|
|
@@ -176,43 +176,6 @@ spec:
|
|
|
- fieldPath
|
|
|
type: object
|
|
|
x-kubernetes-map-type: atomic
|
|
|
- fileKeyRef:
|
|
|
- description: |-
|
|
|
- FileKeyRef selects a key of the env file.
|
|
|
- Requires the EnvFiles feature gate to be enabled.
|
|
|
- properties:
|
|
|
- key:
|
|
|
- description: |-
|
|
|
- The key within the env file. An invalid key will prevent the pod from starting.
|
|
|
- The keys defined within a source may consist of any printable ASCII characters except '='.
|
|
|
- During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
|
|
|
- type: string
|
|
|
- optional:
|
|
|
- default: false
|
|
|
- description: |-
|
|
|
- Specify whether the file or its key must be defined. If the file or key
|
|
|
- does not exist, then the env var is not published.
|
|
|
- If optional is set to true and the specified key does not exist,
|
|
|
- the environment variable will not be set in the Pod's containers.
|
|
|
-
|
|
|
- If optional is set to false and the specified key does not exist,
|
|
|
- an error will be returned during Pod creation.
|
|
|
- type: boolean
|
|
|
- path:
|
|
|
- description: |-
|
|
|
- The path within the volume from which to select the file.
|
|
|
- Must be relative and may not contain the '..' path or start with '..'.
|
|
|
- type: string
|
|
|
- volumeName:
|
|
|
- description: The name of the volume mount containing
|
|
|
- the env file.
|
|
|
- type: string
|
|
|
- required:
|
|
|
- - key
|
|
|
- - path
|
|
|
- - volumeName
|
|
|
- type: object
|
|
|
- x-kubernetes-map-type: atomic
|
|
|
resourceFieldRef:
|
|
|
description: |-
|
|
|
Selects a resource of the container: only resources limits and requests
|
|
|
@@ -584,6 +547,7 @@ spec:
|
|
|
pod labels will be ignored. The default value is empty.
|
|
|
The same key is forbidden to exist in both matchLabelKeys and labelSelector.
|
|
|
Also, matchLabelKeys cannot be set when labelSelector isn't set.
|
|
|
+ This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
@@ -598,6 +562,7 @@ spec:
|
|
|
pod labels will be ignored. The default value is empty.
|
|
|
The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
|
|
|
Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
|
|
|
+ This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
@@ -765,6 +730,7 @@ spec:
|
|
|
pod labels will be ignored. The default value is empty.
|
|
|
The same key is forbidden to exist in both matchLabelKeys and labelSelector.
|
|
|
Also, matchLabelKeys cannot be set when labelSelector isn't set.
|
|
|
+ This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
@@ -779,6 +745,7 @@ spec:
|
|
|
pod labels will be ignored. The default value is empty.
|
|
|
The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
|
|
|
Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
|
|
|
+ This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
@@ -872,8 +839,8 @@ spec:
|
|
|
most preferred is the one with the greatest sum of weights, i.e.
|
|
|
for each node that meets all of the scheduling requirements (resource
|
|
|
request, requiredDuringScheduling anti-affinity expressions, etc.),
|
|
|
- compute a sum by iterating through the elements of this field and subtracting
|
|
|
- "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
|
|
|
+ compute a sum by iterating through the elements of this field and adding
|
|
|
+ "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
|
|
|
node(s) with the highest sum are the most preferred.
|
|
|
items:
|
|
|
description: The weights of all of the matched WeightedPodAffinityTerm
|
|
|
@@ -944,6 +911,7 @@ spec:
|
|
|
pod labels will be ignored. The default value is empty.
|
|
|
The same key is forbidden to exist in both matchLabelKeys and labelSelector.
|
|
|
Also, matchLabelKeys cannot be set when labelSelector isn't set.
|
|
|
+ This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
@@ -958,6 +926,7 @@ spec:
|
|
|
pod labels will be ignored. The default value is empty.
|
|
|
The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
|
|
|
Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
|
|
|
+ This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
@@ -1125,6 +1094,7 @@ spec:
|
|
|
pod labels will be ignored. The default value is empty.
|
|
|
The same key is forbidden to exist in both matchLabelKeys and labelSelector.
|
|
|
Also, matchLabelKeys cannot be set when labelSelector isn't set.
|
|
|
+ This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
@@ -1139,6 +1109,7 @@ spec:
|
|
|
pod labels will be ignored. The default value is empty.
|
|
|
The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
|
|
|
Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
|
|
|
+ This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
@@ -1235,7 +1206,7 @@ spec:
|
|
|
Claims lists the names of resources, defined in spec.resourceClaims,
|
|
|
that are used by this container.
|
|
|
|
|
|
- This field depends on the
|
|
|
+ This is an alpha field and requires enabling the
|
|
|
DynamicResourceAllocation feature gate.
|
|
|
|
|
|
This field is immutable. It can only be set for containers.
|
|
|
@@ -1248,12 +1219,6 @@ spec:
|
|
|
the Pod where this field is used. It makes that resource available
|
|
|
inside a container.
|
|
|
type: string
|
|
|
- request:
|
|
|
- description: |-
|
|
|
- Request is the name chosen for a request in the referenced claim.
|
|
|
- If empty, everything from the claim is made available, otherwise
|
|
|
- only the result of this request.
|
|
|
- type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
@@ -1330,9 +1295,8 @@ spec:
|
|
|
present in a Container.
|
|
|
properties:
|
|
|
name:
|
|
|
- description: |-
|
|
|
- Name of the environment variable.
|
|
|
- May consist of any printable ASCII characters except '='.
|
|
|
+ description: Name of the environment variable. Must
|
|
|
+ be a C_IDENTIFIER.
|
|
|
type: string
|
|
|
value:
|
|
|
description: |-
|
|
|
@@ -1390,43 +1354,6 @@ spec:
|
|
|
- fieldPath
|
|
|
type: object
|
|
|
x-kubernetes-map-type: atomic
|
|
|
- fileKeyRef:
|
|
|
- description: |-
|
|
|
- FileKeyRef selects a key of the env file.
|
|
|
- Requires the EnvFiles feature gate to be enabled.
|
|
|
- properties:
|
|
|
- key:
|
|
|
- description: |-
|
|
|
- The key within the env file. An invalid key will prevent the pod from starting.
|
|
|
- The keys defined within a source may consist of any printable ASCII characters except '='.
|
|
|
- During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
|
|
|
- type: string
|
|
|
- optional:
|
|
|
- default: false
|
|
|
- description: |-
|
|
|
- Specify whether the file or its key must be defined. If the file or key
|
|
|
- does not exist, then the env var is not published.
|
|
|
- If optional is set to true and the specified key does not exist,
|
|
|
- the environment variable will not be set in the Pod's containers.
|
|
|
-
|
|
|
- If optional is set to false and the specified key does not exist,
|
|
|
- an error will be returned during Pod creation.
|
|
|
- type: boolean
|
|
|
- path:
|
|
|
- description: |-
|
|
|
- The path within the volume from which to select the file.
|
|
|
- Must be relative and may not contain the '..' path or start with '..'.
|
|
|
- type: string
|
|
|
- volumeName:
|
|
|
- description: The name of the volume mount
|
|
|
- containing the env file.
|
|
|
- type: string
|
|
|
- required:
|
|
|
- - key
|
|
|
- - path
|
|
|
- - volumeName
|
|
|
- type: object
|
|
|
- x-kubernetes-map-type: atomic
|
|
|
resourceFieldRef:
|
|
|
description: |-
|
|
|
Selects a resource of the container: only resources limits and requests
|
|
|
@@ -1487,7 +1414,7 @@ spec:
|
|
|
whose key-value pairs are injected as environment variables.
|
|
|
items:
|
|
|
description: EnvFromSource represents the source of
|
|
|
- a set of ConfigMaps or Secrets
|
|
|
+ a set of ConfigMaps
|
|
|
properties:
|
|
|
configMapRef:
|
|
|
description: The ConfigMap to select from
|
|
|
@@ -1508,9 +1435,8 @@ spec:
|
|
|
type: object
|
|
|
x-kubernetes-map-type: atomic
|
|
|
prefix:
|
|
|
- description: |-
|
|
|
- Optional text to prepend to the name of each environment variable.
|
|
|
- May consist of any printable ASCII characters except '='.
|
|
|
+ description: An optional identifier to prepend to
|
|
|
+ each key in the ConfigMap. Must be a C_IDENTIFIER.
|
|
|
type: string
|
|
|
secretRef:
|
|
|
description: The Secret to select from
|
|
|
@@ -1697,32 +1623,6 @@ spec:
|
|
|
Note that this field cannot be set when spec.os.name is windows.
|
|
|
format: int64
|
|
|
type: integer
|
|
|
- seLinuxChangePolicy:
|
|
|
- description: |-
|
|
|
- seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.
|
|
|
- It has no effect on nodes that do not support SELinux or to volumes does not support SELinux.
|
|
|
- Valid values are "MountOption" and "Recursive".
|
|
|
-
|
|
|
- "Recursive" means relabeling of all files on all Pod volumes by the container runtime.
|
|
|
- This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.
|
|
|
-
|
|
|
- "MountOption" mounts all eligible Pod volumes with `-o context` mount option.
|
|
|
- This requires all Pods that share the same volume to use the same SELinux label.
|
|
|
- It is not possible to share the same volume among privileged and unprivileged Pods.
|
|
|
- Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
|
|
|
- whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
|
|
|
- CSIDriver instance. Other volumes are always re-labelled recursively.
|
|
|
- "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
|
|
|
-
|
|
|
- If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
|
|
|
- If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
|
|
|
- and "Recursive" for all other volumes.
|
|
|
-
|
|
|
- This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
|
|
|
-
|
|
|
- All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.
|
|
|
- Note that this field cannot be set when spec.os.name is windows.
|
|
|
- type: string
|
|
|
seLinuxOptions:
|
|
|
description: |-
|
|
|
The SELinux context to be applied to all containers.
|
|
|
@@ -1775,28 +1675,18 @@ spec:
|
|
|
type: object
|
|
|
supplementalGroups:
|
|
|
description: |-
|
|
|
- A list of groups applied to the first process run in each container, in
|
|
|
- addition to the container's primary GID and fsGroup (if specified). If
|
|
|
- the SupplementalGroupsPolicy feature is enabled, the
|
|
|
- supplementalGroupsPolicy field determines whether these are in addition
|
|
|
- to or instead of any group memberships defined in the container image.
|
|
|
- If unspecified, no additional groups are added, though group memberships
|
|
|
- defined in the container image may still be used, depending on the
|
|
|
- supplementalGroupsPolicy field.
|
|
|
+ A list of groups applied to the first process run in each container, in addition
|
|
|
+ to the container's primary GID, the fsGroup (if specified), and group memberships
|
|
|
+ defined in the container image for the uid of the container process. If unspecified,
|
|
|
+ no additional groups are added to any container. Note that group memberships
|
|
|
+ defined in the container image for the uid of the container process are still effective,
|
|
|
+ even if they are not included in this list.
|
|
|
Note that this field cannot be set when spec.os.name is windows.
|
|
|
items:
|
|
|
format: int64
|
|
|
type: integer
|
|
|
type: array
|
|
|
x-kubernetes-list-type: atomic
|
|
|
- supplementalGroupsPolicy:
|
|
|
- description: |-
|
|
|
- Defines how supplemental groups of the first container processes are calculated.
|
|
|
- Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
|
|
|
- (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
|
|
|
- and the container runtime must implement support for this feature.
|
|
|
- Note that this field cannot be set when spec.os.name is windows.
|
|
|
- type: string
|
|
|
sysctls:
|
|
|
description: |-
|
|
|
Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
|
|
|
@@ -1872,10 +1762,9 @@ spec:
|
|
|
operator:
|
|
|
description: |-
|
|
|
Operator represents a key's relationship to the value.
|
|
|
- Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
|
|
|
+ Valid operators are Exists and Equal. Defaults to Equal.
|
|
|
Exists is equivalent to wildcard for value, so that a pod can
|
|
|
tolerate all taints of a particular category.
|
|
|
- Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
|
|
|
type: string
|
|
|
tolerationSeconds:
|
|
|
description: |-
|
|
|
@@ -2017,6 +1906,7 @@ spec:
|
|
|
- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
|
|
|
|
|
|
If this value is nil, the behavior is equivalent to the Honor policy.
|
|
|
+ This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
|
|
|
type: string
|
|
|
nodeTaintsPolicy:
|
|
|
description: |-
|
|
|
@@ -2027,6 +1917,7 @@ spec:
|
|
|
- Ignore: node taints are ignored. All nodes are included.
|
|
|
|
|
|
If this value is nil, the behavior is equivalent to the Ignore policy.
|
|
|
+ This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
|
|
|
type: string
|
|
|
topologyKey:
|
|
|
description: |-
|
|
|
@@ -2079,8 +1970,6 @@ spec:
|
|
|
description: |-
|
|
|
awsElasticBlockStore represents an AWS Disk resource that is attached to a
|
|
|
kubelet's host machine and then exposed to the pod.
|
|
|
- Deprecated: AWSElasticBlockStore is deprecated. All operations for the in-tree
|
|
|
- awsElasticBlockStore type are redirected to the ebs.csi.aws.com CSI driver.
|
|
|
More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
|
|
|
properties:
|
|
|
fsType:
|
|
|
@@ -2112,10 +2001,8 @@ spec:
|
|
|
- volumeID
|
|
|
type: object
|
|
|
azureDisk:
|
|
|
- description: |-
|
|
|
- azureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
|
|
|
- Deprecated: AzureDisk is deprecated. All operations for the in-tree azureDisk type
|
|
|
- are redirected to the disk.csi.azure.com CSI driver.
|
|
|
+ description: azureDisk represents an Azure Data Disk
|
|
|
+ mount on the host and bind mount to the pod.
|
|
|
properties:
|
|
|
cachingMode:
|
|
|
description: 'cachingMode is the Host Caching mode:
|
|
|
@@ -2130,7 +2017,6 @@ spec:
|
|
|
the blob storage
|
|
|
type: string
|
|
|
fsType:
|
|
|
- default: ext4
|
|
|
description: |-
|
|
|
fsType is Filesystem type to mount.
|
|
|
Must be a filesystem type supported by the host operating system.
|
|
|
@@ -2144,7 +2030,6 @@ spec:
|
|
|
set). defaults to shared'
|
|
|
type: string
|
|
|
readOnly:
|
|
|
- default: false
|
|
|
description: |-
|
|
|
readOnly Defaults to false (read/write). ReadOnly here will force
|
|
|
the ReadOnly setting in VolumeMounts.
|
|
|
@@ -2154,10 +2039,8 @@ spec:
|
|
|
- diskURI
|
|
|
type: object
|
|
|
azureFile:
|
|
|
- description: |-
|
|
|
- azureFile represents an Azure File Service mount on the host and bind mount to the pod.
|
|
|
- Deprecated: AzureFile is deprecated. All operations for the in-tree azureFile type
|
|
|
- are redirected to the file.csi.azure.com CSI driver.
|
|
|
+ description: azureFile represents an Azure File Service
|
|
|
+ mount on the host and bind mount to the pod.
|
|
|
properties:
|
|
|
readOnly:
|
|
|
description: |-
|
|
|
@@ -2176,9 +2059,8 @@ spec:
|
|
|
- shareName
|
|
|
type: object
|
|
|
cephfs:
|
|
|
- description: |-
|
|
|
- cephFS represents a Ceph FS mount on the host that shares a pod's lifetime.
|
|
|
- Deprecated: CephFS is deprecated and the in-tree cephfs type is no longer supported.
|
|
|
+ description: cephFS represents a Ceph FS mount on the
|
|
|
+ host that shares a pod's lifetime
|
|
|
properties:
|
|
|
monitors:
|
|
|
description: |-
|
|
|
@@ -2231,8 +2113,6 @@ spec:
|
|
|
cinder:
|
|
|
description: |-
|
|
|
cinder represents a cinder volume attached and mounted on kubelets host machine.
|
|
|
- Deprecated: Cinder is deprecated. All operations for the in-tree cinder type
|
|
|
- are redirected to the cinder.csi.openstack.org CSI driver.
|
|
|
More info: https://examples.k8s.io/mysql-cinder-pd/README.md
|
|
|
properties:
|
|
|
fsType:
|
|
|
@@ -2344,7 +2224,7 @@ spec:
|
|
|
csi:
|
|
|
description: csi (Container Storage Interface) represents
|
|
|
ephemeral storage that is handled by certain external
|
|
|
- CSI drivers.
|
|
|
+ CSI drivers (Beta feature).
|
|
|
properties:
|
|
|
driver:
|
|
|
description: |-
|
|
|
@@ -2662,7 +2542,7 @@ spec:
|
|
|
resources:
|
|
|
description: |-
|
|
|
resources represents the minimum resources the volume should have.
|
|
|
- Users are allowed to specify resource requirements
|
|
|
+ If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
|
|
|
that are lower than previous value but must still be higher than capacity recorded in the
|
|
|
status field of the claim.
|
|
|
More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
|
|
|
@@ -2751,13 +2631,15 @@ spec:
|
|
|
volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
|
|
|
If specified, the CSI driver will create or update the volume with the attributes defined
|
|
|
in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
|
|
|
- it can be changed after the claim is created. An empty string or nil value indicates that no
|
|
|
- VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
|
|
|
- this field can be reset to its previous value (including nil) to cancel the modification.
|
|
|
+ it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
|
|
|
+ will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
|
|
|
+ If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
|
|
|
+ will be set by the persistentvolume controller if it exists.
|
|
|
If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
|
|
|
set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
|
|
|
exists.
|
|
|
More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
|
|
|
+ (Alpha) Using this field requires the VolumeAttributesClass feature gate to be enabled.
|
|
|
type: string
|
|
|
volumeMode:
|
|
|
description: |-
|
|
|
@@ -2813,7 +2695,6 @@ spec:
|
|
|
description: |-
|
|
|
flexVolume represents a generic volume resource that is
|
|
|
provisioned/attached using an exec based plugin.
|
|
|
- Deprecated: FlexVolume is deprecated. Consider using a CSIDriver instead.
|
|
|
properties:
|
|
|
driver:
|
|
|
description: driver is the name of the driver to
|
|
|
@@ -2859,9 +2740,9 @@ spec:
|
|
|
- driver
|
|
|
type: object
|
|
|
flocker:
|
|
|
- description: |-
|
|
|
- flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running.
|
|
|
- Deprecated: Flocker is deprecated and the in-tree flocker type is no longer supported.
|
|
|
+ description: flocker represents a Flocker volume attached
|
|
|
+ to a kubelet's host machine. This depends on the Flocker
|
|
|
+ control service being running
|
|
|
properties:
|
|
|
datasetName:
|
|
|
description: |-
|
|
|
@@ -2877,8 +2758,6 @@ spec:
|
|
|
description: |-
|
|
|
gcePersistentDisk represents a GCE Disk resource that is attached to a
|
|
|
kubelet's host machine and then exposed to the pod.
|
|
|
- Deprecated: GCEPersistentDisk is deprecated. All operations for the in-tree
|
|
|
- gcePersistentDisk type are redirected to the pd.csi.storage.gke.io CSI driver.
|
|
|
More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
|
|
|
properties:
|
|
|
fsType:
|
|
|
@@ -2914,7 +2793,7 @@ spec:
|
|
|
gitRepo:
|
|
|
description: |-
|
|
|
gitRepo represents a git repository at a particular revision.
|
|
|
- Deprecated: GitRepo is deprecated. To provision a container with a git repo, mount an
|
|
|
+ DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an
|
|
|
EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir
|
|
|
into the Pod's container.
|
|
|
properties:
|
|
|
@@ -2938,11 +2817,12 @@ spec:
|
|
|
glusterfs:
|
|
|
description: |-
|
|
|
glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
|
|
|
- Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
|
|
|
+ More info: https://examples.k8s.io/volumes/glusterfs/README.md
|
|
|
properties:
|
|
|
endpoints:
|
|
|
- description: endpoints is the endpoint name that
|
|
|
- details Glusterfs topology.
|
|
|
+ description: |-
|
|
|
+ endpoints is the endpoint name that details Glusterfs topology.
|
|
|
+ More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
|
|
|
type: string
|
|
|
path:
|
|
|
description: |-
|
|
|
@@ -2982,46 +2862,11 @@ spec:
|
|
|
required:
|
|
|
- path
|
|
|
type: object
|
|
|
- image:
|
|
|
- description: |-
|
|
|
- image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine.
|
|
|
- The volume is resolved at pod startup depending on which PullPolicy value is provided:
|
|
|
-
|
|
|
- - Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
|
|
|
- - Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
|
|
|
- - IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
|
|
|
-
|
|
|
- The volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation.
|
|
|
- A failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.
|
|
|
- The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
|
|
|
- The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
|
|
|
- The volume will be mounted read-only (ro) and non-executable files (noexec).
|
|
|
- Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
|
|
|
- The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
|
|
|
- properties:
|
|
|
- pullPolicy:
|
|
|
- description: |-
|
|
|
- Policy for pulling OCI objects. Possible values are:
|
|
|
- Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
|
|
|
- Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
|
|
|
- IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
|
|
|
- Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
|
|
|
- type: string
|
|
|
- reference:
|
|
|
- description: |-
|
|
|
- Required: Image or artifact reference to be used.
|
|
|
- Behaves in the same way as pod.spec.containers[*].image.
|
|
|
- Pull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets.
|
|
|
- More info: https://kubernetes.io/docs/concepts/containers/images
|
|
|
- This field is optional to allow higher level config management to default or override
|
|
|
- container images in workload controllers like Deployments and StatefulSets.
|
|
|
- type: string
|
|
|
- type: object
|
|
|
iscsi:
|
|
|
description: |-
|
|
|
iscsi represents an ISCSI Disk resource that is attached to a
|
|
|
kubelet's host machine and then exposed to the pod.
|
|
|
- More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
|
|
|
+ More info: https://examples.k8s.io/volumes/iscsi/README.md
|
|
|
properties:
|
|
|
chapAuthDiscovery:
|
|
|
description: chapAuthDiscovery defines whether support
|
|
|
@@ -3048,7 +2893,6 @@ spec:
|
|
|
description: iqn is the target iSCSI Qualified Name.
|
|
|
type: string
|
|
|
iscsiInterface:
|
|
|
- default: default
|
|
|
description: |-
|
|
|
iscsiInterface is the interface Name that uses an iSCSI transport.
|
|
|
Defaults to 'default' (tcp).
|
|
|
@@ -3146,9 +2990,9 @@ spec:
|
|
|
- claimName
|
|
|
type: object
|
|
|
photonPersistentDisk:
|
|
|
- description: |-
|
|
|
- photonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine.
|
|
|
- Deprecated: PhotonPersistentDisk is deprecated and the in-tree photonPersistentDisk type is no longer supported.
|
|
|
+ description: photonPersistentDisk represents a PhotonController
|
|
|
+ persistent disk attached and mounted on kubelets host
|
|
|
+ machine
|
|
|
properties:
|
|
|
fsType:
|
|
|
description: |-
|
|
|
@@ -3164,11 +3008,8 @@ spec:
|
|
|
- pdID
|
|
|
type: object
|
|
|
portworxVolume:
|
|
|
- description: |-
|
|
|
- portworxVolume represents a portworx volume attached and mounted on kubelets host machine.
|
|
|
- Deprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type
|
|
|
- are redirected to the pxd.portworx.com CSI driver when the CSIMigrationPortworx feature-gate
|
|
|
- is on.
|
|
|
+ description: portworxVolume represents a portworx volume
|
|
|
+ attached and mounted on kubelets host machine
|
|
|
properties:
|
|
|
fsType:
|
|
|
description: |-
|
|
|
@@ -3203,13 +3044,10 @@ spec:
|
|
|
format: int32
|
|
|
type: integer
|
|
|
sources:
|
|
|
- description: |-
|
|
|
- sources is the list of volume projections. Each entry in this list
|
|
|
- handles one source.
|
|
|
+ description: sources is the list of volume projections
|
|
|
items:
|
|
|
- description: |-
|
|
|
- Projection that may be projected along with other supported volume types.
|
|
|
- Exactly one of these fields must be set.
|
|
|
+ description: Projection that may be projected
|
|
|
+ along with other supported volume types
|
|
|
properties:
|
|
|
clusterTrustBundle:
|
|
|
description: |-
|
|
|
@@ -3447,129 +3285,6 @@ spec:
|
|
|
type: array
|
|
|
x-kubernetes-list-type: atomic
|
|
|
type: object
|
|
|
- podCertificate:
|
|
|
- description: |-
|
|
|
- Projects an auto-rotating credential bundle (private key and certificate
|
|
|
- chain) that the pod can use either as a TLS client or server.
|
|
|
-
|
|
|
- Kubelet generates a private key and uses it to send a
|
|
|
- PodCertificateRequest to the named signer. Once the signer approves the
|
|
|
- request and issues a certificate chain, Kubelet writes the key and
|
|
|
- certificate chain to the pod filesystem. The pod does not start until
|
|
|
- certificates have been issued for each podCertificate projected volume
|
|
|
- source in its spec.
|
|
|
-
|
|
|
- Kubelet will begin trying to rotate the certificate at the time indicated
|
|
|
- by the signer using the PodCertificateRequest.Status.BeginRefreshAt
|
|
|
- timestamp.
|
|
|
-
|
|
|
- Kubelet can write a single file, indicated by the credentialBundlePath
|
|
|
- field, or separate files, indicated by the keyPath and
|
|
|
- certificateChainPath fields.
|
|
|
-
|
|
|
- The credential bundle is a single file in PEM format. The first PEM
|
|
|
- entry is the private key (in PKCS#8 format), and the remaining PEM
|
|
|
- entries are the certificate chain issued by the signer (typically,
|
|
|
- signers will return their certificate chain in leaf-to-root order).
|
|
|
-
|
|
|
- Prefer using the credential bundle format, since your application code
|
|
|
- can read it atomically. If you use keyPath and certificateChainPath,
|
|
|
- your application must make two separate file reads. If these coincide
|
|
|
- with a certificate rotation, it is possible that the private key and leaf
|
|
|
- certificate you read may not correspond to each other. Your application
|
|
|
- will need to check for this condition, and re-read until they are
|
|
|
- consistent.
|
|
|
-
|
|
|
- The named signer controls chooses the format of the certificate it
|
|
|
- issues; consult the signer implementation's documentation to learn how to
|
|
|
- use the certificates it issues.
|
|
|
- properties:
|
|
|
- certificateChainPath:
|
|
|
- description: |-
|
|
|
- Write the certificate chain at this path in the projected volume.
|
|
|
-
|
|
|
- Most applications should use credentialBundlePath. When using keyPath
|
|
|
- and certificateChainPath, your application needs to check that the key
|
|
|
- and leaf certificate are consistent, because it is possible to read the
|
|
|
- files mid-rotation.
|
|
|
- type: string
|
|
|
- credentialBundlePath:
|
|
|
- description: |-
|
|
|
- Write the credential bundle at this path in the projected volume.
|
|
|
-
|
|
|
- The credential bundle is a single file that contains multiple PEM blocks.
|
|
|
- The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
|
|
|
- key.
|
|
|
-
|
|
|
- The remaining blocks are CERTIFICATE blocks, containing the issued
|
|
|
- certificate chain from the signer (leaf and any intermediates).
|
|
|
-
|
|
|
- Using credentialBundlePath lets your Pod's application code make a single
|
|
|
- atomic read that retrieves a consistent key and certificate chain. If you
|
|
|
- project them to separate files, your application code will need to
|
|
|
- additionally check that the leaf certificate was issued to the key.
|
|
|
- type: string
|
|
|
- keyPath:
|
|
|
- description: |-
|
|
|
- Write the key at this path in the projected volume.
|
|
|
-
|
|
|
- Most applications should use credentialBundlePath. When using keyPath
|
|
|
- and certificateChainPath, your application needs to check that the key
|
|
|
- and leaf certificate are consistent, because it is possible to read the
|
|
|
- files mid-rotation.
|
|
|
- type: string
|
|
|
- keyType:
|
|
|
- description: |-
|
|
|
- The type of keypair Kubelet will generate for the pod.
|
|
|
-
|
|
|
- Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
|
|
|
- "ECDSAP521", and "ED25519".
|
|
|
- type: string
|
|
|
- maxExpirationSeconds:
|
|
|
- description: |-
|
|
|
- maxExpirationSeconds is the maximum lifetime permitted for the
|
|
|
- certificate.
|
|
|
-
|
|
|
- Kubelet copies this value verbatim into the PodCertificateRequests it
|
|
|
- generates for this projection.
|
|
|
-
|
|
|
- If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
|
|
|
- will reject values shorter than 3600 (1 hour). The maximum allowable
|
|
|
- value is 7862400 (91 days).
|
|
|
-
|
|
|
- The signer implementation is then free to issue a certificate with any
|
|
|
- lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
|
|
|
- seconds (1 hour). This constraint is enforced by kube-apiserver.
|
|
|
- `kubernetes.io` signers will never issue certificates with a lifetime
|
|
|
- longer than 24 hours.
|
|
|
- format: int32
|
|
|
- type: integer
|
|
|
- signerName:
|
|
|
- description: Kubelet's generated CSRs
|
|
|
- will be addressed to this signer.
|
|
|
- type: string
|
|
|
- userAnnotations:
|
|
|
- additionalProperties:
|
|
|
- type: string
|
|
|
- description: |-
|
|
|
- userAnnotations allow pod authors to pass additional information to
|
|
|
- the signer implementation. Kubernetes does not restrict or validate this
|
|
|
- metadata in any way.
|
|
|
-
|
|
|
- These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
|
|
|
- the PodCertificateRequest objects that Kubelet creates.
|
|
|
-
|
|
|
- Entries are subject to the same validation as object metadata annotations,
|
|
|
- with the addition that all keys must be domain-prefixed. No restrictions
|
|
|
- are placed on values, except an overall size limitation on the entire field.
|
|
|
-
|
|
|
- Signers should document the keys and values they support. Signers should
|
|
|
- deny requests that contain keys they do not recognize.
|
|
|
- type: object
|
|
|
- required:
|
|
|
- - keyType
|
|
|
- - signerName
|
|
|
- type: object
|
|
|
secret:
|
|
|
description: secret information about the
|
|
|
secret data to project
|
|
|
@@ -3662,9 +3377,8 @@ spec:
|
|
|
x-kubernetes-list-type: atomic
|
|
|
type: object
|
|
|
quobyte:
|
|
|
- description: |-
|
|
|
- quobyte represents a Quobyte mount on the host that shares a pod's lifetime.
|
|
|
- Deprecated: Quobyte is deprecated and the in-tree quobyte type is no longer supported.
|
|
|
+ description: quobyte represents a Quobyte mount on the
|
|
|
+ host that shares a pod's lifetime
|
|
|
properties:
|
|
|
group:
|
|
|
description: |-
|
|
|
@@ -3703,7 +3417,7 @@ spec:
|
|
|
rbd:
|
|
|
description: |-
|
|
|
rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
|
|
|
- Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
|
|
|
+ More info: https://examples.k8s.io/volumes/rbd/README.md
|
|
|
properties:
|
|
|
fsType:
|
|
|
description: |-
|
|
|
@@ -3718,7 +3432,6 @@ spec:
|
|
|
More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
|
|
|
type: string
|
|
|
keyring:
|
|
|
- default: /etc/ceph/keyring
|
|
|
description: |-
|
|
|
keyring is the path to key ring for RBDUser.
|
|
|
Default is /etc/ceph/keyring.
|
|
|
@@ -3733,7 +3446,6 @@ spec:
|
|
|
type: array
|
|
|
x-kubernetes-list-type: atomic
|
|
|
pool:
|
|
|
- default: rbd
|
|
|
description: |-
|
|
|
pool is the rados pool name.
|
|
|
Default is rbd.
|
|
|
@@ -3764,7 +3476,6 @@ spec:
|
|
|
type: object
|
|
|
x-kubernetes-map-type: atomic
|
|
|
user:
|
|
|
- default: admin
|
|
|
description: |-
|
|
|
user is the rados user name.
|
|
|
Default is admin.
|
|
|
@@ -3775,12 +3486,10 @@ spec:
|
|
|
- monitors
|
|
|
type: object
|
|
|
scaleIO:
|
|
|
- description: |-
|
|
|
- scaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
|
|
|
- Deprecated: ScaleIO is deprecated and the in-tree scaleIO type is no longer supported.
|
|
|
+ description: scaleIO represents a ScaleIO persistent
|
|
|
+ volume attached and mounted on Kubernetes nodes.
|
|
|
properties:
|
|
|
fsType:
|
|
|
- default: xfs
|
|
|
description: |-
|
|
|
fsType is the filesystem type to mount.
|
|
|
Must be a filesystem type supported by the host operating system.
|
|
|
@@ -3821,7 +3530,6 @@ spec:
|
|
|
communication with Gateway, default false
|
|
|
type: boolean
|
|
|
storageMode:
|
|
|
- default: ThinProvisioned
|
|
|
description: |-
|
|
|
storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.
|
|
|
Default is ThinProvisioned.
|
|
|
@@ -3910,9 +3618,8 @@ spec:
|
|
|
type: string
|
|
|
type: object
|
|
|
storageos:
|
|
|
- description: |-
|
|
|
- storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.
|
|
|
- Deprecated: StorageOS is deprecated and the in-tree storageos type is no longer supported.
|
|
|
+ description: storageOS represents a StorageOS volume
|
|
|
+ attached and mounted on Kubernetes nodes.
|
|
|
properties:
|
|
|
fsType:
|
|
|
description: |-
|
|
|
@@ -3957,10 +3664,8 @@ spec:
|
|
|
type: string
|
|
|
type: object
|
|
|
vsphereVolume:
|
|
|
- description: |-
|
|
|
- vsphereVolume represents a vSphere volume attached and mounted on kubelets host machine.
|
|
|
- Deprecated: VsphereVolume is deprecated. All operations for the in-tree vsphereVolume type
|
|
|
- are redirected to the csi.vsphere.vmware.com CSI driver.
|
|
|
+ description: vsphereVolume represents a vSphere volume
|
|
|
+ attached and mounted on kubelets host machine
|
|
|
properties:
|
|
|
fsType:
|
|
|
description: |-
|
