API Reference¶
Packages¶
solar.opendefense.cloud/v1alpha1¶
Package v1alpha1 is the v1alpha1 version of the API.
AgentCredentialConfig¶
AgentCredentialConfig is the non-secret part of a Target's agent connection.
Appears in: - ReleaseConfig
| Field | Description | Default | Validation |
|---|---|---|---|
apiServerURL string |
APIServerURL is the SolAr cluster's kube-apiserver as target clusters reach it. | ||
caData integer array |
CAData is the PEM CA bundle for APIServerURL, base64-encoded in JSON. Empty uses the system roots. |
Optional: {} |
|
targetName string |
TargetName and TargetNamespace name the Target the agent reports for. | ||
targetNamespace string |
BootstrapConfig¶
BootstrapConfig defines the render config for a bootstrap.
Appears in: - RenderTaskSpec - RendererConfig
| Field | Description | Default | Validation |
|---|---|---|---|
chart ChartConfig |
Chart is the ChartConfig for the rendered chart. | ||
input BootstrapInput |
Input is the input of the bootstrap. |
BootstrapInput¶
BootstrapInput defines the inputs to render a bootstrap.
Appears in: - BootstrapConfig
| Field | Description | Default | Validation |
|---|---|---|---|
releases object (keys:string, values:ResolvedResourceAccess) |
|||
userdata RawExtension |
Userdata is additional data to be rendered into the bootstrap chart values. |
ChartConfig¶
ChartConfig defines parameters for the rendered chart.
Appears in: - BootstrapConfig - ReleaseConfig
| Field | Description | Default | Validation |
|---|---|---|---|
name string |
Name is the name of the chart. | ||
description string |
Description is the description of the chart. | ||
version string |
Version is the version of the chart. | ||
appVersion string |
AppVersion is the version of the app. |
ComponentVersion¶
ComponentVersion represents an OCM component available in the solution catalog.
Appears in: - ComponentVersionList
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec ComponentVersionSpec |
|||
status ComponentVersionStatus |
ComponentVersionList¶
ComponentVersionList contains a list of ComponentVersion resources.
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ListMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
items ComponentVersion array |
ComponentVersionSpec¶
ComponentVersionSpec defines the desired state of a ComponentVersion.
Appears in: - ComponentVersion
| Field | Description | Default | Validation |
|---|---|---|---|
componentName string |
ComponentName is the OCM component name, e.g. "opendefense.cloud/arc". | ||
scheme string |
Scheme is the scheme to access the component. | ||
registry string |
Registry is the registry where the component is stored. | ||
repository string |
Repository is the repository where the component is stored. | ||
tag string |
Tag is a version of the component. | ||
digest string |
Digest is the full manifest digest ("sha256: descriptor this ComponentVersion was discovered from. The controller re-checks it for availability, and registry delete events are matched on it. Discovery always records it, so it is empty only on ComponentVersions created before this field existed. Those report Available=Unknown/NoDigest until they are deleted and re-discovered. The scan does not backfill them, because it never updates a ComponentVersion that already exists. |
Optional: {} |
|
resources object (keys:string, values:ResourceAccess) |
Resources are Resources that are within the ComponentVersion. | ||
entrypoint Entrypoint |
Entrypoint is the entrypoint for deploying a ComponentVersion. |
ComponentVersionStatus¶
ComponentVersionStatus defines the observed state of a ComponentVersion.
Appears in: - ComponentVersion
| Field | Description | Default | Validation |
|---|---|---|---|
conditions Condition array |
Conditions represent the latest available observations of a ComponentVersion's state. | Optional: {} |
Entrypoint¶
Entrypoint defines the entrypoint for deploying a ComponentVersion.
Appears in: - ComponentVersionSpec - ReleaseInput
| Field | Description | Default | Validation |
|---|---|---|---|
resourceName string |
ResourceName is the Name of the Resource to use as the entrypoint. | ||
type EntrypointType |
Type of entrypoint. |
EntrypointType¶
Underlying type: string
EntrypointType is the Type of Entrypoint.
Appears in: - Entrypoint
| Field | Description |
|---|---|
kro |
|
helm |
HelmResourceMetadata¶
HelmResourceMetadata contains metadata extracted from a Helm chart resource during discovery.
Appears in: - ResolvedResourceAccess - ResourceAccess
| Field | Description | Default | Validation |
|---|---|---|---|
name string |
Name of the Helm chart. | ||
description string |
Description of the Helm chart. | ||
version string |
Version of the Helm chart. | ||
appVersion string |
AppVersion of the application deployed by the chart. |
ObjectReference¶
ObjectReference references another resource by name, optionally in a different namespace. When Namespace is empty, the referenced resource is assumed to live in the same namespace as the referencing object. Cross-namespace references require a ReferenceGrant in the referenced resource's namespace that grants access to the referencing object's namespace.
Appears in: - RegistryBindingSpec - ReleaseBindingSpec - ReleaseSpec - RenderArtifactSpec - RenderBindingSpec - TargetSpec
| Field | Description | Default | Validation |
|---|---|---|---|
name string |
Name is the name of the referenced resource. | Required: {} |
|
namespace string |
Namespace is the namespace of the referenced resource. If empty, the resource is assumed to be in the same namespace as the referencing object. |
Optional: {} |
PreflightCheck¶
PreflightCheck is one health-check result. It is a metav1.Condition minus ObservedGeneration and LastTransitionTime: a pushed snapshot knows neither.
Appears in: - PreflightReport
| Field | Description | Default | Validation |
|---|---|---|---|
type string |
Type is a stable PascalCase identifier (e.g. FluxCrds). Checks stay in the report; every check feeds the Target's PreflightReady aggregate. |
||
status ConditionStatus |
Status maps onto metav1.Condition: Unknown means the check could not be evaluated, distinct from a check that ran and failed. |
||
reason string |
Reason is a PascalCase machine reason; always set. | ||
message string |
Message is the human-readable detail. | Optional: {} |
PreflightReport¶
PreflightReport holds the agent's health-check results.
Appears in: - TargetReportSpec
| Field | Description | Default | Validation |
|---|---|---|---|
checks PreflightCheck array |
Checks are sorted by Type so equal reports compare equal. | Optional: {} |
Profile¶
Profile represents the link between a Release and a set of matching Targets the Release is intended to be deployed to.
Deletion is a destructive, cascading operation: deleting a Profile deletes all owned ReleaseBindings. To remove a Profile without triggering undeployment, first remove or relabel all matching Targets so the Profile controller deletes the ReleaseBindings itself, then delete the Profile once it has no owned bindings.
Appears in: - ProfileList
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec ProfileSpec |
|||
status ProfileStatus |
ProfileList¶
ProfileList contains a list of Profile resources.
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ListMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
items Profile array |
ProfileSpec¶
ProfileSpec defines the desired state of a Profile. It points to a Release and defines target selection criteria for Targets this Release is intended to be deployed to.
Appears in: - Profile
| Field | Description | Default | Validation |
|---|---|---|---|
releaseRef LocalObjectReference |
ReleaseRef is a reference to a Release. It points to the Release that is intended to be deployed to all Targets identified by the TargetSelector. |
Required: {} |
|
targetSelector LabelSelector |
TargetSelector is a label-based filter to identify the Targets this Release is intended to be deployed to. |
Optional: {} |
|
userdata RawExtension |
Userdata contains arbitrary custom data or configuration which is passed to all Targets associated with this Profile. |
Optional: {} |
ProfileStatus¶
ProfileStatus defines the observed state of a Profile.
Appears in: - Profile
| Field | Description | Default | Validation |
|---|---|---|---|
matchedTargets integer |
MatchedTargets is the total number of Targets matching the target selection criteria. | Optional: {} |
|
conditions Condition array |
Conditions represent the latest available observations of the Profile's state. |
ReferenceGrant¶
ReferenceGrant grants namespaces listed in From permission to reference resource types listed in To within the namespace where this ReferenceGrant lives.
This enables cross-namespace use-cases such as a Profile in one namespace matching Targets in another namespace, or a ReleaseBinding referencing a Registry defined in a shared infrastructure namespace.
Appears in: - ReferenceGrantList
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec ReferenceGrantSpec |
ReferenceGrantFromSubject¶
ReferenceGrantFromSubject identifies the group, kind, and namespace of a resource that is permitted to reference resources in the namespace where the ReferenceGrant lives.
Appears in: - ReferenceGrantSpec
| Field | Description | Default | Validation |
|---|---|---|---|
group string |
Group is the API group of the referencing resource. Use "" for the core API group. |
Required: {} |
|
kind string |
Kind is the kind of the referencing resource (e.g. "Profile", "Target"). | Required: {} |
|
namespace string |
Namespace is the namespace of the referencing resource. A single namespace is allowed per From entry to avoid overly broad grants. |
Required: {} |
ReferenceGrantList¶
ReferenceGrantList contains a list of ReferenceGrant resources.
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ListMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
items ReferenceGrant array |
ReferenceGrantSpec¶
ReferenceGrantSpec defines the desired state of a ReferenceGrant.
Appears in: - ReferenceGrant
| Field | Description | Default | Validation |
|---|---|---|---|
from ReferenceGrantFromSubject array |
From is the list of resources that are permitted to reference resources in this namespace. Each entry specifies the group, kind, and namespace of an allowed referencing resource. |
MinItems: 1 |
|
to ReferenceGrantToTarget array |
To is the list of resource types in this namespace that may be referenced from the resources listed in From. |
MinItems: 1 |
ReferenceGrantToTarget¶
ReferenceGrantToTarget specifies the group and kind of resource that may be referenced. Resource names are intentionally excluded: a namespace-scoped grant already limits the blast radius, and name restrictions rarely provide meaningful security.
Appears in: - ReferenceGrantSpec
| Field | Description | Default | Validation |
|---|---|---|---|
group string |
Group is the API group of the referenced resource. Use "" for the core API group. |
Required: {} |
|
kind string |
Kind is the kind of the referenced resource (e.g. "Target", "Registry"). | Required: {} |
Registry¶
Registry represents an OCI registry that can be used as a source or destination for artifacts.
Appears in: - RegistryList
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec RegistrySpec |
|||
status RegistryStatus |
RegistryBinding¶
RegistryBinding declares that a specific Target is allowed to use a specific Registry.
Appears in: - RegistryBindingList
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec RegistryBindingSpec |
|||
status RegistryBindingStatus |
RegistryBindingList¶
RegistryBindingList contains a list of RegistryBinding resources.
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ListMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
items RegistryBinding array |
RegistryBindingSpec¶
RegistryBindingSpec defines the desired state of a RegistryBinding.
Appears in: - RegistryBinding
| Field | Description | Default | Validation |
|---|---|---|---|
targetRef ObjectReference |
TargetRef references the Target this binding applies to. When Namespace is set, the Target resides in a different namespace than this RegistryBinding; cross-namespace references require a ReferenceGrant in the Target's namespace that permits this RegistryBinding's namespace. |
||
registryRef LocalObjectReference |
RegistryRef references the Registry being bound. |
RegistryBindingStatus¶
RegistryBindingStatus defines the observed state of a RegistryBinding.
Appears in: - RegistryBinding
| Field | Description | Default | Validation |
|---|---|---|---|
conditions Condition array |
Conditions represent the latest available observations of a RegistryBinding's state. | Optional: {} |
RegistryList¶
RegistryList contains a list of Registry resources.
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ListMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
items Registry array |
RegistrySpec¶
RegistrySpec defines the desired state of a Registry.
Appears in: - Registry
| Field | Description | Default | Validation |
|---|---|---|---|
hostname string |
Hostname is the registry endpoint (e.g. "registry.example.com:5000"). | ||
plainHTTP boolean |
PlainHTTP uses HTTP instead of HTTPS for connections to this registry. | Optional: {} |
|
solarSecretRef LocalObjectReference |
SolarSecretRef references a Secret in the same namespace with credentials to access this registry from the SolAr cluster. Required if this registry is used as a render target. |
Optional: {} |
|
targetPullSecretName string |
TargetPullSecretName is the name of the Secret on the target cluster that contains credentials to pull from this registry. SolAr renders this name into target manifests (e.g. Flux OCIRepository.spec.secretRef.name) but never reads the Secret itself. The cluster maintainer must provision a Secret with this name on each target. Omit for anonymous pull. |
Optional: {} |
|
flavor string |
Flavor identifies the registry type for discovery webhook routing (e.g. "zot"). Required when WebhookPath is set. |
Optional: {} |
|
webhookPath string |
WebhookPath is the HTTP path on which the discovery worker listens for push notifications from this registry. Leave empty to disable webhook-based discovery; set ScanInterval to enable scan mode instead. |
Optional: {} |
|
scanInterval Duration |
ScanInterval controls how often the discovery worker performs a full scan of this registry. Leave unset to disable scan mode entirely. |
Optional: {} |
RegistryStatus¶
RegistryStatus defines the observed state of a Registry.
Appears in: - Registry
| Field | Description | Default | Validation |
|---|---|---|---|
conditions Condition array |
Conditions represent the latest available observations of a Registry's state. | Optional: {} |
Release¶
Release represents a specific deployment instance of a component. It combines a component version with deployment values and configuration for a particular use case.
Appears in: - ReleaseList
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec ReleaseSpec |
|||
status ReleaseStatus |
ReleaseBinding¶
ReleaseBinding declares that a Release should be deployed to a Target.
Appears in: - ReleaseBindingList
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec ReleaseBindingSpec |
|||
status ReleaseBindingStatus |
ReleaseBindingList¶
ReleaseBindingList contains a list of ReleaseBinding resources.
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ListMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
items ReleaseBinding array |
ReleaseBindingSpec¶
ReleaseBindingSpec defines the desired state of a ReleaseBinding.
Appears in: - ReleaseBinding
| Field | Description | Default | Validation |
|---|---|---|---|
targetRef ObjectReference |
TargetRef references the Target this release is bound to. When Namespace is set, the Target resides in a different namespace than this ReleaseBinding; cross-namespace references require a ReferenceGrant in the target's namespace that grants access to this ReleaseBinding's namespace. |
||
releaseRef LocalObjectReference |
ReleaseRef references the Release to deploy. |
ReleaseBindingStatus¶
ReleaseBindingStatus defines the observed state of a ReleaseBinding.
Appears in: - ReleaseBinding
| Field | Description | Default | Validation |
|---|---|---|---|
conditions Condition array |
Conditions represent the latest available observations of a ReleaseBinding's state. | Optional: {} |
ReleaseComponent¶
ReleaseComponent is a reference to a component.
Appears in: - ReleaseInput
| Field | Description | Default | Validation |
|---|---|---|---|
name string |
Name is the name of the component. | ||
ref string |
Ref is the OCM component version reference the renderer resolves to fetch the component's helm values template, in the form "[ Empty disables values-template rendering for this release. |
Optional: {} |
ReleaseConfig¶
ReleaseConfig defines the render config for a release.
Appears in: - RenderTaskSpec - RendererConfig
| Field | Description | Default | Validation |
|---|---|---|---|
chart ChartConfig |
Chart is the ChartConfig for the rendered chart. | ||
input ReleaseInput |
Input is the input of the release. | ||
targetNamespace string |
TargetNamespace is the namespace the Component gets deployed to. | ||
values RawExtension |
Values are additional values to be rendered into the release chart. | ||
agentCredential AgentCredentialConfig |
AgentCredential, when set, makes the renderer add the solar-agent connection values for one Target. It holds no secret: the token reaches the renderer through RenderTaskSpec.TargetCredentialSecretRef. |
Optional: {} |
ReleaseInput¶
ReleaseInput defines the inputs to render a release.
Appears in: - ReleaseConfig
| Field | Description | Default | Validation |
|---|---|---|---|
component ReleaseComponent |
Component is a reference to the component. | ||
resources object (keys:string, values:ResolvedResourceAccess) |
Resources is the map of resolved resources in the component. | ||
entrypoint Entrypoint |
Entrypoint is the resource to be used as an entrypoint for deployment. | ||
pullSecrets object (keys:string, values:string) |
PullSecrets maps a registry hostname to the name of the pull secret on the target cluster, resolved from the target's RegistryBindings. |
Optional: {} |
ReleaseList¶
ReleaseList contains a list of Release resources.
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ListMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
items Release array |
ReleasePhase¶
Underlying type: string
ReleasePhase is the mutually-exclusive lifecycle state of one bound Release.
Validation: - Enum: [Pending Progressing Ready Degraded Failed]
Appears in: - ReleaseReport
| Field | Description |
|---|---|
Pending |
ReleasePending means no OCIRepository/HelmRelease pair exists yet for the Release. |
Progressing |
ReleaseProgressing means Flux is still working towards the desired state. |
Ready |
ReleaseReady means both halves of the pair report Ready=True. |
Degraded |
ReleaseDegraded means not ready, but a retry is still coming. |
Failed |
ReleaseFailed means not ready and no retry is coming. |
ReleaseReport¶
ReleaseReport is one bound Release's rolled-up state as reported by the agent.
Appears in: - TargetReportSpec
| Field | Description | Default | Validation |
|---|---|---|---|
name string |
Name is the untruncated Release name. | ||
namespace string |
Namespace is where the OCIRepository/HelmRelease pair lives. | ||
phase ReleasePhase |
Phase is the mutually-exclusive lifecycle state. | Enum: [Pending Progressing Ready Degraded Failed] |
|
revision string |
Revision is the chart version actually live, if known. | Optional: {} |
|
sourceConditions Condition array |
SourceConditions and HelmConditions are the verbatim Flux conditions of the pair, kept apart so a fetch/verify failure stays distinguishable from an apply failure. |
Optional: {} |
|
helmConditions Condition array |
Optional: {} |
ReleaseSpec¶
ReleaseSpec defines the desired state of a Release. It specifies which component version to release and its deployment configuration.
Appears in: - Release
| Field | Description | Default | Validation |
|---|---|---|---|
componentVersionRef ObjectReference |
ComponentVersionRef is a reference to the ComponentVersion to be released. It points to the specific version of a component that this release is based on. When Namespace is set, the ComponentVersion resides in another namespace; cross-namespace references require a ReferenceGrant in the ComponentVersion's namespace that grants access to this Release's namespace. |
||
targetNamespace string |
TargetNamespace is the namespace the ComponentVersion gets deployed to. | Optional: {} |
|
uniqueName string |
UniqueName is a logical identifier that ensures only one Release of this component is deployed per Target when multiple Profiles match. If not set, it defaults to the sanitized component name of the referenced ComponentVersion. Immutable once set. |
Optional: {} |
|
antiAffinity LabelSelector |
AntiAffinity defines exclusion rules. If another Release matching this label selector is already bound to the same Target, this Release should not be deployed there (or a conflict condition should be raised). |
Optional: {} |
|
values RawExtension |
Values contains deployment-specific values or configuration for the release. These values override defaults from the component version and are used during deployment. |
Optional: {} |
|
failedJobTTL integer |
failedJobTTL is the TTL in seconds after which a failed render job and its secrets are cleaned up. After this duration, the Kubernetes TTL controller will delete the Job and the controller will delete the Secrets (ConfigSecret, AuthSecret). On success, Job and Secrets are deleted immediately. If not set, defaults to 3600 (1 hour). |
Optional: {} |
|
priority integer |
Priority determines which Release takes precedence when multiple Releases share the same unique name on a Target. Higher values indicate higher priority. If not set, defaults to 0. |
Optional: {} |
ReleaseStatus¶
ReleaseStatus defines the observed state of a Release.
Appears in: - Release
| Field | Description | Default | Validation |
|---|---|---|---|
conditions Condition array |
Conditions represent the latest available observations of a Release's state. | Optional: {} |
|
renderTaskRef ObjectReference |
RenderTaskRef is a reference to the RenderTask responsible for this Release. | Optional: {} |
|
effectiveUniqueName string |
EffectiveUniqueName is the unique name used for deduplication on Targets. Equals Spec.UniqueName when set; otherwise the sanitized component name of the referenced ComponentVersion. |
Optional: {} |
RenderArtifact¶
RenderArtifact represents a successfully pushed OCI artifact produced by a RenderTask.
Appears in: - RenderArtifactList
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec RenderArtifactSpec |
|||
status RenderArtifactStatus |
RenderArtifactList¶
RenderArtifactList contains a list of RenderArtifact resources.
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ListMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
items RenderArtifact array |
RenderArtifactSpec¶
RenderArtifactSpec holds the OCI coordinates of a successfully pushed artifact.
Appears in: - RenderArtifact
| Field | Description | Default | Validation |
|---|---|---|---|
baseURL string |
BaseURL is the registry's base URL (e.g. "registry.example.com:5000"). | MinLength: 1 |
|
repository string |
Repository is the repository path within the registry. | MinLength: 1 |
|
tag string |
Tag is the OCI tag that was pushed. | MinLength: 1 |
|
renderTaskRef string |
RenderTaskRef is the name of the RenderTask that produced this artifact. | ||
registryRef ObjectReference |
RegistryRef references the Registry that owns the credentials used to push (and later delete) this artifact's OCI tag. When Namespace is empty, the Registry is resolved in the RenderArtifact's own namespace; a non-empty Namespace identifies a different namespace and requires a ReferenceGrant there permitting access, mirroring how Target resolves its RenderRegistryRef. That grant must name this kind: from[].kind "RenderArtifact" with the RenderArtifact's namespace and to[].kind "Registry". The Target's own grant is deliberately not accepted — the field is meant to be controller-owned (copied from a RenderBinding the Target controller populated from Target.Spec.RenderRegistryRef), but the API does not enforce that, so a hand-authored artifact would otherwise borrow the Target's credentials. RenderArtifact never stores Secret- or PlainHTTP-identifying information directly: both are read live from the referenced Registry whenever credentials are needed, so a Registry's credentials or transport settings can change without ever going stale on the artifact. |
Optional: {} |
RenderArtifactStatus¶
RenderArtifactStatus holds the observed state of a RenderArtifact.
Appears in: - RenderArtifact
| Field | Description | Default | Validation |
|---|---|---|---|
chartURL string |
ChartURL is the fully-qualified OCI reference for this artifact. | Optional: {} |
|
conditions Condition array |
Conditions represent the latest available observations of a RenderArtifact's state. | Optional: {} |
RenderBinding¶
RenderBinding declares that a consumer resource (e.g. a Target) is using a RenderArtifact.
Appears in: - RenderBindingList
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec RenderBindingSpec |
RenderBindingList¶
RenderBindingList contains a list of RenderBinding resources.
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ListMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
items RenderBinding array |
RenderBindingSpec¶
RenderBindingSpec links a consumer resource to a RenderArtifact for ref-counting.
Appears in: - RenderBinding
| Field | Description | Default | Validation |
|---|---|---|---|
renderArtifactRef LocalObjectReference |
RenderArtifactRef is the name of the RenderArtifact in the same namespace. | ||
ownerKind string |
OwnerKind is the kind of the consuming resource (e.g. "Target"). | MinLength: 1 |
|
ownerName string |
OwnerName is the name of the consuming resource. | MinLength: 1 |
|
ownerNamespace string |
OwnerNamespace is the namespace of the consuming resource. | MinLength: 1 |
|
registryRef ObjectReference |
RegistryRef references the Registry this binding's owner currently resolves for pushing the shared RenderArtifact. The RenderArtifact controller re-pins RenderArtifact.Spec.RegistryRef from a surviving RenderBinding's value whenever a binding is removed, so the artifact always resolves credentials through a Registry belonging to a consumer that still exists. RenderArtifact/RenderBinding never store Secret-identifying information directly, only a reference to the Registry that owns the credentials, resolved fresh at use time, mirroring how Target resolves its own push credentials. |
Optional: {} |
RenderTask¶
RenderTask manages a rendering job
Appears in: - RenderTaskList
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec RenderTaskSpec |
|||
status RenderTaskStatus |
RenderTaskList¶
RenderTaskList contains a list of RenderTask resources.
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ListMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
items RenderTask array |
RenderTaskSpec¶
RenderTaskSpec holds the specification for a RenderTask
Appears in: - RenderTask
| Field | Description | Default | Validation |
|---|---|---|---|
type RendererConfigType |
Type defines the output type of the renderer. | ||
release ReleaseConfig |
ReleaseConfig is a config for a release. | ||
bootstrap BootstrapConfig |
BootstrapConfig is a config for a bootstrap. | ||
signing SigningConfig |
Signing configures cosign key-based signing of the pushed artifact. Nil disables signing. |
Optional: {} |
|
repository string |
Repository is the Repository where the chart will be pushed to (e.g. charts/mychart) | ||
tag string |
Tag is the Tag of the helm chart to be pushed. Make sure that the tag matches the version in Chart.yaml, otherwise helm will error before pushing. |
||
baseURL string |
BaseURL is the registry URL to push the rendered chart to (e.g. "registry.example.com:5000"). | ||
pushSecretRef LocalObjectReference |
PushSecretRef references a Secret in the same namespace with registry credentials for pushing the rendered chart. |
Optional: {} |
|
sourceSecretRef LocalObjectReference |
SourceSecretRef references a Secret in the same namespace with registry credentials for reading the OCM component the release is built from. The source registry may differ from the push registry. |
Optional: {} |
|
targetCredentialSecretRef LocalObjectReference |
TargetCredentialSecretRef references a Secret in the same namespace whose "token" key is a Target's agent token. The render Job gets it as the TARGET_CREDENTIAL_TOKEN env var. Set only for Releases annotated solar.opendefense.cloud/target-credential. |
Optional: {} |
|
plainHTTP boolean |
PlainHTTP uses HTTP instead of HTTPS for OCI registry connections. | Optional: {} |
|
failedJobTTL integer |
failedJobTTL is the TTL in seconds after which a failed render job and its secrets are cleaned up. After this duration, the Kubernetes TTL controller will delete the Job and the controller will delete the Secrets (ConfigSecret, AuthSecret). On success, Job and Secrets are deleted immediately. If not set, defaults to 3600 (1 hour). |
Optional: {} |
|
ownerName string |
OwnerName is the name of the resource that created this RenderTask. | MinLength: 1 |
|
ownerNamespace string |
OwnerNamespace is the namespace of the resource that created this RenderTask. | MinLength: 1 |
|
ownerKind string |
OwnerKind is the kind of the resource that created this RenderTask (e.g. Release, Target). | MinLength: 1 |
RenderTaskStatus¶
RenderTaskStatus holds the status of the rendering process
Appears in: - RenderTask
| Field | Description | Default | Validation |
|---|---|---|---|
conditions Condition array |
Conditions represent the latest available observations of a RenderTask's state. | Optional: {} |
|
jobRef ObjectReference |
JobRef is a reference to the Job that is executing the rendering. | Optional: {} |
|
configSecretRef ObjectReference |
ConfigSecretRef is a reference to the Secret containing the renderer configuration. | Optional: {} |
|
chartURL string |
ChartURL represents the URL of where the rendered chart was pushed to. | Optional: {} |
RendererConfig¶
RendererConfig defines the configuration for the renderer.
Appears in: - RenderTaskSpec
| Field | Description | Default | Validation |
|---|---|---|---|
type RendererConfigType |
Type defines the output type of the renderer. | ||
release ReleaseConfig |
ReleaseConfig is a config for a release. | ||
bootstrap BootstrapConfig |
BootstrapConfig is a config for a bootstrap. | ||
signing SigningConfig |
Signing configures cosign key-based signing of the pushed artifact. Nil disables signing. |
Optional: {} |
RendererConfigType¶
Underlying type: string
RendererConfigType is the output type of the renderer.
Appears in: - RenderTaskSpec - RendererConfig
| Field | Description |
|---|---|
bootstrap |
|
release |
|
profile |
ResolvedResourceAccess¶
ResolvedResourceAccess extends ResourceAccess with pull secret information resolved from RegistryBindings at render time.
Appears in: - BootstrapInput - ReleaseInput
| Field | Description | Default | Validation |
|---|---|---|---|
repository string |
Repository of the Resource. | ||
insecure boolean |
Insecure switches TLS/HTTPS off if true | ||
tag string |
Tag of the Resource. | ||
helm HelmResourceMetadata |
Helm contains metadata for Helm chart resources, populated during discovery. | ||
pullSecretName string |
PullSecretName is the name of the pull secret on the target cluster for this resource's registry. Resolved from Registry.spec.targetPullSecretName via RegistryBinding. Empty means anonymous pull. |
ResourceAccess¶
ResourceAccess defines how a Resource can be accessed along with optional metadata.
Appears in: - ComponentVersionSpec
| Field | Description | Default | Validation |
|---|---|---|---|
repository string |
Repository of the Resource. | ||
insecure boolean |
Insecure switches TLS/HTTPS off if true | ||
tag string |
Tag of the Resource. | ||
helm HelmResourceMetadata |
Helm contains metadata for Helm chart resources, populated during discovery. |
SigningConfig¶
SigningConfig configures cosign key-based signing of the rendered artifact. The key password is read from the COSIGN_PASSWORD environment variable.
Appears in: - RenderTaskSpec - RendererConfig
| Field | Description | Default | Validation |
|---|---|---|---|
keyPath string |
KeyPath is the path to the cosign private key mounted into the render job. |
Target¶
Target represents a deployment target environment. It defines the intended state of releases and configuration for a specific deployment target, such as a cluster or environment.
Appears in: - TargetList
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec TargetSpec |
|||
status TargetStatus |
TargetList¶
TargetList contains a list of Target resources.
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ListMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
items Target array |
TargetReport¶
TargetReport is one target cluster's state as observed by its solar-agent.
Appears in: - TargetReportList
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec TargetReportSpec |
TargetReportList¶
TargetReportList contains a list of TargetReport resources.
| Field | Description | Default | Validation |
|---|---|---|---|
kind string |
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
Optional: {} |
|
apiVersion string |
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
Optional: {} |
|
metadata ListMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
items TargetReport array |
TargetReportSpec¶
TargetReportSpec is one target cluster's state as observed by its agent. It is a full snapshot, never append-only: written exclusively by the agent, read exclusively by the targetreport controller.
Appears in: - TargetReport
| Field | Description | Default | Validation |
|---|---|---|---|
lastReportTime Time |
LastReportTime is set by the agent at publish time. The agent owns it, and it must advance on every update. It is empty until the agent's first report: solar-controller-manager pre-creates the report without it. |
Optional: {} |
|
releases ReleaseReport array |
Releases are the OCIRepository/HelmRelease pairs the agent observed: a snapshot of what is currently deployed. Observational only — it never gates anything. |
Optional: {} |
|
preflight PreflightReport |
Preflight holds the agent's health-check results that gate new releases: failed checks block deploying to this target. Unlike Releases, it says nothing about what is currently deployed. |
TargetSpec¶
TargetSpec defines the desired state of a Target. It specifies the render registry and configuration for this deployment target.
Appears in: - Target
| Field | Description | Default | Validation |
|---|---|---|---|
renderRegistryRef ObjectReference |
RenderRegistryRef references the Registry to push rendered desired state to. The referenced Registry must have SolarSecretRef set for rendering to succeed. When Namespace is set, the Registry resides in a different namespace than this Target; cross-namespace references require a ReferenceGrant in the Registry's namespace that grants access to this Target's namespace. |
||
userdata RawExtension |
Userdata contains arbitrary custom data or configuration specific to this target. This enables target-specific customization and deployment parameters. |
Optional: {} |
TargetStatus¶
TargetStatus defines the observed state of a Target.
Appears in: - Target
| Field | Description | Default | Validation |
|---|---|---|---|
bootstrapVersion integer |
BootstrapVersion is a monotonically increasing counter used as the bootstrap chart version. It is incremented each time the bootstrap chart is re-rendered, e.g. when the set of bound releases changes. |
Optional: {} |
|
conditions Condition array |
Conditions represent the latest available observations of a Target's state. | Optional: {} |