From 7769430b2a2eb44177ada59d93325418177ee445 Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Wed, 14 Oct 2026 10:02:14 +0200 Subject: [PATCH 1/6] feat: Delegate workspace NetworkPolicy provisioning to DevWorkspace Operator Workspace NetworkPolicies are now provisioned by the DevWorkspace Operator, configured through spec.devEnvironments.networking.networkPolicy. Legacy policies previously created by Che Operator in user namespaces are removed. NetworkPolicies for Che operands are now supported on Kubernetes as well. Assisted-by: Claude Opus 5.5 Co-Authored-By: Claude Opus 5.5 --- api/v2/checluster_types.go | 75 +- api/v2/zz_generated.deepcopy.go | 5 + .../che-operator.clusterserviceversion.yaml | 7 +- .../org.eclipse.che_checlusters.yaml | 1535 +++++++++++++++-- .../bases/org.eclipse.che_checlusters.yaml | 1529 ++++++++++++++-- config/rbac/cluster_role.yaml | 1 + controllers/che/checluster_controller.go | 7 +- .../usernamespace/usernamespace_controller.go | 57 +- ...espace_controller_network_policies_test.go | 199 --- deploy/deployment/kubernetes/combined.yaml | 1530 ++++++++++++++-- .../objects/che-operator.ClusterRole.yaml | 1 + ....eclipse.che.CustomResourceDefinition.yaml | 1529 ++++++++++++++-- deploy/deployment/openshift/combined.yaml | 1530 ++++++++++++++-- .../objects/che-operator.ClusterRole.yaml | 1 + ....eclipse.che.CustomResourceDefinition.yaml | 1529 ++++++++++++++-- go.mod | 2 +- go.sum | 4 +- ....eclipse.che.CustomResourceDefinition.yaml | 1529 ++++++++++++++-- .../templates/che-operator.ClusterRole.yaml | 1 + pkg/common/chelabels/labels.go | 26 + pkg/common/constants/constants.go | 2 +- pkg/common/k8s-client/k8s_client.go | 8 + pkg/common/k8s-client/k8s_client_types.go | 3 + pkg/common/test/utils.go | 27 +- pkg/common/utils/slices.go | 24 + .../devworkspace/dev_workspace_config.go | 4 + .../dev_workspace_config_network_policy.go | 66 + ...ev_workspace_config_network_policy_test.go | 156 ++ .../dev_workspace_config_scheduling_test.go | 2 +- .../dev_workspace_config_security_test.go | 2 +- .../dev_workspace_config_storage_test.go | 2 +- .../dev_workspace_config_workspace_test.go | 2 +- pkg/deploy/devworkspace/init_test.go | 4 +- pkg/deploy/networkpolicies/init_test.go | 25 - pkg/deploy/networkpolicies/networkpolicies.go | 389 ----- .../networkpolicies/networkpolicies_test.go | 513 ------ pkg/provision/{sync.go => helper.go} | 58 +- .../{sync_test.go => helper_test.go} | 41 +- pkg/provision/networkpolicy.go | 63 + pkg/provision/suite_test.go | 6 - .../networkpolicy/networkpolicy_kubernetes.go | 67 + .../networkpolicy/networkpolicy_openshift.go | 238 +++ .../networkpolicy/networkpolicy_reconciler.go | 76 + .../networkpolicy_reconciler_test.go | 167 ++ pkg/reconciler/networkpolicy/suite_test.go | 41 + .../devworkspaceoperatorconfig_types.go | 7 +- .../pkg/config/defaults.go | 29 +- vendor/modules.txt | 2 +- 48 files changed, 11194 insertions(+), 1927 deletions(-) delete mode 100644 controllers/usernamespace/usernamespace_controller_network_policies_test.go create mode 100644 pkg/common/chelabels/labels.go create mode 100644 pkg/common/utils/slices.go create mode 100644 pkg/deploy/devworkspace/dev_workspace_config_network_policy.go create mode 100644 pkg/deploy/devworkspace/dev_workspace_config_network_policy_test.go delete mode 100644 pkg/deploy/networkpolicies/init_test.go delete mode 100644 pkg/deploy/networkpolicies/networkpolicies.go delete mode 100644 pkg/deploy/networkpolicies/networkpolicies_test.go rename pkg/provision/{sync.go => helper.go} (74%) rename pkg/provision/{sync_test.go => helper_test.go} (70%) create mode 100644 pkg/provision/networkpolicy.go create mode 100644 pkg/reconciler/networkpolicy/networkpolicy_kubernetes.go create mode 100644 pkg/reconciler/networkpolicy/networkpolicy_openshift.go create mode 100644 pkg/reconciler/networkpolicy/networkpolicy_reconciler.go create mode 100644 pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go create mode 100644 pkg/reconciler/networkpolicy/suite_test.go diff --git a/api/v2/checluster_types.go b/api/v2/checluster_types.go index 0176c6d14e..c438bc6aca 100644 --- a/api/v2/checluster_types.go +++ b/api/v2/checluster_types.go @@ -347,24 +347,9 @@ type CheClusterSpecNetworking struct { // +optional // +kubebuilder:default:={gateway: {configLabels: {app: che, component: che-gateway-config}}} Auth Auth `json:"auth"` - // NetworkPolicy configures NetworkPolicy resources for the Che namespace - // and user workspace namespaces. For OpenShift clusters only. - // When enabled, the following policies are created: - // In the Che namespace: - // - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - // - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - // - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - // - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - // - allow-from--operator: allows ingress traffic from the operator pod to Che components. - // - allow-all-egress: allows all egress traffic from Che pods. - // In each user workspace namespace: - // - allow-from-: allows ingress traffic from the Che namespace. - // - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - // - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - // - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - // - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - // - allow-all-egress: allows all egress traffic from workspace pods. - // +optional + // NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + // such as the gateway, the server, the dashboard and the registries. + // +kubebuilder:validation:Optional NetworkPolicy *NetworkPolicy `json:"networkPolicy,omitempty"` } @@ -372,13 +357,51 @@ type DevEnvironmentNetworking struct { // External TLS configuration. // +optional ExternalTLSConfig *ExternalTLSConfig `json:"externalTLSConfig,omitempty"` + // NetworkPolicy defines configuration options for the NetworkPolicies provisioned + // for each DevWorkspace by the DevWorkspace Operator. + // + // When enabled and no ingress rules are specified, the Operator sets the default + // DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + // from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + // CheCluster namespace). If custom ingress rules are specified, only those rules apply + // and the rule allowing traffic from Che operands is not added automatically; if Che + // operands need to communicate with the workspaces, a corresponding ingress rule must be + // explicitly included. + // + // When enabled and no egress rules are specified, the Operator sets the default + // DevWorkspace Operator egress rules. If custom egress rules are specified, only + // those rules apply. + // +kubebuilder:validation:Optional + NetworkPolicy *controllerv1alpha1.NetworkPolicyConfig `json:"networkPolicy,omitempty"` } -// NetworkPolicy configuration settings. +// NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, +// such as the gateway, the server, the dashboard and the registries. // +k8s:openapi-gen=true type NetworkPolicy struct { - // Enabled controls whether the operator creates NetworkPolicy resources. - // +optional + // Enabled determines whether the NetworkPolicies are provisioned for Eclipse Che. + // The policies are created in the namespace where the `CheCluster` custom resource is created + // and apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` only. + // Disabled by default. When set to `false`, the NetworkPolicies previously created + // by the Operator are removed. + // + // On OpenShift, the following NetworkPolicies are created in the `CheCluster` namespace: + // - `allow-from-same-namespace` : from the Che operands themselves. + // - `allow-from-openshift-ingress` : from the OpenShift ingress controller. + // - `allow-from-openshift-host-network` : from the pods that use the host network, for example + // the OpenShift router. + // - `allow-from-openshift-monitoring` : from the OpenShift monitoring stack, to scrape metrics. + // - `allow-from-workspaces` : from the users' workspace namespaces. + // - `allow-from-che-operator` : from the Operator pods in the Operator namespace. + // - `allow-all-egress` : allows all egress traffic from the Che operands. + // + // On Kubernetes, only the `allow-all-ingress` and `allow-all-egress` NetworkPolicies are created, + // allowing all ingress and egress traffic, since the namespace of the cluster's ingress controller + // is not known to the Operator. Enabling this setting on Kubernetes does not restrict any traffic + // by itself: administrators are expected to provision their own NetworkPolicies. + // + // +kubebuilder:default:=false + // +kubebuilder:validation:Optional Enabled *bool `json:"enabled,omitempty"` } @@ -1403,8 +1426,14 @@ func (c *CheCluster) IsDevEnvironmentExternalTLSConfigEnabled() bool { } func (c *CheCluster) IsNetworkPoliciesEnabled() bool { - return c.Spec.Networking.NetworkPolicy != nil && - ptr.Deref(c.Spec.Networking.NetworkPolicy.Enabled, constants.NetworkPolicyEnabled) + if c.Spec.Networking.NetworkPolicy == nil { + return constants.DefaultNetworkPolicyEnabled + } + + return ptr.Deref( + c.Spec.Networking.NetworkPolicy.Enabled, + constants.DefaultNetworkPolicyEnabled, + ) } func (c *CheCluster) IsOAuthProxyImageResolutionFromImageStreamEnabled() bool { diff --git a/api/v2/zz_generated.deepcopy.go b/api/v2/zz_generated.deepcopy.go index 5c09b4cc97..82359e3921 100644 --- a/api/v2/zz_generated.deepcopy.go +++ b/api/v2/zz_generated.deepcopy.go @@ -892,6 +892,11 @@ func (in *DevEnvironmentNetworking) DeepCopyInto(out *DevEnvironmentNetworking) *out = new(ExternalTLSConfig) (*in).DeepCopyInto(*out) } + if in.NetworkPolicy != nil { + in, out := &in.NetworkPolicy, &out.NetworkPolicy + *out = new(v1alpha1.NetworkPolicyConfig) + (*in).DeepCopyInto(*out) + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DevEnvironmentNetworking. diff --git a/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml b/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml index 4237961f06..fa6f2b2c19 100644 --- a/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml +++ b/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml @@ -86,7 +86,7 @@ metadata: categories: Developer Tools certified: "false" containerImage: quay.io/eclipse/che-operator:next - createdAt: "2026-10-01T12:19:13Z" + createdAt: "2026-10-13T12:43:02Z" description: A Kube-native development solution that delivers portable and collaborative developer workspaces. features.operators.openshift.io/cnf: "false" @@ -108,7 +108,7 @@ metadata: operatorframework.io/arch.amd64: supported operatorframework.io/arch.arm64: supported operatorframework.io/os.linux: supported - name: eclipse-che.v7.123.0-1079.next + name: eclipse-che.v7.124.0-1085.next namespace: placeholder spec: apiservicedefinitions: {} @@ -931,6 +931,7 @@ spec: verbs: - create - delete + - deletecollection - get - update - patch @@ -1201,7 +1202,7 @@ spec: name: openvsx - image: quay.io/sclorg/postgresql-16-c9s:20260319 name: openvsx-postgres - version: 7.123.0-1079.next + version: 7.124.0-1085.next webhookdefinitions: - admissionReviewVersions: - v1 diff --git a/bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml b/bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml index 68883c4efc..9ef9659c7a 100644 --- a/bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml +++ b/bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml @@ -136,7 +136,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -295,7 +297,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -458,7 +462,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -617,7 +623,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1052,7 +1060,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1247,7 +1257,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1675,7 +1687,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1897,7 +1911,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2126,7 +2142,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2408,7 +2426,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4464,7 +4484,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4871,10 +4893,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5217,6 +5250,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5250,6 +5290,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5337,6 +5384,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5408,6 +5462,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5426,6 +5487,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5519,8 +5592,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5565,7 +5638,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6140,6 +6212,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6241,6 +6320,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6282,6 +6368,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6387,6 +6480,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6495,6 +6595,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6555,6 +6662,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6604,6 +6718,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6812,6 +6933,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6845,6 +6973,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7052,7 +7187,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7459,10 +7596,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7805,6 +7953,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7838,6 +7993,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7925,6 +8087,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7996,6 +8165,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8014,6 +8190,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8107,8 +8295,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8153,7 +8341,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8728,6 +8915,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8829,6 +9023,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8870,6 +9071,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8975,6 +9183,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9083,6 +9298,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9143,6 +9365,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9192,6 +9421,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9400,6 +9636,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9433,6 +9676,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9606,7 +9856,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -10013,10 +10265,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10359,6 +10622,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10392,6 +10662,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10479,6 +10756,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10550,6 +10834,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10568,6 +10859,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10661,8 +10964,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10707,7 +11010,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11282,6 +11584,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11383,6 +11692,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11424,6 +11740,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11529,6 +11852,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11637,6 +11967,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11697,6 +12034,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11746,6 +12090,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11954,6 +12305,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11987,6 +12345,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12229,7 +12594,9 @@ spec: ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12641,10 +13008,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12991,6 +13369,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -13024,6 +13409,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13112,6 +13504,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13186,6 +13585,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13204,6 +13610,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13297,8 +13715,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13343,7 +13761,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13923,6 +14340,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -14026,6 +14450,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14067,6 +14498,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14178,6 +14616,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14286,6 +14731,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14346,6 +14798,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14395,6 +14854,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14605,6 +15071,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14638,6 +15111,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14849,7 +15329,9 @@ spec: ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15261,10 +15743,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15611,6 +16104,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15644,6 +16144,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15732,6 +16239,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15806,6 +16320,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15824,6 +16345,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15917,8 +16450,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15963,7 +16496,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16543,6 +17075,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16646,6 +17185,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16687,6 +17233,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16798,6 +17351,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16906,6 +17466,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16966,6 +17533,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17015,6 +17589,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17225,6 +17806,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17258,6 +17846,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17426,7 +18021,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17833,10 +18430,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18179,6 +18787,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18212,6 +18827,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18299,6 +18921,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18370,6 +18999,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18388,6 +19024,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18481,8 +19129,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18527,7 +19175,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19102,6 +19749,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19203,8 +19857,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19244,6 +19905,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19349,6 +20017,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19457,6 +20132,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19517,6 +20199,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19566,6 +20255,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19774,6 +20470,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19807,6 +20510,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21967,7 +22677,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22365,10 +23077,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22513,7 +23236,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22785,6 +23510,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22898,6 +23628,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22980,6 +23715,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23038,6 +23780,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23195,6 +23942,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23253,6 +24007,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23708,6 +24467,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23766,6 +24532,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23906,10 +24677,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which + the volume should be mounted. type: string mountPropagation: description: |- @@ -24027,6 +24809,432 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -24098,7 +25306,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24496,10 +25706,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24868,11 +26089,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25436,7 +26654,9 @@ spec: ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25848,10 +27068,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26198,6 +27429,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26231,6 +27469,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26319,6 +27564,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26393,6 +27645,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26411,6 +27670,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26504,8 +27775,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26550,7 +27821,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27130,6 +28400,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27233,6 +28510,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27274,6 +28558,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27385,6 +28676,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27493,6 +28791,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27553,6 +28858,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27602,6 +28914,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27812,6 +29131,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27845,6 +29171,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -28071,27 +29404,37 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies\ + \ are provisioned for Eclipse Che.\nThe policies are created\ + \ in the namespace where the `CheCluster` custom resource\ + \ is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org`\ + \ only.\nDisabled by default. When set to `false`, the\ + \ NetworkPolicies previously created\nby the Operator\ + \ are removed.\n\nOn OpenShift, the following NetworkPolicies\ + \ are created in the `CheCluster` namespace:\n - `allow-from-same-namespace`\ + \ \t: from the Che operands themselves.\n - `allow-from-openshift-ingress`\ + \ \t: from the OpenShift ingress controller.\n -\ + \ `allow-from-openshift-host-network` \t: from the pods\ + \ that use the host network, for example\n the OpenShift\ + \ router.\n - `allow-from-openshift-monitoring` \t\ + : from the OpenShift monitoring stack, to scrape metrics.\n\ + \ - `allow-from-workspaces` \t: from the\ + \ users' workspace namespaces.\n - `allow-from-che-operator`\ + \ \t\t: from the Operator pods in the Operator namespace.\n\ + \ - `allow-all-egress` \t: allows all\ + \ egress traffic from the Che operands.\n\nOn Kubernetes,\ + \ only the `allow-all-ingress` and `allow-all-egress`\ + \ NetworkPolicies are created,\nallowing all ingress and\ + \ egress traffic, since the namespace of the cluster's\ + \ ingress controller\nis not known to the Operator. Enabling\ + \ this setting on Kubernetes does not restrict any traffic\n\ + by itself: administrators are expected to provision their\ + \ own NetworkPolicies." type: boolean type: object tlsSecretName: diff --git a/config/crd/bases/org.eclipse.che_checlusters.yaml b/config/crd/bases/org.eclipse.che_checlusters.yaml index 392d68b1e4..13244bd02f 100644 --- a/config/crd/bases/org.eclipse.che_checlusters.yaml +++ b/config/crd/bases/org.eclipse.che_checlusters.yaml @@ -119,7 +119,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -278,7 +280,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -441,7 +445,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -600,7 +606,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1033,7 +1041,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1228,7 +1238,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1656,7 +1668,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1876,7 +1890,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2103,7 +2119,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2383,7 +2401,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4429,7 +4449,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4834,10 +4856,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5178,6 +5211,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5211,6 +5251,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5298,6 +5345,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5368,6 +5422,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5386,6 +5447,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5479,8 +5552,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5525,7 +5598,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6099,6 +6171,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6200,6 +6279,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6241,6 +6327,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6344,6 +6437,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6451,6 +6551,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6511,6 +6618,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6560,6 +6674,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6767,6 +6888,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6800,6 +6928,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7006,7 +7141,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7411,10 +7548,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7755,6 +7903,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7788,6 +7943,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7875,6 +8037,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7945,6 +8114,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -7963,6 +8139,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8056,8 +8244,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8102,7 +8290,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8676,6 +8863,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8777,6 +8971,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8818,6 +9019,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8921,6 +9129,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9028,6 +9243,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9088,6 +9310,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9137,6 +9366,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9344,6 +9580,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9377,6 +9620,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9549,7 +9799,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -9954,10 +10206,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10298,6 +10561,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10331,6 +10601,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10418,6 +10695,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10488,6 +10772,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10506,6 +10797,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10599,8 +10902,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10645,7 +10948,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11219,6 +11521,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11320,6 +11629,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11361,6 +11677,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11464,6 +11787,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11571,6 +11901,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11631,6 +11968,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11680,6 +12024,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11887,6 +12238,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11920,6 +12278,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12159,7 +12524,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12568,10 +12935,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12915,6 +13293,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -12948,6 +13333,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13036,6 +13428,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13110,6 +13509,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13128,6 +13534,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13221,8 +13639,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13267,7 +13685,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13844,6 +14261,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -13947,6 +14371,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13988,6 +14419,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14098,6 +14536,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14206,6 +14651,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14266,6 +14718,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14315,6 +14774,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14524,6 +14990,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14557,6 +15030,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14766,7 +15246,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15175,10 +15657,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15522,6 +16015,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15555,6 +16055,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15643,6 +16150,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15717,6 +16231,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15735,6 +16256,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15828,8 +16361,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15874,7 +16407,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16451,6 +16983,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16554,6 +17093,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16595,6 +17141,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16705,6 +17258,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16813,6 +17373,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16873,6 +17440,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16922,6 +17496,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17131,6 +17712,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17164,6 +17752,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17331,7 +17926,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17736,10 +18333,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18080,6 +18688,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18113,6 +18728,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18200,6 +18822,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18270,6 +18899,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18288,6 +18924,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18381,8 +19029,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18427,7 +19075,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19001,6 +19648,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19102,8 +19756,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19143,6 +19804,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19246,6 +19914,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19353,6 +20028,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19413,6 +20095,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19462,6 +20151,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19669,6 +20365,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19702,6 +20405,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21857,7 +22567,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22255,10 +22967,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22403,7 +23126,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22674,6 +23399,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22787,6 +23517,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22869,6 +23604,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -22927,6 +23669,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23084,6 +23831,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23142,6 +23896,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23597,6 +24356,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23655,6 +24421,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23795,10 +24566,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -23916,6 +24698,428 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -23986,7 +25190,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24384,10 +25590,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24756,11 +25973,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25321,7 +26535,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25730,10 +26946,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26077,6 +27304,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26110,6 +27344,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26198,6 +27439,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26272,6 +27520,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26290,6 +27545,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26383,8 +27650,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26429,7 +27696,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27006,6 +28272,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27109,6 +28382,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27150,6 +28430,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27260,6 +28547,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27368,6 +28662,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27428,6 +28729,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27477,6 +28785,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27686,6 +29001,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27719,6 +29041,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27945,27 +29274,35 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies + are provisioned for Eclipse Che.\nThe policies are created + in the namespace where the `CheCluster` custom resource + is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` + only.\nDisabled by default. When set to `false`, the NetworkPolicies + previously created\nby the Operator are removed.\n\nOn OpenShift, + the following NetworkPolicies are created in the `CheCluster` + namespace:\n - `allow-from-same-namespace` \t: + from the Che operands themselves.\n - `allow-from-openshift-ingress` + \ \t: from the OpenShift ingress controller.\n - `allow-from-openshift-host-network` + \t: from the pods that use the host network, for example\n + \ the OpenShift router.\n - `allow-from-openshift-monitoring` + \ \t: from the OpenShift monitoring stack, to scrape metrics.\n + \ - `allow-from-workspaces` \t: from the users' + workspace namespaces.\n - `allow-from-che-operator` \t\t: + from the Operator pods in the Operator namespace.\n - `allow-all-egress` + \ \t: allows all egress traffic from the + Che operands.\n\nOn Kubernetes, only the `allow-all-ingress` + and `allow-all-egress` NetworkPolicies are created,\nallowing + all ingress and egress traffic, since the namespace of the + cluster's ingress controller\nis not known to the Operator. + Enabling this setting on Kubernetes does not restrict any + traffic\nby itself: administrators are expected to provision + their own NetworkPolicies." type: boolean type: object tlsSecretName: diff --git a/config/rbac/cluster_role.yaml b/config/rbac/cluster_role.yaml index 3d2aa5243e..af4fb5d008 100644 --- a/config/rbac/cluster_role.yaml +++ b/config/rbac/cluster_role.yaml @@ -403,6 +403,7 @@ rules: verbs: - create - delete + - deletecollection - get - update - patch diff --git a/controllers/che/checluster_controller.go b/controllers/che/checluster_controller.go index 41e3ca0444..fce834e31b 100644 --- a/controllers/che/checluster_controller.go +++ b/controllers/che/checluster_controller.go @@ -22,7 +22,7 @@ import ( "github.com/eclipse-che/che-operator/pkg/common/reconciler" agentsandbox "github.com/eclipse-che/che-operator/pkg/deploy/agent-sandbox" "github.com/eclipse-che/che-operator/pkg/deploy/metrics" - "github.com/eclipse-che/che-operator/pkg/deploy/networkpolicies" + "github.com/eclipse-che/che-operator/pkg/reconciler/networkpolicy" monitoringv1 "github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1" "k8s.io/utils/ptr" "sigs.k8s.io/controller-runtime/pkg/controller" @@ -109,10 +109,7 @@ func NewReconciler( reconcilerManager.AddReconciler(tls.NewTlsSecretReconciler()) reconcilerManager.AddReconciler(devworkspace.NewDevWorkspaceConfigReconciler()) reconcilerManager.AddReconciler(rbac.NewGatewayPermissionsReconciler()) - - if infrastructure.IsOpenShift() { - reconcilerManager.AddReconciler(networkpolicies.NewNetworkPoliciesReconciler()) - } + reconcilerManager.AddReconciler(&networkpolicy.NetworkPoliciesReconciler{}) // we have to expose che endpoint independently of syncing other server // resources since che host is used for dashboard deployment and che config map diff --git a/controllers/usernamespace/usernamespace_controller.go b/controllers/usernamespace/usernamespace_controller.go index dca33fb85d..e7da54bca7 100644 --- a/controllers/usernamespace/usernamespace_controller.go +++ b/controllers/usernamespace/usernamespace_controller.go @@ -24,9 +24,8 @@ import ( "github.com/eclipse-che/che-operator/pkg/common/diffs" "github.com/eclipse-che/che-operator/pkg/common/infrastructure" k8sclient "github.com/eclipse-che/che-operator/pkg/common/k8s-client" - defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" containercapabilties "github.com/eclipse-che/che-operator/pkg/deploy/container-capabilities" - "github.com/eclipse-che/che-operator/pkg/deploy/networkpolicies" + "github.com/eclipse-che/che-operator/pkg/provision" rbacv1 "k8s.io/api/rbac/v1" "k8s.io/utils/ptr" @@ -45,7 +44,6 @@ import ( projectv1 "github.com/openshift/api/project/v1" "github.com/sirupsen/logrus" corev1 "k8s.io/api/core/v1" - networkingv1 "k8s.io/api/networking/v1" "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" @@ -115,8 +113,7 @@ func (r *CheUserNamespaceReconciler) SetupWithManager(mgr ctrl.Manager) error { Watches(&corev1.Pod{}, r.watchRuleForDevWorkspacePod()). Watches(&corev1.Secret{}, r.watchRulesForSecrets(ctx)). Watches(&corev1.ConfigMap{}, r.watchRulesForConfigMaps(ctx)). - Watches(&chev2.CheCluster{}, r.triggerAllNamespaces()). - Watches(&networkingv1.NetworkPolicy{}, r.watchRulesForNetworkPolicies(ctx)) + Watches(&chev2.CheCluster{}, r.triggerAllNamespaces()) // Use controller.TypedOptions to allow to configure 2 controllers for same object being reconciled return bld.WithOptions( @@ -151,32 +148,6 @@ func (r *CheUserNamespaceReconciler) commonRules(ctx context.Context, namesInChe } } -func (r *CheUserNamespaceReconciler) watchRulesForNetworkPolicies(_ context.Context) handler.EventHandler { - return handler.EnqueueRequestsFromMapFunc( - func(ctx context.Context, obj client.Object) []reconcile.Request { - workspaceInfo, err := r.namespaceCache.GetNamespaceInfo(ctx, obj.GetNamespace()) - if err != nil { - logger.Error(err, "failed to get namespace info", "Namespace", obj.GetNamespace()) - return []reconcile.Request{} - } - - if workspaceInfo != nil && - workspaceInfo.IsWorkspaceNamespace && - deploy.IsOperatorManagedComponent(obj.GetLabels(), defaults.GetCheFlavor()) { - - return []reconcile.Request{ - { - NamespacedName: types.NamespacedName{ - Name: obj.GetNamespace(), - }, - }, - } - } - - return []reconcile.Request{} - }) -} - func (r *CheUserNamespaceReconciler) watchRulesForConfigMaps(ctx context.Context) handler.EventHandler { rules := r.commonRules(ctx, tls.CheMergedCABundleCertsCMName) return handler.EnqueueRequestsFromMapFunc( @@ -331,8 +302,10 @@ func (r *CheUserNamespaceReconciler) Reconcile(ctx context.Context, req ctrl.Req } if infrastructure.IsOpenShift() { - if err = r.reconcileNetworkPolicies(cheCtx, req.Name); err != nil { - return ctrl.Result{}, fmt.Errorf("failed to reconcile network policies in namespace %s: %w", req.Name, err) + // Removes legacy network policies previously provisioned by Che Operator, + // as DevWorkspace Operator now manages network policy provisioning for DevWorkspaces. + if err := provision.NetworkPolicy.DeleteAll(cheCtx, req.Name); err != nil { + return ctrl.Result{}, fmt.Errorf("failed to delete legacy NetworkPolicy in namespace %s: %w", req.Name, err) } } @@ -702,24 +675,6 @@ func (r *CheUserNamespaceReconciler) reconcileSCCPrivileges( ) } -func (r *CheUserNamespaceReconciler) reconcileNetworkPolicies(cheCtx *chetypes.CheContext, targetNs string) error { - if !cheCtx.CheCluster.IsNetworkPoliciesEnabled() { - err := networkpolicies.DeleteNetworkPolicy(cheCtx, targetNs) - if err != nil { - err = fmt.Errorf("failed to delete NetworkPolicy in namespace %s: %w", targetNs, err) - } - - return err - } - - err := networkpolicies.SyncNetworkPolicy(cheCtx, targetNs) - if err != nil { - return fmt.Errorf("failed to sync NetworkPolicy in namespace %s: %w", targetNs, err) - } - - return nil -} - func prefixedName(name string) string { return "che-" + name } diff --git a/controllers/usernamespace/usernamespace_controller_network_policies_test.go b/controllers/usernamespace/usernamespace_controller_network_policies_test.go deleted file mode 100644 index 4a4f3b8e5d..0000000000 --- a/controllers/usernamespace/usernamespace_controller_network_policies_test.go +++ /dev/null @@ -1,199 +0,0 @@ -// -// Copyright (c) 2019-2026 Red Hat, Inc. -// This program and the accompanying materials are made -// available under the terms of the Eclipse Public License 2.0 -// which is available at https://www.eclipse.org/legal/epl-2.0/ -// -// SPDX-License-Identifier: EPL-2.0 -// -// Contributors: -// Red Hat, Inc. - initial API and implementation -// - -package usernamespace - -import ( - "context" - "testing" - - chev2 "github.com/eclipse-che/che-operator/api/v2" - "github.com/eclipse-che/che-operator/pkg/common/constants" - "github.com/eclipse-che/che-operator/pkg/common/infrastructure" - projectv1 "github.com/openshift/api/project/v1" - "github.com/stretchr/testify/assert" - corev1 "k8s.io/api/core/v1" - networkingv1 "k8s.io/api/networking/v1" - "k8s.io/apimachinery/pkg/api/errors" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/types" - "k8s.io/utils/ptr" - "sigs.k8s.io/controller-runtime/pkg/client" - "sigs.k8s.io/controller-runtime/pkg/reconcile" -) - -var allUserNsNetworkPolicyNames = []string{ - "allow-from-eclipse-che", - "allow-from-same-namespace", - "allow-from-devworkspace-operator", - "allow-from-openshift-monitoring", - "allow-from-openshift-ingress", - "allow-all-egress", -} - -func TestNetworkPoliciesCreatedWhenEnabledOnOpenShift(t *testing.T) { - cheCluster, userNamespace, userProject := buildNetworkPolicyTestObjects() - _, cl, r := setup(infrastructure.OpenShiftV4, cheCluster, userNamespace, userProject) - - _, err := r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - npList := &networkingv1.NetworkPolicyList{} - err = cl.List(context.TODO(), npList, &client.ListOptions{Namespace: "user-project"}) - assert.NoError(t, err) - assert.Equal(t, len(allUserNsNetworkPolicyNames), len(npList.Items)) - - for _, name := range allUserNsNetworkPolicyNames { - np := &networkingv1.NetworkPolicy{} - err := cl.Get( - context.TODO(), - types.NamespacedName{Name: name, Namespace: "user-project"}, - np, - ) - assert.NoError(t, err) - } -} - -func TestNetworkPoliciesDeletedWhenDisabled(t *testing.T) { - cheCluster, userNamespace, userProject := buildNetworkPolicyTestObjects() - _, cl, r := setup(infrastructure.OpenShiftV4, cheCluster, userNamespace, userProject) - - _, err := r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - cheCluster.Spec.Networking.NetworkPolicy.Enabled = ptr.To(false) - err = cl.Update(context.TODO(), cheCluster) - assert.NoError(t, err) - - _, err = r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - for _, name := range allUserNsNetworkPolicyNames { - np := &networkingv1.NetworkPolicy{} - err := cl.Get( - context.TODO(), - types.NamespacedName{Name: name, Namespace: "user-project"}, - np, - ) - assert.Error(t, err) - assert.True(t, errors.IsNotFound(err)) - } -} - -func TestNetworkPoliciesIdempotent(t *testing.T) { - cheCluster, userNamespace, userProject := buildNetworkPolicyTestObjects() - _, cl, r := setup(infrastructure.OpenShiftV4, cheCluster, userNamespace, userProject) - - _, err := r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - _, err = r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - for _, name := range allUserNsNetworkPolicyNames { - np := &networkingv1.NetworkPolicy{} - err := cl.Get( - context.TODO(), - types.NamespacedName{Name: name, Namespace: "user-project"}, - np, - ) - assert.NoError(t, err) - } -} - -func TestNetworkPoliciesDeletedOnlyOwnedPolicies(t *testing.T) { - cheCluster, userNamespace, userProject := buildNetworkPolicyTestObjects() - - unownedNetworkPolicy := &networkingv1.NetworkPolicy{ - ObjectMeta: metav1.ObjectMeta{ - Name: "unowned-policy", - Namespace: "user-project", - }, - } - - _, cl, r := setup( - infrastructure.OpenShiftV4, - cheCluster, - userNamespace, - userProject, - unownedNetworkPolicy, - ) - - _, err := r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - cheCluster.Spec.Networking.NetworkPolicy.Enabled = ptr.To(false) - err = cl.Update(context.TODO(), cheCluster) - assert.NoError(t, err) - - _, err = r.Reconcile(context.TODO(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "user-project"}}) - assert.NoError(t, err) - - for _, name := range allUserNsNetworkPolicyNames { - np := &networkingv1.NetworkPolicy{} - err := cl.Get( - context.TODO(), - types.NamespacedName{Name: name, Namespace: "user-project"}, - np, - ) - assert.Error(t, err) - assert.True(t, errors.IsNotFound(err)) - } - - np := &networkingv1.NetworkPolicy{} - err = cl.Get( - context.TODO(), - types.NamespacedName{Name: "unowned-policy", Namespace: "user-project"}, - np, - ) - assert.NoError(t, err) -} - -func buildNetworkPolicyTestObjects() (*chev2.CheCluster, client.Object, client.Object) { - cheCluster := &chev2.CheCluster{ - ObjectMeta: metav1.ObjectMeta{ - Name: "eclipse-che", - Namespace: "eclipse-che", - }, - Spec: chev2.CheClusterSpec{ - Networking: chev2.CheClusterSpecNetworking{ - NetworkPolicy: &chev2.NetworkPolicy{ - Enabled: ptr.To(true), - }, - }, - }, - } - - userNamespace := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{ - Name: "user-project", - Labels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - constants.KubernetesComponentLabelKey: "workspaces-namespace", - constants.WorkspaceNamespaceOwnerUidLabelKey: "some-uid", - }, - }, - } - - userProject := &projectv1.Project{ - ObjectMeta: metav1.ObjectMeta{ - Name: "user-project", - Labels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - constants.KubernetesComponentLabelKey: "workspaces-namespace", - constants.WorkspaceNamespaceOwnerUidLabelKey: "some-uid", - }, - }, - } - - return cheCluster, userNamespace, userProject -} diff --git a/deploy/deployment/kubernetes/combined.yaml b/deploy/deployment/kubernetes/combined.yaml index cfcf69ae51..c79e2e15e2 100644 --- a/deploy/deployment/kubernetes/combined.yaml +++ b/deploy/deployment/kubernetes/combined.yaml @@ -140,7 +140,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -299,7 +301,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -462,7 +466,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -621,7 +627,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1054,7 +1062,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1249,7 +1259,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1677,7 +1689,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1897,7 +1911,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2124,7 +2140,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2404,7 +2422,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4450,7 +4470,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4855,10 +4877,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5199,6 +5232,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5232,6 +5272,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5319,6 +5366,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5389,6 +5443,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5407,6 +5468,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5500,8 +5573,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5546,7 +5619,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6120,6 +6192,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6221,6 +6300,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6262,6 +6348,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6365,6 +6458,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6472,6 +6572,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6532,6 +6639,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6581,6 +6695,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6788,6 +6909,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6821,6 +6949,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7027,7 +7162,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7432,10 +7569,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7776,6 +7924,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7809,6 +7964,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7896,6 +8058,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7966,6 +8135,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -7984,6 +8160,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8077,8 +8265,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8123,7 +8311,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8697,6 +8884,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8798,6 +8992,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8839,6 +9040,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8942,6 +9150,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9049,6 +9264,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9109,6 +9331,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9158,6 +9387,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9365,6 +9601,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9398,6 +9641,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9570,7 +9820,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -9975,10 +10227,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10319,6 +10582,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10352,6 +10622,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10439,6 +10716,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10509,6 +10793,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10527,6 +10818,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10620,8 +10923,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10666,7 +10969,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11240,6 +11542,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11341,6 +11650,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11382,6 +11698,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11485,6 +11808,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11592,6 +11922,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11652,6 +11989,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11701,6 +12045,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11908,6 +12259,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11941,6 +12299,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12180,7 +12545,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12589,10 +12956,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12936,6 +13314,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -12969,6 +13354,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13057,6 +13449,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13131,6 +13530,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13149,6 +13555,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13242,8 +13660,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13288,7 +13706,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13865,6 +14282,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -13968,6 +14392,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14009,6 +14440,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14119,6 +14557,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14227,6 +14672,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14287,6 +14739,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14336,6 +14795,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14545,6 +15011,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14578,6 +15051,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14787,7 +15267,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15196,10 +15678,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15543,6 +16036,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15576,6 +16076,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15664,6 +16171,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15738,6 +16252,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15756,6 +16277,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15849,8 +16382,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15895,7 +16428,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16472,6 +17004,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16575,6 +17114,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16616,6 +17162,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16726,6 +17279,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16834,6 +17394,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16894,6 +17461,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16943,6 +17517,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17152,6 +17733,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17185,6 +17773,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17352,7 +17947,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17757,10 +18354,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18101,6 +18709,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18134,6 +18749,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18221,6 +18843,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18291,6 +18920,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18309,6 +18945,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18402,8 +19050,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18448,7 +19096,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19022,6 +19669,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19123,8 +19777,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19164,6 +19825,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19267,6 +19935,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19374,6 +20049,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19434,6 +20116,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19483,6 +20172,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19690,6 +20386,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19723,6 +20426,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21878,7 +22588,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22276,10 +22988,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22424,7 +23147,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22695,6 +23420,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22808,6 +23538,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22890,6 +23625,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -22948,6 +23690,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23105,6 +23852,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23163,6 +23917,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23618,6 +24377,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23676,6 +24442,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23816,10 +24587,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -23937,6 +24719,428 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -24007,7 +25211,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24405,10 +25611,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24777,11 +25994,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25342,7 +26556,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25751,10 +26967,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26098,6 +27325,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26131,6 +27365,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26219,6 +27460,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26293,6 +27541,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26311,6 +27566,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26404,8 +27671,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26450,7 +27717,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27027,6 +28293,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27130,6 +28403,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27171,6 +28451,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27281,6 +28568,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27389,6 +28683,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27449,6 +28750,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27498,6 +28806,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27707,6 +29022,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27740,6 +29062,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27966,27 +29295,35 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies + are provisioned for Eclipse Che.\nThe policies are created + in the namespace where the `CheCluster` custom resource + is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` + only.\nDisabled by default. When set to `false`, the NetworkPolicies + previously created\nby the Operator are removed.\n\nOn OpenShift, + the following NetworkPolicies are created in the `CheCluster` + namespace:\n - `allow-from-same-namespace` \t: + from the Che operands themselves.\n - `allow-from-openshift-ingress` + \ \t: from the OpenShift ingress controller.\n - `allow-from-openshift-host-network` + \t: from the pods that use the host network, for example\n + \ the OpenShift router.\n - `allow-from-openshift-monitoring` + \ \t: from the OpenShift monitoring stack, to scrape metrics.\n + \ - `allow-from-workspaces` \t: from the users' + workspace namespaces.\n - `allow-from-che-operator` \t\t: + from the Operator pods in the Operator namespace.\n - `allow-all-egress` + \ \t: allows all egress traffic from the + Che operands.\n\nOn Kubernetes, only the `allow-all-ingress` + and `allow-all-egress` NetworkPolicies are created,\nallowing + all ingress and egress traffic, since the namespace of the + cluster's ingress controller\nis not known to the Operator. + Enabling this setting on Kubernetes does not restrict any + traffic\nby itself: administrators are expected to provision + their own NetworkPolicies." type: boolean type: object tlsSecretName: @@ -28491,6 +29828,7 @@ rules: verbs: - create - delete + - deletecollection - get - update - patch diff --git a/deploy/deployment/kubernetes/objects/che-operator.ClusterRole.yaml b/deploy/deployment/kubernetes/objects/che-operator.ClusterRole.yaml index 63f57f28ba..55813e93c4 100644 --- a/deploy/deployment/kubernetes/objects/che-operator.ClusterRole.yaml +++ b/deploy/deployment/kubernetes/objects/che-operator.ClusterRole.yaml @@ -403,6 +403,7 @@ rules: verbs: - create - delete + - deletecollection - get - update - patch diff --git a/deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml b/deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml index 4850b7cdb3..a754e46a13 100644 --- a/deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml +++ b/deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml @@ -135,7 +135,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -294,7 +296,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -457,7 +461,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -616,7 +622,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1049,7 +1057,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1244,7 +1254,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1672,7 +1684,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1892,7 +1906,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2119,7 +2135,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2399,7 +2417,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4445,7 +4465,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4850,10 +4872,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5194,6 +5227,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5227,6 +5267,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5314,6 +5361,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5384,6 +5438,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5402,6 +5463,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5495,8 +5568,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5541,7 +5614,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6115,6 +6187,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6216,6 +6295,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6257,6 +6343,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6360,6 +6453,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6467,6 +6567,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6527,6 +6634,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6576,6 +6690,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6783,6 +6904,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6816,6 +6944,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7022,7 +7157,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7427,10 +7564,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7771,6 +7919,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7804,6 +7959,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7891,6 +8053,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7961,6 +8130,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -7979,6 +8155,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8072,8 +8260,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8118,7 +8306,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8692,6 +8879,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8793,6 +8987,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8834,6 +9035,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8937,6 +9145,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9044,6 +9259,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9104,6 +9326,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9153,6 +9382,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9360,6 +9596,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9393,6 +9636,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9565,7 +9815,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -9970,10 +10222,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10314,6 +10577,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10347,6 +10617,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10434,6 +10711,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10504,6 +10788,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10522,6 +10813,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10615,8 +10918,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10661,7 +10964,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11235,6 +11537,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11336,6 +11645,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11377,6 +11693,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11480,6 +11803,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11587,6 +11917,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11647,6 +11984,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11696,6 +12040,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11903,6 +12254,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11936,6 +12294,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12175,7 +12540,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12584,10 +12951,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12931,6 +13309,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -12964,6 +13349,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13052,6 +13444,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13126,6 +13525,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13144,6 +13550,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13237,8 +13655,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13283,7 +13701,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13860,6 +14277,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -13963,6 +14387,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14004,6 +14435,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14114,6 +14552,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14222,6 +14667,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14282,6 +14734,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14331,6 +14790,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14540,6 +15006,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14573,6 +15046,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14782,7 +15262,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15191,10 +15673,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15538,6 +16031,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15571,6 +16071,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15659,6 +16166,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15733,6 +16247,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15751,6 +16272,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15844,8 +16377,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15890,7 +16423,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16467,6 +16999,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16570,6 +17109,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16611,6 +17157,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16721,6 +17274,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16829,6 +17389,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16889,6 +17456,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16938,6 +17512,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17147,6 +17728,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17180,6 +17768,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17347,7 +17942,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17752,10 +18349,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18096,6 +18704,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18129,6 +18744,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18216,6 +18838,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18286,6 +18915,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18304,6 +18940,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18397,8 +19045,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18443,7 +19091,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19017,6 +19664,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19118,8 +19772,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19159,6 +19820,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19262,6 +19930,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19369,6 +20044,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19429,6 +20111,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19478,6 +20167,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19685,6 +20381,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19718,6 +20421,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21873,7 +22583,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22271,10 +22983,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22419,7 +23142,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22690,6 +23415,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22803,6 +23533,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22885,6 +23620,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -22943,6 +23685,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23100,6 +23847,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23158,6 +23912,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23613,6 +24372,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23671,6 +24437,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23811,10 +24582,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -23932,6 +24714,428 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -24002,7 +25206,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24400,10 +25606,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24772,11 +25989,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25337,7 +26551,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25746,10 +26962,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26093,6 +27320,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26126,6 +27360,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26214,6 +27455,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26288,6 +27536,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26306,6 +27561,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26399,8 +27666,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26445,7 +27712,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27022,6 +28288,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27125,6 +28398,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27166,6 +28446,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27276,6 +28563,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27384,6 +28678,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27444,6 +28745,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27493,6 +28801,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27702,6 +29017,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27735,6 +29057,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27961,27 +29290,35 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies + are provisioned for Eclipse Che.\nThe policies are created + in the namespace where the `CheCluster` custom resource + is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` + only.\nDisabled by default. When set to `false`, the NetworkPolicies + previously created\nby the Operator are removed.\n\nOn OpenShift, + the following NetworkPolicies are created in the `CheCluster` + namespace:\n - `allow-from-same-namespace` \t: + from the Che operands themselves.\n - `allow-from-openshift-ingress` + \ \t: from the OpenShift ingress controller.\n - `allow-from-openshift-host-network` + \t: from the pods that use the host network, for example\n + \ the OpenShift router.\n - `allow-from-openshift-monitoring` + \ \t: from the OpenShift monitoring stack, to scrape metrics.\n + \ - `allow-from-workspaces` \t: from the users' + workspace namespaces.\n - `allow-from-che-operator` \t\t: + from the Operator pods in the Operator namespace.\n - `allow-all-egress` + \ \t: allows all egress traffic from the + Che operands.\n\nOn Kubernetes, only the `allow-all-ingress` + and `allow-all-egress` NetworkPolicies are created,\nallowing + all ingress and egress traffic, since the namespace of the + cluster's ingress controller\nis not known to the Operator. + Enabling this setting on Kubernetes does not restrict any + traffic\nby itself: administrators are expected to provision + their own NetworkPolicies." type: boolean type: object tlsSecretName: diff --git a/deploy/deployment/openshift/combined.yaml b/deploy/deployment/openshift/combined.yaml index d0c02f18ad..6d88631eb8 100644 --- a/deploy/deployment/openshift/combined.yaml +++ b/deploy/deployment/openshift/combined.yaml @@ -140,7 +140,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -299,7 +301,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -462,7 +466,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -621,7 +627,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1054,7 +1062,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1249,7 +1259,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1677,7 +1689,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1897,7 +1911,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2124,7 +2140,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2404,7 +2422,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4450,7 +4470,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4855,10 +4877,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5199,6 +5232,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5232,6 +5272,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5319,6 +5366,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5389,6 +5443,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5407,6 +5468,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5500,8 +5573,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5546,7 +5619,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6120,6 +6192,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6221,6 +6300,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6262,6 +6348,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6365,6 +6458,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6472,6 +6572,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6532,6 +6639,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6581,6 +6695,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6788,6 +6909,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6821,6 +6949,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7027,7 +7162,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7432,10 +7569,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7776,6 +7924,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7809,6 +7964,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7896,6 +8058,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7966,6 +8135,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -7984,6 +8160,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8077,8 +8265,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8123,7 +8311,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8697,6 +8884,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8798,6 +8992,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8839,6 +9040,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8942,6 +9150,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9049,6 +9264,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9109,6 +9331,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9158,6 +9387,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9365,6 +9601,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9398,6 +9641,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9570,7 +9820,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -9975,10 +10227,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10319,6 +10582,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10352,6 +10622,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10439,6 +10716,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10509,6 +10793,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10527,6 +10818,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10620,8 +10923,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10666,7 +10969,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11240,6 +11542,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11341,6 +11650,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11382,6 +11698,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11485,6 +11808,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11592,6 +11922,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11652,6 +11989,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11701,6 +12045,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11908,6 +12259,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11941,6 +12299,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12180,7 +12545,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12589,10 +12956,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12936,6 +13314,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -12969,6 +13354,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13057,6 +13449,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13131,6 +13530,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13149,6 +13555,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13242,8 +13660,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13288,7 +13706,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13865,6 +14282,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -13968,6 +14392,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14009,6 +14440,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14119,6 +14557,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14227,6 +14672,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14287,6 +14739,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14336,6 +14795,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14545,6 +15011,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14578,6 +15051,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14787,7 +15267,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15196,10 +15678,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15543,6 +16036,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15576,6 +16076,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15664,6 +16171,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15738,6 +16252,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15756,6 +16277,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15849,8 +16382,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15895,7 +16428,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16472,6 +17004,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16575,6 +17114,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16616,6 +17162,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16726,6 +17279,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16834,6 +17394,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16894,6 +17461,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16943,6 +17517,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17152,6 +17733,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17185,6 +17773,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17352,7 +17947,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17757,10 +18354,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18101,6 +18709,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18134,6 +18749,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18221,6 +18843,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18291,6 +18920,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18309,6 +18945,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18402,8 +19050,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18448,7 +19096,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19022,6 +19669,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19123,8 +19777,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19164,6 +19825,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19267,6 +19935,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19374,6 +20049,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19434,6 +20116,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19483,6 +20172,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19690,6 +20386,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19723,6 +20426,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21878,7 +22588,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22276,10 +22988,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22424,7 +23147,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22695,6 +23420,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22808,6 +23538,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22890,6 +23625,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -22948,6 +23690,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23105,6 +23852,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23163,6 +23917,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23618,6 +24377,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23676,6 +24442,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23816,10 +24587,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -23937,6 +24719,428 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -24007,7 +25211,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24405,10 +25611,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24777,11 +25994,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25342,7 +26556,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25751,10 +26967,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26098,6 +27325,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26131,6 +27365,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26219,6 +27460,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26293,6 +27541,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26311,6 +27566,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26404,8 +27671,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26450,7 +27717,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27027,6 +28293,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27130,6 +28403,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27171,6 +28451,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27281,6 +28568,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27389,6 +28683,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27449,6 +28750,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27498,6 +28806,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27707,6 +29022,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27740,6 +29062,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27966,27 +29295,35 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies + are provisioned for Eclipse Che.\nThe policies are created + in the namespace where the `CheCluster` custom resource + is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` + only.\nDisabled by default. When set to `false`, the NetworkPolicies + previously created\nby the Operator are removed.\n\nOn OpenShift, + the following NetworkPolicies are created in the `CheCluster` + namespace:\n - `allow-from-same-namespace` \t: + from the Che operands themselves.\n - `allow-from-openshift-ingress` + \ \t: from the OpenShift ingress controller.\n - `allow-from-openshift-host-network` + \t: from the pods that use the host network, for example\n + \ the OpenShift router.\n - `allow-from-openshift-monitoring` + \ \t: from the OpenShift monitoring stack, to scrape metrics.\n + \ - `allow-from-workspaces` \t: from the users' + workspace namespaces.\n - `allow-from-che-operator` \t\t: + from the Operator pods in the Operator namespace.\n - `allow-all-egress` + \ \t: allows all egress traffic from the + Che operands.\n\nOn Kubernetes, only the `allow-all-ingress` + and `allow-all-egress` NetworkPolicies are created,\nallowing + all ingress and egress traffic, since the namespace of the + cluster's ingress controller\nis not known to the Operator. + Enabling this setting on Kubernetes does not restrict any + traffic\nby itself: administrators are expected to provision + their own NetworkPolicies." type: boolean type: object tlsSecretName: @@ -28491,6 +29828,7 @@ rules: verbs: - create - delete + - deletecollection - get - update - patch diff --git a/deploy/deployment/openshift/objects/che-operator.ClusterRole.yaml b/deploy/deployment/openshift/objects/che-operator.ClusterRole.yaml index 63f57f28ba..55813e93c4 100644 --- a/deploy/deployment/openshift/objects/che-operator.ClusterRole.yaml +++ b/deploy/deployment/openshift/objects/che-operator.ClusterRole.yaml @@ -403,6 +403,7 @@ rules: verbs: - create - delete + - deletecollection - get - update - patch diff --git a/deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml b/deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml index 4f796cd013..3a9feb848d 100644 --- a/deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml +++ b/deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml @@ -135,7 +135,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -294,7 +296,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -457,7 +461,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -616,7 +622,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1049,7 +1057,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1244,7 +1254,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1672,7 +1684,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1892,7 +1906,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2119,7 +2135,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2399,7 +2417,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4445,7 +4465,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4850,10 +4872,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5194,6 +5227,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5227,6 +5267,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5314,6 +5361,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5384,6 +5438,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5402,6 +5463,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5495,8 +5568,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5541,7 +5614,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6115,6 +6187,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6216,6 +6295,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6257,6 +6343,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6360,6 +6453,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6467,6 +6567,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6527,6 +6634,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6576,6 +6690,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6783,6 +6904,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6816,6 +6944,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7022,7 +7157,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7427,10 +7564,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7771,6 +7919,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7804,6 +7959,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7891,6 +8053,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7961,6 +8130,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -7979,6 +8155,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8072,8 +8260,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8118,7 +8306,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8692,6 +8879,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8793,6 +8987,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8834,6 +9035,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8937,6 +9145,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9044,6 +9259,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9104,6 +9326,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9153,6 +9382,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9360,6 +9596,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9393,6 +9636,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9565,7 +9815,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -9970,10 +10222,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10314,6 +10577,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10347,6 +10617,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10434,6 +10711,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10504,6 +10788,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10522,6 +10813,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10615,8 +10918,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10661,7 +10964,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11235,6 +11537,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11336,6 +11645,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11377,6 +11693,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11480,6 +11803,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11587,6 +11917,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11647,6 +11984,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11696,6 +12040,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11903,6 +12254,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11936,6 +12294,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12175,7 +12540,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12584,10 +12951,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12931,6 +13309,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -12964,6 +13349,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13052,6 +13444,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13126,6 +13525,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13144,6 +13550,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13237,8 +13655,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13283,7 +13701,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13860,6 +14277,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -13963,6 +14387,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14004,6 +14435,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14114,6 +14552,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14222,6 +14667,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14282,6 +14734,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14331,6 +14790,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14540,6 +15006,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14573,6 +15046,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14782,7 +15262,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15191,10 +15673,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15538,6 +16031,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15571,6 +16071,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15659,6 +16166,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15733,6 +16247,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15751,6 +16272,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15844,8 +16377,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15890,7 +16423,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16467,6 +16999,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16570,6 +17109,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16611,6 +17157,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16721,6 +17274,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16829,6 +17389,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16889,6 +17456,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16938,6 +17512,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17147,6 +17728,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17180,6 +17768,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17347,7 +17942,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17752,10 +18349,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18096,6 +18704,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18129,6 +18744,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18216,6 +18838,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18286,6 +18915,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18304,6 +18940,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18397,8 +19045,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18443,7 +19091,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19017,6 +19664,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19118,8 +19772,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19159,6 +19820,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19262,6 +19930,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19369,6 +20044,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19429,6 +20111,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19478,6 +20167,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19685,6 +20381,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19718,6 +20421,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21873,7 +22583,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22271,10 +22983,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22419,7 +23142,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22690,6 +23415,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22803,6 +23533,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22885,6 +23620,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -22943,6 +23685,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23100,6 +23847,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23158,6 +23912,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23613,6 +24372,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23671,6 +24437,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23811,10 +24582,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -23932,6 +24714,428 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -24002,7 +25206,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24400,10 +25606,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24772,11 +25989,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25337,7 +26551,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25746,10 +26962,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26093,6 +27320,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26126,6 +27360,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26214,6 +27455,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26288,6 +27536,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26306,6 +27561,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26399,8 +27666,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26445,7 +27712,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27022,6 +28288,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27125,6 +28398,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27166,6 +28446,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27276,6 +28563,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27384,6 +28678,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27444,6 +28745,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27493,6 +28801,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27702,6 +29017,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27735,6 +29057,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27961,27 +29290,35 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies + are provisioned for Eclipse Che.\nThe policies are created + in the namespace where the `CheCluster` custom resource + is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` + only.\nDisabled by default. When set to `false`, the NetworkPolicies + previously created\nby the Operator are removed.\n\nOn OpenShift, + the following NetworkPolicies are created in the `CheCluster` + namespace:\n - `allow-from-same-namespace` \t: + from the Che operands themselves.\n - `allow-from-openshift-ingress` + \ \t: from the OpenShift ingress controller.\n - `allow-from-openshift-host-network` + \t: from the pods that use the host network, for example\n + \ the OpenShift router.\n - `allow-from-openshift-monitoring` + \ \t: from the OpenShift monitoring stack, to scrape metrics.\n + \ - `allow-from-workspaces` \t: from the users' + workspace namespaces.\n - `allow-from-che-operator` \t\t: + from the Operator pods in the Operator namespace.\n - `allow-all-egress` + \ \t: allows all egress traffic from the + Che operands.\n\nOn Kubernetes, only the `allow-all-ingress` + and `allow-all-egress` NetworkPolicies are created,\nallowing + all ingress and egress traffic, since the namespace of the + cluster's ingress controller\nis not known to the Operator. + Enabling this setting on Kubernetes does not restrict any + traffic\nby itself: administrators are expected to provision + their own NetworkPolicies." type: boolean type: object tlsSecretName: diff --git a/go.mod b/go.mod index a2ed419855..894edbde35 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.26.4 require ( github.com/che-incubator/kubernetes-image-puller-operator v0.0.0-20260717080248-21df2985d548 github.com/devfile/api/v2 v2.3.1-alpha.0.20261007143616-3c7e2fd6d137 - github.com/devfile/devworkspace-operator v0.2.1-0.20261008221424-9e9bab4780a9 + github.com/devfile/devworkspace-operator v0.2.1-0.20261013204914-cd25c621588c github.com/go-logr/logr v1.4.4 github.com/google/go-cmp v0.7.0 github.com/onsi/ginkgo/v2 v2.33.0 diff --git a/go.sum b/go.sum index 13d484ffe4..d9e2fc06c4 100644 --- a/go.sum +++ b/go.sum @@ -62,8 +62,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/devfile/api/v2 v2.3.1-alpha.0.20261007143616-3c7e2fd6d137 h1:bECxO1gOSmWNjqoTv+xUWSwzXGZhnCQOSJrlIVOWtR4= github.com/devfile/api/v2 v2.3.1-alpha.0.20261007143616-3c7e2fd6d137/go.mod h1:t+btHuWTpDnTPPf+MM4kB34Ebp5PVmEnn/nrhQXC4IQ= -github.com/devfile/devworkspace-operator v0.2.1-0.20261008221424-9e9bab4780a9 h1:E/c/MIbcMOB7ctfsUK7Ny/iBI95IjocZ8Ygol0qGNWI= -github.com/devfile/devworkspace-operator v0.2.1-0.20261008221424-9e9bab4780a9/go.mod h1:+EIM8ujp9GO+S2w/eU3nAZv1hAkEZBrFmRQtg5PMVQA= +github.com/devfile/devworkspace-operator v0.2.1-0.20261013204914-cd25c621588c h1:OUpOXrtAu+KG/hLKKdj10YCnywMQlAlcQhZvcQj8Ixw= +github.com/devfile/devworkspace-operator v0.2.1-0.20261013204914-cd25c621588c/go.mod h1:+EIM8ujp9GO+S2w/eU3nAZv1hAkEZBrFmRQtg5PMVQA= github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78= github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc= github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM= diff --git a/helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml b/helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml index 4850b7cdb3..a754e46a13 100644 --- a/helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml +++ b/helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml @@ -135,7 +135,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -294,7 +296,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -457,7 +461,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -616,7 +622,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1049,7 +1057,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1244,7 +1254,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1672,7 +1684,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -1892,7 +1906,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2119,7 +2135,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -2399,7 +2417,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4445,7 +4465,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -4850,10 +4872,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -5194,6 +5227,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -5227,6 +5267,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -5314,6 +5361,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -5384,6 +5438,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -5402,6 +5463,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -5495,8 +5568,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -5541,7 +5614,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -6115,6 +6187,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -6216,6 +6295,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6257,6 +6343,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6360,6 +6453,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6467,6 +6567,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -6527,6 +6634,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -6576,6 +6690,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -6783,6 +6904,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -6816,6 +6944,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7022,7 +7157,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -7427,10 +7564,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -7771,6 +7919,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -7804,6 +7959,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -7891,6 +8053,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -7961,6 +8130,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -7979,6 +8155,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -8072,8 +8260,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -8118,7 +8306,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -8692,6 +8879,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -8793,6 +8987,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -8834,6 +9035,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -8937,6 +9145,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9044,6 +9259,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -9104,6 +9326,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9153,6 +9382,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -9360,6 +9596,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -9393,6 +9636,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -9565,7 +9815,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -9970,10 +10222,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -10314,6 +10577,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -10347,6 +10617,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -10434,6 +10711,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -10504,6 +10788,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -10522,6 +10813,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -10615,8 +10918,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -10661,7 +10964,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -11235,6 +11537,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -11336,6 +11645,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11377,6 +11693,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11480,6 +11803,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11587,6 +11917,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -11647,6 +11984,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -11696,6 +12040,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -11903,6 +12254,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -11936,6 +12294,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -12175,7 +12540,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -12584,10 +12951,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -12931,6 +13309,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -12964,6 +13349,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -13052,6 +13444,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -13126,6 +13525,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -13144,6 +13550,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -13237,8 +13655,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -13283,7 +13701,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -13860,6 +14277,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -13963,6 +14387,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14004,6 +14435,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14114,6 +14552,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14222,6 +14667,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -14282,6 +14734,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14331,6 +14790,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -14540,6 +15006,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -14573,6 +15046,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -14782,7 +15262,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -15191,10 +15673,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -15538,6 +16031,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -15571,6 +16071,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -15659,6 +16166,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -15733,6 +16247,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -15751,6 +16272,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -15844,8 +16377,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -15890,7 +16423,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -16467,6 +16999,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -16570,6 +17109,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16611,6 +17157,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16721,6 +17274,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -16829,6 +17389,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -16889,6 +17456,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -16938,6 +17512,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -17147,6 +17728,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -17180,6 +17768,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -17347,7 +17942,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -17752,10 +18349,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at + which the volume should be mounted. type: string mountPropagation: description: |- @@ -18096,6 +18704,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -18129,6 +18744,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -18216,6 +18838,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -18286,6 +18915,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -18304,6 +18940,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -18397,8 +19045,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -18443,7 +19091,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -19017,6 +19664,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -19118,8 +19772,15 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string - required: - - path + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer + required: + - path type: object configMap: description: configMap information about @@ -19159,6 +19820,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19262,6 +19930,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19369,6 +20044,13 @@ spec: description: Kubelet's generated CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -19429,6 +20111,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -19478,6 +20167,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -19685,6 +20381,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -19718,6 +20421,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -21873,7 +22583,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22271,10 +22983,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -22419,7 +23142,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -22690,6 +23415,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22803,6 +23533,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -22885,6 +23620,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -22943,6 +23685,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23100,6 +23847,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23158,6 +23912,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23613,6 +24372,13 @@ spec: grpc: description: GRPC specifies a GRPC HealthCheckRequest. properties: + mode: + description: |- + mode specifies the connection mode for the gRPC health probe. + Set to "TLS" to use TLS without certificate verification. + Set to "Plaintext" to use a plaintext (insecure) connection explicitly. + If not specified, the probe uses a plaintext (insecure) connection. + type: string port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -23671,6 +24437,11 @@ spec: Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true + protocol: + description: |- + Protocol selects the wire protocol for the probe connection. + Nil defaults to HTTP/1.1. + type: string scheme: description: |- Scheme to use for connecting to the host. @@ -23811,10 +24582,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -23932,6 +24714,428 @@ spec: when external TLS is enabled. type: object type: object + networkPolicy: + description: |- + NetworkPolicy defines configuration options for the NetworkPolicies provisioned + for each DevWorkspace by the DevWorkspace Operator. + + When enabled and no ingress rules are specified, the Operator sets the default + DevWorkspace Operator ingress rules and adds one custom ingress rule allowing traffic + from Che operands (pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` in the + CheCluster namespace). If custom ingress rules are specified, only those rules apply + and the rule allowing traffic from Che operands is not added automatically; if Che + operands need to communicate with the workspaces, a corresponding ingress rule must be + explicitly included. + + When enabled and no egress rules are specified, the Operator sets the default + DevWorkspace Operator egress rules. If custom egress rules are specified, only + those rules apply. + properties: + egress: + description: |- + Egress defines the egress rules applied to DevWorkspace pods. If this field is not + specified, the default egress rule of the DevWorkspace Operator applies, which allows + all egress traffic. If this field is specified as an empty list, all egress traffic + from DevWorkspace pods is denied. If this field is specified as a non-empty list, + exactly those rules apply and the default rule no longer applies. + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + enabled: + description: |- + Enabled determines whether a NetworkPolicy is provisioned for each DevWorkspace. + Disabled by default. Changing this field does not immediately affect existing + DevWorkspaces: changing the DevWorkspaceOperatorConfig does not enqueue the + DevWorkspaces it affects, so the new value is applied to a DevWorkspace the next + time that DevWorkspace is reconciled for any reason. Restarting a workspace is not + required. Both enabling and disabling apply to running and stopped DevWorkspaces + alike. + type: boolean + ingress: + description: |- + Ingress defines the ingress rules applied to DevWorkspace pods. If this field is not + specified, the default ingress rules of the DevWorkspace Operator apply. On OpenShift, + the defaults allow traffic from the operator's own namespace and from the OpenShift + monitoring, ingress, and host-network namespaces, and deny all other ingress traffic. + On Kubernetes, the default allows all ingress traffic, since the namespace of the + cluster's ingress controller is not known to the operator; administrators are expected + to replace this with rules appropriate to their cluster. + If this field is specified as an empty list, all ingress traffic to DevWorkspace pods + is denied. If this field is specified as a non-empty list, exactly those rules apply + and the default rules no longer apply. + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + type: object type: object nodeSelector: additionalProperties: @@ -24002,7 +25206,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -24400,10 +25606,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container at which the + volume should be mounted. type: string mountPropagation: description: |- @@ -24772,11 +25989,8 @@ spec: Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. - "MountOption" value is allowed only when SELinuxMount feature gate is enabled. - If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. - If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes - and "Recursive" for all other volumes. + If not specified, "MountOption" is used. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. @@ -25337,7 +26551,9 @@ spec: description: Selects a key of a ConfigMap. properties: key: - description: The key to select. + description: |- + The key to select from the ConfigMap's Data field. + Keys in the BinaryData field are not currently propagated to container env vars. type: string name: default: "" @@ -25746,10 +26962,21 @@ spec: description: VolumeMount describes a mounting of a Volume within a container. properties: - mountPath: + bindMountOptions: description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. + bindMountOptions is the list of additional bind mount options to apply when + mounting this volume into the container. Allowed values are noexec, + nodev, and nosuid. These are Linux mount options and have no effect on + Windows nodes. + This field is not supported with image volumes. + This is an alpha field and requires enabling the VolumeBindMountOptions feature gate. + items: + type: string + type: array + x-kubernetes-list-type: set + mountPath: + description: Path within the container + at which the volume should be mounted. type: string mountPropagation: description: |- @@ -26093,6 +27320,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced @@ -26126,6 +27360,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -26214,6 +27455,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: Items is a list of downward API volume file @@ -26288,6 +27536,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -26306,6 +27561,18 @@ spec: Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string + mode: + description: |- + mode specifies the permission bits for the emptyDir directory, in numeric + notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. + If not specified, defaults to 0777. + This might be in conflict with other options that affect the file + mode, like fsGroup. If fsGroup is specified, the fsGroup permissions + will override the mode specified here. + This field has no effect on Windows. + This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled. + format: int32 + type: integer sizeLimit: anyOf: - type: integer @@ -26399,8 +27666,8 @@ spec: * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. - When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, - and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: @@ -26445,7 +27712,6 @@ spec: specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. - (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: @@ -27022,6 +28288,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer sources: description: |- sources is the list of volume projections. Each entry in this list @@ -27125,6 +28398,13 @@ spec: Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27166,6 +28446,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27276,6 +28563,13 @@ spec: - resource type: object x-kubernetes-map-type: atomic + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27384,6 +28678,13 @@ spec: CSRs will be addressed to this signer. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer userAnnotations: additionalProperties: type: string @@ -27444,6 +28745,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27493,6 +28801,13 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - path type: object @@ -27702,6 +29017,13 @@ spec: mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer + defaultUser: + description: |- + defaultUser is Optional: The owner UID of the created files by default. + The defaultUser field is only used as a fallback when the item-level user field is unset. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced @@ -27735,6 +29057,13 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + user: + description: |- + user is Optional: The owner UID of the created file. + If specified, the item-level user field takes precedence over defaultUser. + (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled. + format: int64 + type: integer required: - key - path @@ -27961,27 +29290,35 @@ spec: type: object networkPolicy: description: |- - NetworkPolicy configures NetworkPolicy resources for the Che namespace - and user workspace namespaces. For OpenShift clusters only. - When enabled, the following policies are created: - In the Che namespace: - - allow-from-same-namespace: allows ingress traffic between Che pods in the same namespace. - - allow-from-workspaces: allows ingress traffic from user workspace namespaces. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from--operator: allows ingress traffic from the operator pod to Che components. - - allow-all-egress: allows all egress traffic from Che pods. - In each user workspace namespace: - - allow-from-: allows ingress traffic from the Che namespace. - - allow-from-same-namespace: allows ingress traffic between pods in the same namespace. - - allow-from-devworkspace-operator: allows ingress traffic from the DevWorkspace operator. - - allow-from-openshift-monitoring: allows ingress traffic from the OpenShift monitoring namespace. - - allow-from-openshift-ingress: allows ingress traffic from the OpenShift ingress namespace. - - allow-all-egress: allows all egress traffic from workspace pods. + NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, + such as the gateway, the server, the dashboard and the registries. properties: enabled: - description: Enabled controls whether the operator creates - NetworkPolicy resources. + default: false + description: "Enabled determines whether the NetworkPolicies + are provisioned for Eclipse Che.\nThe policies are created + in the namespace where the `CheCluster` custom resource + is created\nand apply to the pods labeled with `app.kubernetes.io/part-of=che.eclipse.org` + only.\nDisabled by default. When set to `false`, the NetworkPolicies + previously created\nby the Operator are removed.\n\nOn OpenShift, + the following NetworkPolicies are created in the `CheCluster` + namespace:\n - `allow-from-same-namespace` \t: + from the Che operands themselves.\n - `allow-from-openshift-ingress` + \ \t: from the OpenShift ingress controller.\n - `allow-from-openshift-host-network` + \t: from the pods that use the host network, for example\n + \ the OpenShift router.\n - `allow-from-openshift-monitoring` + \ \t: from the OpenShift monitoring stack, to scrape metrics.\n + \ - `allow-from-workspaces` \t: from the users' + workspace namespaces.\n - `allow-from-che-operator` \t\t: + from the Operator pods in the Operator namespace.\n - `allow-all-egress` + \ \t: allows all egress traffic from the + Che operands.\n\nOn Kubernetes, only the `allow-all-ingress` + and `allow-all-egress` NetworkPolicies are created,\nallowing + all ingress and egress traffic, since the namespace of the + cluster's ingress controller\nis not known to the Operator. + Enabling this setting on Kubernetes does not restrict any + traffic\nby itself: administrators are expected to provision + their own NetworkPolicies." type: boolean type: object tlsSecretName: diff --git a/helmcharts/next/templates/che-operator.ClusterRole.yaml b/helmcharts/next/templates/che-operator.ClusterRole.yaml index 63f57f28ba..55813e93c4 100644 --- a/helmcharts/next/templates/che-operator.ClusterRole.yaml +++ b/helmcharts/next/templates/che-operator.ClusterRole.yaml @@ -403,6 +403,7 @@ rules: verbs: - create - delete + - deletecollection - get - update - patch diff --git a/pkg/common/chelabels/labels.go b/pkg/common/chelabels/labels.go new file mode 100644 index 0000000000..a0cb6f0ad4 --- /dev/null +++ b/pkg/common/chelabels/labels.go @@ -0,0 +1,26 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package chelabels + +import ( + "github.com/eclipse-che/che-operator/pkg/common/constants" + "github.com/eclipse-che/che-operator/pkg/deploy" +) + +func OperatorManaged(component string) map[string]string { + return map[string]string{ + constants.KubernetesComponentLabelKey: component, + constants.KubernetesManagedByLabelKey: deploy.GetManagedByLabel(), + constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, + } +} diff --git a/pkg/common/constants/constants.go b/pkg/common/constants/constants.go index 9be6df7be7..161e0e1f96 100644 --- a/pkg/common/constants/constants.go +++ b/pkg/common/constants/constants.go @@ -188,7 +188,7 @@ const ( DefaultDisableContainerRunCapabilities = true // Networking - NetworkPolicyEnabled = false + DefaultNetworkPolicyEnabled = false // AgentSandbox AgentSandboxEnabled = false diff --git a/pkg/common/k8s-client/k8s_client.go b/pkg/common/k8s-client/k8s_client.go index e1681a5312..c18e96b25e 100644 --- a/pkg/common/k8s-client/k8s_client.go +++ b/pkg/common/k8s-client/k8s_client.go @@ -127,6 +127,14 @@ func (k K8sClientWrapper) DeleteByKeyIgnoreNotFound( return k.deleteByKeyIgnoreNotFound(ctx, key, objectMeta, opts...) } +func (k K8sClientWrapper) DeleteAllOf( + ctx context.Context, + obj client.Object, + opts ...client.DeleteAllOfOption, +) error { + return k.cli.DeleteAllOf(ctx, obj, opts...) +} + func (k K8sClientWrapper) DeleteIgnoreNotFound( ctx context.Context, obj client.Object, diff --git a/pkg/common/k8s-client/k8s_client_types.go b/pkg/common/k8s-client/k8s_client_types.go index d1b6db294e..e1cc739135 100644 --- a/pkg/common/k8s-client/k8s_client_types.go +++ b/pkg/common/k8s-client/k8s_client_types.go @@ -42,6 +42,9 @@ type K8sClient interface { // DeleteByKeyIgnoreNotFound deletes object by key. // Returns nil if object is deleted or not found otherwise returns error. DeleteByKeyIgnoreNotFound(ctx context.Context, key client.ObjectKey, objectMeta client.Object, opts ...client.DeleteOption) error + // DeleteAllOf deletes all objects of the given type. + // Returns nil if objects are deleted otherwise returns error. + DeleteAllOf(ctx context.Context, obj client.Object, opts ...client.DeleteAllOfOption) error // List returns list of runtime objects. // Returns nil if list is retrieved otherwise returns error. List(ctx context.Context, list client.ObjectList, opts ...client.ListOption) ([]runtime.Object, error) diff --git a/pkg/common/test/utils.go b/pkg/common/test/utils.go index 74993a0689..ae9040531e 100644 --- a/pkg/common/test/utils.go +++ b/pkg/common/test/utils.go @@ -16,11 +16,16 @@ import ( "context" "testing" + dwInfrastructure "github.com/devfile/devworkspace-operator/pkg/infrastructure" "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/infrastructure" + defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" "github.com/stretchr/testify/assert" "k8s.io/utils/ptr" "sigs.k8s.io/controller-runtime/pkg/reconcile" + . "github.com/onsi/gomega" + appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/resource" @@ -39,10 +44,10 @@ type TestExpectedResources struct { func EnsureReconcile( t *testing.T, cheCtx *chetypes.CheContext, - testReconcileFunc func(cheCtx *chetypes.CheContext) (result reconcile.Result, done bool, err error)) { + reconcileFunc func(cheCtx *chetypes.CheContext) (result reconcile.Result, done bool, err error)) { for i := 0; i < 10; i++ { - _, done, err := testReconcileFunc(cheCtx) + _, done, err := reconcileFunc(cheCtx) assert.NoError(t, err) if done { return @@ -52,6 +57,18 @@ func EnsureReconcile( assert.Fail(t, "Reconcile did not finish in 10 iterations") } +// Reconcile runs the reconcileFunc once and asserts, with gomega matchers, that the component +// reconciled in a single pass: it requested no requeue and returned no error. +func Reconcile( + cheCtx *chetypes.CheContext, + reconcileFunc func(cheCtx *chetypes.CheContext) (result reconcile.Result, done bool, err error)) { + + result, done, err := reconcileFunc(cheCtx) + Expect(result).To(Equal(reconcile.Result{})) + Expect(done).To(BeTrue()) + Expect(err).ToNot(HaveOccurred()) +} + func CompareResources(actualDeployment *appsv1.Deployment, expected TestExpectedResources, t *testing.T) { container := &actualDeployment.Spec.Template.Spec.Containers[0] compareQuantity( @@ -139,3 +156,9 @@ func GetResourceQuantity(value string, defaultValue string) resource.Quantity { } return resource.MustParse(defaultValue) } + +func Initialize(infra infrastructure.Type) { + infrastructure.InitializeForTesting(infra) + dwInfrastructure.InitializeForTesting(dwInfrastructure.Type(infra)) + defaults.InitializeForTesting() +} diff --git a/pkg/common/utils/slices.go b/pkg/common/utils/slices.go new file mode 100644 index 0000000000..dce99810de --- /dev/null +++ b/pkg/common/utils/slices.go @@ -0,0 +1,24 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package utils + +// Map applies the transform function to each element of the input slice +// and returns a new slice containing the transformed elements. +func Map[T any, R any](items []T, transform func(T) R) []R { + result := make([]R, len(items)) + for i, item := range items { + result[i] = transform(item) + } + + return result +} diff --git a/pkg/deploy/devworkspace/dev_workspace_config.go b/pkg/deploy/devworkspace/dev_workspace_config.go index 6446396d2d..9a339ce115 100644 --- a/pkg/deploy/devworkspace/dev_workspace_config.go +++ b/pkg/deploy/devworkspace/dev_workspace_config.go @@ -135,6 +135,10 @@ func updateWorkspaceConfig(cheCtx *chetypes.CheContext, operatorConfig *controll return err } + if err := updateNetworkPolicy(cheCtx, operatorConfig.Workspace); err != nil { + return err + } + // If the CheCluster has a configured proxy, or if the Che Operator has detected a proxy configuration, // we need to disable automatic proxy handling in the DevWorkspace Operator as its implementation collides // with ours -- they set environment variables the deployment spec explicitly, which overrides the proxy-settings diff --git a/pkg/deploy/devworkspace/dev_workspace_config_network_policy.go b/pkg/deploy/devworkspace/dev_workspace_config_network_policy.go new file mode 100644 index 0000000000..617bcfdde7 --- /dev/null +++ b/pkg/deploy/devworkspace/dev_workspace_config_network_policy.go @@ -0,0 +1,66 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package devworkspace + +import ( + controllerv1alpha1 "github.com/devfile/devworkspace-operator/apis/controller/v1alpha1" + dwoconfig "github.com/devfile/devworkspace-operator/pkg/config" + "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/constants" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +func updateNetworkPolicy(cheCtx *chetypes.CheContext, workspaceConfig *controllerv1alpha1.WorkspaceConfig) error { + workspaceConfig.NetworkPolicy = getNetworkPolicyConfigFromSpec(cheCtx) + + dwoIngressRules, dwoEgressRules, err := dwoconfig.GetDefaultNetworkPolicy(cheCtx.DWONamespace) + if err != nil { + return err + } + + if workspaceConfig.NetworkPolicy.Ingress == nil { + workspaceConfig.NetworkPolicy.Ingress = append(dwoIngressRules, buildAllowFromCheIngressRule(cheCtx.CheCluster.Namespace)) + } + + if workspaceConfig.NetworkPolicy.Egress == nil { + workspaceConfig.NetworkPolicy.Egress = dwoEgressRules + } + + return nil +} + +func getNetworkPolicyConfigFromSpec(cheCtx *chetypes.CheContext) *controllerv1alpha1.NetworkPolicyConfig { + if cheCtx.CheCluster.Spec.DevEnvironments.Networking != nil && + cheCtx.CheCluster.Spec.DevEnvironments.Networking.NetworkPolicy != nil { + + return cheCtx.CheCluster.Spec.DevEnvironments.Networking.NetworkPolicy.DeepCopy() + } + + return &controllerv1alpha1.NetworkPolicyConfig{} +} + +func buildAllowFromCheIngressRule(namespace string) networkingv1.NetworkPolicyIngressRule { + return networkingv1.NetworkPolicyIngressRule{ + From: []networkingv1.NetworkPolicyPeer{ + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"kubernetes.io/metadata.name": namespace}, + }, + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + }, + }, + } +} diff --git a/pkg/deploy/devworkspace/dev_workspace_config_network_policy_test.go b/pkg/deploy/devworkspace/dev_workspace_config_network_policy_test.go new file mode 100644 index 0000000000..d08a5f2459 --- /dev/null +++ b/pkg/deploy/devworkspace/dev_workspace_config_network_policy_test.go @@ -0,0 +1,156 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package devworkspace + +import ( + "slices" + "testing" + + controllerv1alpha1 "github.com/devfile/devworkspace-operator/apis/controller/v1alpha1" + dwoconfig "github.com/devfile/devworkspace-operator/pkg/config" + chev2 "github.com/eclipse-che/che-operator/api/v2" + "github.com/eclipse-che/che-operator/pkg/common/test" + "github.com/stretchr/testify/assert" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/types" + "sigs.k8s.io/controller-runtime/pkg/client" +) + +func TestReconcileNetworkPolicy(t *testing.T) { + customIngressRule := networkingv1.NetworkPolicyIngressRule{ + From: []networkingv1.NetworkPolicyPeer{ + {PodSelector: &metav1.LabelSelector{MatchLabels: map[string]string{"app": "custom-ingress"}}}, + }, + } + + existedDWOC := &controllerv1alpha1.DevWorkspaceOperatorConfig{ + ObjectMeta: metav1.ObjectMeta{ + Name: devWorkspaceConfigName, + Namespace: "eclipse-che", + }, + TypeMeta: metav1.TypeMeta{ + Kind: "DevWorkspaceOperatorConfig", + APIVersion: controllerv1alpha1.GroupVersion.String(), + }, + Config: &controllerv1alpha1.OperatorConfiguration{ + Workspace: &controllerv1alpha1.WorkspaceConfig{ + NetworkPolicy: &controllerv1alpha1.NetworkPolicyConfig{ + Enabled: new(true), + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + {PodSelector: &metav1.LabelSelector{MatchLabels: map[string]string{"app": "stale-ingress"}}}, + }, + }, + }, + Egress: []networkingv1.NetworkPolicyEgressRule{ + { + To: []networkingv1.NetworkPolicyPeer{ + {PodSelector: &metav1.LabelSelector{MatchLabels: map[string]string{"app": "stale-egress"}}}, + }, + }, + }, + }, + }, + }, + } + + defaultIngressRules, defaultEgressRules, err := dwoconfig.GetDefaultNetworkPolicy("devworkspace-controller") + assert.NoError(t, err) + + type testCase struct { + name string + networkPolicy *controllerv1alpha1.NetworkPolicyConfig + existedObjects []client.Object + expectedIngress []networkingv1.NetworkPolicyIngressRule + expectedEgress []networkingv1.NetworkPolicyEgressRule + expectedEnabled *bool + } + + testCases := []testCase{ + { + name: "Set default rules and the rule allowing traffic from Che operands when the network policy is not set", + networkPolicy: nil, + expectedIngress: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), + expectedEgress: defaultEgressRules, + }, + { + name: "Set default rules and the rule allowing traffic from Che operands when the network policy is empty", + networkPolicy: &controllerv1alpha1.NetworkPolicyConfig{}, + expectedIngress: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), + expectedEgress: defaultEgressRules, + }, + { + name: "Keep custom ingress rules and not add the rule allowing traffic from Che operands", + networkPolicy: &controllerv1alpha1.NetworkPolicyConfig{ + Ingress: []networkingv1.NetworkPolicyIngressRule{customIngressRule}, + }, + expectedIngress: []networkingv1.NetworkPolicyIngressRule{customIngressRule}, + expectedEgress: defaultEgressRules, + }, + { + name: "Don't Lose the empty rule lists when they are written to the DWOC", + networkPolicy: &controllerv1alpha1.NetworkPolicyConfig{ + Ingress: []networkingv1.NetworkPolicyIngressRule{}, + Egress: []networkingv1.NetworkPolicyEgressRule{}, + }, + expectedIngress: []networkingv1.NetworkPolicyIngressRule{}, + expectedEgress: []networkingv1.NetworkPolicyEgressRule{}, + }, + { + name: "Override the network policy already set in the DWOC with the default rules when the network policy is not set", + networkPolicy: nil, + existedObjects: []client.Object{existedDWOC}, + expectedIngress: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), + expectedEgress: defaultEgressRules, + }, + } + + for _, testCase := range testCases { + t.Run(testCase.name, func(t *testing.T) { + cheCtx := test.NewCtxBuilder().WithCheCluster( + &chev2.CheCluster{ + ObjectMeta: metav1.ObjectMeta{ + Name: "eclipse-che", + Namespace: "eclipse-che", + }, + Spec: chev2.CheClusterSpec{ + DevEnvironments: chev2.CheClusterDevEnvironments{ + Networking: &chev2.DevEnvironmentNetworking{NetworkPolicy: testCase.networkPolicy}, + }, + }, + }).WithObjects(testCase.existedObjects...).Build() + + devWorkspaceConfigReconciler := NewDevWorkspaceConfigReconciler() + test.EnsureReconcile(t, cheCtx, devWorkspaceConfigReconciler.Reconcile) + + dwoc := &controllerv1alpha1.DevWorkspaceOperatorConfig{} + err := cheCtx.ClusterAPI.Client.Get( + cheCtx.Context, + types.NamespacedName{Name: devWorkspaceConfigName, Namespace: "eclipse-che"}, + dwoc) + assert.NoError(t, err) + + assert.NotNil(t, dwoc.Config) + assert.NotNil(t, dwoc.Config.Workspace) + + dwocNetworkPolicy := dwoc.Config.Workspace.NetworkPolicy + + assert.NotNil(t, dwocNetworkPolicy) + assert.Equal(t, testCase.expectedIngress, dwocNetworkPolicy.Ingress) + assert.Equal(t, testCase.expectedEgress, dwocNetworkPolicy.Egress) + assert.Equal(t, testCase.expectedEnabled, dwocNetworkPolicy.Enabled) + }) + } +} diff --git a/pkg/deploy/devworkspace/dev_workspace_config_scheduling_test.go b/pkg/deploy/devworkspace/dev_workspace_config_scheduling_test.go index a7bdffc920..4d484e514d 100644 --- a/pkg/deploy/devworkspace/dev_workspace_config_scheduling_test.go +++ b/pkg/deploy/devworkspace/dev_workspace_config_scheduling_test.go @@ -180,7 +180,7 @@ func TestReconcileDevWorkspaceConfigProgressTimeout(t *testing.T) { diff := cmp.Diff(testCase.expectedOperatorConfig, dwoc.Config, cmp.Options{ - cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "DefaultStorageSize", "StorageClassName", "ProjectCloneConfig", "DeploymentStrategy"), + cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "DefaultStorageSize", "StorageClassName", "ProjectCloneConfig", "DeploymentStrategy", "NetworkPolicy"), cmpopts.IgnoreFields(controllerv1alpha1.RoutingConfig{}, "TLSCertificateConfigmapRef"), }) assert.Empty(t, diff) diff --git a/pkg/deploy/devworkspace/dev_workspace_config_security_test.go b/pkg/deploy/devworkspace/dev_workspace_config_security_test.go index 092c475b38..0db8f4db90 100644 --- a/pkg/deploy/devworkspace/dev_workspace_config_security_test.go +++ b/pkg/deploy/devworkspace/dev_workspace_config_security_test.go @@ -286,7 +286,7 @@ func TestReconcileDevWorkspaceConfigForContainerCapabilities(t *testing.T) { diff := cmp.Diff(testCase.expectedOperatorConfig, dwoc.Config, cmp.Options{ - cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "ProjectCloneConfig", "DeploymentStrategy", "DefaultStorageSize", "StorageClassName"), + cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "ProjectCloneConfig", "DeploymentStrategy", "DefaultStorageSize", "StorageClassName", "NetworkPolicy"), cmpopts.IgnoreFields(controllerv1alpha1.RoutingConfig{}, "TLSCertificateConfigmapRef"), }) assert.Empty(t, diff) diff --git a/pkg/deploy/devworkspace/dev_workspace_config_storage_test.go b/pkg/deploy/devworkspace/dev_workspace_config_storage_test.go index 5b7f06ee82..6df2c1eb84 100644 --- a/pkg/deploy/devworkspace/dev_workspace_config_storage_test.go +++ b/pkg/deploy/devworkspace/dev_workspace_config_storage_test.go @@ -729,7 +729,7 @@ func TestReconcileDevWorkspaceConfigStorage(t *testing.T) { assert.NoError(t, err) diff := cmp.Diff(testCase.expectedOperatorConfig, dwoc.Config, cmp.Options{ - cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount"), + cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "NetworkPolicy"), cmpopts.IgnoreFields(controllerv1alpha1.RoutingConfig{}, "TLSCertificateConfigmapRef"), }) assert.Empty(t, diff) diff --git a/pkg/deploy/devworkspace/dev_workspace_config_workspace_test.go b/pkg/deploy/devworkspace/dev_workspace_config_workspace_test.go index e480c70fed..8807d45f6e 100644 --- a/pkg/deploy/devworkspace/dev_workspace_config_workspace_test.go +++ b/pkg/deploy/devworkspace/dev_workspace_config_workspace_test.go @@ -507,7 +507,7 @@ func TestReconcileDevWorkspaceConfigPersistUserHome(t *testing.T) { err := cheCtx.ClusterAPI.Client.Get(context.TODO(), types.NamespacedName{Name: devWorkspaceConfigName, Namespace: testCase.cheCluster.Namespace}, dwoc) assert.NoError(t, err) diff := cmp.Diff(testCase.expectedOperatorConfig, dwoc.Config, cmp.Options{ - cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "DeploymentStrategy", "ContainerSecurityContext"), + cmpopts.IgnoreFields(controllerv1alpha1.WorkspaceConfig{}, "ServiceAccount", "DeploymentStrategy", "ContainerSecurityContext", "NetworkPolicy"), cmpopts.IgnoreFields(controllerv1alpha1.RoutingConfig{}, "TLSCertificateConfigmapRef"), }) assert.Empty(t, diff) diff --git a/pkg/deploy/devworkspace/init_test.go b/pkg/deploy/devworkspace/init_test.go index f034fd379e..b990f50f0b 100644 --- a/pkg/deploy/devworkspace/init_test.go +++ b/pkg/deploy/devworkspace/init_test.go @@ -1,5 +1,5 @@ // -// Copyright (c) 2019-2023 Red Hat, Inc. +// Copyright (c) 2019-2026 Red Hat, Inc. // This program and the accompanying materials are made // available under the terms of the Eclipse Public License 2.0 // which is available at https://www.eclipse.org/legal/epl-2.0/ @@ -13,6 +13,7 @@ package devworkspace import ( + dwoinfrastructure "github.com/devfile/devworkspace-operator/pkg/infrastructure" "github.com/eclipse-che/che-operator/pkg/common/infrastructure" k8shelper "github.com/eclipse-che/che-operator/pkg/common/k8s-helper" defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" @@ -21,5 +22,6 @@ import ( func init() { k8shelper.InitializeForTesting() infrastructure.InitializeForTesting(infrastructure.OpenShiftV4) + dwoinfrastructure.InitializeForTesting(dwoinfrastructure.OpenShiftv4) defaults.InitializeForTesting() } diff --git a/pkg/deploy/networkpolicies/init_test.go b/pkg/deploy/networkpolicies/init_test.go deleted file mode 100644 index ccb1e060ff..0000000000 --- a/pkg/deploy/networkpolicies/init_test.go +++ /dev/null @@ -1,25 +0,0 @@ -// -// Copyright (c) 2019-2026 Red Hat, Inc. -// This program and the accompanying materials are made -// available under the terms of the Eclipse Public License 2.0 -// which is available at https://www.eclipse.org/legal/epl-2.0/ -// -// SPDX-License-Identifier: EPL-2.0 -// -// Contributors: -// Red Hat, Inc. - initial API and implementation -// - -package networkpolicies - -import ( - "github.com/eclipse-che/che-operator/pkg/common/infrastructure" - k8shelper "github.com/eclipse-che/che-operator/pkg/common/k8s-helper" - defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" -) - -func init() { - k8shelper.InitializeForTesting() - infrastructure.InitializeForTesting(infrastructure.OpenShiftV4) - defaults.InitializeForTesting() -} diff --git a/pkg/deploy/networkpolicies/networkpolicies.go b/pkg/deploy/networkpolicies/networkpolicies.go deleted file mode 100644 index 01ea2df327..0000000000 --- a/pkg/deploy/networkpolicies/networkpolicies.go +++ /dev/null @@ -1,389 +0,0 @@ -// -// Copyright (c) 2019-2026 Red Hat, Inc. -// This program and the accompanying materials are made -// available under the terms of the Eclipse Public License 2.0 -// which is available at https://www.eclipse.org/legal/epl-2.0/ -// -// SPDX-License-Identifier: EPL-2.0 -// -// Contributors: -// Red Hat, Inc. - initial API and implementation -// - -package networkpolicies - -import ( - "fmt" - - "github.com/eclipse-che/che-operator/pkg/common/chetypes" - "github.com/eclipse-che/che-operator/pkg/common/constants" - "github.com/eclipse-che/che-operator/pkg/common/diffs" - "github.com/eclipse-che/che-operator/pkg/common/infrastructure" - k8sclient "github.com/eclipse-che/che-operator/pkg/common/k8s-client" - defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" - "github.com/eclipse-che/che-operator/pkg/common/reconciler" - "github.com/eclipse-che/che-operator/pkg/deploy" - networkingv1 "k8s.io/api/networking/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/labels" - "sigs.k8s.io/controller-runtime/pkg/client" - "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" - "sigs.k8s.io/controller-runtime/pkg/reconcile" -) - -type NetworkPoliciesReconciler struct { - reconciler.Reconcilable -} - -func NewNetworkPoliciesReconciler() *NetworkPoliciesReconciler { - return &NetworkPoliciesReconciler{} -} - -func (r *NetworkPoliciesReconciler) Reconcile(cheCtx *chetypes.CheContext) (reconcile.Result, bool, error) { - if !cheCtx.CheCluster.IsNetworkPoliciesEnabled() { - err := DeleteNetworkPolicy(cheCtx, cheCtx.CheCluster.Namespace) - if err != nil { - err = fmt.Errorf("failed to delete NetworkPolicy in namespace %s: %w", cheCtx.CheCluster.Namespace, err) - } - - return reconcile.Result{}, err == nil, err - } - - err := SyncNetworkPolicy(cheCtx, cheCtx.CheCluster.Namespace) - if err != nil { - return reconcile.Result{}, false, fmt.Errorf("failed to sync NetworkPolicy in namespace %s: %w", cheCtx.CheCluster.Namespace, err) - } - - return reconcile.Result{}, true, nil -} - -func (r *NetworkPoliciesReconciler) Finalize(_ *chetypes.CheContext) bool { - return true -} - -func GetNetworkPolicies(cheCtx *chetypes.CheContext, namespace string) ([]*networkingv1.NetworkPolicy, error) { - isWorkspaceNetworkPolicies := cheCtx.CheCluster.Namespace != namespace - - operatorNamespace, err := infrastructure.GetOperatorNamespace() - if err != nil { - return nil, fmt.Errorf("failed to get operator namespace: %w", err) - } - - var podSelector metav1.LabelSelector - - if isWorkspaceNetworkPolicies { - podSelector = metav1.LabelSelector{} - } else { - podSelector = metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - } - } - - allowFromSameNamespace := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-from-same-namespace", - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - PodSelector: podSelector.DeepCopy(), - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - - allowFromOpenShiftIngress := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-from-openshift-ingress", - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "network.openshift.io/policy-group": "ingress", - }, - }, - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - - allowFromOpenShiftMonitoring := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-from-openshift-monitoring", - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "network.openshift.io/policy-group": "monitoring", - }, - }, - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - - allowFromWorkspaces := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-from-workspaces", - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesComponentLabelKey: constants.WorkspacesNamespaceComponentName, - }, - }, - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - - allowFromChe := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-from-" + cheCtx.CheCluster.Namespace, - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "kubernetes.io/metadata.name": cheCtx.CheCluster.Namespace, - }, - }, - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - }, - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - - allowFromCheOperator := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: fmt.Sprintf("allow-from-%s-operator", defaults.GetCheFlavor()), - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "kubernetes.io/metadata.name": operatorNamespace, - }, - }, - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - }, - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - - var allowFromDevWorkspaceOperator *networkingv1.NetworkPolicy - - if cheCtx.DWONamespace != "" { - allowFromDevWorkspaceOperator = &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-from-devworkspace-operator", - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Ingress: []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "kubernetes.io/metadata.name": cheCtx.DWONamespace, - }, - }, - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.DevWorkspaceOperatorName, - }, - }, - }, - }, - }, - }, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, - }, - } - } - - allowAllEgress := &networkingv1.NetworkPolicy{ - TypeMeta: metav1.TypeMeta{ - Kind: "NetworkPolicy", - APIVersion: networkingv1.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "allow-all-egress", - Namespace: namespace, - Labels: deploy.GetLabels(defaults.GetCheFlavor()), - }, - Spec: networkingv1.NetworkPolicySpec{ - PodSelector: *podSelector.DeepCopy(), - Egress: []networkingv1.NetworkPolicyEgressRule{{}}, - PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, - }, - } - - networkPolicies := []*networkingv1.NetworkPolicy{ - allowFromSameNamespace, - allowFromOpenShiftIngress, - allowFromOpenShiftMonitoring, - allowAllEgress, - } - - if isWorkspaceNetworkPolicies { - networkPolicies = append(networkPolicies, allowFromChe) - if allowFromDevWorkspaceOperator != nil { - networkPolicies = append(networkPolicies, allowFromDevWorkspaceOperator) - } - } else { - networkPolicies = append(networkPolicies, allowFromWorkspaces, allowFromCheOperator) - } - - return networkPolicies, nil -} - -func SyncNetworkPolicy(cheCtx *chetypes.CheContext, namespace string) error { - networkPolicies, err := GetNetworkPolicies(cheCtx, namespace) - if err != nil { - return fmt.Errorf("failed to get NetworkPolicy in namespace %s: %w", namespace, err) - } - - for _, networkPolicy := range networkPolicies { - if cheCtx.CheCluster.Namespace == namespace { - if err = controllerutil.SetControllerReference(cheCtx.CheCluster, networkPolicy, cheCtx.ClusterAPI.Scheme); err != nil { - return err - } - } - - if err := cheCtx.ClusterAPI.ClientWrapper.Sync( - cheCtx.Context, - networkPolicy, - &k8sclient.SyncOptions{DiffOpts: diffs.NetworkPolicy}, - ); err != nil { - return fmt.Errorf("failed to sync NetworkPolicy %s/%s: %w", networkPolicy.Namespace, networkPolicy.Name, err) - } - } - - return nil -} - -func DeleteNetworkPolicy(cheCtx *chetypes.CheContext, namespace string) error { - items, err := cheCtx.ClusterAPI.ClientWrapper.List( - cheCtx.Context, - &networkingv1.NetworkPolicyList{}, - &client.ListOptions{ - Namespace: namespace, - LabelSelector: labels.SelectorFromSet(deploy.GetLabels(defaults.GetCheFlavor())), - }, - ) - if err != nil { - return fmt.Errorf("failed to list NetworkPolicy in namespace %s: %w", namespace, err) - } - - for _, item := range items { - networkPolicy, ok := item.(*networkingv1.NetworkPolicy) - if !ok { - continue - } - - err = cheCtx.ClusterAPI.ClientWrapper.DeleteIgnoreNotFound(cheCtx.Context, networkPolicy) - if err != nil { - return fmt.Errorf("failed to delete NetworkPolicy %s/%s: %w", networkPolicy.GetNamespace(), networkPolicy.GetName(), err) - } - } - - return nil -} diff --git a/pkg/deploy/networkpolicies/networkpolicies_test.go b/pkg/deploy/networkpolicies/networkpolicies_test.go deleted file mode 100644 index cb40fd014f..0000000000 --- a/pkg/deploy/networkpolicies/networkpolicies_test.go +++ /dev/null @@ -1,513 +0,0 @@ -// -// Copyright (c) 2019-2026 Red Hat, Inc. -// This program and the accompanying materials are made -// available under the terms of the Eclipse Public License 2.0 -// which is available at https://www.eclipse.org/legal/epl-2.0/ -// -// SPDX-License-Identifier: EPL-2.0 -// -// Contributors: -// Red Hat, Inc. - initial API and implementation -// - -package networkpolicies - -import ( - "context" - "slices" - "testing" - - chev2 "github.com/eclipse-che/che-operator/api/v2" - "github.com/eclipse-che/che-operator/pkg/common/chetypes" - "github.com/eclipse-che/che-operator/pkg/common/constants" - defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" - "github.com/eclipse-che/che-operator/pkg/common/test" - "github.com/eclipse-che/che-operator/pkg/deploy" - "github.com/stretchr/testify/assert" - networkingv1 "k8s.io/api/networking/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/types" - "k8s.io/utils/ptr" -) - -var cheClusterPolicyNames = []string{ - "allow-from-same-namespace", - "allow-from-openshift-ingress", - "allow-from-openshift-monitoring", - "allow-from-workspaces", - "allow-from-che-operator", - "allow-all-egress", -} - -var workspacePolicyNames = []string{ - "allow-from-same-namespace", - "allow-from-openshift-ingress", - "allow-from-openshift-monitoring", - "allow-from-eclipse-che", - "allow-from-devworkspace-operator", - "allow-all-egress", -} - -func TestReconcileCreatesNetworkPoliciesWhenEnabled(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - cheCtx.CheCluster.Spec.Networking.NetworkPolicy = &chev2.NetworkPolicy{Enabled: ptr.To(true)} - - reconciler := NewNetworkPoliciesReconciler() - - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - - for _, name := range cheClusterPolicyNames { - exists, err := cheCtx.ClusterAPI.ClientWrapper.GetIgnoreNotFound( - context.TODO(), - types.NamespacedName{Name: name, Namespace: cheCtx.CheCluster.Namespace}, - &networkingv1.NetworkPolicy{}, - ) - - assert.NoError(t, err) - assert.True(t, exists) - } -} - -func TestReconcileDeletesNetworkPoliciesWhenDisabled(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - cheCtx.CheCluster.Spec.Networking.NetworkPolicy = &chev2.NetworkPolicy{Enabled: ptr.To(true)} - - reconciler := NewNetworkPoliciesReconciler() - - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - - cheCtx.CheCluster.Spec.Networking.NetworkPolicy.Enabled = ptr.To(false) - - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - - for _, name := range cheClusterPolicyNames { - exists, err := cheCtx.ClusterAPI.ClientWrapper.GetIgnoreNotFound( - context.TODO(), - types.NamespacedName{Name: name, Namespace: cheCtx.CheCluster.Namespace}, - &networkingv1.NetworkPolicy{}, - ) - - assert.NoError(t, err) - assert.False(t, exists) - } -} - -func TestReconcileDeletesOnlyLabeledPolicies(t *testing.T) { - unownedPolicy := &networkingv1.NetworkPolicy{ - ObjectMeta: metav1.ObjectMeta{ - Name: "unowned-policy", - Namespace: "eclipse-che", - }, - } - - cheCtx := test.NewCtxBuilder().WithObjects(unownedPolicy).Build() - cheCtx.CheCluster.Spec.Networking.NetworkPolicy = &chev2.NetworkPolicy{Enabled: ptr.To(true)} - - reconciler := NewNetworkPoliciesReconciler() - - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - - cheCtx.CheCluster.Spec.Networking.NetworkPolicy.Enabled = ptr.To(false) - - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - - exists, err := cheCtx.ClusterAPI.ClientWrapper.GetIgnoreNotFound( - context.TODO(), - types.NamespacedName{Name: "unowned-policy", Namespace: cheCtx.CheCluster.Namespace}, - &networkingv1.NetworkPolicy{}, - ) - - assert.NoError(t, err) - assert.True(t, exists) -} - -func TestReconcileIdempotent(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - cheCtx.CheCluster.Spec.Networking.NetworkPolicy = &chev2.NetworkPolicy{Enabled: ptr.To(true)} - - reconciler := NewNetworkPoliciesReconciler() - - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - test.EnsureReconcile(t, cheCtx, reconciler.Reconcile) - - for _, name := range cheClusterPolicyNames { - exists, err := cheCtx.ClusterAPI.ClientWrapper.GetIgnoreNotFound( - context.TODO(), - types.NamespacedName{Name: name, Namespace: cheCtx.CheCluster.Namespace}, - &networkingv1.NetworkPolicy{}, - ) - - assert.NoError(t, err) - assert.True(t, exists) - } -} - -func TestGetNetworkPoliciesPodSelectorForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policies, err := GetNetworkPolicies(cheCtx, cheCtx.CheCluster.Namespace) - assert.NoError(t, err) - - expectedSelector := metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - } - - for _, p := range policies { - assert.Equal(t, expectedSelector, p.Spec.PodSelector) - } -} - -func TestGetNetworkPoliciesPodSelectorForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policies, err := GetNetworkPolicies(cheCtx, "user-ns") - assert.NoError(t, err) - - expectedSelector := metav1.LabelSelector{} - - for _, p := range policies { - assert.Equal(t, expectedSelector, p.Spec.PodSelector) - } -} - -func TestGetNetworkPoliciesLabelsForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policies, err := GetNetworkPolicies(cheCtx, cheCtx.CheCluster.Namespace) - assert.NoError(t, err) - - expectedLabels := deploy.GetLabels(defaults.GetCheFlavor()) - - for _, p := range policies { - assert.Equal(t, expectedLabels, p.Labels) - } -} - -func TestGetNetworkPoliciesLabelsForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policies, err := GetNetworkPolicies(cheCtx, "user-ns") - assert.NoError(t, err) - - expectedLabels := deploy.GetLabels(defaults.GetCheFlavor()) - - for _, p := range policies { - assert.Equal(t, expectedLabels, p.Labels) - } -} - -func TestGetNetworkPoliciesNamespaceForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policies, err := GetNetworkPolicies(cheCtx, cheCtx.CheCluster.Namespace) - assert.NoError(t, err) - - for _, p := range policies { - assert.Equal(t, cheCtx.CheCluster.Namespace, p.Namespace) - } -} - -func TestGetNetworkPoliciesNamespaceForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policies, err := GetNetworkPolicies(cheCtx, "user-ns") - assert.NoError(t, err) - - for _, p := range policies { - assert.Equal(t, "user-ns", p.Namespace) - } -} - -func TestAllowFromSameNamespaceSpecForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, cheCtx.CheCluster.Namespace, "allow-from-same-namespace") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - {PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - }}, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromSameNamespaceSpecForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, "user-ns", "allow-from-same-namespace") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - {PodSelector: &metav1.LabelSelector{}}, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromOpenShiftIngressSpecForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, cheCtx.CheCluster.Namespace, "allow-from-openshift-ingress") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "network.openshift.io/policy-group": "ingress", - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromOpenShiftIngressSpecForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, "user-ns", "allow-from-openshift-ingress") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "network.openshift.io/policy-group": "ingress", - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromOpenShiftMonitoringSpecForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, cheCtx.CheCluster.Namespace, "allow-from-openshift-monitoring") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "network.openshift.io/policy-group": "monitoring", - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromOpenShiftMonitoringSpecForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, "user-ns", "allow-from-openshift-monitoring") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "network.openshift.io/policy-group": "monitoring", - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromWorkspacesSpec(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, cheCtx.CheCluster.Namespace, "allow-from-workspaces") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesComponentLabelKey: constants.WorkspacesNamespaceComponentName, - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromCheOperatorSpec(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, cheCtx.CheCluster.Namespace, "allow-from-che-operator") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "kubernetes.io/metadata.name": "openshift-operators", - }, - }, - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromCheNamespaceSpec(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, "user-ns", "allow-from-eclipse-che") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "kubernetes.io/metadata.name": "eclipse-che", - }, - }, - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowFromDevWorkspaceOperatorSpec(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, "user-ns", "allow-from-devworkspace-operator") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, policy.Spec.PolicyTypes) - assert.Equal(t, []networkingv1.NetworkPolicyIngressRule{ - { - From: []networkingv1.NetworkPolicyPeer{ - { - NamespaceSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "kubernetes.io/metadata.name": "devworkspace-controller", - }, - }, - PodSelector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - constants.KubernetesPartOfLabelKey: constants.DevWorkspaceOperatorName, - }, - }, - }, - }, - }, - }, policy.Spec.Ingress) -} - -func TestAllowAllEgressSpecForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, cheCtx.CheCluster.Namespace, "allow-all-egress") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, policy.Spec.PolicyTypes) - assert.Empty(t, policy.Spec.Ingress) - assert.Equal(t, []networkingv1.NetworkPolicyEgressRule{{}}, policy.Spec.Egress) -} - -func TestAllowAllEgressSpecForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - policy := findPolicy(t, cheCtx, "user-ns", "allow-all-egress") - - assert.Equal(t, []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, policy.Spec.PolicyTypes) - assert.Empty(t, policy.Spec.Ingress) - assert.Equal(t, []networkingv1.NetworkPolicyEgressRule{{}}, policy.Spec.Egress) -} - -func TestSyncNetworkPolicySetsOwnerReferenceForCheClusterNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - err := SyncNetworkPolicy(cheCtx, cheCtx.CheCluster.Namespace) - assert.NoError(t, err) - - for _, name := range cheClusterPolicyNames { - networkPolicy := &networkingv1.NetworkPolicy{} - exists, err := cheCtx.ClusterAPI.ClientWrapper.GetIgnoreNotFound( - context.TODO(), - types.NamespacedName{Name: name, Namespace: "eclipse-che"}, - networkPolicy, - ) - - assert.NoError(t, err) - assert.True(t, exists) - assert.NotEmpty(t, networkPolicy.OwnerReferences) - assert.Equal(t, cheCtx.CheCluster.Name, networkPolicy.OwnerReferences[0].Name) - } -} - -func TestSyncNetworkPolicyNoOwnerReferenceForWorkspaceNamespace(t *testing.T) { - cheCtx := test.NewCtxBuilder().Build() - - err := SyncNetworkPolicy(cheCtx, "user-ns") - assert.NoError(t, err) - - for _, name := range workspacePolicyNames { - networkPolicy := &networkingv1.NetworkPolicy{} - exists, err := cheCtx.ClusterAPI.ClientWrapper.GetIgnoreNotFound( - context.TODO(), - types.NamespacedName{Name: name, Namespace: "user-ns"}, - networkPolicy, - ) - - assert.NoError(t, err) - assert.True(t, exists) - assert.Empty(t, networkPolicy.OwnerReferences) - } -} - -func findPolicy(t *testing.T, cheCtx *chetypes.CheContext, namespace string, name string) *networkingv1.NetworkPolicy { - t.Helper() - - policies, err := GetNetworkPolicies(cheCtx, namespace) - assert.NoError(t, err) - - idx := slices.IndexFunc(policies, func(item *networkingv1.NetworkPolicy) bool { return item.Name == name }) - if idx == -1 { - t.Fatalf("policy %s not found in namespace %s", name, namespace) - } - - return policies[idx] -} diff --git a/pkg/provision/sync.go b/pkg/provision/helper.go similarity index 74% rename from pkg/provision/sync.go rename to pkg/provision/helper.go index 51148ed573..d799200942 100644 --- a/pkg/provision/sync.go +++ b/pkg/provision/helper.go @@ -18,6 +18,7 @@ import ( "slices" "strings" + "github.com/eclipse-che/che-operator/pkg/common/chelabels" "github.com/eclipse-che/che-operator/pkg/common/chetypes" "github.com/eclipse-che/che-operator/pkg/common/constants" k8sclient "github.com/eclipse-che/che-operator/pkg/common/k8s-client" @@ -26,11 +27,17 @@ import ( apierrors "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/validation" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/apimachinery/pkg/types" "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" ) -// SyncObject ensures that the object is up to date in the cluster. +// Package provision provides low-level utilities for provisioning, synchronizing, +// and cleaning up Kubernetes resources. It serves as a higher-level abstraction +// layer in front of K8sClientWrapper, simplifying cluster interaction calls. + +// syncObject ensures that the object is up to date in the cluster. // Besides the actual sync it: // - selects the client to use: the cached one for objects labeled with // `app.kubernetes.io/part-of: che.eclipse.org` (they are watched by the operator), @@ -42,7 +49,7 @@ import ( // should not be used with `pkg/common/diffs/diffs.go`. // - retries the sync with recreation if the update failed because an immutable field has changed, // but only when `allowForceRecreate` is set. -func SyncObject( +func syncObject( cheCtx *chetypes.CheContext, obj client.Object, diff cmp.Options, @@ -99,6 +106,53 @@ func SyncObject( return nil } +// deleteObject ensures that the object is deleted in the cluster. +func deleteObject( + cheCtx *chetypes.CheContext, + name string, + namespace string, + obj client.Object, + opts ...client.DeleteOption, +) error { + cw := cheCtx.ClusterAPI.ClientWrapper + key := types.NamespacedName{Name: name, Namespace: namespace} + + if err := cw.DeleteByKeyIgnoreNotFound(cheCtx.Context, key, obj, opts...); err != nil { + return fmt.Errorf("failed to delete %s %s: %w", k8sclient.GetObjectType(obj), key.String(), err) + } + + return nil +} + +// deleteAllManaged ensures that all objects of the given type managed by the operator +// for the specified component are deleted in the cluster. +// If namespace is not empty, the deletion is scoped to that namespace. +func deleteAllManaged( + cheCtx *chetypes.CheContext, + namespace string, + obj client.Object, + component string, +) error { + cw := cheCtx.ClusterAPI.ClientWrapper + cheLabels := chelabels.OperatorManaged(component) + + opts := &client.DeleteAllOfOptions{ + ListOptions: client.ListOptions{ + LabelSelector: labels.SelectorFromSet(cheLabels), + }, + } + + if namespace != "" { + opts.Namespace = namespace + } + + if err := cw.DeleteAllOf(cheCtx.Context, obj, opts); err != nil { + return fmt.Errorf("failed to delete %s in %s: %w", k8sclient.GetObjectType(obj), namespace, err) + } + + return nil +} + // cmpMetadata compares only the labels and annotations under the given keys, plus the controller owner // reference. Everything else in the metadata - resourceVersion, uid, managedFields, timestamps and any // label or annotation set by another actor - is ignored, which is what lets the merge semantics of diff --git a/pkg/provision/sync_test.go b/pkg/provision/helper_test.go similarity index 70% rename from pkg/provision/sync_test.go rename to pkg/provision/helper_test.go index 169fbf50a8..03e805e160 100644 --- a/pkg/provision/sync_test.go +++ b/pkg/provision/helper_test.go @@ -16,6 +16,8 @@ package provision import ( "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/infrastructure" + "github.com/eclipse-che/che-operator/pkg/common/test" "github.com/google/go-cmp/cmp" "github.com/google/go-cmp/cmp/cmpopts" . "github.com/onsi/ginkgo/v2" @@ -32,15 +34,16 @@ var ( var _ = Describe("syncObject", Ordered, func() { var ( - cheContext *chetypes.CheContext + cheCtx *chetypes.CheContext ) BeforeAll(func() { - cheContext = env.NewCheCtxBuilder().WithEmptyCheCluster().Build() + cheCtx = env.NewCheCtxBuilder().WithEmptyCheCluster().Build() + test.Initialize(infrastructure.Kubernetes) }) AfterEach(func() { - Expect(env.Client.DeleteAllOf(env.Context, &corev1.ConfigMap{}, client.InNamespace(cheContext.CheCluster.Namespace))).To(Succeed()) + Expect(env.Client.DeleteAllOf(env.Context, &corev1.ConfigMap{}, client.InNamespace(cheCtx.CheCluster.Namespace))).To(Succeed()) }) It("should set owner reference", func(ctx SpecContext) { @@ -52,18 +55,18 @@ var _ = Describe("syncObject", Ordered, func() { } emptyCheClusterContext := env.NewCheCtxBuilder().Build() - Expect(SyncObject(emptyCheClusterContext, testCm, cmDiffs, false, false)).To(Succeed()) + Expect(syncObject(emptyCheClusterContext, testCm, cmDiffs, false, false)).To(Succeed()) actualCm := &corev1.ConfigMap{} - Expect(env.Client.Get(cheContext.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) + Expect(env.Client.Get(cheCtx.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) Expect(actualCm.OwnerReferences).To(BeEmpty()) - Expect(SyncObject(cheContext, testCm, cmDiffs, false, false)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, false)).To(Succeed()) actualCm = &corev1.ConfigMap{} - Expect(env.Client.Get(cheContext.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) + Expect(env.Client.Get(cheCtx.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) Expect(actualCm.OwnerReferences).To(HaveLen(1)) - Expect(actualCm.OwnerReferences[0].UID).To(Equal(cheContext.CheCluster.UID)) + Expect(actualCm.OwnerReferences[0].UID).To(Equal(cheCtx.CheCluster.UID)) }) It("should sync immutable object", func(ctx SpecContext) { @@ -76,10 +79,10 @@ var _ = Describe("syncObject", Ordered, func() { Immutable: new(true), } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, true)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, true)).To(Succeed()) actualCm := &corev1.ConfigMap{} - Expect(env.Client.Get(cheContext.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) + Expect(env.Client.Get(cheCtx.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) Expect(actualCm.Data).To(Equal(map[string]string{"a": "b"})) testCm = &corev1.ConfigMap{ @@ -91,10 +94,10 @@ var _ = Describe("syncObject", Ordered, func() { Immutable: new(true), } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, true)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, true)).To(Succeed()) actualCm = &corev1.ConfigMap{} - Expect(env.Client.Get(cheContext.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) + Expect(env.Client.Get(cheCtx.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) Expect(actualCm.Data).To(Equal(map[string]string{"a": "c"})) }) @@ -108,7 +111,7 @@ var _ = Describe("syncObject", Ordered, func() { Immutable: new(true), } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, false)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, false)).To(Succeed()) testCm = &corev1.ConfigMap{ ObjectMeta: metav1.ObjectMeta{ @@ -119,7 +122,7 @@ var _ = Describe("syncObject", Ordered, func() { Immutable: new(true), } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, false)).To(Not(Succeed())) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, false)).To(Not(Succeed())) }) It("should respect metadata", func(ctx SpecContext) { @@ -138,7 +141,7 @@ var _ = Describe("syncObject", Ordered, func() { }, } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, false)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, false)).To(Succeed()) testCm = &corev1.ConfigMap{ ObjectMeta: metav1.ObjectMeta{ @@ -155,10 +158,10 @@ var _ = Describe("syncObject", Ordered, func() { }, } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, false)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, false)).To(Succeed()) actualCm := &corev1.ConfigMap{} - Expect(env.Client.Get(cheContext.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) + Expect(env.Client.Get(cheCtx.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) Expect(actualCm.Labels["label1"]).To(Equal("value2")) Expect(actualCm.Labels["label2"]).To(Equal("value1")) Expect(actualCm.Labels["label3"]).To(Equal("value2")) @@ -179,10 +182,10 @@ var _ = Describe("syncObject", Ordered, func() { }, } - Expect(SyncObject(cheContext, testCm, cmDiffs, false, false)).To(Succeed()) + Expect(syncObject(cheCtx, testCm, cmDiffs, false, false)).To(Succeed()) actualCm = &corev1.ConfigMap{} - Expect(env.Client.Get(cheContext.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) + Expect(env.Client.Get(cheCtx.Context, types.NamespacedName{Name: "test", Namespace: "eclipse-che"}, actualCm)).To(Succeed()) Expect(actualCm.Labels["label1"]).To(Equal("value2")) Expect(actualCm.Labels["label2"]).To(Equal("value3")) Expect(actualCm.Labels["label3"]).To(Equal("value2")) diff --git a/pkg/provision/networkpolicy.go b/pkg/provision/networkpolicy.go new file mode 100644 index 0000000000..8048fc6c83 --- /dev/null +++ b/pkg/provision/networkpolicy.go @@ -0,0 +1,63 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package provision + +import ( + "github.com/eclipse-che/che-operator/pkg/common/chetypes" + defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" + "github.com/google/go-cmp/cmp" + "github.com/google/go-cmp/cmp/cmpopts" + networkingv1 "k8s.io/api/networking/v1" +) + +var NetworkPolicy = &networkPolicyHandler{ + suppressDiff: false, + allowForceRecreate: true, + diff: cmp.Options{ + cmpopts.IgnoreFields(networkingv1.NetworkPolicy{}, "TypeMeta"), + }, +} + +type networkPolicyHandler struct { + suppressDiff bool + allowForceRecreate bool + diff cmp.Options +} + +func (h networkPolicyHandler) Sync(cheCtx *chetypes.CheContext, policy *networkingv1.NetworkPolicy) error { + return syncObject( + cheCtx, + policy, + h.diff, + h.suppressDiff, + h.allowForceRecreate, + ) +} + +func (h networkPolicyHandler) Delete(cheCtx *chetypes.CheContext, name string, namespace string) error { + return deleteObject( + cheCtx, + name, + namespace, + &networkingv1.NetworkPolicy{}, + ) +} + +func (h networkPolicyHandler) DeleteAll(cheCtx *chetypes.CheContext, namespace string) error { + return deleteAllManaged( + cheCtx, + namespace, + &networkingv1.NetworkPolicy{}, + defaults.GetCheFlavor(), + ) +} diff --git a/pkg/provision/suite_test.go b/pkg/provision/suite_test.go index 63a8623c17..5e85b5a4de 100644 --- a/pkg/provision/suite_test.go +++ b/pkg/provision/suite_test.go @@ -17,8 +17,6 @@ package provision import ( "testing" - "github.com/eclipse-che/che-operator/pkg/common/infrastructure" - defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" "github.com/eclipse-che/che-operator/pkg/common/test/envtest" . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" @@ -35,10 +33,6 @@ func TestProvision(t *testing.T) { var _ = BeforeSuite(func() { logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(true))) - - infrastructure.InitializeForTesting(infrastructure.Kubernetes) - defaults.InitializeForTesting() - env = envtest.Start() }) diff --git a/pkg/reconciler/networkpolicy/networkpolicy_kubernetes.go b/pkg/reconciler/networkpolicy/networkpolicy_kubernetes.go new file mode 100644 index 0000000000..29fe51b28f --- /dev/null +++ b/pkg/reconciler/networkpolicy/networkpolicy_kubernetes.go @@ -0,0 +1,67 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package networkpolicy + +import ( + "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/constants" + defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" + "github.com/eclipse-che/che-operator/pkg/deploy" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +func (r *NetworkPoliciesReconciler) buildKubernetesNetworkPolicies(cheCtx *chetypes.CheContext) ([]*networkingv1.NetworkPolicy, error) { + allowAllEgress := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-all-egress", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Egress: []networkingv1.NetworkPolicyEgressRule{{}}, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, + }, + } + + allowAllIngress := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-all-ingress", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{{}}, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + return []*networkingv1.NetworkPolicy{ + allowAllEgress, + allowAllIngress, + }, nil +} diff --git a/pkg/reconciler/networkpolicy/networkpolicy_openshift.go b/pkg/reconciler/networkpolicy/networkpolicy_openshift.go new file mode 100644 index 0000000000..c81e0e00a2 --- /dev/null +++ b/pkg/reconciler/networkpolicy/networkpolicy_openshift.go @@ -0,0 +1,238 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package networkpolicy + +import ( + "fmt" + + "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/constants" + "github.com/eclipse-che/che-operator/pkg/common/infrastructure" + defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" + "github.com/eclipse-che/che-operator/pkg/deploy" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +func (r *NetworkPoliciesReconciler) buildOpenShiftNetworkPolicies(cheCtx *chetypes.CheContext) ([]*networkingv1.NetworkPolicy, error) { + operatorNamespace, err := infrastructure.GetOperatorNamespace() + if err != nil { + return nil, err + } + + allowFromSameNamespace := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-from-same-namespace", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + { + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + }, + }, + }, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + allowFromOpenShiftIngress := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-from-openshift-ingress", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"network.openshift.io/policy-group": "ingress"}, + }, + }, + }, + }, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + allowFromOpenShiftHostNetwork := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-from-openshift-host-network", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"policy-group.network.openshift.io/host-network": ""}, + }, + }, + }, + }, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + allowFromOpenShiftMonitoring := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-from-openshift-monitoring", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"network.openshift.io/policy-group": "monitoring"}, + }, + }, + }, + }, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + allowFromWorkspaces := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-from-workspaces", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesComponentLabelKey: constants.WorkspacesNamespaceComponentName}, + }, + }, + }, + }, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + allowFromCheOperator := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: fmt.Sprintf("allow-from-%s-operator", defaults.GetCheFlavor()), + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + From: []networkingv1.NetworkPolicyPeer{ + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"kubernetes.io/metadata.name": operatorNamespace}, + }, + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + }, + }, + }, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + } + + allowAllEgress := &networkingv1.NetworkPolicy{ + TypeMeta: metav1.TypeMeta{ + Kind: "NetworkPolicy", + APIVersion: networkingv1.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-all-egress", + Namespace: cheCtx.CheCluster.Namespace, + Labels: deploy.GetLabels(defaults.GetCheFlavor()), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg}, + }, + Egress: []networkingv1.NetworkPolicyEgressRule{{}}, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, + }, + } + + return []*networkingv1.NetworkPolicy{ + allowFromSameNamespace, + allowFromOpenShiftIngress, + allowFromOpenShiftHostNetwork, + allowFromOpenShiftMonitoring, + allowFromWorkspaces, + allowFromCheOperator, + allowAllEgress, + }, nil +} diff --git a/pkg/reconciler/networkpolicy/networkpolicy_reconciler.go b/pkg/reconciler/networkpolicy/networkpolicy_reconciler.go new file mode 100644 index 0000000000..07eb460121 --- /dev/null +++ b/pkg/reconciler/networkpolicy/networkpolicy_reconciler.go @@ -0,0 +1,76 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package networkpolicy + +import ( + "fmt" + + "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/infrastructure" + "github.com/eclipse-che/che-operator/pkg/provision" + networkingv1 "k8s.io/api/networking/v1" + "sigs.k8s.io/controller-runtime/pkg/reconcile" +) + +type NetworkPoliciesReconciler struct{} + +func (r *NetworkPoliciesReconciler) Reconcile(cheCtx *chetypes.CheContext) (reconcile.Result, bool, error) { + if cheCtx.CheCluster.IsNetworkPoliciesEnabled() { + if err := r.syncAll(cheCtx); err != nil { + return reconcile.Result{}, + false, + fmt.Errorf("failed to reconcile NetworkPolicy: %w", err) + } + + return reconcile.Result{}, true, nil + } + + if err := r.deleteAll(cheCtx); err != nil { + return reconcile.Result{}, + false, + fmt.Errorf("failed to reconcile NetworkPolicy: %w", err) + } + + return reconcile.Result{}, true, nil +} + +func (r *NetworkPoliciesReconciler) Finalize(_ *chetypes.CheContext) bool { + return true +} + +func (r *NetworkPoliciesReconciler) syncAll(cheCtx *chetypes.CheContext) error { + networkPolicies, err := r.buildNetworkPolicies(cheCtx) + if err != nil { + return err + } + + for _, networkPolicy := range networkPolicies { + if err := provision.NetworkPolicy.Sync(cheCtx, networkPolicy); err != nil { + return err + } + } + + return nil +} + +func (r *NetworkPoliciesReconciler) deleteAll(cheCtx *chetypes.CheContext) error { + return provision.NetworkPolicy.DeleteAll(cheCtx, cheCtx.CheCluster.Namespace) +} + +func (r *NetworkPoliciesReconciler) buildNetworkPolicies(cheCtx *chetypes.CheContext) ([]*networkingv1.NetworkPolicy, error) { + if infrastructure.IsOpenShift() { + return r.buildOpenShiftNetworkPolicies(cheCtx) + } + + return r.buildKubernetesNetworkPolicies(cheCtx) +} diff --git a/pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go b/pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go new file mode 100644 index 0000000000..72ef607f1e --- /dev/null +++ b/pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go @@ -0,0 +1,167 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package networkpolicy + +import ( + "fmt" + + chev2 "github.com/eclipse-che/che-operator/api/v2" + "github.com/eclipse-che/che-operator/pkg/common/chetypes" + "github.com/eclipse-che/che-operator/pkg/common/infrastructure" + defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" + "github.com/eclipse-che/che-operator/pkg/common/test" + "github.com/eclipse-che/che-operator/pkg/common/utils" + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + networkingv1 "k8s.io/api/networking/v1" + "k8s.io/apimachinery/pkg/types" + "sigs.k8s.io/controller-runtime/pkg/client" +) + +var _ = Describe("NetworkPoliciesReconciler", func() { + var ( + cheCtx *chetypes.CheContext + reconciler *NetworkPoliciesReconciler + ) + + BeforeEach(func() { + reconciler = &NetworkPoliciesReconciler{} + cheCtx = env.NewCheCtxBuilder().WithEmptyCheCluster().Build() + }) + + AfterEach(func() { + Expect(env.Client.DeleteAllOf(env.Context, &networkingv1.NetworkPolicy{}, client.InNamespace(cheCtx.CheCluster.Namespace))).To(Succeed()) + Expect(env.Client.DeleteAllOf(env.Context, &chev2.CheCluster{}, client.InNamespace(cheCtx.CheCluster.Namespace))).To(Succeed()) + }) + + Context("Finalize", func() { + BeforeEach(func() { + test.Initialize(infrastructure.Kubernetes) + }) + + It("should report the component as finalized", func() { + Expect(reconciler.Finalize(cheCtx)).To(BeTrue()) + }) + }) + + Context("when NetworkPolicy is disabled", func() { + BeforeEach(func() { + test.Initialize(infrastructure.Kubernetes) + cheCtx.CheCluster.Spec.Networking.NetworkPolicy = &chev2.NetworkPolicy{Enabled: new(false)} + }) + + It("should delete NetworkPolicies created while enabled", func() { + By("provisioning NetworkPolicies as if enabled") + Expect(reconciler.syncAll(cheCtx)).To(Not(HaveOccurred())) + + By("confirming the NetworkPolicies exist") + npList := &networkingv1.NetworkPolicyList{} + Expect(cheCtx.ClusterAPI.Client.List(cheCtx.Context, npList)).To(Succeed()) + Expect(npList.Items).To(Not(BeEmpty())) + + By("reconciling") + test.Reconcile(cheCtx, reconciler.Reconcile) + + By("confirming the NetworkPolicies are gone") + npList = &networkingv1.NetworkPolicyList{} + Expect(cheCtx.ClusterAPI.Client.List(cheCtx.Context, npList)).To(Succeed()) + Expect(npList.Items).To(BeEmpty()) + }) + }) + + Context("when NetworkPolicy is enabled", func() { + BeforeEach(func() { + cheCtx.CheCluster.Spec.Networking.NetworkPolicy = &chev2.NetworkPolicy{Enabled: new(true)} + }) + + Context("on OpenShift", func() { + var expectedPolicyNames []string + + BeforeEach(func() { + test.Initialize(infrastructure.OpenShiftV4) + + expectedPolicyNames = []string{ + "allow-from-same-namespace", + "allow-from-openshift-ingress", + "allow-from-openshift-host-network", + "allow-from-openshift-monitoring", + "allow-from-workspaces", + fmt.Sprintf("allow-from-%s-operator", defaults.GetCheFlavor()), + "allow-all-egress", + } + }) + + It("should create the scoped OpenShift ingress policies and allow-all egress", func() { + test.Reconcile(cheCtx, reconciler.Reconcile) + + npList := &networkingv1.NetworkPolicyList{} + Expect(cheCtx.ClusterAPI.Client.List(cheCtx.Context, npList)).To(Succeed()) + Expect(npList.Items).To(HaveLen(len(expectedPolicyNames))) + + npNames := utils.Map(npList.Items, func(np networkingv1.NetworkPolicy) string { return np.Name }) + Expect(npNames).To(ConsistOf(expectedPolicyNames)) + }) + }) + + Context("on Kubernetes", func() { + var expectedPolicyNames []string + + BeforeEach(func() { + test.Initialize(infrastructure.Kubernetes) + + expectedPolicyNames = []string{ + "allow-all-egress", + "allow-all-ingress", + } + }) + + It("should create permissive allow-all ingress and egress policies", func() { + test.Reconcile(cheCtx, reconciler.Reconcile) + + npList := &networkingv1.NetworkPolicyList{} + Expect(cheCtx.ClusterAPI.Client.List(cheCtx.Context, npList)).To(Succeed()) + Expect(npList.Items).To(HaveLen(len(expectedPolicyNames))) + + npNames := utils.Map(npList.Items, func(np networkingv1.NetworkPolicy) string { return np.Name }) + Expect(npNames).To(ConsistOf(expectedPolicyNames)) + }) + + It("should revert out-of-band edits to a NetworkPolicy", func() { + test.Reconcile(cheCtx, reconciler.Reconcile) + + npKey := types.NamespacedName{Name: "allow-all-ingress", Namespace: cheCtx.CheCluster.Namespace} + + By("editing allow-all-ingress out of band") + np := &networkingv1.NetworkPolicy{} + Expect(cheCtx.ClusterAPI.Client.Get(cheCtx.Context, npKey, np)).To(Succeed()) + Expect(np.Spec.Ingress).To(Not(BeNil())) + + np.Spec.Ingress = nil + Expect(cheCtx.ClusterAPI.Client.Update(cheCtx.Context, np)).To(Succeed()) + + By("reading it back before reconciling") + np = &networkingv1.NetworkPolicy{} + Expect(cheCtx.ClusterAPI.Client.Get(cheCtx.Context, npKey, np)).To(Succeed()) + Expect(np.Spec.Ingress).To(BeNil()) + + By("reconciling a second time") + test.Reconcile(cheCtx, reconciler.Reconcile) + + By("reading it back after reconciling") + np = &networkingv1.NetworkPolicy{} + Expect(cheCtx.ClusterAPI.Client.Get(cheCtx.Context, npKey, np)).To(Succeed()) + Expect(np.Spec.Ingress).To(Not(BeNil())) + }) + }) + }) +}) diff --git a/pkg/reconciler/networkpolicy/suite_test.go b/pkg/reconciler/networkpolicy/suite_test.go new file mode 100644 index 0000000000..07224ce4b3 --- /dev/null +++ b/pkg/reconciler/networkpolicy/suite_test.go @@ -0,0 +1,41 @@ +// +// Copyright (c) 2019-2026 Red Hat, Inc. +// This program and the accompanying materials are made +// available under the terms of the Eclipse Public License 2.0 +// which is available at https://www.eclipse.org/legal/epl-2.0/ +// +// SPDX-License-Identifier: EPL-2.0 +// +// Contributors: +// Red Hat, Inc. - initial API and implementation +// + +package networkpolicy + +import ( + "testing" + + "github.com/eclipse-che/che-operator/pkg/common/test/envtest" + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + logf "sigs.k8s.io/controller-runtime/pkg/log" + "sigs.k8s.io/controller-runtime/pkg/log/zap" +) + +var env *envtest.Env + +func TestNetworkPolicy(t *testing.T) { + RegisterFailHandler(Fail) + RunSpecs(t, "NetworkPolicy Reconciler Suite") +} + +var _ = BeforeSuite(func() { + logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(true))) + env = envtest.Start() +}) + +var _ = AfterSuite(func() { + if env != nil { + env.Stop() + } +}) diff --git a/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go b/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go index 61741c34db..890300213e 100644 --- a/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go +++ b/vendor/github.com/devfile/devworkspace-operator/apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go @@ -351,14 +351,14 @@ type NetworkPolicyConfig struct { // is denied. If this field is specified as a non-empty list, exactly those rules apply // and the default rules no longer apply. // +kubebuilder:validation:Optional - Ingress []networkingv1.NetworkPolicyIngressRule `json:"ingress,omitempty"` + Ingress []networkingv1.NetworkPolicyIngressRule `json:"ingress"` // Egress defines the egress rules applied to DevWorkspace pods. If this field is not // specified, the default egress rule of the DevWorkspace Operator applies, which allows // all egress traffic. If this field is specified as an empty list, all egress traffic // from DevWorkspace pods is denied. If this field is specified as a non-empty list, // exactly those rules apply and the default rule no longer applies. // +kubebuilder:validation:Optional - Egress []networkingv1.NetworkPolicyEgressRule `json:"egress,omitempty"` + Egress []networkingv1.NetworkPolicyEgressRule `json:"egress"` } type Proxy struct { @@ -438,6 +438,7 @@ type ProjectCloneConfig struct { Image string `json:"image,omitempty"` // ImagePullPolicy configures the imagePullPolicy for the project clone container. // If undefined, the general setting .config.workspace.imagePullPolicy is used instead. + // If neither is set, defaults to IfNotPresent. ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"` // Resources defines the resource (cpu, memory) limits and requests for the project // clone container. To explicitly not specify a limit or request, define the resource @@ -449,7 +450,7 @@ type ProjectCloneConfig struct { type RestoreConfig struct { // ImagePullPolicy configures the imagePullPolicy for the restore container. - // If undefined, the general setting .config.workspace.imagePullPolicy is used instead. + // If undefined, defaults to IfNotPresent. ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"` // Resources defines the resource (cpu, memory) limits and requests for the restore // container. To explicitly not specify a limit or request, define the resource diff --git a/vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go b/vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go index 7b34e554be..7a071892cc 100644 --- a/vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go +++ b/vendor/github.com/devfile/devworkspace-operator/pkg/config/defaults.go @@ -61,6 +61,7 @@ var defaultConfig = &v1alpha1.OperatorConfiguration{ NetworkPolicy: nil, // Set per-platform in setDefaultNetworkPolicy() DefaultTemplate: nil, ProjectCloneConfig: &v1alpha1.ProjectCloneConfig{ + ImagePullPolicy: corev1.PullIfNotPresent, Resources: &corev1.ResourceRequirements{ Limits: corev1.ResourceList{ corev1.ResourceMemory: resource.MustParse("1Gi"), @@ -268,10 +269,28 @@ func GetDefaultNetworkPolicy(operatorNamespace string) ( ingressPolicyRules = defaultKubernetesIngressPolicyRules } - defaultConfig.Workspace.NetworkPolicy = &v1alpha1.NetworkPolicyConfig{ - Enabled: pointer.Bool(constants.DefaultNetworkPolicyEnabled), - Ingress: ingressPolicyRules, - Egress: defaultEgressPolicyRules, + // Return copies so callers can extend the rules without mutating package-level defaults + return deepCopyIngressRules(ingressPolicyRules), deepCopyEgressRules(defaultEgressPolicyRules), nil +} + +func deepCopyIngressRules(rules []networkingv1.NetworkPolicyIngressRule) []networkingv1.NetworkPolicyIngressRule { + if rules == nil { + return nil + } + copied := make([]networkingv1.NetworkPolicyIngressRule, len(rules)) + for i := range rules { + rules[i].DeepCopyInto(&copied[i]) + } + return copied +} + +func deepCopyEgressRules(rules []networkingv1.NetworkPolicyEgressRule) []networkingv1.NetworkPolicyEgressRule { + if rules == nil { + return nil + } + copied := make([]networkingv1.NetworkPolicyEgressRule, len(rules)) + for i := range rules { + rules[i].DeepCopyInto(&copied[i]) } - return ingressPolicyRules, defaultEgressPolicyRules, nil + return copied } diff --git a/vendor/modules.txt b/vendor/modules.txt index 0d1591dc37..cd07fd2db2 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -28,7 +28,7 @@ github.com/davecgh/go-spew/spew github.com/devfile/api/v2/pkg/apis/workspaces/v1alpha2 github.com/devfile/api/v2/pkg/attributes github.com/devfile/api/v2/pkg/devfile -# github.com/devfile/devworkspace-operator v0.2.1-0.20261008221424-9e9bab4780a9 +# github.com/devfile/devworkspace-operator v0.2.1-0.20261013204914-cd25c621588c ## explicit; go 1.26.0 github.com/devfile/devworkspace-operator/apis/controller/v1alpha1 github.com/devfile/devworkspace-operator/controllers/controller/devworkspacerouting From f10ff7598c981963ea576380afd8693670fb087e Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Wed, 14 Oct 2026 13:04:19 +0200 Subject: [PATCH 2/6] fixup Signed-off-by: Anatolii Bazko --- .golangci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.golangci.yml b/.golangci.yml index 0e8bf1a63b..724cd52b36 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -25,6 +25,11 @@ linters: - common-false-positives - legacy - std-error-handling + rules: + # Dot imports are allowed. + - linters: + - staticcheck + text: 'ST1001: should not use dot imports' paths: - third_party$ - builtin$ From af01c7dd120c7fe842e0cfeca1845746f01c3fdf Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Wed, 14 Oct 2026 16:57:16 +0200 Subject: [PATCH 3/6] fixup Signed-off-by: Anatolii Bazko --- pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go | 2 ++ pkg/reconciler/networkpolicy/suite_test.go | 2 ++ 2 files changed, 4 insertions(+) diff --git a/pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go b/pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go index 72ef607f1e..0be0b20687 100644 --- a/pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go +++ b/pkg/reconciler/networkpolicy/networkpolicy_reconciler_test.go @@ -10,6 +10,8 @@ // Red Hat, Inc. - initial API and implementation // +//go:build integration + package networkpolicy import ( diff --git a/pkg/reconciler/networkpolicy/suite_test.go b/pkg/reconciler/networkpolicy/suite_test.go index 07224ce4b3..767f21d65c 100644 --- a/pkg/reconciler/networkpolicy/suite_test.go +++ b/pkg/reconciler/networkpolicy/suite_test.go @@ -10,6 +10,8 @@ // Red Hat, Inc. - initial API and implementation // +//go:build integration + package networkpolicy import ( From 2f96152f75afe96126a567967f3be269f4827e78 Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Thu, 15 Oct 2026 09:13:56 +0200 Subject: [PATCH 4/6] fixup Signed-off-by: Anatolii Bazko --- .golangci.yml | 1 + api/v2/checluster_types.go | 2 +- .../manifests/che-operator.clusterserviceversion.yaml | 6 +++--- pkg/common/chelabels/labels.go | 4 ++-- pkg/common/operator-defaults/defaults.go | 4 ++++ pkg/provision/helper.go | 3 +++ 6 files changed, 14 insertions(+), 6 deletions(-) diff --git a/.golangci.yml b/.golangci.yml index 724cd52b36..b170dea3ca 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -30,6 +30,7 @@ linters: - linters: - staticcheck text: 'ST1001: should not use dot imports' + source: '\. "github\.com/onsi/(ginkgo(/v2)?|gomega)"' paths: - third_party$ - builtin$ diff --git a/api/v2/checluster_types.go b/api/v2/checluster_types.go index c438bc6aca..be24a2964a 100644 --- a/api/v2/checluster_types.go +++ b/api/v2/checluster_types.go @@ -349,7 +349,7 @@ type CheClusterSpecNetworking struct { Auth Auth `json:"auth"` // NetworkPolicy defines the NetworkPolicies the Operator provisions for Che components, // such as the gateway, the server, the dashboard and the registries. - // +kubebuilder:validation:Optional + // +optional NetworkPolicy *NetworkPolicy `json:"networkPolicy,omitempty"` } diff --git a/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml b/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml index fa6f2b2c19..8fd361879c 100644 --- a/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml +++ b/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml @@ -86,7 +86,7 @@ metadata: categories: Developer Tools certified: "false" containerImage: quay.io/eclipse/che-operator:next - createdAt: "2026-10-13T12:43:02Z" + createdAt: "2026-10-15T07:13:12Z" description: A Kube-native development solution that delivers portable and collaborative developer workspaces. features.operators.openshift.io/cnf: "false" @@ -108,7 +108,7 @@ metadata: operatorframework.io/arch.amd64: supported operatorframework.io/arch.arm64: supported operatorframework.io/os.linux: supported - name: eclipse-che.v7.124.0-1085.next + name: eclipse-che.v7.124.0-1086.next namespace: placeholder spec: apiservicedefinitions: {} @@ -1202,7 +1202,7 @@ spec: name: openvsx - image: quay.io/sclorg/postgresql-16-c9s:20260319 name: openvsx-postgres - version: 7.124.0-1085.next + version: 7.124.0-1086.next webhookdefinitions: - admissionReviewVersions: - v1 diff --git a/pkg/common/chelabels/labels.go b/pkg/common/chelabels/labels.go index a0cb6f0ad4..454c7917f1 100644 --- a/pkg/common/chelabels/labels.go +++ b/pkg/common/chelabels/labels.go @@ -14,13 +14,13 @@ package chelabels import ( "github.com/eclipse-che/che-operator/pkg/common/constants" - "github.com/eclipse-che/che-operator/pkg/deploy" + defaults "github.com/eclipse-che/che-operator/pkg/common/operator-defaults" ) func OperatorManaged(component string) map[string]string { return map[string]string{ constants.KubernetesComponentLabelKey: component, - constants.KubernetesManagedByLabelKey: deploy.GetManagedByLabel(), + constants.KubernetesManagedByLabelKey: defaults.GetOperatorName(), constants.KubernetesPartOfLabelKey: constants.CheEclipseOrg, } } diff --git a/pkg/common/operator-defaults/defaults.go b/pkg/common/operator-defaults/defaults.go index 2adde8bb99..fe8feaf05e 100644 --- a/pkg/common/operator-defaults/defaults.go +++ b/pkg/common/operator-defaults/defaults.go @@ -237,6 +237,10 @@ func GetCheFlavor() string { return defaultCheFlavor } +func GetOperatorName() string { + return GetCheFlavor() + "-operator" +} + func GetConsoleLinkName() string { if !initialized { Initialize() diff --git a/pkg/provision/helper.go b/pkg/provision/helper.go index d799200942..8fb54d1535 100644 --- a/pkg/provision/helper.go +++ b/pkg/provision/helper.go @@ -147,6 +147,9 @@ func deleteAllManaged( } if err := cw.DeleteAllOf(cheCtx.Context, obj, opts); err != nil { + if namespace == "" { + return fmt.Errorf("failed to delete %s: %w", k8sclient.GetObjectType(obj), err) + } return fmt.Errorf("failed to delete %s in %s: %w", k8sclient.GetObjectType(obj), namespace, err) } From dc5ce3b606cafcb412aa919d865bc0f0c7f7edac Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Thu, 15 Oct 2026 13:25:34 +0200 Subject: [PATCH 5/6] fixup Signed-off-by: Anatolii Bazko --- .../dev_workspace_config_network_policy.go | 11 ++ ...ev_workspace_config_network_policy_test.go | 149 ++++++++++++++---- 2 files changed, 130 insertions(+), 30 deletions(-) diff --git a/pkg/deploy/devworkspace/dev_workspace_config_network_policy.go b/pkg/deploy/devworkspace/dev_workspace_config_network_policy.go index 617bcfdde7..58461c469e 100644 --- a/pkg/deploy/devworkspace/dev_workspace_config_network_policy.go +++ b/pkg/deploy/devworkspace/dev_workspace_config_network_policy.go @@ -37,6 +37,17 @@ func updateNetworkPolicy(cheCtx *chetypes.CheContext, workspaceConfig *controlle workspaceConfig.NetworkPolicy.Egress = dwoEgressRules } + // Backward compatibility with Che 7.123 and earlier, where workspace isolation was driven by the + // Che-wide `spec.networking.networkPolicy.enabled` flag and the Che Operator created the + // NetworkPolicies in the user namespace itself. That no longer happens: the usernamespace + // controller deletes those legacy policies on OpenShift, and DWO leaves isolation disabled unless + // `spec.devEnvironments.networking.networkPolicy.enabled` is set explicitly. Without this, an + // upgrade would silently lose isolation, so carry the legacy setting over — unless the user has + // already expressed an explicit choice in the devEnvironments section. + if workspaceConfig.NetworkPolicy.Enabled == nil && cheCtx.CheCluster.IsNetworkPoliciesEnabled() { + workspaceConfig.NetworkPolicy.Enabled = new(true) + } + return nil } diff --git a/pkg/deploy/devworkspace/dev_workspace_config_network_policy_test.go b/pkg/deploy/devworkspace/dev_workspace_config_network_policy_test.go index d08a5f2459..cf48d50459 100644 --- a/pkg/deploy/devworkspace/dev_workspace_config_network_policy_test.go +++ b/pkg/deploy/devworkspace/dev_workspace_config_network_policy_test.go @@ -27,7 +27,7 @@ import ( "sigs.k8s.io/controller-runtime/pkg/client" ) -func TestReconcileNetworkPolicy(t *testing.T) { +func TestDWONetworkPolicyRules(t *testing.T) { customIngressRule := networkingv1.NetworkPolicyIngressRule{ From: []networkingv1.NetworkPolicyPeer{ {PodSelector: &metav1.LabelSelector{MatchLabels: map[string]string{"app": "custom-ingress"}}}, @@ -70,50 +70,56 @@ func TestReconcileNetworkPolicy(t *testing.T) { assert.NoError(t, err) type testCase struct { - name string - networkPolicy *controllerv1alpha1.NetworkPolicyConfig - existedObjects []client.Object - expectedIngress []networkingv1.NetworkPolicyIngressRule - expectedEgress []networkingv1.NetworkPolicyEgressRule - expectedEnabled *bool + name string + dwoNetworkPolicyConfig *controllerv1alpha1.NetworkPolicyConfig + existedObjects []client.Object + expectedDWOIngressRules []networkingv1.NetworkPolicyIngressRule + expectedDWOEgressRules []networkingv1.NetworkPolicyEgressRule } testCases := []testCase{ { - name: "Set default rules and the rule allowing traffic from Che operands when the network policy is not set", - networkPolicy: nil, - expectedIngress: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), - expectedEgress: defaultEgressRules, + name: "Set default rules and the rule allowing traffic from Che operands when the network policy is not set", + dwoNetworkPolicyConfig: nil, + expectedDWOIngressRules: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), + expectedDWOEgressRules: defaultEgressRules, }, { - name: "Set default rules and the rule allowing traffic from Che operands when the network policy is empty", - networkPolicy: &controllerv1alpha1.NetworkPolicyConfig{}, - expectedIngress: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), - expectedEgress: defaultEgressRules, + name: "Set default rules and the rule allowing traffic from Che operands when the network policy is empty", + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{}, + expectedDWOIngressRules: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), + expectedDWOEgressRules: defaultEgressRules, }, { name: "Keep custom ingress rules and not add the rule allowing traffic from Che operands", - networkPolicy: &controllerv1alpha1.NetworkPolicyConfig{ + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{ Ingress: []networkingv1.NetworkPolicyIngressRule{customIngressRule}, }, - expectedIngress: []networkingv1.NetworkPolicyIngressRule{customIngressRule}, - expectedEgress: defaultEgressRules, + expectedDWOIngressRules: []networkingv1.NetworkPolicyIngressRule{customIngressRule}, + expectedDWOEgressRules: defaultEgressRules, }, { name: "Don't Lose the empty rule lists when they are written to the DWOC", - networkPolicy: &controllerv1alpha1.NetworkPolicyConfig{ + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{ Ingress: []networkingv1.NetworkPolicyIngressRule{}, Egress: []networkingv1.NetworkPolicyEgressRule{}, }, - expectedIngress: []networkingv1.NetworkPolicyIngressRule{}, - expectedEgress: []networkingv1.NetworkPolicyEgressRule{}, + expectedDWOIngressRules: []networkingv1.NetworkPolicyIngressRule{}, + expectedDWOEgressRules: []networkingv1.NetworkPolicyEgressRule{}, }, { - name: "Override the network policy already set in the DWOC with the default rules when the network policy is not set", - networkPolicy: nil, - existedObjects: []client.Object{existedDWOC}, - expectedIngress: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), - expectedEgress: defaultEgressRules, + name: "Override the network policy already set in the DWOC with the default rules when the network policy is not set", + dwoNetworkPolicyConfig: nil, + existedObjects: []client.Object{existedDWOC}, + expectedDWOIngressRules: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), + expectedDWOEgressRules: defaultEgressRules, + }, + { + name: "Override the network policy already set in the DWOC with the default rules when the network policy is empty", + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{}, + existedObjects: []client.Object{existedDWOC}, + expectedDWOIngressRules: slices.Concat(defaultIngressRules, []networkingv1.NetworkPolicyIngressRule{buildAllowFromCheIngressRule("eclipse-che")}), + expectedDWOEgressRules: defaultEgressRules, }, } @@ -127,7 +133,7 @@ func TestReconcileNetworkPolicy(t *testing.T) { }, Spec: chev2.CheClusterSpec{ DevEnvironments: chev2.CheClusterDevEnvironments{ - Networking: &chev2.DevEnvironmentNetworking{NetworkPolicy: testCase.networkPolicy}, + Networking: &chev2.DevEnvironmentNetworking{NetworkPolicy: testCase.dwoNetworkPolicyConfig}, }, }, }).WithObjects(testCase.existedObjects...).Build() @@ -148,9 +154,92 @@ func TestReconcileNetworkPolicy(t *testing.T) { dwocNetworkPolicy := dwoc.Config.Workspace.NetworkPolicy assert.NotNil(t, dwocNetworkPolicy) - assert.Equal(t, testCase.expectedIngress, dwocNetworkPolicy.Ingress) - assert.Equal(t, testCase.expectedEgress, dwocNetworkPolicy.Egress) - assert.Equal(t, testCase.expectedEnabled, dwocNetworkPolicy.Enabled) + assert.Equal(t, testCase.expectedDWOIngressRules, dwocNetworkPolicy.Ingress) + assert.Equal(t, testCase.expectedDWOEgressRules, dwocNetworkPolicy.Egress) + }) + } +} + +func TestDWONetworkPolicyEnabled(t *testing.T) { + type testCase struct { + name string + dwoNetworkPolicyConfig *controllerv1alpha1.NetworkPolicyConfig + cheNetworkPolicyConfig *chev2.NetworkPolicy + expectedDWONetworkPolicyEnabled *bool + } + + testCases := []testCase{ + { + name: "Do not set the DWO network policy enabled flag when it is not set in the Che or the DWO network policy configuration", + cheNetworkPolicyConfig: &chev2.NetworkPolicy{ + Enabled: nil, + }, + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{ + Enabled: nil, + }, + expectedDWONetworkPolicyEnabled: nil, + }, + { + name: "Do not set the DWO network policy enabled flag when the Che network policy is disabled", + cheNetworkPolicyConfig: &chev2.NetworkPolicy{ + Enabled: new(false), + }, + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{ + Enabled: nil, + }, + expectedDWONetworkPolicyEnabled: nil, + }, + { + name: "Set the DWO network policy enabled flag when the Che network policy is enabled", + cheNetworkPolicyConfig: &chev2.NetworkPolicy{ + Enabled: new(true), + }, + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{ + Enabled: nil, + }, + expectedDWONetworkPolicyEnabled: new(true), + }, + { + name: "Keep the DWO network policy enabled flag set in the dev environments networking configuration", + dwoNetworkPolicyConfig: &controllerv1alpha1.NetworkPolicyConfig{ + Enabled: new(true), + }, + expectedDWONetworkPolicyEnabled: new(true), + }, + } + + for _, testCase := range testCases { + t.Run(testCase.name, func(t *testing.T) { + cheCtx := test.NewCtxBuilder().WithCheCluster( + &chev2.CheCluster{ + ObjectMeta: metav1.ObjectMeta{ + Name: "eclipse-che", + Namespace: "eclipse-che", + }, + Spec: chev2.CheClusterSpec{ + Networking: chev2.CheClusterSpecNetworking{ + NetworkPolicy: testCase.cheNetworkPolicyConfig, + }, + DevEnvironments: chev2.CheClusterDevEnvironments{ + Networking: &chev2.DevEnvironmentNetworking{NetworkPolicy: testCase.dwoNetworkPolicyConfig}, + }, + }, + }).Build() + + devWorkspaceConfigReconciler := NewDevWorkspaceConfigReconciler() + test.EnsureReconcile(t, cheCtx, devWorkspaceConfigReconciler.Reconcile) + + dwoc := &controllerv1alpha1.DevWorkspaceOperatorConfig{} + err := cheCtx.ClusterAPI.Client.Get( + cheCtx.Context, + types.NamespacedName{Name: devWorkspaceConfigName, Namespace: "eclipse-che"}, + dwoc) + assert.NoError(t, err) + + assert.NotNil(t, dwoc.Config) + assert.NotNil(t, dwoc.Config.Workspace) + assert.NotNil(t, dwoc.Config.Workspace.NetworkPolicy) + assert.Equal(t, testCase.expectedDWONetworkPolicyEnabled, dwoc.Config.Workspace.NetworkPolicy.Enabled) }) } } From 375c31e52e9d898ed709816f10eeea5e0eb3e85f Mon Sep 17 00:00:00 2001 From: Anatolii Bazko Date: Fri, 16 Oct 2026 11:11:53 +0200 Subject: [PATCH 6/6] fixup Signed-off-by: Anatolii Bazko --- api/v2/checluster_types.go | 11 +++++++++++ .../che-operator.clusterserviceversion.yaml | 6 +++--- .../manifests/org.eclipse.che_checlusters.yaml | 14 +++++++++++++- config/crd/bases/org.eclipse.che_checlusters.yaml | 13 ++++++++++++- deploy/deployment/kubernetes/combined.yaml | 13 ++++++++++++- ...s.org.eclipse.che.CustomResourceDefinition.yaml | 13 ++++++++++++- deploy/deployment/openshift/combined.yaml | 13 ++++++++++++- ...s.org.eclipse.che.CustomResourceDefinition.yaml | 13 ++++++++++++- ...s.org.eclipse.che.CustomResourceDefinition.yaml | 13 ++++++++++++- 9 files changed, 99 insertions(+), 10 deletions(-) diff --git a/api/v2/checluster_types.go b/api/v2/checluster_types.go index be24a2964a..e9b02a6310 100644 --- a/api/v2/checluster_types.go +++ b/api/v2/checluster_types.go @@ -371,6 +371,11 @@ type DevEnvironmentNetworking struct { // When enabled and no egress rules are specified, the Operator sets the default // DevWorkspace Operator egress rules. If custom egress rules are specified, only // those rules apply. + // + // When `enabled` is not set here, it falls back to the Che-wide + // `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + // is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + // keeping the NetworkPolicies for the Che components. // +kubebuilder:validation:Optional NetworkPolicy *controllerv1alpha1.NetworkPolicyConfig `json:"networkPolicy,omitempty"` } @@ -400,6 +405,12 @@ type NetworkPolicy struct { // is not known to the Operator. Enabling this setting on Kubernetes does not restrict any traffic // by itself: administrators are expected to provision their own NetworkPolicies. // + // This setting also drives workspace isolation when `spec.devEnvironments.networking.networkPolicy` + // does not define `enabled`: setting this field to `true` additionally enables the NetworkPolicies + // that the DevWorkspace Operator provisions for each DevWorkspace. To protect the Che components + // without isolating the workspaces, explicitly set + // `spec.devEnvironments.networking.networkPolicy.enabled` to `false`. + // // +kubebuilder:default:=false // +kubebuilder:validation:Optional Enabled *bool `json:"enabled,omitempty"` diff --git a/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml b/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml index 8fd361879c..d219f71251 100644 --- a/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml +++ b/bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml @@ -86,7 +86,7 @@ metadata: categories: Developer Tools certified: "false" containerImage: quay.io/eclipse/che-operator:next - createdAt: "2026-10-15T07:13:12Z" + createdAt: "2026-10-16T09:11:33Z" description: A Kube-native development solution that delivers portable and collaborative developer workspaces. features.operators.openshift.io/cnf: "false" @@ -108,7 +108,7 @@ metadata: operatorframework.io/arch.amd64: supported operatorframework.io/arch.arm64: supported operatorframework.io/os.linux: supported - name: eclipse-che.v7.124.0-1086.next + name: eclipse-che.v7.124.0-1087.next namespace: placeholder spec: apiservicedefinitions: {} @@ -1202,7 +1202,7 @@ spec: name: openvsx - image: quay.io/sclorg/postgresql-16-c9s:20260319 name: openvsx-postgres - version: 7.124.0-1086.next + version: 7.124.0-1087.next webhookdefinitions: - admissionReviewVersions: - v1 diff --git a/bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml b/bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml index 9ef9659c7a..78b534b76e 100644 --- a/bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml +++ b/bundle/next/eclipse-che/manifests/org.eclipse.che_checlusters.yaml @@ -24825,6 +24825,11 @@ spec: When enabled and no egress rules are specified, the Operator sets the default DevWorkspace Operator egress rules. If custom egress rules are specified, only those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. properties: egress: description: |- @@ -29434,7 +29439,14 @@ spec: \ ingress controller\nis not known to the Operator. Enabling\ \ this setting on Kubernetes does not restrict any traffic\n\ by itself: administrators are expected to provision their\ - \ own NetworkPolicies." + \ own NetworkPolicies.\n\nThis setting also drives workspace\ + \ isolation when `spec.devEnvironments.networking.networkPolicy`\n\ + does not define `enabled`: setting this field to `true`\ + \ additionally enables the NetworkPolicies\nthat the DevWorkspace\ + \ Operator provisions for each DevWorkspace. To protect\ + \ the Che components\nwithout isolating the workspaces,\ + \ explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled`\ + \ to `false`." type: boolean type: object tlsSecretName: diff --git a/config/crd/bases/org.eclipse.che_checlusters.yaml b/config/crd/bases/org.eclipse.che_checlusters.yaml index 13244bd02f..38bc6b9358 100644 --- a/config/crd/bases/org.eclipse.che_checlusters.yaml +++ b/config/crd/bases/org.eclipse.che_checlusters.yaml @@ -24714,6 +24714,11 @@ spec: When enabled and no egress rules are specified, the Operator sets the default DevWorkspace Operator egress rules. If custom egress rules are specified, only those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. properties: egress: description: |- @@ -29302,7 +29307,13 @@ spec: cluster's ingress controller\nis not known to the Operator. Enabling this setting on Kubernetes does not restrict any traffic\nby itself: administrators are expected to provision - their own NetworkPolicies." + their own NetworkPolicies.\n\nThis setting also drives workspace + isolation when `spec.devEnvironments.networking.networkPolicy`\ndoes + not define `enabled`: setting this field to `true` additionally + enables the NetworkPolicies\nthat the DevWorkspace Operator + provisions for each DevWorkspace. To protect the Che components\nwithout + isolating the workspaces, explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled` + to `false`." type: boolean type: object tlsSecretName: diff --git a/deploy/deployment/kubernetes/combined.yaml b/deploy/deployment/kubernetes/combined.yaml index c79e2e15e2..3f2bffcdd4 100644 --- a/deploy/deployment/kubernetes/combined.yaml +++ b/deploy/deployment/kubernetes/combined.yaml @@ -24735,6 +24735,11 @@ spec: When enabled and no egress rules are specified, the Operator sets the default DevWorkspace Operator egress rules. If custom egress rules are specified, only those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. properties: egress: description: |- @@ -29323,7 +29328,13 @@ spec: cluster's ingress controller\nis not known to the Operator. Enabling this setting on Kubernetes does not restrict any traffic\nby itself: administrators are expected to provision - their own NetworkPolicies." + their own NetworkPolicies.\n\nThis setting also drives workspace + isolation when `spec.devEnvironments.networking.networkPolicy`\ndoes + not define `enabled`: setting this field to `true` additionally + enables the NetworkPolicies\nthat the DevWorkspace Operator + provisions for each DevWorkspace. To protect the Che components\nwithout + isolating the workspaces, explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled` + to `false`." type: boolean type: object tlsSecretName: diff --git a/deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml b/deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml index a754e46a13..ed61532045 100644 --- a/deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml +++ b/deploy/deployment/kubernetes/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml @@ -24730,6 +24730,11 @@ spec: When enabled and no egress rules are specified, the Operator sets the default DevWorkspace Operator egress rules. If custom egress rules are specified, only those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. properties: egress: description: |- @@ -29318,7 +29323,13 @@ spec: cluster's ingress controller\nis not known to the Operator. Enabling this setting on Kubernetes does not restrict any traffic\nby itself: administrators are expected to provision - their own NetworkPolicies." + their own NetworkPolicies.\n\nThis setting also drives workspace + isolation when `spec.devEnvironments.networking.networkPolicy`\ndoes + not define `enabled`: setting this field to `true` additionally + enables the NetworkPolicies\nthat the DevWorkspace Operator + provisions for each DevWorkspace. To protect the Che components\nwithout + isolating the workspaces, explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled` + to `false`." type: boolean type: object tlsSecretName: diff --git a/deploy/deployment/openshift/combined.yaml b/deploy/deployment/openshift/combined.yaml index 6d88631eb8..be8919e013 100644 --- a/deploy/deployment/openshift/combined.yaml +++ b/deploy/deployment/openshift/combined.yaml @@ -24735,6 +24735,11 @@ spec: When enabled and no egress rules are specified, the Operator sets the default DevWorkspace Operator egress rules. If custom egress rules are specified, only those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. properties: egress: description: |- @@ -29323,7 +29328,13 @@ spec: cluster's ingress controller\nis not known to the Operator. Enabling this setting on Kubernetes does not restrict any traffic\nby itself: administrators are expected to provision - their own NetworkPolicies." + their own NetworkPolicies.\n\nThis setting also drives workspace + isolation when `spec.devEnvironments.networking.networkPolicy`\ndoes + not define `enabled`: setting this field to `true` additionally + enables the NetworkPolicies\nthat the DevWorkspace Operator + provisions for each DevWorkspace. To protect the Che components\nwithout + isolating the workspaces, explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled` + to `false`." type: boolean type: object tlsSecretName: diff --git a/deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml b/deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml index 3a9feb848d..c2049480e8 100644 --- a/deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml +++ b/deploy/deployment/openshift/objects/checlusters.org.eclipse.che.CustomResourceDefinition.yaml @@ -24730,6 +24730,11 @@ spec: When enabled and no egress rules are specified, the Operator sets the default DevWorkspace Operator egress rules. If custom egress rules are specified, only those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. properties: egress: description: |- @@ -29318,7 +29323,13 @@ spec: cluster's ingress controller\nis not known to the Operator. Enabling this setting on Kubernetes does not restrict any traffic\nby itself: administrators are expected to provision - their own NetworkPolicies." + their own NetworkPolicies.\n\nThis setting also drives workspace + isolation when `spec.devEnvironments.networking.networkPolicy`\ndoes + not define `enabled`: setting this field to `true` additionally + enables the NetworkPolicies\nthat the DevWorkspace Operator + provisions for each DevWorkspace. To protect the Che components\nwithout + isolating the workspaces, explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled` + to `false`." type: boolean type: object tlsSecretName: diff --git a/helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml b/helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml index a754e46a13..ed61532045 100644 --- a/helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml +++ b/helmcharts/next/crds/checlusters.org.eclipse.che.CustomResourceDefinition.yaml @@ -24730,6 +24730,11 @@ spec: When enabled and no egress rules are specified, the Operator sets the default DevWorkspace Operator egress rules. If custom egress rules are specified, only those rules apply. + + When `enabled` is not set here, it falls back to the Che-wide + `spec.networking.networkPolicy.enabled` flag: if that flag is `true`, workspace isolation + is enabled as well. Set `enabled` to `false` explicitly to opt the workspaces out while + keeping the NetworkPolicies for the Che components. properties: egress: description: |- @@ -29318,7 +29323,13 @@ spec: cluster's ingress controller\nis not known to the Operator. Enabling this setting on Kubernetes does not restrict any traffic\nby itself: administrators are expected to provision - their own NetworkPolicies." + their own NetworkPolicies.\n\nThis setting also drives workspace + isolation when `spec.devEnvironments.networking.networkPolicy`\ndoes + not define `enabled`: setting this field to `true` additionally + enables the NetworkPolicies\nthat the DevWorkspace Operator + provisions for each DevWorkspace. To protect the Che components\nwithout + isolating the workspaces, explicitly set\n`spec.devEnvironments.networking.networkPolicy.enabled` + to `false`." type: boolean type: object tlsSecretName: