9 +24,8 @@ import ( "github.com/eclipse-che/che-operator/pkg/common/diffs" "github.com/eclipse-che/che-operator/pkg/common/infrastructure" k8sclient "github.com/eclipse-che/che-operator/pkg/common/k8s-client" - defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" containercapabilties "github.com/eclipse-che/che-operator/pkg/deploy/container-capabilities" - "github.com/eclipse-che/che-operator/pkg/deploy/networkpolicies" + "github.com/eclipse-che/che-operator/pkg/provision" rbacv1 "k8s.io/api/rbac/v1" "k8s.io/utils/ptr" @@ -45,7 +44,6 @@ import ( projectv1 "github.com/openshift/api/project/v1" "github.com/sirupsen/logrus" corev1 "k8s.io/api/core/v1" - networkingv1 "k8s.io/api/networking/v1" "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" @@ -115,8 +113,7 @@ func (r *CheUserNamespaceReconciler) SetupWithManager(mgr ctrl.Manager) error { Watches(&corev1.Pod{}, r.watchRuleForDevWorkspacePod()). Watches(&corev1.Secret{}, r.watchRulesForSecrets(ctx)). Watches(&corev1.ConfigMap{}, r.watchRulesForConfigMaps(ctx)). - Watches(&chev2.CheCluster{}, r.triggerAllNamespaces()). - Watches(&networkingv1.NetworkPolicy{}, r.watchRulesForNetworkPolicies(ctx)) + Watches(&chev2.CheCluster{}, r.triggerAllNamespaces()) // Use controller.TypedOptions to allow to configure 2 controllers for same object being reconciled return bld.WithOptions( @@ -151,32 +148,6 @@ func (r *CheUserNamespaceReconciler) commonRules(ctx context.Context, namesInChe } } -func (r *CheUserNamespaceReconciler) watchRulesForNetworkPolicies(_ context.Context) handler.EventHandler { - return handler.EnqueueRequestsFromMapFunc( - func(ctx context.Context, obj client.Object) []reconcile.Request { - workspaceInfo, err := r.namespaceCache.GetNamespaceInfo(ctx, obj.GetNamespace()) - if err != nil { - logger.Error(err, "failed to get namespace info", "Namespace", obj.GetNamespace()) - return []reconcile.Request{} - } - - if workspaceInfo != nil && - workspaceInfo.IsWorkspaceNamespace && - deploy.IsOperatorManagedComponent(obj.GetLabels(), defaults.GetCheFlavor()) { - - return []reconcile.Request{ - { - NamespacedName: types.NamespacedName{ - Name: obj.GetNamespace(), - }, - }, - } - } - - return []reconcile.Request{} - }) -} - func (r *CheUserNamespaceReconciler) watchRulesForConfigMaps(ctx context.Context) handler.EventHandler { rules := r.commonRules(ctx, tls.CheMergedCABundleCertsCMName) return handler.EnqueueRequestsFromMapFunc( @@ -331,8 +302,10 @@ func (r *CheUserNamespaceReconciler) Reconcile(ctx context.Context, req ctrl.Req } if infrastructure.IsOpenShift() { - if err = r.reconcileNetworkPolicies(cheCtx, req.Name); err != nil { - return ctrl.Result{}, fmt.Errorf("failed to reconcile network policies in namespace %s: %w", req.Name, err) + // Removes legacy network policies previously provisioned by Che Operator, + // as DevWorkspace Operator now manages network policy provisioning for DevWorkspaces. + if err := provision.NetworkPolicy.DeleteAll(cheCtx, req.Name); err != nil { + return ctrl.Result{}, fmt.Errorf("failed to delete legacy NetworkPolicy in namespace %s: %w", req.Name, err) } } @@ -702,24 +675,6 @@ func (r *CheUserNamespaceReconciler) reconcileSCCPrivileges( ) } -func (r *CheUserNamespaceReconciler) reconcileNetworkPolicies(cheCtx *chetypes.CheContext, targetNs string) error { - if !cheCtx.CheCluster.IsNetworkPoliciesEnabled() { - err := networkpolicies.DeleteNetworkPolicy(cheCtx, targetNs) - if err != nil { - err = fmt.Errorf("failed to delete NetworkPolicy in namespace %s: %w", targetNs, err) - } - - return err - } - - err := networkpolicies.SyncNetworkPolicy(cheCtx, targetNs) - if err != nil { - return fmt.Errorf("failed to sync NetworkPolicy in namespace %s: %w", targetNs, err) - } - - return nil -} - func prefixedName(name string) string { return "che-" + name } diff --git a/controllers/usernamespace/usernamespace_controller_network_policies_test.go b/controllers/usernamespace/usernamespace_controller_network_policies_test.go deleted file mode 100644 index 4a4f3b8e5d..0000000000 --- a/controllers/usernamespace/usernamespace_controller_network_policies_test.go +++ /dev/null @@ -1,199 +0,0 @@ -// -// Copyright (c) 2019-2026 Red Hat, Inc. -// This program and the accompanying materials are made -// available under the terms of the Eclipse Public License 2.0 -// which is available at https://www.eclipse.org/legal/epl-2.0/ -// -// SPDX-License-Identifier: EPL-2.0 -// -// Contributors: -// Red Hat, Inc. - initial API and implementation -// - -package usernamespace - -import ( - "context" - "testing" - - chev2 "github.com/eclipse-che/che-operator/api/v2" - "github.com/eclipse-che/che-operator/pkg/common/constants" - "github.com/eclipse-che/che-operator/pkg/common/infrastructure" - projectv1 "github.com/openshift/api/project/v1" - "github.com/stretchr/testify/assert" - corev1 "k8s.io/api/core/v1" - networkingv1 "k8s.io/api/networking/v1" - "k8s.io/apimachinery/pkg/api/errors" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/types" - "k8s.io/utils/ptr" - "sigs.k8s.io/controller-runtime/pkg/client" - "sigs.k8s.io/controller-runtime/pkg/reconcile" -) - -var allUserNsNetworkPolicyNames = []string{ - "allow-from-eclipse-che", - "allow-from-same-namespace", - "allow-from-devworkspace-operator", - "allow-from-openshift-monitoring", - "allow-from-openshift-ingress", - "allow-all-egress", -} - -func TestNetworkPoliciesCreatedWhenEnabledOnOpenShift(t *testing.T) { - cheCluster, userNamespace, userProject := buildNetworkPolicyTestObjects() - _, cl, r := setup(infrastructure.OpenShiftV4, cheCluster, userNamespace, userProject) - - _, err := r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - npList := &networkingv1.NetworkPolicyList{} - err = cl.List(context.TODO(), npList, &client.ListOptions{Namespace: "user-project"}) - assert.NoError(t, err) - assert.Equal(t, len(allUserNsNetworkPolicyNames), len(npList.Items)) - - for _, name := range allUserNsNetworkPolicyNames { - np := &networkingv1.NetworkPolicy{} - err := cl.Get( - context.TODO(), - types.NamespacedName{Name: name, Namespace: "user-project"}, - np, - ) - assert.NoError(t, err) - } -} - -func TestNetworkPoliciesDeletedWhenDisabled(t *testing.T) { - cheCluster, userNamespace, userProject := buildNetworkPolicyTestObjects() - _, cl, r := setup(infrastructure.OpenShiftV4, cheCluster, userNamespace, userProject) - - _, err := r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - cheCluster.Spec.Networking.NetworkPolicy.Enabled = ptr.To(false) - err = cl.Update(context.TODO(), cheCluster) - assert.NoError(t, err) - - _, err = r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - for _, name := range allUserNsNetworkPolicyNames { - np := &networkingv1.NetworkPolicy{} - err := cl.Get( - context.TODO(), - types.NamespacedName{Name: name, Namespace: "user-project"}, - np, - ) - assert.Error(t, err) - assert.True(t, errors.IsNotFound(err)) - } -} - -func TestNetworkPoliciesIdempotent(t *testing.T) { - cheCluster, userNamespace, userProject := buildNetworkPolicyTestObjects() - _, cl, r := setup(infrastructure.OpenShiftV4, cheCluster, userNamespace, userProject) - - _, err := r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - _, err = r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - for _, name := range allUserNsNetworkPolicyNames { - np := &networkingv1.NetworkPolicy{} - err := cl.Get( - context.TODO(), - types.NamespacedName{Name: name, Namespace: "user-project"}, - np, - ) - assert.NoError(t, err) - } -} - -func TestNetworkPoliciesDeletedOnlyOwnedPolicies(t *testing.T) { - cheCluster, userNamespace, userProject := buildNetworkPolicyTestObjects() - - unownedNetworkPolicy := &networkingv1.NetworkPolicy{ - ObjectMeta: metav1.ObjectMeta{ - Name: "unowned-policy", - Namespace: "user-project", - }, - } - - _, cl, r := setup( - infrastructure.OpenShiftV4, - cheCluster, - userNamespace, - userProject, - unownedNetworkPolicy, - ) - - _, err := r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - cheCluster.Spec.Networking.NetworkPolicy.Enabled = ptr.To(false) - err = cl.Update(context.TODO(), cheCluster) - assert.NoError(t, err) - - _, err = r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - for _, name := range allUserNsNetworkPolicyNames { - np := &networkingv1.NetworkPolicy{} - err := cl.Get( - context.TODO(), - types.NamespacedName{Name: name, Namespace: "user-project"}, - np, - ) - assert.Error(t, err) - assert.True(t, errors.IsNotFound(err)) - } - - np := &networkingv1.NetworkPolicy{} - err = cl.Get( - context.TODO(), - types.NamespacedName{Name: "unowned-policy", Namespace: "user-project"}, - np, - ) - assert.NoError(t, err) -} - -func buildNetworkPolicyTestObjects() (*chev2.CheCluster, client.Object, client.Object) { - cheCluster := &chev2.CheCluster{ - ObjectMeta: metav1.ObjectMeta{ - Name: "eclipse-che", - Namespace: "eclipse-che", - }, - Spec: chev2.CheClusterSpec{ - Networking: chev2.CheClusterSpecNetworking{ - NetworkPolicy: &chev2.NetworkPolicy{ - Enabled: ptr.To(true), - }, - }, - }, - } - - userNamespace := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{ - Name: "user-project", - Labels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - constants.KubernetesComponentLabelKey: "workspaces-namespace", - constants.WorkspaceNamespaceOwnerUidLabelKey: "some-uid", - }, - }, - } - - userProject := &projectv1.Project{ - ObjectMeta: metav1.ObjectMeta{ - Name: "user-project", - Labels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - constants.KubernetesComponentLabelKey: "workspaces-namespace", - constants.WorkspaceNamespaceOwnerUidLabelKey: "some-uid", - }, - }, - } - - return cheCluster, userNamespace, userProject -} diff --git a/deploy/deployment/kubernetes/combined.yaml b/deploy/deployment/kubernetes/combined.yaml index cfcf69ae51..3f2bffcdd4 100644 --- a/deploy/deployment/kubernetes/combined.yaml +++ b/deploy/deployment/kubernetes/combined.yaml @@ -140,7 +140,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -299,7 +301,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -462,7 +466,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -621,7 +627,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1054,7 +1062,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1249,7 +1259,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1677,7 +1689,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1897,7 +1911,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2124,7 +2140,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2404,7 +2422,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4450,7 +4470,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4855,10 +4877,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5199,6 +5232,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5232,6 +5272,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5319,6 +5366,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5389,6 +5443,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5407,6 +5468,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5500,8 +5573,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5546,7 +5619,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6120,6 +6192,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6221,6 +6300,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6262,6 +6348,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6365,6 +6458,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6472,6 +6572,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6532,6 +6639,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6581,6 +6695,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6788,6 +6909,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6821,6 +6949,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7027,7 +7162,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7432,10 +7569,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7776,6 +7924,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7809,6 +7964,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7896,6 +8058,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7966,6 +8135,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -7984,6 +8160,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8077,8 +8265,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8123,7 +8311,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8697,6 +8884,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8798,6 +8992,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8839,6 +9040,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8942,6 +9150,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9049,6 +9264,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9109,6 +9331,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9158,6 +9387,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9365,6 +9601,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9398,6 +9641,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9570,7 +9820,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -9975,10 +10227,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10319,6 +10582,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10352,6 +10622,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10439,6 +10716,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10509,6 +10793,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10527,6 +10818,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10620,8 +10923,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10666,7 +10969,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11240,6 +11542,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11341,6 +11650,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11382,6 +11698,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11485,6 +11808,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11592,6 +11922,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11652,6 +11989,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11701,6 +12045,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11908,6 +12259,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11941,6 +12299,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12180,7 +12545,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12589,10 +12956,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12936,6 +13314,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -12969,6 +13354,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13057,6 +13449,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13131,6 +13530,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13149,6 +13555,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13242,8 +13660,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13288,7 +13706,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13865,6 +14282,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -13968,6 +14392,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14009,6 +14440,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14119,6 +14557,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14227,6 +14672,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14287,6 +14739,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14336,6 +14795,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14545,6 +15011,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14578,6 +15051,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14787,7 +15267,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15196,10 +15678,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15543,6 +16036,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15576,6 +16076,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15664,6 +16171,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15738,6 +16252,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15756,6 +16277,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15849,8 +16382,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15895,7 +16428,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16472,6 +17004,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16575,6 +17114,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16616,6 +17162,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16726,6 +17279,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16834,6 +17394,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16894,6 +17461,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16943,6 +17517,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17152,6 +17733,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17185,6 +17773,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17352,7 +17947,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17757,10 +18354,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18101,6 +18709,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18134,6 +18749,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18221,6 +18843,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18291,6 +18920,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18309,6 +18945,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18402,8 +19050,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18448,7 +19096,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19022,6 +19669,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19123,8 +19777,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19164,6 +19825,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19267,6 +19935,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19374,6 +20049,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19434,6 +20116,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19483,6 +20172,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19690,6 +20386,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19723,6 +20426,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21878,7 +22588,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22276,10 +22988,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22424,7 +23147,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22695,6 +23420,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22808,6 +23538,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22890,6 +23625,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -22948,6 +23690,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23105,6 +23852,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23163,6 +23917,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23618,6 +24377,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23676,6 +24442,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23816,10 +24587,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -23937,6 +24719,433 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -24007,7 +25216,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24405,10 +25616,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24777,11 +25999,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25342,7 +26561,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25751,10 +26972,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26098,6 +27330,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26131,6 +27370,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26219,6 +27465,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26293,6 +27546,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26311,6 +27571,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26404,8 +27676,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26450,7 +27722,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27027,6 +28298,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27130,6 +28408,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27171,6 +28456,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27281,6 +28573,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27389,6 +28688,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27449,6 +28755,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27498,6 +28811,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27707,6 +29027,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27740,6 +29067,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27966,27 +29300,41 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies + are provisioned for Eclipse Che.\nThe policies are created + in the namespace where the `CheCluster` custom resource + is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` + only.\nDisabled by default. When set to `false`, the NetworkPolicies + previously created\nby the Operator are removed.\n\nOn OpenShift, + the following NetworkPolicies are created in the `CheCluster` + namespace:\n - `allow-from-same-namespace` \t: + from the Che operands themselves.\n - `allow-from-openshift-ingress` + \ \t: from the OpenShift ingress controller.\n - `allow-from-openshift-host-network` + \t: from the pods that use the host network, for example\n + \ the OpenShift router.\n - `allow-from-openshift-monitoring` + \ \t: from the OpenShift monitoring stack, to scrape metrics.\n + \ - `allow-from-workspaces` \t: from the users' + workspace namespaces.\n - `allow-from-che-operator` \t\t: + from the Operator pods in the Operator namespace.\n - `allow-all-egress` + \ \t: allows all egress traffic from the + Che operands.\n\nOn Kubernetes, only the `allow-all-ingress` + and `allow-all-egress` NetworkPolicies are created,\nallowing + all ingress and egress traffic, since the namespace of the + cluster's ingress controller\nis not known to the Operator. + Enabling this setting on Kubernetes does not restrict any + traffic\nby itself: administrators are expected to provision + their own NetworkPolicies.\n\nThis setting also drives workspace + isolation when `spec.devEnvironments.networking.networkPolicy`\ndoes + not define `enabled`: setting this field to `true` additionally + enables the NetworkPolicies\nthat the DevWorkspace Operator + provisions for each DevWorkspace. To protect the Che components\nwithout + isolating the workspaces, explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled` + to `false`." type: boolean type: object tlsSecretName: @@ -28491,6 +29839,7 @@ rules: verbs: - create - delete + - deletecollection - get - update - patch diff --git a/deploy/deployment/kubernetes/objects/che-operator.ClusterRole.yaml b/deploy/deployment/kubernetes/objects/che-operator.ClusterRole.yaml index 63f57f28ba..55813e93c4 100644 --- a/deploy/deployment/kubernetes/objects/che-operator.ClusterRole.yaml +++ b/deploy/deployment/kubernetes/objects/che-operator.ClusterRole.yaml @@ -403,6 +403,7 @@ rules: verbs: - create - delete + - deletecollection - get - update - patch diff --git a/deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml b/deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml index 4850b7cdb3..ed61532045 100644 --- a/deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml +++ b/deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml @@ -135,7 +135,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -294,7 +296,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -457,7 +461,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -616,7 +622,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1049,7 +1057,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1244,7 +1254,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1672,7 +1684,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1892,7 +1906,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2119,7 +2135,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2399,7 +2417,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4445,7 +4465,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4850,10 +4872,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5194,6 +5227,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5227,6 +5267,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5314,6 +5361,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5384,6 +5438,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5402,6 +5463,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5495,8 +5568,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5541,7 +5614,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6115,6 +6187,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6216,6 +6295,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6257,6 +6343,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6360,6 +6453,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6467,6 +6567,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6527,6 +6634,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6576,6 +6690,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6783,6 +6904,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6816,6 +6944,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7022,7 +7157,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7427,10 +7564,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7771,6 +7919,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7804,6 +7959,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7891,6 +8053,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7961,6 +8130,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -7979,6 +8155,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8072,8 +8260,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8118,7 +8306,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8692,6 +8879,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8793,6 +8987,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8834,6 +9035,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8937,6 +9145,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9044,6 +9259,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9104,6 +9326,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9153,6 +9382,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9360,6 +9596,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9393,6 +9636,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9565,7 +9815,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -9970,10 +10222,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10314,6 +10577,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10347,6 +10617,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10434,6 +10711,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10504,6 +10788,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10522,6 +10813,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10615,8 +10918,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10661,7 +10964,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11235,6 +11537,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11336,6 +11645,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11377,6 +11693,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11480,6 +11803,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11587,6 +11917,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11647,6 +11984,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11696,6 +12040,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11903,6 +12254,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11936,6 +12294,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12175,7 +12540,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12584,10 +12951,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12931,6 +13309,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -12964,6 +13349,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13052,6 +13444,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13126,6 +13525,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13144,6 +13550,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13237,8 +13655,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13283,7 +13701,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13860,6 +14277,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -13963,6 +14387,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14004,6 +14435,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14114,6 +14552,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14222,6 +14667,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14282,6 +14734,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14331,6 +14790,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14540,6 +15006,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14573,6 +15046,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14782,7 +15262,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15191,10 +15673,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15538,6 +16031,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15571,6 +16071,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15659,6 +16166,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15733,6 +16247,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15751,6 +16272,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15844,8 +16377,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15890,7 +16423,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16467,6 +16999,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16570,6 +17109,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16611,6 +17157,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16721,6 +17274,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16829,6 +17389,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16889,6 +17456,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16938,6 +17512,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17147,6 +17728,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17180,6 +17768,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17347,7 +17942,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17752,10 +18349,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18096,6 +18704,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18129,6 +18744,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18216,6 +18838,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18286,6 +18915,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18304,6 +18940,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18397,8 +19045,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18443,7 +19091,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19017,6 +19664,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19118,8 +19772,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19159,6 +19820,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19262,6 +19930,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19369,6 +20044,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19429,6 +20111,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19478,6 +20167,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19685,6 +20381,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19718,6 +20421,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21873,7 +22583,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22271,10 +22983,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22419,7 +23142,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22690,6 +23415,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22803,6 +23533,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22885,6 +23620,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -22943,6 +23685,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23100,6 +23847,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23158,6 +23912,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23613,6 +24372,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23671,6 +24437,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23811,10 +24582,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -23932,6 +24714,433 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -24002,7 +25211,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24400,10 +25611,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24772,11 +25994,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25337,7 +26556,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25746,10 +26967,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26093,6 +27325,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26126,6 +27365,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26214,6 +27460,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26288,6 +27541,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26306,6 +27566,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26399,8 +27671,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26445,7 +27717,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27022,6 +28293,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27125,6 +28403,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27166,6 +28451,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27276,6 +28568,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27384,6 +28683,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27444,6 +28750,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27493,6 +28806,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27702,6 +29022,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27735,6 +29062,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27961,27 +29295,41 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies + are provisioned for Eclipse Che.\nThe policies are created + in the namespace where the `CheCluster` custom resource + is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` + only.\nDisabled by default. When set to `false`, the NetworkPolicies + previously created\nby the Operator are removed.\n\nOn OpenShift, + the following NetworkPolicies are created in the `CheCluster` + namespace:\n - `allow-from-same-namespace` \t: + from the Che operands themselves.\n - `allow-from-openshift-ingress` + \ \t: from the OpenShift ingress controller.\n - `allow-from-openshift-host-network` + \t: from the pods that use the host network, for example\n + \ the OpenShift router.\n - `allow-from-openshift-monitoring` + \ \t: from the OpenShift monitoring stack, to scrape metrics.\n + \ - `allow-from-workspaces` \t: from the users' + workspace namespaces.\n - `allow-from-che-operator` \t\t: + from the Operator pods in the Operator namespace.\n - `allow-all-egress` + \ \t: allows all egress traffic from the + Che operands.\n\nOn Kubernetes, only the `allow-all-ingress` + and `allow-all-egress` NetworkPolicies are created,\nallowing + all ingress and egress traffic, since the namespace of the + cluster's ingress controller\nis not known to the Operator. + Enabling this setting on Kubernetes does not restrict any + traffic\nby itself: administrators are expected to provision + their own NetworkPolicies.\n\nThis setting also drives workspace + isolation when `spec.devEnvironments.networking.networkPolicy`\ndoes + not define `enabled`: setting this field to `true` additionally + enables the NetworkPolicies\nthat the DevWorkspace Operator + provisions for each DevWorkspace. To protect the Che components\nwithout + isolating the workspaces, explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled` + to `false`." type: boolean type: object tlsSecretName: diff --git a/deploy/deployment/openshift/combined.yaml b/deploy/deployment/openshift/combined.yaml index d0c02f18ad..be8919e013 100644 --- a/deploy/deployment/openshift/combined.yaml +++ b/deploy/deployment/openshift/combined.yaml @@ -140,7 +140,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -299,7 +301,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -462,7 +466,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -621,7 +627,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1054,7 +1062,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1249,7 +1259,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1677,7 +1689,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1897,7 +1911,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2124,7 +2140,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2404,7 +2422,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4450,7 +4470,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4855,10 +4877,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5199,6 +5232,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5232,6 +5272,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5319,6 +5366,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5389,6 +5443,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5407,6 +5468,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5500,8 +5573,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5546,7 +5619,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6120,6 +6192,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6221,6 +6300,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6262,6 +6348,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6365,6 +6458,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6472,6 +6572,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6532,6 +6639,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6581,6 +6695,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6788,6 +6909,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6821,6 +6949,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7027,7 +7162,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7432,10 +7569,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7776,6 +7924,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7809,6 +7964,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7896,6 +8058,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7966,6 +8135,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -7984,6 +8160,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8077,8 +8265,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8123,7 +8311,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8697,6 +8884,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8798,6 +8992,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8839,6 +9040,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8942,6 +9150,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9049,6 +9264,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9109,6 +9331,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9158,6 +9387,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9365,6 +9601,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9398,6 +9641,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9570,7 +9820,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -9975,10 +10227,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10319,6 +10582,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10352,6 +10622,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10439,6 +10716,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10509,6 +10793,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10527,6 +10818,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10620,8 +10923,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10666,7 +10969,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11240,6 +11542,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11341,6 +11650,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11382,6 +11698,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11485,6 +11808,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11592,6 +11922,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11652,6 +11989,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11701,6 +12045,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11908,6 +12259,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11941,6 +12299,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12180,7 +12545,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12589,10 +12956,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12936,6 +13314,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -12969,6 +13354,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13057,6 +13449,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13131,6 +13530,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13149,6 +13555,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13242,8 +13660,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13288,7 +13706,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13865,6 +14282,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -13968,6 +14392,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14009,6 +14440,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14119,6 +14557,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14227,6 +14672,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14287,6 +14739,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14336,6 +14795,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14545,6 +15011,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14578,6 +15051,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14787,7 +15267,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15196,10 +15678,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15543,6 +16036,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15576,6 +16076,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15664,6 +16171,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15738,6 +16252,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15756,6 +16277,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15849,8 +16382,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15895,7 +16428,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16472,6 +17004,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16575,6 +17114,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16616,6 +17162,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16726,6 +17279,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16834,6 +17394,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16894,6 +17461,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16943,6 +17517,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17152,6 +17733,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17185,6 +17773,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17352,7 +17947,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17757,10 +18354,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18101,6 +18709,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18134,6 +18749,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18221,6 +18843,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18291,6 +18920,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18309,6 +18945,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18402,8 +19050,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18448,7 +19096,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19022,6 +19669,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19123,8 +19777,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19164,6 +19825,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19267,6 +19935,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19374,6 +20049,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19434,6 +20116,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19483,6 +20172,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19690,6 +20386,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19723,6 +20426,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21878,7 +22588,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22276,10 +22988,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22424,7 +23147,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22695,6 +23420,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22808,6 +23538,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22890,6 +23625,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -22948,6 +23690,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23105,6 +23852,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23163,6 +23917,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23618,6 +24377,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23676,6 +24442,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23816,10 +24587,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -23937,6 +24719,433 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -24007,7 +25216,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24405,10 +25616,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24777,11 +25999,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25342,7 +26561,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25751,10 +26972,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26098,6 +27330,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26131,6 +27370,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26219,6 +27465,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26293,6 +27546,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26311,6 +27571,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26404,8 +27676,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26450,7 +27722,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27027,6 +28298,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27130,6 +28408,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27171,6 +28456,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27281,6 +28573,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27389,6 +28688,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27449,6 +28755,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27498,6 +28811,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27707,6 +29027,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27740,6 +29067,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27966,27 +29300,41 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies + are provisioned for Eclipse Che.\nThe policies are created + in the namespace where the `CheCluster` custom resource + is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` + only.\nDisabled by default. When set to `false`, the NetworkPolicies + previously created\nby the Operator are removed.\n\nOn OpenShift, + the following NetworkPolicies are created in the `CheCluster` + namespace:\n - `allow-from-same-namespace` \t: + from the Che operands themselves.\n - `allow-from-openshift-ingress` + \ \t: from the OpenShift ingress controller.\n - `allow-from-openshift-host-network` + \t: from the pods that use the host network, for example\n + \ the OpenShift router.\n - `allow-from-openshift-monitoring` + \ \t: from the OpenShift monitoring stack, to scrape metrics.\n + \ - `allow-from-workspaces` \t: from the users' + workspace namespaces.\n - `allow-from-che-operator` \t\t: + from the Operator pods in the Operator namespace.\n - `allow-all-egress` + \ \t: allows all egress traffic from the + Che operands.\n\nOn Kubernetes, only the `allow-all-ingress` + and `allow-all-egress` NetworkPolicies are created,\nallowing + all ingress and egress traffic, since the namespace of the + cluster's ingress controller\nis not known to the Operator. + Enabling this setting on Kubernetes does not restrict any + traffic\nby itself: administrators are expected to provision + their own NetworkPolicies.\n\nThis setting also drives workspace + isolation when `spec.devEnvironments.networking.networkPolicy`\ndoes + not define `enabled`: setting this field to `true` additionally + enables the NetworkPolicies\nthat the DevWorkspace Operator + provisions for each DevWorkspace. To protect the Che components\nwithout + isolating the workspaces, explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled` + to `false`." type: boolean type: object tlsSecretName: @@ -28491,6 +29839,7 @@ rules: verbs: - create - delete + - deletecollection - get - update - patch diff --git a/deploy/deployment/openshift/objects/che-operator.ClusterRole.yaml b/deploy/deployment/openshift/objects/che-operator.ClusterRole.yaml index 63f57f28ba..55813e93c4 100644 --- a/deploy/deployment/openshift/objects/che-operator.ClusterRole.yaml +++ b/deploy/deployment/openshift/objects/che-operator.ClusterRole.yaml @@ -403,6 +403,7 @@ rules: verbs: - create - delete + - deletecollection - get - update - patch diff --git a/deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml b/deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml index 4f796cd013..c2049480e8 100644 --- a/deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml +++ b/deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml @@ -135,7 +135,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -294,7 +296,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -457,7 +461,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -616,7 +622,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1049,7 +1057,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1244,7 +1254,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1672,7 +1684,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1892,7 +1906,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2119,7 +2135,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2399,7 +2417,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4445,7 +4465,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4850,10 +4872,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5194,6 +5227,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5227,6 +5267,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5314,6 +5361,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5384,6 +5438,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5402,6 +5463,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5495,8 +5568,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5541,7 +5614,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6115,6 +6187,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6216,6 +6295,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6257,6 +6343,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6360,6 +6453,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6467,6 +6567,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6527,6 +6634,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6576,6 +6690,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6783,6 +6904,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6816,6 +6944,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7022,7 +7157,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7427,10 +7564,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7771,6 +7919,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7804,6 +7959,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7891,6 +8053,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7961,6 +8130,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -7979,6 +8155,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8072,8 +8260,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8118,7 +8306,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8692,6 +8879,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8793,6 +8987,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8834,6 +9035,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8937,6 +9145,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9044,6 +9259,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9104,6 +9326,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9153,6 +9382,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9360,6 +9596,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9393,6 +9636,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9565,7 +9815,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -9970,10 +10222,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10314,6 +10577,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10347,6 +10617,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10434,6 +10711,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10504,6 +10788,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10522,6 +10813,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10615,8 +10918,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10661,7 +10964,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11235,6 +11537,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11336,6 +11645,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11377,6 +11693,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11480,6 +11803,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11587,6 +11917,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11647,6 +11984,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11696,6 +12040,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11903,6 +12254,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11936,6 +12294,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12175,7 +12540,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12584,10 +12951,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12931,6 +13309,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -12964,6 +13349,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13052,6 +13444,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13126,6 +13525,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13144,6 +13550,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13237,8 +13655,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13283,7 +13701,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13860,6 +14277,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -13963,6 +14387,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14004,6 +14435,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14114,6 +14552,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14222,6 +14667,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14282,6 +14734,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14331,6 +14790,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14540,6 +15006,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14573,6 +15046,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14782,7 +15262,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15191,10 +15673,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15538,6 +16031,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15571,6 +16071,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15659,6 +16166,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15733,6 +16247,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15751,6 +16272,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15844,8 +16377,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15890,7 +16423,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16467,6 +16999,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16570,6 +17109,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16611,6 +17157,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16721,6 +17274,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16829,6 +17389,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16889,6 +17456,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16938,6 +17512,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17147,6 +17728,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17180,6 +17768,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17347,7 +17942,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17752,10 +18349,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18096,6 +18704,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18129,6 +18744,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18216,6 +18838,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18286,6 +18915,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18304,6 +18940,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18397,8 +19045,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18443,7 +19091,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19017,6 +19664,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19118,8 +19772,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19159,6 +19820,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19262,6 +19930,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19369,6 +20044,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19429,6 +20111,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19478,6 +20167,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19685,6 +20381,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19718,6 +20421,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21873,7 +22583,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22271,10 +22983,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22419,7 +23142,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22690,6 +23415,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22803,6 +23533,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22885,6 +23620,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -22943,6 +23685,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23100,6 +23847,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23158,6 +23912,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23613,6 +24372,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23671,6 +24437,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23811,10 +24582,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -23932,6 +24714,433 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -24002,7 +25211,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24400,10 +25611,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24772,11 +25994,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25337,7 +26556,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25746,10 +26967,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26093,6 +27325,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26126,6 +27365,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26214,6 +27460,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26288,6 +27541,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26306,6 +27566,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26399,8 +27671,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26445,7 +27717,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27022,6 +28293,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27125,6 +28403,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27166,6 +28451,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27276,6 +28568,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27384,6 +28683,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27444,6 +28750,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27493,6 +28806,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27702,6 +29022,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27735,6 +29062,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27961,27 +29295,41 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies + are provisioned for Eclipse Che.\nThe policies are created + in the namespace where the `CheCluster` custom resource + is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` + only.\nDisabled by default. When set to `false`, the NetworkPolicies + previously created\nby the Operator are removed.\n\nOn OpenShift, + the following NetworkPolicies are created in the `CheCluster` + namespace:\n - `allow-from-same-namespace` \t: + from the Che operands themselves.\n - `allow-from-openshift-ingress` + \ \t: from the OpenShift ingress controller.\n - `allow-from-openshift-host-network` + \t: from the pods that use the host network, for example\n + \ the OpenShift router.\n - `allow-from-openshift-monitoring` + \ \t: from the OpenShift monitoring stack, to scrape metrics.\n + \ - `allow-from-workspaces` \t: from the users' + workspace namespaces.\n - `allow-from-che-operator` \t\t: + from the Operator pods in the Operator namespace.\n - `allow-all-egress` + \ \t: allows all egress traffic from the + Che operands.\n\nOn Kubernetes, only the `allow-all-ingress` + and `allow-all-egress` NetworkPolicies are created,\nallowing + all ingress and egress traffic, since the namespace of the + cluster's ingress controller\nis not known to the Operator. + Enabling this setting on Kubernetes does not restrict any + traffic\nby itself: administrators are expected to provision + their own NetworkPolicies.\n\nThis setting also drives workspace + isolation when `spec.devEnvironments.networking.networkPolicy`\ndoes + not define `enabled`: setting this field to `true` additionally + enables the NetworkPolicies\nthat the DevWorkspace Operator + provisions for each DevWorkspace. To protect the Che components\nwithout + isolating the workspaces, explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled` + to `false`." type: boolean type: object tlsSecretName: diff --git a/go.mod b/go.mod index a2ed419855..894edbde35 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.26.4 require ( github.com/che-incubator/kubernetes-image-puller-operator v0.0.0-20260717080248-21df2985d548 github.com/devfile/api/v2 v2.3.1-alpha.0.20261007143616-3c7e2fd6d137 - github.com/devfile/devworkspace-operator v0.2.1-0.20261008221424-9e9bab4780a9 + github.com/devfile/devworkspace-operator v0.2.1-0.20261013204914-cd25c621588c github.com/go-logr/logr v1.4.4 github.com/google/go-cmp v0.7.0 github.com/onsi/ginkgo/v2 v2.33.0 diff --git a/go.sum b/go.sum index 13d484ffe4..d9e2fc06c4 100644 --- a/go.sum +++ b/go.sum @@ -62,8 +62,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/devfile/api/v2 v2.3.1-alpha.0.20261007143616-3c7e2fd6d137 h1:bECxO1gOSmWNjqoTv+xUWSwzXGZhnCQOSJrlIVOWtR4= github.com/devfile/api/v2 v2.3.1-alpha.0.20261007143616-3c7e2fd6d137/go.mod h1:t+btHuWTpDnTPPf+MM4kB34Ebp5PVmEnn/nrhQXC4IQ= -github.com/devfile/devworkspace-operator v0.2.1-0.20261008221424-9e9bab4780a9 h1:E/c/MIbcMOB7ctfsUK7Ny/iBI95IjocZ8Ygol0qGNWI= -github.com/devfile/devworkspace-operator v0.2.1-0.20261008221424-9e9bab4780a9/go.mod h1:+EIM8ujp9GO+S2w/eU3nAZv1hAkEZBrFmRQtg5PMVQA= +github.com/devfile/devworkspace-operator v0.2.1-0.20261013204914-cd25c621588c h1:OUpOXrtAu+KG/hLKKdj10YCnywMQlAlcQhZvcQj8Ixw= +github.com/devfile/devworkspace-operator v0.2.1-0.20261013204914-cd25c621588c/go.mod h1:+EIM8ujp9GO+S2w/eU3nAZv1hAkEZBrFmRQtg5PMVQA= github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78= github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc= github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM= diff --git a/helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml b/helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml index 4850b7cdb3..ed61532045 100644 --- a/helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml +++ b/helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml @@ -135,7 +135,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -294,7 +296,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -457,7 +461,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -616,7 +622,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1049,7 +1057,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1244,7 +1254,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1672,7 +1684,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1892,7 +1906,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2119,7 +2135,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2399,7 +2417,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4445,7 +4465,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4850,10 +4872,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5194,6 +5227,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5227,6 +5267,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5314,6 +5361,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5384,6 +5438,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5402,6 +5463,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5495,8 +5568,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5541,7 +5614,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6115,6 +6187,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6216,6 +6295,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6257,6 +6343,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6360,6 +6453,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6467,6 +6567,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6527,6 +6634,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6576,6 +6690,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6783,6 +6904,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6816,6 +6944,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7022,7 +7157,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7427,10 +7564,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7771,6 +7919,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7804,6 +7959,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7891,6 +8053,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7961,6 +8130,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -7979,6 +8155,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8072,8 +8260,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8118,7 +8306,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8692,6 +8879,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8793,6 +8987,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8834,6 +9035,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8937,6 +9145,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9044,6 +9259,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9104,6 +9326,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9153,6 +9382,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9360,6 +9596,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9393,6 +9636,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9565,7 +9815,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -9970,10 +10222,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10314,6 +10577,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10347,6 +10617,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10434,6 +10711,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10504,6 +10788,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10522,6 +10813,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10615,8 +10918,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10661,7 +10964,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11235,6 +11537,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11336,6 +11645,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11377,6 +11693,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11480,6 +11803,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11587,6 +11917,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11647,6 +11984,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11696,6 +12040,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11903,6 +12254,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11936,6 +12294,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12175,7 +12540,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12584,10 +12951,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12931,6 +13309,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -12964,6 +13349,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13052,6 +13444,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13126,6 +13525,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13144,6 +13550,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13237,8 +13655,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13283,7 +13701,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13860,6 +14277,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -13963,6 +14387,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14004,6 +14435,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14114,6 +14552,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14222,6 +14667,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14282,6 +14734,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14331,6 +14790,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14540,6 +15006,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14573,6 +15046,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14782,7 +15262,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15191,10 +15673,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15538,6 +16031,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15571,6 +16071,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15659,6 +16166,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15733,6 +16247,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15751,6 +16272,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15844,8 +16377,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15890,7 +16423,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16467,6 +16999,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16570,6 +17109,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16611,6 +17157,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16721,6 +17274,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16829,6 +17389,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16889,6 +17456,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16938,6 +17512,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17147,6 +17728,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17180,6 +17768,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17347,7 +17942,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17752,10 +18349,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18096,6 +18704,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18129,6 +18744,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18216,6 +18838,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18286,6 +18915,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18304,6 +18940,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18397,8 +19045,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18443,7 +19091,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19017,6 +19664,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19118,8 +19772,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19159,6 +19820,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19262,6 +19930,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19369,6 +20044,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19429,6 +20111,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19478,6 +20167,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19685,6 +20381,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19718,6 +20421,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21873,7 +22583,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22271,10 +22983,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22419,7 +23142,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22690,6 +23415,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22803,6 +23533,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22885,6 +23620,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -22943,6 +23685,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23100,6 +23847,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23158,6 +23912,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23613,6 +24372,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23671,6 +24437,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23811,10 +24582,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -23932,6 +24714,433 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -24002,7 +25211,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24400,10 +25611,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24772,11 +25994,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25337,7 +26556,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25746,10 +26967,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26093,6 +27325,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26126,6 +27365,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26214,6 +27460,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26288,6 +27541,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26306,6 +27566,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26399,8 +27671,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26445,7 +27717,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27022,6 +28293,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27125,6 +28403,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27166,6 +28451,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27276,6 +28568,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27384,6 +28683,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27444,6 +28750,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27493,6 +28806,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27702,6 +29022,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27735,6 +29062,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27961,27 +29295,41 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies + are provisioned for Eclipse Che.\nThe policies are created + in the namespace where the `CheCluster` custom resource + is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` + only.\nDisabled by default. When set to `false`, the NetworkPolicies + previously created\nby the Operator are removed.\n\nOn OpenShift, + the following NetworkPolicies are created in the `CheCluster` + namespace:\n - `allow-from-same-namespace` \t: + from the Che operands themselves.\n - `allow-from-openshift-ingress` + \ \t: from the OpenShift ingress controller.\n - `allow-from-openshift-host-network` + \t: from the pods that use the host network, for example\n + \ the OpenShift router.\n - `allow-from-openshift-monitoring` + \ \t: from the OpenShift monitoring stack, to scrape metrics.\n + \ - `allow-from-workspaces` \t: from the users' + workspace namespaces.\n - `allow-from-che-operator` \t\t: + from the Operator pods in the Operator namespace.\n - `allow-all-egress` + \ \t: allows all egress traffic from the + Che operands.\n\nOn Kubernetes, only the `allow-all-ingress` + and `allow-all-egress` NetworkPolicies are created,\nallowing + all ingress and egress traffic, since the namespace of the + cluster's ingress controller\nis not known to the Operator. + Enabling this setting on Kubernetes does not restrict any + traffic\nby itself: administrators are expected to provision + their own NetworkPolicies.\n\nThis setting also drives workspace + isolation when `spec.devEnvironments.networking.networkPolicy`\ndoes + not define `enabled`: setting this field to `true` additionally + enables the NetworkPolicies\nthat the DevWorkspace Operator + provisions for each DevWorkspace. To protect the Che components\nwithout + isolating the workspaces, explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled` + to `false`." type: boolean type: object tlsSecretName: diff --git a/helmcharts/next/templates/che-operator.ClusterRole.yaml b/helmcharts/next/templates/che-operator.ClusterRole.yaml index 63f57f28ba..55813e93c4 100644 --- a/helmcharts/next/templates/che-operator.ClusterRole.yaml +++ b/helmcharts/next/templates/che-operator.ClusterRole.yaml @@ -403,6 +403,7 @@ rules: verbs: - create - delete + - deletecollection - get - update - patch diff --git a/pkg/deploy/networkpolicies/init_test.go b/pkg/common/chelabels/labels.go similarity index 55% rename from pkg/deploy/networkpolicies/init_test.go rename to pkg/common/chelabels/labels.go index ccb1e060ff..454c7917f1 100644 --- a/pkg/deploy/networkpolicies/init_test.go +++ b/pkg/common/chelabels/labels.go @@ -10,16 +10,17 @@ // Red Hat, Inc. - initial API and implementation // -package networkpolicies +package chelabels import ( - "github.com/eclipse-che/che-operator/pkg/common/infrastructure" - k8shelper "github.com/eclipse-che/che-operator/pkg/common/k8s-helper" + "github.com/eclipse-che/che-operator/pkg/common/constants" defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" ) -func init() { - k8shelper.InitializeForTesting() - infrastructure.InitializeForTesting(infrastructure.OpenShiftV4) - defaults.InitializeForTesting() +func OperatorManaged(component string) map[string]string { + return map[string]string{ + constants.KubernetesComponentLabelKey: component, + constants.KubernetesManagedByLabelKey: defaults.GetOperatorName(), + constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, + } } diff --git a/pkg/common/constants/constants.go b/pkg/common/constants/constants.go index 9be6df7be7..161e0e1f96 100644 --- a/pkg/common/constants/constants.go +++ b/pkg/common/constants/constants.go @@ -188,7 +188,7 @@ const ( DefaultDisableContainerRunCapabilities = true // Networking - NetworkPolicyEnabled = false + DefaultNetworkPolicyEnabled = false // AgentSandbox AgentSandboxEnabled = false diff --git a/pkg/common/k8s-client/k8s_client.go b/pkg/common/k8s-client/k8s_client.go index e1681a5312..c18e96b25e 100644 --- a/pkg/common/k8s-client/k8s_client.go +++ b/pkg/common/k8s-client/k8s_client.go @@ -127,6 +127,14 @@ func (k K8sClientWrapper) DeleteByKeyIgnoreNotFound( return k.deleteByKeyIgnoreNotFound(ctx, key, objectMeta, opts...) } +func (k K8sClientWrapper) DeleteAllOf( + ctx context.Context, + obj client.Object, + opts ...client.DeleteAllOfOption, +) error { + return k.cli.DeleteAllOf(ctx, obj, opts...) +} + func (k K8sClientWrapper) DeleteIgnoreNotFound( ctx context.Context, obj client.Object, diff --git a/pkg/common/k8s-client/k8s_client_types.go b/pkg/common/k8s-client/k8s_client_types.go index d1b6db294e..e1cc739135 100644 --- a/pkg/common/k8s-client/k8s_client_types.go +++ b/pkg/common/k8s-client/k8s_client_types.go @@ -42,6 +42,9 @@ type K8sClient interface { // DeleteByKeyIgnoreNotFound deletes object by key. // Returns nil if object is deleted or not found otherwise returns error. DeleteByKeyIgnoreNotFound(ctx context.Context, key client.ObjectKey, objectMeta client.Object, opts ...client.DeleteOption) error + // DeleteAllOf deletes all objects of the given type. + // Returns nil if objects are deleted otherwise returns error. + DeleteAllOf(ctx context.Context, obj client.Object, opts ...client.DeleteAllOfOption) error // List returns list of runtime objects. // Returns nil if list is retrieved otherwise returns error. List(ctx context.Context, list client.ObjectList, opts ...client.ListOption) ([]runtime.Object, error) diff --git a/pkg/common/operator-defaults/defaults.go b/pkg/common/operator-defaults/defaults.go index 2adde8bb99..fe8feaf05e 100644 --- a/pkg/common/operator-defaults/defaults.go +++ b/pkg/common/operator-defaults/defaults.go @@ -237,6 +237,10 @@ func GetCheFlavor() string { return defaultCheFlavor } +func GetOperatorName() string { + return GetCheFlavor() + "-operator" +} + func GetConsoleLinkName() string { if !initialized { Initialize() diff --git a/pkg/common/test/utils.go b/pkg/common/test/utils.go index 74993a0689..ae9040531e 100644 --- a/pkg/common/test/utils.go +++ b/pkg/common/test/utils.go @@ -16,11 +16,16 @@ import ( "context" "testing" + dwInfrastructure "github.com/devfile/devworkspace-operator/pkg/infrastructure" "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/infrastructure" + defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" "github.com/stretchr/testify/assert" "k8s.io/utils/ptr" "sigs.k8s.io/controller-runtime/pkg/reconcile" + . "github.com/onsi/gomega" + appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/resource" @@ -39,10 +44,10 @@ type TestExpectedResources struct { func EnsureReconcile( t *testing.T, cheCtx *chetypes.CheContext, - testReconcileFunc func(cheCtx *chetypes.CheContext) (result reconcile.Result, done bool, err error)) { + reconcileFunc func(cheCtx *chetypes.CheContext) (result reconcile.Result, done bool, err error)) { for i := 0; i < 10; i++ { - _, done, err := testReconcileFunc(cheCtx) + _, done, err := reconcileFunc(cheCtx) assert.NoError(t, err) if done { return @@ -52,6 +57,18 @@ func EnsureReconcile( assert.Fail(t, "Reconcile did not finish in 10 iterations") } +// Reconcile runs the reconcileFunc once and asserts, with gomega matchers, that the component +// reconciled in a single pass: it requested no requeue and returned no error. +func Reconcile( + cheCtx *chetypes.CheContext, + reconcileFunc func(cheCtx *chetypes.CheContext) (result reconcile.Result, done bool, err error)) { + + result, done, err := reconcileFunc(cheCtx) + Expect(result).To(Equal(reconcile.Result{})) + Expect(done).To(BeTrue()) + Expect(err).ToNot(HaveOccurred()) +} + func CompareResources(actualDeployment *appsv1.Deployment, expected TestExpectedResources, t *testing.T) { container := &actualDeployment.Spec.Template.Spec.Containers[0] compareQuantity( @@ -139,3 +156,9 @@ func GetResourceQuantity(value string, defaultValue string) resource.Quantity { } return resource.MustParse(defaultValue) } + +func Initialize(infra infrastructure.Type) { + infrastructure.InitializeForTesting(infra) + dwInfrastructure.InitializeForTesting(dwInfrastructure.Type(infra)) + defaults.InitializeForTesting() +} diff --git a/pkg/common/utils/slices.go b/pkg/common/utils/slices.go new file mode 100644 index 0000000000..dce99810de --- /dev/null +++ b/pkg/common/utils/slices.go @@ -0,0 +1,24 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package utils + +// Map applies the transform function to each element of the input slice +// and returns a new slice containing the transformed elements. +func Map[T any, R any](items []T, transform func(T) R) []R { + result := make([]R, len(items)) + for i, item := range items { + result[i] = transform(item) + } + + return result +} diff --git a/pkg/deploy/devworkspace/dev_workspace_config.go b/pkg/deploy/devworkspace/dev_workspace_config.go index 6446396d2d..9a339ce115 100644 --- a/pkg/deploy/devworkspace/dev_workspace_config.go +++ b/pkg/deploy/devworkspace/dev_workspace_config.go @@ -135,6 +135,10 @@ func updateWorkspaceConfig(cheCtx *chetypes.CheContext, operatorConfig *controll return err } + if err := updateNetworkPolicy(cheCtx, operatorConfig.Workspace); err != nil { + return err + } + // If the CheCluster has a configured proxy, or if the Che Operator has detected a proxy configuration, // we need to disable automatic proxy handling in the DevWorkspace Operator as its implementation collides // with ours -- they set environment variables the deployment spec explicitly, which overrides the proxy-settings diff --git a/pkg/deploy/devworkspace/dev_workspace_config_network_policy.go b/pkg/deploy/devworkspace/dev_workspace_config_network_policy.go new file mode 100644 index 0000000000..58461c469e --- /dev/null +++ b/pkg/deploy/devworkspace/dev_workspace_config_network_policy.go @@ -0,0 +1,77 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package devworkspace + +import ( + controllerv1alpha1 "github.com/devfile/devworkspace-operator/apis/controller/v1alpha1" + dwoconfig "github.com/devfile/devworkspace-operator/pkg/config" + "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/constants" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +func updateNetworkPolicy(cheCtx *chetypes.CheContext, workspaceConfig *controllerv1alpha1.WorkspaceConfig) error { + workspaceConfig.NetworkPolicy = getNetworkPolicyConfigFromSpec(cheCtx) + + dwoIngressRules, dwoEgressRules, err := dwoconfig.GetDefaultNetworkPolicy(cheCtx.DWONamespace) + if err != nil { + return err + } + + if workspaceConfig.NetworkPolicy.Ingress == nil { + workspaceConfig.NetworkPolicy.Ingress = append(dwoIngressRules, buildAllowFromCheIngressRule(cheCtx.CheCluster.Namespace)) + } + + if workspaceConfig.NetworkPolicy.Egress == nil { + workspaceConfig.NetworkPolicy.Egress = dwoEgressRules + } + + // Backward compatibility with Che 7.123 and earlier, where workspace isolation was driven by the + // Che-wide `spec.networking.networkPolicy.enabled` flag and the Che Operator created the + // NetworkPolicies in the user namespace itself. That no longer happens: the usernamespace + // controller deletes those legacy policies on OpenShift, and DWO leaves isolation disabled unless + // `spec.devEnvironments.networking.networkPolicy.enabled` is set explicitly. Without this, an + // upgrade would silently lose isolation, so carry the legacy setting over — unless the user has + // already expressed an explicit choice in the devEnvironments section. + if workspaceConfig.NetworkPolicy.Enabled == nil && cheCtx.CheCluster.IsNetworkPoliciesEnabled() { + workspaceConfig.NetworkPolicy.Enabled = new(true) + } + + return nil +} + +func getNetworkPolicyConfigFromSpec(cheCtx *chetypes.CheContext) *controllerv1alpha1.NetworkPolicyConfig { + if cheCtx.CheCluster.Spec.DevEnvironments.Networking != nil && + cheCtx.CheCluster.Spec.DevEnvironments.Networking.NetworkPolicy != nil { + + return cheCtx.CheCluster.Spec.DevEnvironments.Networking.NetworkPolicy.DeepCopy() + } + + return &controllerv1alpha1.NetworkPolicyConfig{} +} + +func buildAllowFromCheIngressRule(namespace string) networkingv1.NetworkPolicyIngressRule { + return networkingv1.NetworkPolicyIngressRule{ + From: []networkingv1.NetworkPolicyPeer{ + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"kubernetes.io/metadata.name": namespace}, + }, + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + }, + }, + } +} diff --git a/pkg/deploy/devworkspace/dev_workspace_config_network_policy_test.go b/pkg/deploy/devworkspace/dev_workspace_config_network_policy_test.go new file mode 100644 index 0000000000..cf48d50459 --- /dev/null +++ b/pkg/deploy/devworkspace/dev_workspace_config_network_policy_test.go @@ -0,0 +1,245 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package devworkspace + +import ( + "slices" + "testing" + + controllerv1alpha1 "github.com/devfile/devworkspace-operator/apis/controller/v1alpha1" + dwoconfig "github.com/devfile/devworkspace-operator/pkg/config" + chev2 "github.com/eclipse-che/che-operator/api/v2" + "github.com/eclipse-che/che-operator/pkg/common/test" + "github.com/stretchr/testify/assert" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/types" + "sigs.k8s.io/controller-runtime/pkg/client" +) + +func TestDWONetworkPolicyRules(t *testing.T) { + customIngressRule := networkingv1.NetworkPolicyIngressRule{ + From: []networkingv1.NetworkPolicyPeer{ + {PodSelector: &metav1.LabelSelector{MatchLabels: map[string]string{"app": "custom-ingress"}}}, + }, + } + + existedDWOC := &controllerv1alpha1.DevWorkspaceOperatorConfig{ + ObjectMeta: metav1.ObjectMeta{ + Name: devWorkspaceConfigName, + Namespace: "eclipse-che", + }, + TypeMeta: metav1.TypeMeta{ + Kind: "DevWorkspaceOperatorConfig", + APIVersion: controllerv1alpha1.GroupVersion.String(), + }, + Config: &controllerv1alpha1.OperatorConfiguration{ + Workspace: &controllerv1alpha1.WorkspaceConfig{ + NetworkPolicy: &controllerv1alpha1.NetworkPolicyConfig{ + Enabled: new(true), + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + {PodSelector: &metav1.LabelSelector{MatchLabels: map[string]string{"app": "stale-ingress"}}}, + }, + }, + }, + Egress: []networkingv1.NetworkPolicyEgressRule{ + { + To: []networkingv1.NetworkPolicyPeer{ + {PodSelector: &metav1.LabelSelector{MatchLabels: map[string]string{"app": "stale-egress"}}}, + }, + }, + }, + }, + }, + }, + } + + defaultIngressRules, defaultEgressRules, err := dwoconfig.GetDefaultNetworkPolicy("devworkspace-controller") + assert.NoError(t, err) + + type testCase struct { + name string + dwoNetworkPolicyConfig *controllerv1alpha1.NetworkPolicyConfig + existedObjects []client.Object + expectedDWOIngressRules []networkingv1.NetworkPolicyIngressRule + expectedDWOEgressRules []networkingv1.NetworkPolicyEgressRule + } + + testCases := []testCase{ + { + name: "Set default rules and the rule allowing traffic from Che operands when the network policy is not set", + dwoNetworkPolicyConfig: nil, + expectedDWOIngressRules: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), + expectedDWOEgressRules: defaultEgressRules, + }, + { + name: "Set default rules and the rule allowing traffic from Che operands when the network policy is empty", + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{}, + expectedDWOIngressRules: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), + expectedDWOEgressRules: defaultEgressRules, + }, + { + name: "Keep custom ingress rules and not add the rule allowing traffic from Che operands", + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{ + Ingress: []networkingv1.NetworkPolicyIngressRule{customIngressRule}, + }, + expectedDWOIngressRules: []networkingv1.NetworkPolicyIngressRule{customIngressRule}, + expectedDWOEgressRules: defaultEgressRules, + }, + { + name: "Don't Lose the empty rule lists when they are written to the DWOC", + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{ + Ingress: []networkingv1.NetworkPolicyIngressRule{}, + Egress: []networkingv1.NetworkPolicyEgressRule{}, + }, + expectedDWOIngressRules: []networkingv1.NetworkPolicyIngressRule{}, + expectedDWOEgressRules: []networkingv1.NetworkPolicyEgressRule{}, + }, + { + name: "Override the network policy already set in the DWOC with the default rules when the network policy is not set", + dwoNetworkPolicyConfig: nil, + existedObjects: []client.Object{existedDWOC}, + expectedDWOIngressRules: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), + expectedDWOEgressRules: defaultEgressRules, + }, + { + name: "Override the network policy already set in the DWOC with the default rules when the network policy is empty", + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{}, + existedObjects: []client.Object{existedDWOC}, + expectedDWOIngressRules: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), + expectedDWOEgressRules: defaultEgressRules, + }, + } + + for _, testCase := range testCases { + t.Run(testCase.name, func(t *testing.T) { + cheCtx := test.NewCtxBuilder().WithCheCluster( + &chev2.CheCluster{ + ObjectMeta: metav1.ObjectMeta{ + Name: "eclipse-che", + Namespace: "eclipse-che", + }, + Spec: chev2.CheClusterSpec{ + DevEnvironments: chev2.CheClusterDevEnvironments{ + Networking: &chev2.DevEnvironmentNetworking{NetworkPolicy: testCase.dwoNetworkPolicyConfig}, + }, + }, + }).WithObjects(testCase.existedObjects...).Build() + + devWorkspaceConfigReconciler := NewDevWorkspaceConfigReconciler() + test.EnsureReconcile(t, cheCtx, devWorkspaceConfigReconciler.Reconcile) + + dwoc := &controllerv1alpha1.DevWorkspaceOperatorConfig{} + err := cheCtx.ClusterAPI.Client.Get( + cheCtx.Context, + types.NamespacedName{Name: devWorkspaceConfigName, Namespace: "eclipse-che"}, + dwoc) + assert.NoError(t, err) + + assert.NotNil(t, dwoc.Config) + assert.NotNil(t, dwoc.Config.Workspace) + + dwocNetworkPolicy := dwoc.Config.Workspace.NetworkPolicy + + assert.NotNil(t, dwocNetworkPolicy) + assert.Equal(t, testCase.expectedDWOIngressRules, dwocNetworkPolicy.Ingress) + assert.Equal(t, testCase.expectedDWOEgressRules, dwocNetworkPolicy.Egress) + }) + } +} + +func TestDWONetworkPolicyEnabled(t *testing.T) { + type testCase struct { + name string + dwoNetworkPolicyConfig *controllerv1alpha1.NetworkPolicyConfig + cheNetworkPolicyConfig *chev2.NetworkPolicy + expectedDWONetworkPolicyEnabled *bool + } + + testCases := []testCase{ + { + name: "Do not set the DWO network policy enabled flag when it is not set in the Che or the DWO network policy configuration", + cheNetworkPolicyConfig: &chev2.NetworkPolicy{ + Enabled: nil, + }, + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{ + Enabled: nil, + }, + expectedDWONetworkPolicyEnabled: nil, + }, + { + name: "Do not set the DWO network policy enabled flag when the Che network policy is disabled", + cheNetworkPolicyConfig: &chev2.NetworkPolicy{ + Enabled: new(false), + }, + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{ + Enabled: nil, + }, + expectedDWONetworkPolicyEnabled: nil, + }, + { + name: "Set the DWO network policy enabled flag when the Che network policy is enabled", + cheNetworkPolicyConfig: &chev2.NetworkPolicy{ + Enabled: new(true), + }, + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{ + Enabled: nil, + }, + expectedDWONetworkPolicyEnabled: new(true), + }, + { + name: "Keep the DWO network policy enabled flag set in the dev environments networking configuration", + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{ + Enabled: new(true), + }, + expectedDWONetworkPolicyEnabled: new(true), + }, + } + + for _, testCase := range testCases { + t.Run(testCase.name, func(t *testing.T) { + cheCtx := test.NewCtxBuilder().WithCheCluster( + &chev2.CheCluster{ + ObjectMeta: metav1.ObjectMeta{ + Name: "eclipse-che", + Namespace: "eclipse-che", + }, + Spec: chev2.CheClusterSpec{ + Networking: chev2.CheClusterSpecNetworking{ + NetworkPolicy: testCase.cheNetworkPolicyConfig, + }, + DevEnvironments: chev2.CheClusterDevEnvironments{ + Networking: &chev2.DevEnvironmentNetworking{NetworkPolicy: testCase.dwoNetworkPolicyConfig}, + }, + }, + }).Build() + + devWorkspaceConfigReconciler := NewDevWorkspaceConfigReconciler() + test.EnsureReconcile(t, cheCtx, devWorkspaceConfigReconciler.Reconcile) + + dwoc := &controllerv1alpha1.DevWorkspaceOperatorConfig{} + err := cheCtx.ClusterAPI.Client.Get( + cheCtx.Context, + types.NamespacedName{Name: devWorkspaceConfigName, Namespace: "eclipse-che"}, + dwoc) + assert.NoError(t, err) + + assert.NotNil(t, dwoc.Config) + assert.NotNil(t, dwoc.Config.Workspace) + assert.NotNil(t, dwoc.Config.Workspace.NetworkPolicy) + assert.Equal(t, testCase.expectedDWONetworkPolicyEnabled, dwoc.Config.Workspace.NetworkPolicy.Enabled) + }) + } +} diff --git a/pkg/deploy/devworkspace/dev_workspace_config_scheduling_test.go b/pkg/deploy/devworkspace/dev_workspace_config_scheduling_test.go index a7bdffc920..4d484e514d 100644 --- a/pkg/deploy/devworkspace/dev_workspace_config_scheduling_test.go +++ b/pkg/deploy/devworkspace/dev_workspace_config_scheduling_test.go @@ -180,7 +180,7 @@ func TestReconcileDevWorkspaceConfigProgressTimeout(t *testing.T) { diff := cmp.Diff(testCase.expectedOperatorConfig, dwoc.Config, cmp.Options{ - cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "DefaultStorageSize", "StorageClassName", "ProjectCloneConfig", "DeploymentStrategy"), + cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "DefaultStorageSize", "StorageClassName", "ProjectCloneConfig", "DeploymentStrategy", "NetworkPolicy"), cmpopts.IgnoreFields(controllerv1alpha1.RoutingConfig{}, "TLSCertificateConfigmapRef"), }) assert.Empty(t, diff) diff --git a/pkg/deploy/devworkspace/dev_workspace_config_security_test.go b/pkg/deploy/devworkspace/dev_workspace_config_security_test.go index 092c475b38..0db8f4db90 100644 --- a/pkg/deploy/devworkspace/dev_workspace_config_security_test.go +++ b/pkg/deploy/devworkspace/dev_workspace_config_security_test.go @@ -286,7 +286,7 @@ func TestReconcileDevWorkspaceConfigForContainerCapabilities(t *testing.T) { diff := cmp.Diff(testCase.expectedOperatorConfig, dwoc.Config, cmp.Options{ - cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "ProjectCloneConfig", "DeploymentStrategy", "DefaultStorageSize", "StorageClassName"), + cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "ProjectCloneConfig", "DeploymentStrategy", "DefaultStorageSize", "StorageClassName", "NetworkPolicy"), cmpopts.IgnoreFields(controllerv1alpha1.RoutingConfig{}, "TLSCertificateConfigmapRef"), }) assert.Empty(t, diff) diff --git a/pkg/deploy/devworkspace/dev_workspace_config_storage_test.go b/pkg/deploy/devworkspace/dev_workspace_config_storage_test.go index 5b7f06ee82..6df2c1eb84 100644 --- a/pkg/deploy/devworkspace/dev_workspace_config_storage_test.go +++ b/pkg/deploy/devworkspace/dev_workspace_config_storage_test.go @@ -729,7 +729,7 @@ func TestReconcileDevWorkspaceConfigStorage(t *testing.T) { assert.NoError(t, err) diff := cmp.Diff(testCase.expectedOperatorConfig, dwoc.Config, cmp.Options{ - cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount"), + cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "NetworkPolicy"), cmpopts.IgnoreFields(controllerv1alpha1.RoutingConfig{}, "TLSCertificateConfigmapRef"), }) assert.Empty(t, diff) diff --git a/pkg/deploy/devworkspace/dev_workspace_config_workspace_test.go b/pkg/deploy/devworkspace/dev_workspace_config_workspace_test.go index e480c70fed..8807d45f6e 100644 --- a/pkg/deploy/devworkspace/dev_workspace_config_workspace_test.go +++ b/pkg/deploy/devworkspace/dev_workspace_config_workspace_test.go @@ -507,7 +507,7 @@ func TestReconcileDevWorkspaceConfigPersistUserHome(t *testing.T) { err := cheCtx.ClusterAPI.Client.Get(context.TODO(), types.NamespacedName{Name: devWorkspaceConfigName, Namespace: testCase.cheCluster.Namespace}, dwoc) assert.NoError(t, err) diff := cmp.Diff(testCase.expectedOperatorConfig, dwoc.Config, cmp.Options{ - cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "DeploymentStrategy", "ContainerSecurityContext"), + cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "DeploymentStrategy", "ContainerSecurityContext", "NetworkPolicy"), cmpopts.IgnoreFields(controllerv1alpha1.RoutingConfig{}, "TLSCertificateConfigmapRef"), }) assert.Empty(t, diff) diff --git a/pkg/deploy/devworkspace/init_test.go b/pkg/deploy/devworkspace/init_test.go index f034fd379e..b990f50f0b 100644 --- a/pkg/deploy/devworkspace/init_test.go +++ b/pkg/deploy/devworkspace/init_test.go @@ -1,5 +1,5 @@ // -// Copyright (c) 2019-2023 Red Hat, Inc. +// Copyright (c) 2019-2026 Red Hat, Inc. // This program and the accompanying materials are made // available under the terms of the Eclipse Public License 2.0 // which is available at https://www.eclipse.org/legal/epl-2.0/ @@ -13,6 +13,7 @@ package devworkspace import ( + dwoinfrastructure "github.com/devfile/devworkspace-operator/pkg/infrastructure" "github.com/eclipse-che/che-operator/pkg/common/infrastructure" k8shelper "github.com/eclipse-che/che-operator/pkg/common/k8s-helper" defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" @@ -21,5 +22,6 @@ import ( func init() { k8shelper.InitializeForTesting() infrastructure.InitializeForTesting(infrastructure.OpenShiftV4) + dwoinfrastructure.InitializeForTesting(dwoinfrastructure.OpenShiftv4) defaults.InitializeForTesting() } diff --git a/pkg/deploy/networkpolicies/networkpolicies.go b/pkg/deploy/networkpolicies/networkpolicies.go deleted file mode 100644 index 01ea2df327..0000000000 --- a/pkg/deploy/networkpolicies/networkpolicies.go +++ /dev/null @@ -1,389 +0,0 @@ -// -// Copyright (c) 2019-2026 Red Hat, Inc. -// This program and the accompanying materials are made -// available under the terms of the Eclipse Public License 2.0 -// which is available at https://www.eclipse.org/legal/epl-2.0/ -// -// SPDX-License-Identifier: EPL-2.0 -// -// Contributors: -// Red Hat, Inc. - initial API and implementation -// - -package networkpolicies - -import ( - "fmt" - - "github.com/eclipse-che/che-operator/pkg/common/chetypes" - "github.com/eclipse-che/che-operator/pkg/common/constants" - "github.com/eclipse-che/che-operator/pkg/common/diffs" - "github.com/eclipse-che/che-operator/pkg/common/infrastructure" - k8sclient "github.com/eclipse-che/che-operator/pkg/common/k8s-client" - defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" - "github.com/eclipse-che/che-operator/pkg/common/reconciler" - "github.com/eclipse-che/che-operator/pkg/deploy" - networkingv1 "k8s.io/api/networking/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/labels" - "sigs.k8s.io/controller-runtime/pkg/client" - "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" - "sigs.k8s.io/controller-runtime/pkg/reconcile" -) - -type NetworkPoliciesReconciler struct { - reconciler.Reconcilable -} - -func NewNetworkPoliciesReconciler() *NetworkPoliciesReconciler { - return &NetworkPoliciesReconciler{} -} - -func (r *NetworkPoliciesReconciler) Reconcile(cheCtx *chetypes.CheContext) (reconcile.Result, bool, error) { - if !cheCtx.CheCluster.IsNetworkPoliciesEnabled() { - err := DeleteNetworkPolicy(cheCtx, cheCtx.CheCluster.Namespace) - if err != nil { - err = fmt.Errorf("failed to delete NetworkPolicy in namespace %s: %w", cheCtx.CheCluster.Namespace, err) - } - - return reconcile.Result{}, err == nil, err - } - - err := SyncNetworkPolicy(cheCtx, cheCtx.CheCluster.Namespace) - if err != nil { - return reconcile.Result{}, false, fmt.Errorf("failed to sync NetworkPolicy in namespace %s: %w", cheCtx.CheCluster.Namespace, err) - } - - return reconcile.Result{}, true, nil -} - -func (r *NetworkPoliciesReconciler) Finalize(_ *chetypes.CheContext) bool { - return true -} - -func GetNetworkPolicies(cheCtx *chetypes.CheContext, namespace string) ([]*networkingv1.NetworkPolicy, error) { - isWorkspaceNetworkPolicies := cheCtx.CheCluster.Namespace != namespace - - operatorNamespace, err := infrastructure.GetOperatorNamespace() - if err != nil { - return nil, fmt.Errorf("failed to get operator namespace: %w", err) - } - - var podSelector metav1.LabelSelector - - if isWorkspaceNetworkPolicies { - podSelector = metav1.LabelSelector{} - } else { - podSelector = metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - } - } - - allowFromSameNamespace := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-from-same-namespace", - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - PodSelector: podSelector.DeepCopy(), - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - - allowFromOpenShiftIngress := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-from-openshift-ingress", - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "network.openshift.io/policy-group": "ingress", - }, - }, - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - - allowFromOpenShiftMonitoring := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-from-openshift-monitoring", - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "network.openshift.io/policy-group": "monitoring", - }, - }, - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - - allowFromWorkspaces := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-from-workspaces", - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesComponentLabelKey: constants.WorkspacesNamespaceComponentName, - }, - }, - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - - allowFromChe := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-from-" + cheCtx.CheCluster.Namespace, - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "kubernetes.io/metadata.name": cheCtx.CheCluster.Namespace, - }, - }, - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - }, - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - - allowFromCheOperator := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: fmt.Sprintf("allow-from-%s-operator", defaults.GetCheFlavor()), - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "kubernetes.io/metadata.name": operatorNamespace, - }, - }, - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - }, - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - - var allowFromDevWorkspaceOperator *networkingv1.NetworkPolicy - - if cheCtx.DWONamespace != "" { - allowFromDevWorkspaceOperator = &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-from-devworkspace-operator", - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "kubernetes.io/metadata.name": cheCtx.DWONamespace, - }, - }, - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.DevWorkspaceOperatorName, - }, - }, - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - } - - allowAllEgress := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-all-egress", - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Egress: []networkingv1.NetworkPolicyEgressRule{{}}, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, - }, - } - - networkPolicies := []*networkingv1.NetworkPolicy{ - allowFromSameNamespace, - allowFromOpenShiftIngress, - allowFromOpenShiftMonitoring, - allowAllEgress, - } - - if isWorkspaceNetworkPolicies { - networkPolicies = append(networkPolicies, allowFromChe) - if allowFromDevWorkspaceOperator != nil { - networkPolicies = append(networkPolicies, allowFromDevWorkspaceOperator) - } - } else { - networkPolicies = append(networkPolicies, allowFromWorkspaces, allowFromCheOperator) - } - - return networkPolicies, nil -} - -func SyncNetworkPolicy(cheCtx *chetypes.CheContext, namespace string) error { - networkPolicies, err := GetNetworkPolicies(cheCtx, namespace) - if err != nil { - return fmt.Errorf("failed to get NetworkPolicy in namespace %s: %w", namespace, err) - } - - for _, networkPolicy := range networkPolicies { - if cheCtx.CheCluster.Namespace == namespace { - if err = controllerutil.SetControllerReference(cheCtx.CheCluster, networkPolicy, cheCtx.ClusterAPI.Scheme); err != nil { - return err - } - } - - if err := cheCtx.ClusterAPI.ClientWrapper.Sync( - cheCtx.Context, - networkPolicy, - &k8sclient.SyncOptions{DiffOpts: diffs.NetworkPolicy}, - ); err != nil { - return fmt.Errorf("failed to sync NetworkPolicy %s/%s: %w", networkPolicy.Namespace, networkPolicy.Name, err) - } - } - - return nil -} - -func DeleteNetworkPolicy(cheCtx *chetypes.CheContext, namespace string) error { - items, err := cheCtx.ClusterAPI.ClientWrapper.List( - cheCtx.Context, - &networkingv1.NetworkPolicyList{}, - &client.ListOptions{ - Namespace: namespace, - LabelSelector: labels.SelectorFromSet(deploy.GetLabels(defaults.GetCheFlavor())), - }, - ) - if err != nil { - return fmt.Errorf("failed to list NetworkPolicy in namespace %s: %w", namespace, err) - } - - for _, item := range items { - networkPolicy, ok := item.(*networkingv1.NetworkPolicy) - if !ok { - continue - } - - err = cheCtx.ClusterAPI.ClientWrapper.DeleteIgnoreNotFound(cheCtx.Context, networkPolicy) - if err != nil { - return fmt.Errorf("failed to delete NetworkPolicy %s/%s: %w", networkPolicy.GetNamespace(), networkPolicy.GetName(), err) - } - } - - return nil -} diff --git a/pkg/deploy/networkpolicies/networkpolicies_test.go b/pkg/deploy/networkpolicies/networkpolicies_test.go deleted file mode 100644 index cb40fd014f..0000000000 --- a/pkg/deploy/networkpolicies/networkpolicies_test.go +++ /dev/null @@ -1,513 +0,0 @@ -// -// Copyright (c) 2019-2026 Red Hat, Inc. -// This program and the accompanying materials are made -// available under the terms of the Eclipse Public License 2.0 -// which is available at https://www.eclipse.org/legal/epl-2.0/ -// -// SPDX-License-Identifier: EPL-2.0 -// -// Contributors: -// Red Hat, Inc. - initial API and implementation -// - -package networkpolicies - -import ( - "context" - "slices" - "testing" - - chev2 "github.com/eclipse-che/che-operator/api/v2" - "github.com/eclipse-che/che-operator/pkg/common/chetypes" - "github.com/eclipse-che/che-operator/pkg/common/constants" - defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" - "github.com/eclipse-che/che-operator/pkg/common/test" - "github.com/eclipse-che/che-operator/pkg/deploy" - "github.com/stretchr/testify/assert" - networkingv1 "k8s.io/api/networking/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/types" - "k8s.io/utils/ptr" -) - -var cheClusterPolicyNames = []string{ - "allow-from-same-namespace", - "allow-from-openshift-ingress", - "allow-from-openshift-monitoring", - "allow-from-workspaces", - "allow-from-che-operator", - "allow-all-egress", -} - -var workspacePolicyNames = []string{ - "allow-from-same-namespace", - "allow-from-openshift-ingress", - "allow-from-openshift-monitoring", - "allow-from-eclipse-che", - "allow-from-devworkspace-operator", - "allow-all-egress", -} - -func TestReconcileCreatesNetworkPoliciesWhenEnabled(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - cheCtx.CheCluster.Spec.Networking.NetworkPolicy = &chev2.NetworkPolicy{Enabled: ptr.To(true)} - - reconciler := NewNetworkPoliciesReconciler() - - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - - for _, name := range cheClusterPolicyNames { - exists, err := cheCtx.ClusterAPI.ClientWrapper.GetIgnoreNotFound( - context.TODO(), - types.NamespacedName{Name: name, Namespace: cheCtx.CheCluster.Namespace}, - &networkingv1.NetworkPolicy{}, - ) - - assert.NoError(t, err) - assert.True(t, exists) - } -} - -func TestReconcileDeletesNetworkPoliciesWhenDisabled(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - cheCtx.CheCluster.Spec.Networking.NetworkPolicy = &chev2.NetworkPolicy{Enabled: ptr.To(true)} - - reconciler := NewNetworkPoliciesReconciler() - - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - - cheCtx.CheCluster.Spec.Networking.NetworkPolicy.Enabled = ptr.To(false) - - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - - for _, name := range cheClusterPolicyNames { - exists, err := cheCtx.ClusterAPI.ClientWrapper.GetIgnoreNotFound( - context.TODO(), - types.NamespacedName{Name: name, Namespace: cheCtx.CheCluster.Namespace}, - &networkingv1.NetworkPolicy{}, - ) - - assert.NoError(t, err) - assert.False(t, exists) - } -} - -func TestReconcileDeletesOnlyLabeledPolicies(t *testing.T) { - unownedPolicy := &networkingv1.NetworkPolicy{ - ObjectMeta: metav1.ObjectMeta{ - Name: "unowned-policy", - Namespace: "eclipse-che", - }, - } - - cheCtx := test.NewCtxBuilder().WithObjects(unownedPolicy).Build() - cheCtx.CheCluster.Spec.Networking.NetworkPolicy = &chev2.NetworkPolicy{Enabled: ptr.To(true)} - - reconciler := NewNetworkPoliciesReconciler() - - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - - cheCtx.CheCluster.Spec.Networking.NetworkPolicy.Enabled = ptr.To(false) - - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - - exists, err := cheCtx.ClusterAPI.ClientWrapper.GetIgnoreNotFound( - context.TODO(), - types.NamespacedName{Name: "unowned-policy", Namespace: cheCtx.CheCluster.Namespace}, - &networkingv1.NetworkPolicy{}, - ) - - assert.NoError(t, err) - assert.True(t, exists) -} - -func TestReconcileIdempotent(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - cheCtx.CheCluster.Spec.Networking.NetworkPolicy = &chev2.NetworkPolicy{Enabled: ptr.To(true)} - - reconciler := NewNetworkPoliciesReconciler() - - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - - for _, name := range cheClusterPolicyNames { - exists, err := cheCtx.ClusterAPI.ClientWrapper.GetIgnoreNotFound( - context.TODO(), - types.NamespacedName{Name: name, Namespace: cheCtx.CheCluster.Namespace}, - &networkingv1.NetworkPolicy{}, - ) - - assert.NoError(t, err) - assert.True(t, exists) - } -} - -func TestGetNetworkPoliciesPodSelectorForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policies, err := GetNetworkPolicies(cheCtx, cheCtx.CheCluster.Namespace) - assert.NoError(t, err) - - expectedSelector := metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - } - - for _, p := range policies { - assert.Equal(t, expectedSelector, p.Spec.PodSelector) - } -} - -func TestGetNetworkPoliciesPodSelectorForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policies, err := GetNetworkPolicies(cheCtx, "user-ns") - assert.NoError(t, err) - - expectedSelector := metav1.LabelSelector{} - - for _, p := range policies { - assert.Equal(t, expectedSelector, p.Spec.PodSelector) - } -} - -func TestGetNetworkPoliciesLabelsForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policies, err := GetNetworkPolicies(cheCtx, cheCtx.CheCluster.Namespace) - assert.NoError(t, err) - - expectedLabels := deploy.GetLabels(defaults.GetCheFlavor()) - - for _, p := range policies { - assert.Equal(t, expectedLabels, p.Labels) - } -} - -func TestGetNetworkPoliciesLabelsForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policies, err := GetNetworkPolicies(cheCtx, "user-ns") - assert.NoError(t, err) - - expectedLabels := deploy.GetLabels(defaults.GetCheFlavor()) - - for _, p := range policies { - assert.Equal(t, expectedLabels, p.Labels) - } -} - -func TestGetNetworkPoliciesNamespaceForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policies, err := GetNetworkPolicies(cheCtx, cheCtx.CheCluster.Namespace) - assert.NoError(t, err) - - for _, p := range policies { - assert.Equal(t, cheCtx.CheCluster.Namespace, p.Namespace) - } -} - -func TestGetNetworkPoliciesNamespaceForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policies, err := GetNetworkPolicies(cheCtx, "user-ns") - assert.NoError(t, err) - - for _, p := range policies { - assert.Equal(t, "user-ns", p.Namespace) - } -} - -func TestAllowFromSameNamespaceSpecForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, cheCtx.CheCluster.Namespace, "allow-from-same-namespace") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - {PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - }}, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromSameNamespaceSpecForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, "user-ns", "allow-from-same-namespace") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - {PodSelector: &metav1.LabelSelector{}}, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromOpenShiftIngressSpecForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, cheCtx.CheCluster.Namespace, "allow-from-openshift-ingress") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "network.openshift.io/policy-group": "ingress", - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromOpenShiftIngressSpecForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, "user-ns", "allow-from-openshift-ingress") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "network.openshift.io/policy-group": "ingress", - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromOpenShiftMonitoringSpecForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, cheCtx.CheCluster.Namespace, "allow-from-openshift-monitoring") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "network.openshift.io/policy-group": "monitoring", - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromOpenShiftMonitoringSpecForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, "user-ns", "allow-from-openshift-monitoring") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "network.openshift.io/policy-group": "monitoring", - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromWorkspacesSpec(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, cheCtx.CheCluster.Namespace, "allow-from-workspaces") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesComponentLabelKey: constants.WorkspacesNamespaceComponentName, - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromCheOperatorSpec(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, cheCtx.CheCluster.Namespace, "allow-from-che-operator") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "kubernetes.io/metadata.name": "openshift-operators", - }, - }, - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromCheNamespaceSpec(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, "user-ns", "allow-from-eclipse-che") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "kubernetes.io/metadata.name": "eclipse-che", - }, - }, - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromDevWorkspaceOperatorSpec(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, "user-ns", "allow-from-devworkspace-operator") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "kubernetes.io/metadata.name": "devworkspace-controller", - }, - }, - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.DevWorkspaceOperatorName, - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowAllEgressSpecForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, cheCtx.CheCluster.Namespace, "allow-all-egress") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, policy.Spec.PolicyTypes) - assert.Empty(t, policy.Spec.Ingress) - assert.Equal(t, []networkingv1.NetworkPolicyEgressRule{{}}, policy.Spec.Egress) -} - -func TestAllowAllEgressSpecForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, "user-ns", "allow-all-egress") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, policy.Spec.PolicyTypes) - assert.Empty(t, policy.Spec.Ingress) - assert.Equal(t, []networkingv1.NetworkPolicyEgressRule{{}}, policy.Spec.Egress) -} - -func TestSyncNetworkPolicySetsOwnerReferenceForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - err := SyncNetworkPolicy(cheCtx, cheCtx.CheCluster.Namespace) - assert.NoError(t, err) - - for _, name := range cheClusterPolicyNames { - networkPolicy := &networkingv1.NetworkPolicy{} - exists, err := cheCtx.ClusterAPI.ClientWrapper.GetIgnoreNotFound( - context.TODO(), - types.NamespacedName{Name: name, Namespace: "eclipse-che"}, - networkPolicy, - ) - - assert.NoError(t, err) - assert.True(t, exists) - assert.NotEmpty(t, networkPolicy.OwnerReferences) - assert.Equal(t, cheCtx.CheCluster.Name, networkPolicy.OwnerReferences[0].Name) - } -} - -func TestSyncNetworkPolicyNoOwnerReferenceForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - err := SyncNetworkPolicy(cheCtx, "user-ns") - assert.NoError(t, err) - - for _, name := range workspacePolicyNames { - networkPolicy := &networkingv1.NetworkPolicy{} - exists, err := cheCtx.ClusterAPI.ClientWrapper.GetIgnoreNotFound( - context.TODO(), - types.NamespacedName{Name: name, Namespace: "user-ns"}, - networkPolicy, - ) - - assert.NoError(t, err) - assert.True(t, exists) - assert.Empty(t, networkPolicy.OwnerReferences) - } -} - -func findPolicy(t *testing.T, cheCtx *chetypes.CheContext, namespace string, name string) *networkingv1.NetworkPolicy { - t.Helper() - - policies, err := GetNetworkPolicies(cheCtx, namespace) - assert.NoError(t, err) - - idx := slices.IndexFunc(policies, func(item *networkingv1.NetworkPolicy) bool { return item.Name == name }) - if idx == -1 { - t.Fatalf("policy %s not found in namespace %s", name, namespace) - } - - return policies[idx] -} diff --git a/pkg/provision/sync.go b/pkg/provision/helper.go similarity index 73% rename from pkg/provision/sync.go rename to pkg/provision/helper.go index 51148ed573..8fb54d1535 100644 --- a/pkg/provision/sync.go +++ b/pkg/provision/helper.go @@ -18,6 +18,7 @@ import ( "slices" "strings" + "github.com/eclipse-che/che-operator/pkg/common/chelabels" "github.com/eclipse-che/che-operator/pkg/common/chetypes" "github.com/eclipse-che/che-operator/pkg/common/constants" k8sclient "github.com/eclipse-che/che-operator/pkg/common/k8s-client" @@ -26,11 +27,17 @@ import ( apierrors "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/validation" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/apimachinery/pkg/types" "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" ) -// SyncObject ensures that the object is up to date in the cluster. +// Package provision provides low-level utilities for provisioning, synchronizing, +// and cleaning up Kubernetes resources. It serves as a higher-level abstraction +// layer in front of K8sClientWrapper, simplifying cluster interaction calls. + +// syncObject ensures that the object is up to date in the cluster. // Besides the actual sync it: // - selects the client to use: the cached one for objects labeled with // `app.kubernetes.io/part-of: che.eclipse.org` (they are watched by the operator), @@ -42,7 +49,7 @@ import ( // should not be used with `pkg/common/diffs/diffs.go`. // - retries the sync with recreation if the update failed because an immutable field has changed, // but only when `allowForceRecreate` is set. -func SyncObject( +func syncObject( cheCtx *chetypes.CheContext, obj client.Object, diff cmp.Options, @@ -99,6 +106,56 @@ func SyncObject( return nil } +// deleteObject ensures that the object is deleted in the cluster. +func deleteObject( + cheCtx *chetypes.CheContext, + name string, + namespace string, + obj client.Object, + opts ...client.DeleteOption, +) error { + cw := cheCtx.ClusterAPI.ClientWrapper + key := types.NamespacedName{Name: name, Namespace: namespace} + + if err := cw.DeleteByKeyIgnoreNotFound(cheCtx.Context, key, obj, opts...); err != nil { + return fmt.Errorf("failed to delete %s %s: %w", k8sclient.GetObjectType(obj), key.String(), err) + } + + return nil +} + +// deleteAllManaged ensures that all objects of the given type managed by the operator +// for the specified component are deleted in the cluster. +// If namespace is not empty, the deletion is scoped to that namespace. +func deleteAllManaged( + cheCtx *chetypes.CheContext, + namespace string, + obj client.Object, + component string, +) error { + cw := cheCtx.ClusterAPI.ClientWrapper + cheLabels := chelabels.OperatorManaged(component) + + opts := &client.DeleteAllOfOptions{ + ListOptions: client.ListOptions{ + LabelSelector: labels.SelectorFromSet(cheLabels), + }, + } + + if namespace != "" { + opts.Namespace = namespace + } + + if err := cw.DeleteAllOf(cheCtx.Context, obj, opts); err != nil { + if namespace == "" { + return fmt.Errorf("failed to delete %s: %w", k8sclient.GetObjectType(obj), err) + } + return fmt.Errorf("failed to delete %s in %s: %w", k8sclient.GetObjectType(obj), namespace, err) + } + + return nil +} + // cmpMetadata compares only the labels and annotations under the given keys, plus the controller owner // reference. Everything else in the metadata - resourceVersion, uid, managedFields, timestamps and any // label or annotation set by another actor - is ignored, which is what lets the merge semantics of diff --git a/pkg/provision/sync_test.go b/pkg/provision/helper_test.go similarity index 70% rename from pkg/provision/sync_test.go rename to pkg/provision/helper_test.go index 169fbf50a8..03e805e160 100644 --- a/pkg/provision/sync_test.go +++ b/pkg/provision/helper_test.go @@ -16,6 +16,8 @@ package provision import ( "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/infrastructure" + "github.com/eclipse-che/che-operator/pkg/common/test" "github.com/google/go-cmp/cmp" "github.com/google/go-cmp/cmp/cmpopts" . "github.com/onsi/ginkgo/v2" @@ -32,15 +34,16 @@ var ( var _ = Describe("syncObject", Ordered, func() { var ( - cheContext *chetypes.CheContext + cheCtx *chetypes.CheContext ) BeforeAll(func() { - cheContext = env.NewCheCtxBuilder().WithEmptyCheCluster().Build() + cheCtx = env.NewCheCtxBuilder().WithEmptyCheCluster().Build() + test.Initialize(infrastructure.Kubernetes) }) AfterEach(func() { - Expect(env.Client.DeleteAllOf(env.Context, &corev1.ConfigMap{}, client.InNamespace(cheContext.CheCluster.Namespace))).To(Succeed()) + Expect(env.Client.DeleteAllOf(env.Context, &corev1.ConfigMap{}, client.InNamespace(cheCtx.CheCluster.Namespace))).To(Succeed()) }) It("should set owner reference", func(ctx SpecContext) { @@ -52,18 +55,18 @@ var _ = Describe("syncObject", Ordered, func() { } emptyCheClusterContext := env.NewCheCtxBuilder().Build() - Expect(SyncObject(emptyCheClusterContext, testCm, cmDiffs, false, false)).To(Succeed()) + Expect(syncObject(emptyCheClusterContext, testCm, cmDiffs, false, false)).To(Succeed()) actualCm := &corev1.ConfigMap{} - Expect(env.Client.Get(cheContext.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) + Expect(env.Client.Get(cheCtx.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) Expect(actualCm.OwnerReferences).To(BeEmpty()) - Expect(SyncObject(cheContext, testCm, cmDiffs, false, false)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, false)).To(Succeed()) actualCm = &corev1.ConfigMap{} - Expect(env.Client.Get(cheContext.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) + Expect(env.Client.Get(cheCtx.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) Expect(actualCm.OwnerReferences).To(HaveLen(1)) - Expect(actualCm.OwnerReferences[0].UID).To(Equal(cheContext.CheCluster.UID)) + Expect(actualCm.OwnerReferences[0].UID).To(Equal(cheCtx.CheCluster.UID)) }) It("should sync immutable object", func(ctx SpecContext) { @@ -76,10 +79,10 @@ var _ = Describe("syncObject", Ordered, func() { Immutable: new(true), } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, true)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, true)).To(Succeed()) actualCm := &corev1.ConfigMap{} - Expect(env.Client.Get(cheContext.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) + Expect(env.Client.Get(cheCtx.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) Expect(actualCm.Data).To(Equal(map[string]string{"a": "b"})) testCm = &corev1.ConfigMap{ @@ -91,10 +94,10 @@ var _ = Describe("syncObject", Ordered, func() { Immutable: new(true), } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, true)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, true)).To(Succeed()) actualCm = &corev1.ConfigMap{} - Expect(env.Client.Get(cheContext.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) + Expect(env.Client.Get(cheCtx.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) Expect(actualCm.Data).To(Equal(map[string]string{"a": "c"})) }) @@ -108,7 +111,7 @@ var _ = Describe("syncObject", Ordered, func() { Immutable: new(true), } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, false)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, false)).To(Succeed()) testCm = &corev1.ConfigMap{ ObjectMeta: metav1.ObjectMeta{ @@ -119,7 +122,7 @@ var _ = Describe("syncObject", Ordered, func() { Immutable: new(true), } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, false)).To(Not(Succeed())) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, false)).To(Not(Succeed())) }) It("should respect metadata", func(ctx SpecContext) { @@ -138,7 +141,7 @@ var _ = Describe("syncObject", Ordered, func() { }, } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, false)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, false)).To(Succeed()) testCm = &corev1.ConfigMap{ ObjectMeta: metav1.ObjectMeta{ @@ -155,10 +158,10 @@ var _ = Describe("syncObject", Ordered, func() { }, } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, false)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, false)).To(Succeed()) actualCm := &corev1.ConfigMap{} - Expect(env.Client.Get(cheContext.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) + Expect(env.Client.Get(cheCtx.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) Expect(actualCm.Labels["label1"]).To(Equal("value2")) Expect(actualCm.Labels["label2"]).To(Equal("value1")) Expect(actualCm.Labels["label3"]).To(Equal("value2")) @@ -179,10 +182,10 @@ var _ = Describe("syncObject", Ordered, func() { }, } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, false)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, false)).To(Succeed()) actualCm = &corev1.ConfigMap{} - Expect(env.Client.Get(cheContext.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) + Expect(env.Client.Get(cheCtx.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) Expect(actualCm.Labels["label1"]).To(Equal("value2")) Expect(actualCm.Labels["label2"]).To(Equal("value3")) Expect(actualCm.Labels["label3"]).To(Equal("value2")) diff --git a/pkg/provision/networkpolicy.go b/pkg/provision/networkpolicy.go new file mode 100644 index 0000000000..8048fc6c83 --- /dev/null +++ b/pkg/provision/networkpolicy.go @@ -0,0 +1,63 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package provision + +import ( + "github.com/eclipse-che/che-operator/pkg/common/chetypes" + defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" + "github.com/google/go-cmp/cmp" + "github.com/google/go-cmp/cmp/cmpopts" + networkingv1 "k8s.io/api/networking/v1" +) + +var NetworkPolicy = &networkPolicyHandler{ + suppressDiff: false, + allowForceRecreate: true, + diff: cmp.Options{ + cmpopts.IgnoreFields(networkingv1.NetworkPolicy{}, "TypeMeta"), + }, +} + +type networkPolicyHandler struct { + suppressDiff bool + allowForceRecreate bool + diff cmp.Options +} + +func (h networkPolicyHandler) Sync(cheCtx *chetypes.CheContext, policy *networkingv1.NetworkPolicy) error { + return syncObject( + cheCtx, + policy, + h.diff, + h.suppressDiff, + h.allowForceRecreate, + ) +} + +func (h networkPolicyHandler) Delete(cheCtx *chetypes.CheContext, name string, namespace string) error { + return deleteObject( + cheCtx, + name, + namespace, + &networkingv1.NetworkPolicy{}, + ) +} + +func (h networkPolicyHandler) DeleteAll(cheCtx *chetypes.CheContext, namespace string) error { + return deleteAllManaged( + cheCtx, + namespace, + &networkingv1.NetworkPolicy{}, + defaults.GetCheFlavor(), + ) +} diff --git a/pkg/provision/suite_test.go b/pkg/provision/suite_test.go index 63a8623c17..5e85b5a4de 100644 --- a/pkg/provision/suite_test.go +++ b/pkg/provision/suite_test.go @@ -17,8 +17,6 @@ package provision import ( "testing" - "github.com/eclipse-che/che-operator/pkg/common/infrastructure" - defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" "github.com/eclipse-che/che-operator/pkg/common/test/envtest" . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" @@ -35,10 +33,6 @@ func TestProvision(t *testing.T) { var _ = BeforeSuite(func() { logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(true))) - - infrastructure.InitializeForTesting(infrastructure.Kubernetes) - defaults.InitializeForTesting() - env = envtest.Start() }) diff --git a/pkg/reconciler/networkpolicy/networkpolicy_kubernetes.go b/pkg/reconciler/networkpolicy/networkpolicy_kubernetes.go new file mode 100644 index 0000000000..29fe51b28f --- /dev/null +++ b/pkg/reconciler/networkpolicy/networkpolicy_kubernetes.go @@ -0,0 +1,67 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package networkpolicy + +import ( + "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/constants" + defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" + "github.com/eclipse-che/che-operator/pkg/deploy" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +func (r *NetworkPoliciesReconciler) buildKubernetesNetworkPolicies(cheCtx *chetypes.CheContext) ([]*networkingv1.NetworkPolicy, error) { + allowAllEgress := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-all-egress", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Egress: []networkingv1.NetworkPolicyEgressRule{{}}, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, + }, + } + + allowAllIngress := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-all-ingress", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{{}}, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + return []*networkingv1.NetworkPolicy{ + allowAllEgress, + allowAllIngress, + }, nil +} diff --git a/pkg/reconciler/networkpolicy/networkpolicy_openshift.go b/pkg/reconciler/networkpolicy/networkpolicy_openshift.go new file mode 100644 index 0000000000..c81e0e00a2 --- /dev/null +++ b/pkg/reconciler/networkpolicy/networkpolicy_openshift.go @@ -0,0 +1,238 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package networkpolicy + +import ( + "fmt" + + "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/constants" + "github.com/eclipse-che/che-operator/pkg/common/infrastructure" + defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" + "github.com/eclipse-che/che-operator/pkg/deploy" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +func (r *NetworkPoliciesReconciler) buildOpenShiftNetworkPolicies(cheCtx *chetypes.CheContext) ([]*networkingv1.NetworkPolicy, error) { + operatorNamespace, err := infrastructure.GetOperatorNamespace() + if err != nil { + return nil, err + } + + allowFromSameNamespace := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-from-same-namespace", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + { + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + }, + }, + }, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + allowFromOpenShiftIngress := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-from-openshift-ingress", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"network.openshift.io/policy-group": "ingress"}, + }, + }, + }, + }, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + allowFromOpenShiftHostNetwork := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-from-openshift-host-network", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"policy-group.network.openshift.io/host-network": ""}, + }, + }, + }, + }, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + allowFromOpenShiftMonitoring := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-from-openshift-monitoring", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"network.openshift.io/policy-group": "monitoring"}, + }, + }, + }, + }, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + allowFromWorkspaces := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-from-workspaces", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesComponentLabelKey: constants.WorkspacesNamespaceComponentName}, + }, + }, + }, + }, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + allowFromCheOperator := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: fmt.Sprintf("allow-from-%s-operator", defaults.GetCheFlavor()), + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"kubernetes.io/metadata.name": operatorNamespace}, + }, + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + }, + }, + }, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + allowAllEgress := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-all-egress", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Egress: []networkingv1.NetworkPolicyEgressRule{{}}, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, + }, + } + + return []*networkingv1.NetworkPolicy{ + allowFromSameNamespace, + allowFromOpenShiftIngress, + allowFromOpenShiftHostNetwork, + allowFromOpenShiftMonitoring, + allowFromWorkspaces, + allowFromCheOperator, + allowAllEgress, + }, nil +} diff --git a/pkg/reconciler/networkpolicy/networkpolicy_reconciler.go b/pkg/reconciler/networkpolicy/networkpolicy_reconciler.go new file mode 100644 index 0000000000..07eb460121 --- /dev/null +++ b/pkg/reconciler/networkpolicy/networkpolicy_reconciler.go @@ -0,0 +1,76 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package networkpolicy + +import ( + "fmt" + + "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/infrastructure" + "github.com/eclipse-che/che-operator/pkg/provision" + networkingv1 "k8s.io/api/networking/v1" + "sigs.k8s.io/controller-runtime/pkg/reconcile" +) + +type NetworkPoliciesReconciler struct{} + +func (r *NetworkPoliciesReconciler) Reconcile(cheCtx *chetypes.CheContext) (reconcile.Result, bool, error) { + if cheCtx.CheCluster.IsNetworkPoliciesEnabled() { + if err := r.syncAll(cheCtx); err != nil { + return reconcile.Result{}, + false, + fmt.Errorf("failed to reconcile NetworkPolicy: %w", err) + } + + return reconcile.Result{}, true, nil + } + + if err := r.deleteAll(cheCtx); err != nil { + return reconcile.Result{}, + false, + fmt.Errorf("failed to reconcile NetworkPolicy: %w", err) + } + + return reconcile.Result{}, true, nil +} + +func (r *NetworkPoliciesReconciler) Finalize(_ *chetypes.CheContext) bool { + return true +} + +func (r *NetworkPoliciesReconciler) syncAll(cheCtx *chetypes.CheContext) error { + networkPolicies, err := r.buildNetworkPolicies(cheCtx) + if err != nil { + return err + } + + for _, networkPolicy := range networkPolicies { + if err := provision.NetworkPolicy.Sync(cheCtx, networkPolicy); err != nil { + return err + } + } + + return nil +} + +func (r *NetworkPoliciesReconciler) deleteAll(cheCtx *chetypes.CheContext) error { + return provision.NetworkPolicy.DeleteAll(cheCtx, cheCtx.CheCluster.Namespace) +} + +func (r *NetworkPoliciesReconciler) buildNetworkPolicies(cheCtx *chetypes.CheContext) ([]*networkingv1.NetworkPolicy, error) { + if infrastructure.IsOpenShift() { + return r.buildOpenShiftNetworkPolicies(cheCtx) + } + + return r.buildKubernetesNetworkPolicies(cheCtx) +} diff --git a/pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go b/pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go new file mode 100644 index 0000000000..0be0b20687 --- /dev/null +++ b/pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go @@ -0,0 +1,169 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +//go:build integration + +package networkpolicy + +import ( + "fmt" + + chev2 "github.com/eclipse-che/che-operator/api/v2" + "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/infrastructure" + defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" + "github.com/eclipse-che/che-operator/pkg/common/test" + "github.com/eclipse-che/che-operator/pkg/common/utils" + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + networkingv1 "k8s.io/api/networking/v1" + "k8s.io/apimachinery/pkg/types" + "sigs.k8s.io/controller-runtime/pkg/client" +) + +var _ = Describe("NetworkPoliciesReconciler", func() { + var ( + cheCtx *chetypes.CheContext + reconciler *NetworkPoliciesReconciler + ) + + BeforeEach(func() { + reconciler = &NetworkPoliciesReconciler{} + cheCtx = env.NewCheCtxBuilder().WithEmptyCheCluster().Build() + }) + + AfterEach(func() { + Expect(env.Client.DeleteAllOf(env.Context, &networkingv1.NetworkPolicy{}, client.InNamespace(cheCtx.CheCluster.Namespace))).To(Succeed()) + Expect(env.Client.DeleteAllOf(env.Context, &chev2.CheCluster{}, client.InNamespace(cheCtx.CheCluster.Namespace))).To(Succeed()) + }) + + Context("Finalize", func() { + BeforeEach(func() { + test.Initialize(infrastructure.Kubernetes) + }) + + It("should report the component as finalized", func() { + Expect(reconciler.Finalize(cheCtx)).To(BeTrue()) + }) + }) + + Context("when NetworkPolicy is disabled", func() { + BeforeEach(func() { + test.Initialize(infrastructure.Kubernetes) + cheCtx.CheCluster.Spec.Networking.NetworkPolicy = &chev2.NetworkPolicy{Enabled: new(false)} + }) + + It("should delete NetworkPolicies created while enabled", func() { + By("provisioning NetworkPolicies as if enabled") + Expect(reconciler.syncAll(cheCtx)).To(Not(HaveOccurred())) + + By("confirming the NetworkPolicies exist") + npList := &networkingv1.NetworkPolicyList{} + Expect(cheCtx.ClusterAPI.Client.List(cheCtx.Context, npList)).To(Succeed()) + Expect(npList.Items).To(Not(BeEmpty())) + + By("reconciling") + test.Reconcile(cheCtx, reconciler.Reconcile) + + By("confirming the NetworkPolicies are gone") + npList = &networkingv1.NetworkPolicyList{} + Expect(cheCtx.ClusterAPI.Client.List(cheCtx.Context, npList)).To(Succeed()) + Expect(npList.Items).To(BeEmpty()) + }) + }) + + Context("when NetworkPolicy is enabled", func() { + BeforeEach(func() { + cheCtx.CheCluster.Spec.Networking.NetworkPolicy = &chev2.NetworkPolicy{Enabled: new(true)} + }) + + Context("on OpenShift", func() { + var expectedPolicyNames []string + + BeforeEach(func() { + test.Initialize(infrastructure.OpenShiftV4) + + expectedPolicyNames = []string{ + "allow-from-same-namespace", + "allow-from-openshift-ingress", + "allow-from-openshift-host-network", + "allow-from-openshift-monitoring", + "allow-from-workspaces", + fmt.Sprintf("allow-from-%s-operator", defaults.GetCheFlavor()), + "allow-all-egress", + } + }) + + It("should create the scoped OpenShift ingress policies and allow-all egress", func() { + test.Reconcile(cheCtx, reconciler.Reconcile) + + npList := &networkingv1.NetworkPolicyList{} + Expect(cheCtx.ClusterAPI.Client.List(cheCtx.Context, npList)).To(Succeed()) + Expect(npList.Items).To(HaveLen(len(expectedPolicyNames))) + + npNames := utils.Map(npList.Items, func(np networkingv1.NetworkPolicy) string { return np.Name }) + Expect(npNames).To(ConsistOf(expectedPolicyNames)) + }) + }) + + Context("on Kubernetes", func() { + var expectedPolicyNames []string + + BeforeEach(func() { + test.Initialize(infrastructure.Kubernetes) + + expectedPolicyNames = []string{ + "allow-all-egress", + "allow-all-ingress", + } + }) + + It("should create permissive allow-all ingress and egress policies", func() { + test.Reconcile(cheCtx, reconciler.Reconcile) + + npList := &networkingv1.NetworkPolicyList{} + Expect(cheCtx.ClusterAPI.Client.List(cheCtx.Context, npList)).To(Succeed()) + Expect(npList.Items).To(HaveLen(len(expectedPolicyNames))) + + npNames := utils.Map(npList.Items, func(np networkingv1.NetworkPolicy) string { return np.Name }) + Expect(npNames).To(ConsistOf(expectedPolicyNames)) + }) + + It("should revert out-of-band edits to a NetworkPolicy", func() { + test.Reconcile(cheCtx, reconciler.Reconcile) + + npKey := types.NamespacedName{Name: "allow-all-ingress", Namespace: cheCtx.CheCluster.Namespace} + + By("editing allow-all-ingress out of band") + np := &networkingv1.NetworkPolicy{} + Expect(cheCtx.ClusterAPI.Client.Get(cheCtx.Context, npKey, np)).To(Succeed()) + Expect(np.Spec.Ingress).To(Not(BeNil())) + + np.Spec.Ingress = nil + Expect(cheCtx.ClusterAPI.Client.Update(cheCtx.Context, np)).To(Succeed()) + + By("reading it back before reconciling") + np = &networkingv1.NetworkPolicy{} + Expect(cheCtx.ClusterAPI.Client.Get(cheCtx.Context, npKey, np)).To(Succeed()) + Expect(np.Spec.Ingress).To(BeNil()) + + By("reconciling a second time") + test.Reconcile(cheCtx, reconciler.Reconcile) + + By("reading it back after reconciling") + np = &networkingv1.NetworkPolicy{} + Expect(cheCtx.ClusterAPI.Client.Get(cheCtx.Context, npKey, np)).To(Succeed()) + Expect(np.Spec.Ingress).To(Not(BeNil())) + }) + }) + }) +}) diff --git a/pkg/reconciler/networkpolicy/suite_test.go b/pkg/reconciler/networkpolicy/suite_test.go new file mode 100644 index 0000000000..767f21d65c --- /dev/null +++ b/pkg/reconciler/networkpolicy/suite_test.go @@ -0,0 +1,43 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +//go:build integration + +package networkpolicy + +import ( + "testing" + + "github.com/eclipse-che/che-operator/pkg/common/test/envtest" + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + logf "sigs.k8s.io/controller-runtime/pkg/log" + "sigs.k8s.io/controller-runtime/pkg/log/zap" +) + +var env *envtest.Env + +func TestNetworkPolicy(t *testing.T) { + RegisterFailHandler(Fail) + RunSpecs(t, "NetworkPolicy Reconciler Suite") +} + +var _ = BeforeSuite(func() { + logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(true))) + env = envtest.Start() +}) + +var _ = AfterSuite(func() { + if env != nil { + env.Stop() + } +}) diff --git a/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go b/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go index 61741c34db..890300213e 100644 --- a/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go +++ b/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go @@ -351,14 +351,14 @@ type NetworkPolicyConfig struct { // is denied. If this field is specified as a non-empty list, exactly those rules apply // and the default rules no longer apply. // +kubebuilder:validation:Optional - Ingress []networkingv1.NetworkPolicyIngressRule `json:"ingress,omitempty"` + Ingress []networkingv1.NetworkPolicyIngressRule `json:"ingress"` // Egress defines the egress rules applied to DevWorkspace pods. If this field is not // specified, the default egress rule of the DevWorkspace Operator applies, which allows // all egress traffic. If this field is specified as an empty list, all egress traffic // from DevWorkspace pods is denied. If this field is specified as a non-empty list, // exactly those rules apply and the default rule no longer applies. // +kubebuilder:validation:Optional - Egress []networkingv1.NetworkPolicyEgressRule `json:"egress,omitempty"` + Egress []networkingv1.NetworkPolicyEgressRule `json:"egress"` } type Proxy struct { @@ -438,6 +438,7 @@ type ProjectCloneConfig struct { Image string `json:"image,omitempty"` // ImagePullPolicy configures the imagePullPolicy for the project clone container. // If undefined, the general setting .config.workspace.imagePullPolicy is used instead. + // If neither is set, defaults to IfNotPresent. ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"` // Resources defines the resource (cpu, memory) limits and requests for the project // clone container. To explicitly not specify a limit or request, define the resource @@ -449,7 +450,7 @@ type ProjectCloneConfig struct { type RestoreConfig struct { // ImagePullPolicy configures the imagePullPolicy for the restore container. - // If undefined, the general setting .config.workspace.imagePullPolicy is used instead. + // If undefined, defaults to IfNotPresent. ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"` // Resources defines the resource (cpu, memory) limits and requests for the restore // container. To explicitly not specify a limit or request, define the resource diff --git a/vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go b/vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go index 7b34e554be..7a071892cc 100644 --- a/vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go +++ b/vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go @@ -61,6 +61,7 @@ var defaultConfig = &v1alpha1.OperatorConfiguration{ NetworkPolicy: nil, // Set per-platform in setDefaultNetworkPolicy() DefaultTemplate: nil, ProjectCloneConfig: &v1alpha1.ProjectCloneConfig{ + ImagePullPolicy: corev1.PullIfNotPresent, Resources: &corev1.ResourceRequirements{ Limits: corev1.ResourceList{ corev1.ResourceMemory: resource.MustParse("1Gi"), @@ -268,10 +269,28 @@ func GetDefaultNetworkPolicy(operatorNamespace string) ( ingressPolicyRules = defaultKubernetesIngressPolicyRules } - defaultConfig.Workspace.NetworkPolicy = &v1alpha1.NetworkPolicyConfig{ - Enabled: pointer.Bool(constants.DefaultNetworkPolicyEnabled), - Ingress: ingressPolicyRules, - Egress: defaultEgressPolicyRules, + // Return copies so callers can extend the rules without mutating package-level defaults + return deepCopyIngressRules(ingressPolicyRules), deepCopyEgressRules(defaultEgressPolicyRules), nil +} + +func deepCopyIngressRules(rules []networkingv1.NetworkPolicyIngressRule) []networkingv1.NetworkPolicyIngressRule { + if rules == nil { + return nil + } + copied := make([]networkingv1.NetworkPolicyIngressRule, len(rules)) + for i := range rules { + rules[i].DeepCopyInto(&copied[i]) + } + return copied +} + +func deepCopyEgressRules(rules []networkingv1.NetworkPolicyEgressRule) []networkingv1.NetworkPolicyEgressRule { + if rules == nil { + return nil + } + copied := make([]networkingv1.NetworkPolicyEgressRule, len(rules)) + for i := range rules { + rules[i].DeepCopyInto(&copied[i]) } - return ingressPolicyRules, defaultEgressPolicyRules, nil + return copied } diff --git a/vendor/modules.txt b/vendor/modules.txt index 0d1591dc37..cd07fd2db2 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -28,7 +28,7 @@ github.com/davecgh/go-spew/spew github.com/devfile/api/v2/pkg/apis/workspaces/v1alpha2 github.com/devfile/api/v2/pkg/attributes github.com/devfile/api/v2/pkg/devfile -# github.com/devfile/devworkspace-operator v0.2.1-0.20261008221424-9e9bab4780a9 +# github.com/devfile/devworkspace-operator v0.2.1-0.20261013204914-cd25c621588c ## explicit; go 1.26.0 github.com/devfile/devworkspace-operator/apis/controller/v1alpha1 github.com/devfile/devworkspace-operator/controllers/controller/devworkspacerouting