diff --git a/load/testdata/manifests/controllers/lemming/manifest.yaml b/load/testdata/manifests/controllers/lemming/manifest.yaml index 273dc2d43..049ccc373 100644 --- a/load/testdata/manifests/controllers/lemming/manifest.yaml +++ b/load/testdata/manifests/controllers/lemming/manifest.yaml @@ -21,245 +21,268 @@ spec: singular: lemming scope: Namespaced versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: Lemming is the Schema for the lemmings API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: LemmingSpec defines the desired state of Lemming. - properties: - args: - description: Args are the args to pass to the command. - items: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: Lemming is the Schema for the lemmings API + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: LemmingSpec defines the desired state of Lemming. + properties: + args: + description: Args are the args to pass to the command. + items: + type: string + type: array + command: + description: Command is the name of the executable to run. type: string - type: array - command: - description: Command is the name of the executable to run. - type: string - configFile: - description: ConfigFile is the default configuration file name for - the pod. - type: string - configPath: - description: ConfigPath is the mount point for configuration inside - the pod. - type: string - env: - description: Env are the environment variables to set for the container. - items: - description: EnvVar represents an environment variable present in - a Container. - properties: - name: - description: Name of the environment variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) are expanded using - the previously defined environment variables in the container - and any service environment variables. If a variable cannot - be resolved, the reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable exists or - not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment variable's value. Cannot - be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, status.hostIP, - status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the schema the FieldPath is - written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the specified - API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of the container: only - resources limits and requests (limits.cpu, limits.memory, - limits.ephemeral-storage, requests.cpu, requests.memory - and requests.ephemeral-storage) are currently supported.' - properties: - containerName: - description: 'Container name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of the exposed - resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the Secret or its key must - be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - image: - description: Image is the container image to run. - type: string - initImage: - description: InitImage is the docker image to use as an init container - for the pod. - type: string - initSleep: - description: InitSleep is the time sleep in the init container - type: integer - interfaceCount: - description: InterfaceCount is number of interfaces to be attached - to the pod. - type: integer - ports: - additionalProperties: - description: ServicePort describes an external L4 port on the device. - properties: - innerPort: - description: InnerPort is port on the container to expose. - format: int32 - type: integer - outerPort: - description: OuterPort is port on the container to expose. - format: int32 - type: integer - required: - - innerPort - - outerPort - type: object - description: Ports are ports to create on the service. - type: object - resources: - description: Resources are the K8s resources to allocate to lemming - container. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount of compute - resources required. If Requests is omitted for a container, - it defaults to Limits if that is explicitly specified, otherwise - to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - tls: - description: TLS is the configuration the key/certs to use for management. - properties: - selfSigned: - description: SelfSigned generates a new self signed certificate. + configFile: + description: + ConfigFile is the default configuration file name for + the pod. + type: string + configPath: + description: + ConfigPath is the mount point for configuration inside + the pod. + type: string + env: + description: Env are the environment variables to set for the container. + items: + description: + EnvVar represents an environment variable present in + a Container. properties: - commonName: - description: / Common name to set in the cert. + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: + 'Variable references $(VAR_NAME) are expanded using + the previously defined environment variables in the container + and any service environment variables. If a variable cannot + be resolved, the reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows for escaping + the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the + string literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists or + not. Defaults to "".' type: string - keySize: - description: RSA keysize to use for key generation. + valueFrom: + description: + Source for the environment variable's value. Cannot + be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: + "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?" + type: string + optional: + description: + Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + fieldRef: + description: + "Selects a field of the pod: supports metadata.name, + metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, + status.podIP, status.podIPs." + properties: + apiVersion: + description: + Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: + Path of the field to select in the specified + API version. + type: string + required: + - fieldPath + type: object + resourceFieldRef: + description: + "Selects a resource of the container: only + resources limits and requests (limits.cpu, limits.memory, + limits.ephemeral-storage, requests.cpu, requests.memory + and requests.ephemeral-storage) are currently supported." + properties: + containerName: + description: + "Container name: required for volumes, + optional for env vars" + type: string + divisor: + anyOf: + - type: integer + - type: string + description: + Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: "Required: resource to select" + type: string + required: + - resource + type: object + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: + The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: + "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?" + type: string + optional: + description: + Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + type: object + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + image: + description: Image is the container image to run. + type: string + initImage: + description: + InitImage is the docker image to use as an init container + for the pod. + type: string + initSleep: + description: InitSleep is the time sleep in the init container + type: integer + interfaceCount: + description: + InterfaceCount is number of interfaces to be attached + to the pod. + type: integer + ports: + additionalProperties: + description: ServicePort describes an external L4 port on the device. + properties: + innerPort: + description: InnerPort is port on the container to expose. + format: int32 + type: integer + outerPort: + description: OuterPort is port on the container to expose. + format: int32 type: integer required: - - commonName - - keySize + - innerPort + - outerPort type: object - type: object - type: object - status: - description: LemmingStatus defines the observed state of Lemming - properties: - message: - description: Message describes why the lemming is in the current phase. - type: string - phase: - description: Phase is the overall status of the Lemming. - type: string - required: - - message - - phase - type: object - type: object - served: true - storage: true - subresources: - status: {} + description: Ports are ports to create on the service. + type: object + resources: + description: + Resources are the K8s resources to allocate to lemming + container. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: + "Limits describes the maximum amount of compute resources + allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: + "Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, otherwise + to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" + type: object + type: object + tls: + description: TLS is the configuration the key/certs to use for management. + properties: + selfSigned: + description: SelfSigned generates a new self signed certificate. + properties: + commonName: + description: / Common name to set in the cert. + type: string + keySize: + description: RSA keysize to use for key generation. + type: integer + required: + - commonName + - keySize + type: object + type: object + type: object + status: + description: LemmingStatus defines the observed state of Lemming + properties: + message: + description: Message describes why the lemming is in the current phase. + type: string + phase: + description: Phase is the overall status of the Lemming. + type: string + required: + - message + - phase + type: object + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: v1 kind: ServiceAccount @@ -273,37 +296,37 @@ metadata: name: lemming-leader-election-role namespace: lemming-operator rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -311,74 +334,74 @@ metadata: creationTimestamp: null name: lemming-manager-role rules: -- apiGroups: - - "" - resources: - - pods - - secrets - - services - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - lemming.openconfig.net - resources: - - lemmings - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - lemming.openconfig.net - resources: - - lemmings/finalizers - verbs: - - update -- apiGroups: - - lemming.openconfig.net - resources: - - lemmings/status - verbs: - - get - - patch - - update + - apiGroups: + - "" + resources: + - pods + - secrets + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - lemming.openconfig.net + resources: + - lemmings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - lemming.openconfig.net + resources: + - lemmings/finalizers + verbs: + - update + - apiGroups: + - lemming.openconfig.net + resources: + - lemmings/status + verbs: + - get + - patch + - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: lemming-metrics-reader rules: -- nonResourceURLs: - - /metrics - verbs: - - get + - nonResourceURLs: + - /metrics + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: lemming-proxy-role rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -390,9 +413,9 @@ roleRef: kind: Role name: lemming-leader-election-role subjects: -- kind: ServiceAccount - name: lemming-controller-manager - namespace: lemming-operator + - kind: ServiceAccount + name: lemming-controller-manager + namespace: lemming-operator --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -403,9 +426,9 @@ roleRef: kind: ClusterRole name: lemming-manager-role subjects: -- kind: ServiceAccount - name: lemming-controller-manager - namespace: lemming-operator + - kind: ServiceAccount + name: lemming-controller-manager + namespace: lemming-operator --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -416,9 +439,9 @@ roleRef: kind: ClusterRole name: lemming-proxy-role subjects: -- kind: ServiceAccount - name: lemming-controller-manager - namespace: lemming-operator + - kind: ServiceAccount + name: lemming-controller-manager + namespace: lemming-operator --- apiVersion: v1 data: @@ -458,10 +481,10 @@ metadata: namespace: lemming-operator spec: ports: - - name: https - port: 8443 - protocol: TCP - targetPort: https + - name: https + port: 8443 + protocol: TCP + targetPort: https selector: control-plane: controller-manager --- @@ -485,61 +508,61 @@ spec: control-plane: controller-manager spec: containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=0 - image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.12.0 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - protocol: TCP - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - command: - - /manager - image: us-west1-docker.pkg.dev/openconfig-lemming/release/operator:v0.2.3 - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.12.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + image: us-west1-docker.pkg.dev/openconfig-lemming/release/operator:v0.2.8 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL securityContext: runAsNonRoot: true serviceAccountName: lemming-controller-manager diff --git a/manifests/controllers/lemming/manifest.yaml b/manifests/controllers/lemming/manifest.yaml index 3f3b60158..2628fcf34 100644 --- a/manifests/controllers/lemming/manifest.yaml +++ b/manifests/controllers/lemming/manifest.yaml @@ -21,265 +21,290 @@ spec: singular: lemming scope: Namespaced versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: Lemming is the Schema for the lemmings API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: LemmingSpec defines the desired state of Lemming. - properties: - args: - description: Args are the args to pass to the command. - items: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: Lemming is the Schema for the lemmings API + properties: + apiVersion: + description: + "APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: + "Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: LemmingSpec defines the desired state of Lemming. + properties: + args: + description: Args are the args to pass to the command. + items: + type: string + type: array + command: + description: Command is the name of the executable to run. type: string - type: array - command: - description: Command is the name of the executable to run. - type: string - configFile: - description: ConfigFile is the default configuration file name for - the pod. - type: string - configPath: - description: ConfigPath is the mount point for configuration inside - the pod. - type: string - env: - description: Env are the environment variables to set for the container. - items: - description: EnvVar represents an environment variable present in - a Container. + configFile: + description: + ConfigFile is the default configuration file name for + the pod. + type: string + configPath: + description: + ConfigPath is the mount point for configuration inside + the pod. + type: string + env: + description: Env are the environment variables to set for the container. + items: + description: + EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: + 'Variable references $(VAR_NAME) are expanded using + the previously defined environment variables in the container + and any service environment variables. If a variable cannot + be resolved, the reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows for escaping + the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the + string literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists or + not. Defaults to "".' + type: string + valueFrom: + description: + Source for the environment variable's value. Cannot + be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: + "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?" + type: string + optional: + description: + Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + fieldRef: + description: + "Selects a field of the pod: supports metadata.name, + metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, + status.podIP, status.podIPs." + properties: + apiVersion: + description: + Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: + Path of the field to select in the specified + API version. + type: string + required: + - fieldPath + type: object + resourceFieldRef: + description: + "Selects a resource of the container: only + resources limits and requests (limits.cpu, limits.memory, + limits.ephemeral-storage, requests.cpu, requests.memory + and requests.ephemeral-storage) are currently supported." + properties: + containerName: + description: + "Container name: required for volumes, + optional for env vars" + type: string + divisor: + anyOf: + - type: integer + - type: string + description: + Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: "Required: resource to select" + type: string + required: + - resource + type: object + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: + The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: + "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?" + type: string + optional: + description: + Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + type: object + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + image: + description: Image is the container image to run. + type: string + initImage: + description: + InitImage is the docker image to use as an init container + for the pod. + type: string + initSleep: + description: InitSleep is the time sleep in the init container + type: integer + interfaceCount: + description: + InterfaceCount is number of interfaces to be attached + to the pod. + type: integer + ports: + additionalProperties: + description: ServicePort describes an external L4 port on the device. + properties: + innerPort: + description: InnerPort is port on the container to expose. + format: int32 + type: integer + outerPort: + description: OuterPort is port on the container to expose. + format: int32 + type: integer + required: + - innerPort + - outerPort + type: object + description: Ports are ports to create on the service. + type: object + resources: + description: + Resources are the K8s resources to allocate to lemming + container. properties: - name: - description: Name of the environment variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) are expanded using - the previously defined environment variables in the container - and any service environment variables. If a variable cannot - be resolved, the reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable exists or - not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment variable's value. Cannot - be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, status.hostIP, - status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the schema the FieldPath is - written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the specified - API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of the container: only - resources limits and requests (limits.cpu, limits.memory, - limits.ephemeral-storage, requests.cpu, requests.memory - and requests.ephemeral-storage) are currently supported.' - properties: - containerName: - description: 'Container name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of the exposed - resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the Secret or its key must - be defined - type: boolean - required: - - key - type: object + claims: + description: + "Claims lists the names of resources, defined in + spec.resourceClaims, that are used by this container. \n This + is an alpha field and requires enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: + Name must match the name of one entry in pod.spec.resourceClaims + of the Pod where this field is used. It makes that resource + available inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: + "Limits describes the maximum amount of compute resources + allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: + "Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, otherwise + to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" type: object - required: - - name type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - image: - description: Image is the container image to run. - type: string - initImage: - description: InitImage is the docker image to use as an init container - for the pod. - type: string - initSleep: - description: InitSleep is the time sleep in the init container - type: integer - interfaceCount: - description: InterfaceCount is number of interfaces to be attached - to the pod. - type: integer - ports: - additionalProperties: - description: ServicePort describes an external L4 port on the device. + tls: + description: TLS is the configuration the key/certs to use for management. properties: - innerPort: - description: InnerPort is port on the container to expose. - format: int32 - type: integer - outerPort: - description: OuterPort is port on the container to expose. - format: int32 - type: integer - required: - - innerPort - - outerPort - type: object - description: Ports are ports to create on the service. - type: object - resources: - description: Resources are the K8s resources to allocate to lemming - container. - properties: - claims: - description: "Claims lists the names of resources, defined in - spec.resourceClaims, that are used by this container. \n This - is an alpha field and requires enabling the DynamicResourceAllocation - feature gate. \n This field is immutable." - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. + selfSigned: + description: SelfSigned generates a new self signed certificate. properties: - name: - description: Name must match the name of one entry in pod.spec.resourceClaims - of the Pod where this field is used. It makes that resource - available inside a container. + commonName: + description: / Common name to set in the cert. type: string + keySize: + description: RSA keysize to use for key generation. + type: integer required: - - name + - commonName + - keySize type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount of compute - resources required. If Requests is omitted for a container, - it defaults to Limits if that is explicitly specified, otherwise - to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - tls: - description: TLS is the configuration the key/certs to use for management. - properties: - selfSigned: - description: SelfSigned generates a new self signed certificate. - properties: - commonName: - description: / Common name to set in the cert. - type: string - keySize: - description: RSA keysize to use for key generation. - type: integer - required: - - commonName - - keySize - type: object - type: object - type: object - status: - description: LemmingStatus defines the observed state of Lemming - properties: - message: - description: Message describes why the lemming is in the current phase. - type: string - phase: - description: Phase is the overall status of the Lemming. - type: string - required: - - message - - phase - type: object - type: object - served: true - storage: true - subresources: - status: {} + type: object + type: object + status: + description: LemmingStatus defines the observed state of Lemming + properties: + message: + description: Message describes why the lemming is in the current phase. + type: string + phase: + description: Phase is the overall status of the Lemming. + type: string + required: + - message + - phase + type: object + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: v1 kind: ServiceAccount @@ -293,37 +318,37 @@ metadata: name: lemming-leader-election-role namespace: lemming-operator rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -331,74 +356,74 @@ metadata: creationTimestamp: null name: lemming-manager-role rules: -- apiGroups: - - "" - resources: - - pods - - secrets - - services - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - lemming.openconfig.net - resources: - - lemmings - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - lemming.openconfig.net - resources: - - lemmings/finalizers - verbs: - - update -- apiGroups: - - lemming.openconfig.net - resources: - - lemmings/status - verbs: - - get - - patch - - update + - apiGroups: + - "" + resources: + - pods + - secrets + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - lemming.openconfig.net + resources: + - lemmings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - lemming.openconfig.net + resources: + - lemmings/finalizers + verbs: + - update + - apiGroups: + - lemming.openconfig.net + resources: + - lemmings/status + verbs: + - get + - patch + - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: lemming-metrics-reader rules: -- nonResourceURLs: - - /metrics - verbs: - - get + - nonResourceURLs: + - /metrics + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: lemming-proxy-role rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -410,9 +435,9 @@ roleRef: kind: Role name: lemming-leader-election-role subjects: -- kind: ServiceAccount - name: lemming-controller-manager - namespace: lemming-operator + - kind: ServiceAccount + name: lemming-controller-manager + namespace: lemming-operator --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -423,9 +448,9 @@ roleRef: kind: ClusterRole name: lemming-manager-role subjects: -- kind: ServiceAccount - name: lemming-controller-manager - namespace: lemming-operator + - kind: ServiceAccount + name: lemming-controller-manager + namespace: lemming-operator --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -436,9 +461,9 @@ roleRef: kind: ClusterRole name: lemming-proxy-role subjects: -- kind: ServiceAccount - name: lemming-controller-manager - namespace: lemming-operator + - kind: ServiceAccount + name: lemming-controller-manager + namespace: lemming-operator --- apiVersion: v1 data: @@ -478,10 +503,10 @@ metadata: namespace: lemming-operator spec: ports: - - name: https - port: 8443 - protocol: TCP - targetPort: https + - name: https + port: 8443 + protocol: TCP + targetPort: https selector: control-plane: controller-manager --- @@ -505,61 +530,61 @@ spec: control-plane: controller-manager spec: containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=0 - image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.12.0 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - protocol: TCP - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - command: - - /manager - image: us-west1-docker.pkg.dev/openconfig-lemming/release/operator:v0.2.4 - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + image: registry.k8s.io/kubebuilder/kube-rbac-proxy:v0.12.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + command: + - /manager + image: us-west1-docker.pkg.dev/openconfig-lemming/release/operator:v0.2.8 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: "2" + memory: 1Gi + requests: + cpu: 100m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL securityContext: runAsNonRoot: true serviceAccountName: lemming-controller-manager