MkeChildConfig#
MkeChildConfig describes an MKE 4 child cluster that the management cluster provisions through k0rdent.
MkeChildConfig
Kind
Kind
mke.mirantis.com
Group
Group
v1alpha1
Version
Version
apiVersion: mke.mirantis.com/v1alpha1
kind: MkeChildConfig
MkeChildConfig is the Schema for the mkechildconfigs API
Scope: Namespaced · Source: mke.mirantis.com_mkechildconfigs.yaml
spec object required
spec is the desired state of the child cluster.airgap object
airgap configures installation in an airgapped environment.enabled boolean required
enabled marks the cluster as installed in an airgapped environment. Defaults to false.apiServer object
apiServer configures the Kubernetes API server.alwaysPullImages boolean
alwaysPullImages enables the AlwaysPullImages admission controller.audit object
audit configures audit logging for the API server.customPolicyYaml string
customPolicyYaml is a custom audit policy in YAML. When set, level is ignored.enabled boolean required
enabled enables audit logging for the API server. Defaults to false.level string
level is the audit log level. Defaults to Metadata.maxAge integer
maxAge is the number of days to retain rotated audit log files, by the timestamp in their name. Defaults to 30.maxBackup integer
maxBackup is the number of rotated audit log files to retain. 0 means unlimited. Defaults to 10.maxSize integer
maxSize is the size in megabytes at which the audit log file is rotated. Defaults to 10.webhookConfigSecret string
webhookConfigSecret is the name of a Secret in the same namespace holding the audit webhook configuration under the value key.encryptionConfigSecret string
encryptionConfigSecret is the name of a Secret in the same namespace holding a custom EncryptionConfig under the value key.eventRateLimit object
eventRateLimit configures the EventRateLimit admission controller.enabled boolean required
enabled enables the EventRateLimit admission controller. Defaults to false.limits []object
limits lists the rate limits. At least one is required when enabled.limit string required
limit is the limit type: Namespace, User, SourceAndObject or Server.limitBurst integer required
limitBurst is the maximum burst of events allowed for this limit type. For example, with limitBurst: 10 and limitQPS: 3, 10 events are accepted at once, then 3 more per second; unused allowance carries over up to 10.limitCacheSize integer
limitCacheSize is the size of the LRU cache of rate-limit buckets. An evicted bucket starts over with a full burst allowance. Defaults to 4096.limitQPS integer required
limitQPS is the number of events per second allowed for this limit type once the burst is exhausted.extraArgs map[string]string
extraArgs sets extra arguments passed to kube-apiserver.port integer
port is the port kube-apiserver listens on. Defaults to 6443.profilingEnabled boolean
profilingEnabled enables profiling on the API server at /debug/pprof/.requestTimeout string
requestTimeout is how long a request may stay open before the API server times it out. Defaults to 1m0s.sans []string
sans lists extra Subject Alternative Names for the API server serving certificate. Entries may be IP addresses or DNS names.tlsCipherSuites []string
tlsCipherSuites lists the TLS cipher suites enabled for the API server.ucpauthz object
ucpauthz configures the mke4-ucpauthz ValidatingAdmissionPolicy.disabled boolean
disabled disables the policy.exemptNamespaces []string
exemptNamespaces lists additional namespaces exempt from the policy.exemptUsers []string
exemptUsers lists additional service accounts exempt from the policy.noDefaultUserExemptions boolean
noDefaultUserExemptions removes the default user exemptions, which are the service accounts of the MKE-managed Calico components.valuesYaml string
valuesYaml sets raw Helm values for the policy chart, in YAML. When set, it overrides all other fields here.authentication object
authentication configures MKE authentication.audience []string
audience lists the audiences for the aud claim of Dex-issued ID tokens and access tokens.authenticatedUsers object
authenticatedUsers sets the permissions granted to every authenticated user (the system:authenticated group).grants object
grants sets the permissions granted to every authenticated user.nodeAccess boolean
nodeAccess grants cluster-wide read access to nodes by binding the mke-viewer-role cluster role. Defaults to false.prometheusAccess boolean
prometheusAccess grants access to the Prometheus service proxy in the mke namespace by binding the mke-prometheus-access role. Defaults to false.clients []object
clients lists predefined OIDC clients.id string
id is the OIDC client id.name string
name is the display name shown to users at login.public boolean
public marks the client as public (for example CLI or mobile apps), disabling client secret checks.redirectURIs []string
redirectURIs lists the allowed redirect URIs. They must match the application's callback URLs exactly.secret string
secret is the client secret. Not required for public clients.credentialsSecretName string
credentialsSecretName is the name of a pre-created Secret of type mke.mirantis.com/auth-credentials holding the authentication secrets under the keys ldapBindPassword, oidcClientSecret and oidcClientId. When set, the operator reads credentials from it and does not modify spec. Cannot be combined with the deprecated inline fields ldap.bindPW, oidc.clientSecret and oidc.clientID. CA data (ldap.caData, saml.caData and oidc.rootCAs) stays in spec; the Secret's CA keys are read only as a fallback for clusters upgraded from MKE 4.2.0.expiry object
expiry sets token and key expiration. Durations are a number with a unit (s, m, h), for example 10m. The example shows the defaults.deviceRequests string
deviceRequests is the time frame in which users can authorize a device to receive an access or ID token.idTokens string
idTokens is the ID token lifetime. Short lifetimes such as 10m are recommended. Defaults to 1h.refreshTokens object
refreshTokens sets the refresh token expiration. When unset, defaults to validIfNotUsedFor: 4h and absoluteLifetime: 12h; when set, only the fields given apply.absoluteLifetime string
absoluteLifetime is the absolute lifetime of a refresh token. After it, users must authenticate again.reuseInterval string
reuseInterval is the period during which the refresh endpoint returns the same refresh token, provided the request carries the previous one.validIfNotUsedFor string
validIfNotUsedFor invalidates refresh tokens unused for this long.signingKeys string
signingKeys is the signing key rotation period. Public keys stay available for validation until the ID tokens signed with them expire.ldap object required
ldap configures Lightweight Directory Access Protocol (ldap) authentication.bindDN string
bindDN is the Distinguished Name of the service account used with bindPW to search for users and groups. Not required for anonymous access.
Example: bindDN: "uid=serviceaccount,cn=users,dc=example,dc=com"bindPW string
bindPW is the password of the service account identified by bindDN. Not required for anonymous access. Prefer the ldapBindPassword key of the Secret referenced by credentialsSecretName; this inline field is deprecated and will be removed.ca string
ca is the path to the trusted root ca certificate file inside the Dex Pod. The file must be mounted manually. Alternative to caData.caData string
caData is the trusted root CA certificate, PEM-encoded. Alternative to ca.enabled boolean required
enabled enables LDAP authentication. Defaults to false.groupSearch object
groupSearch finds the groups of a user entry.baseDN string
baseDN is the base DN of the group search. The query is (&(<filter>)(<userMatchers[].groupAttr>=<user attribute>)).
Example: baseDN: "cn=groups,dc=freeipa,dc=example,dc=com"filter string
filter is the filter for the group search.
Example: filter: "(objectClass=group)"nameAttr string
nameAttr is the attribute holding the group name.
Example: nameAttr: "cn"userMatchers []object
userMatchers lists attribute pairs that match a user to a group: the group attribute must equal the user attribute.
Example: userMatchers: [{userAttr: "dn", groupAttr: "member"}]groupAttr string
groupAttr is the group attribute listing the members.
Example: groupAttr: "member"userAttr string
userAttr is the user attribute compared with the group attribute. Usually the same as userSearch.idAttr.
Example: userAttr: "uid"host string
host is the LDAP server, as host or host:port. Without a port, 389 is used with insecureNoSSL or startTLS, 636 otherwise.insecureNoSSL boolean
insecureNoSSL connects without TLS. Required when the LDAP server does not use TLS (port 389).insecureSkipVerify boolean
insecureSkipVerify disables verification of the server TLS certificate. For testing only.noSimplePagination boolean
noSimplePagination omits the Simple Paged Results control from LDAP user and group synchronization searches, for directory servers that reject or mishandle the control. Defaults to false, which paginates searches.startTLS boolean
startTLS connects over ldap:// and upgrades the connection with startTLS. Otherwise ldaps:// is used.userSearch object
userSearch maps the entered username and password to an LDAP user entry.baseDN string
baseDN is the base DN of the user search. The query is (&(<filter>)(<username>=<entered username>)).
Example: baseDN: "cn=users,dc=example,dc=com"emailAttr string
emailAttr is the attribute mapped to the user email.
Example: emailAttr: "mail"filter string
filter is an optional filter for the user search.
Example: filter: "(objectClass=person)"idAttr string
idAttr is the attribute uniquely identifying the user. Usually the same as groupSearch.userMatchers[].userAttr.
Example: idAttr: "DN" or idAttr: "uid"nameAttr string
nameAttr is the attribute mapped to the user display name.
Example: nameAttr: "name"preferredUsernameAttr string
preferredUsernameAttr is the attribute mapped to the preferred username. When set, it replaces the username value.
Example: preferredUsernameAttr: "uid"username string
username is the attribute compared with the entered username, as (<attr>=<username>).
Example: username: "uid"usernamePrompt string
usernamePrompt is the label of the username field on the login form. Defaults to Username.localUsers boolean
localUsers enables local users in Dex. Defaults to true.oauth2 object
oauth2 customizes the OAuth 2.0 flow.alwaysShowLoginScreen boolean
alwaysShowLoginScreen always shows the login screen. By default, when a single authentication method is enabled, users are redirected straight to it.passwordConnector string
passwordConnector is the connector ID used for password grants.responseTypes []string
responseTypes lists the allowed OAuth 2.0 response types, which select the authorization flow.
- code: Authorization Code Flow
- id_token: Implicit Flow
- id_token token: Implicit Flow
- code id_token: Hybrid Flow
- code token: Hybrid Flow
- code id_token token: Hybrid Flow
See the Authorization Examples in OpenID Connect Core 1.0.skipApprovalScreen boolean
skipApprovalScreen skips the consent screen that asks users to approve sharing their data with the client application.oidc object required
oidc configures OpenID Connect (oidc) authentication.clientID string
clientID is the OIDC client ID. Prefer the oidcClientId key of the Secret referenced by credentialsSecretName; this inline field is deprecated and will be removed.clientSecret string
clientSecret is the OIDC client secret. Prefer the oidcClientSecret key of the Secret referenced by credentialsSecretName; this inline field is deprecated and will be removed.enabled boolean required
enabled enables OIDC authentication. Defaults to false.insecureSkipVerify boolean
insecureSkipVerify disables TLS certificate verification of the OIDC provider. For testing only.issuer string
issuer is the provider issuer URL, also used for discovery. Must match the issuer in the provider's discovery document.rootCAs []string
rootCAs lists PEM-encoded root CA certificates used to verify the TLS connection to the OIDC provider. Use it when the IdP has a private or self-signed certificate.usernameClaim string
usernameClaim is the claim used as the username. Defaults to name.preLogonMessage string
preLogonMessage is a plain-text message shown on the login page before credentials are entered, for example a regulatory notice. Empty shows no banner.proxy object
proxy configures a single shared HTTP(S) proxy for outbound authentication traffic: Dex OIDC requests and operator retrieval of saml.ssoMetadataURL. It does not apply to LDAP, browser redirects or SAML form posts. Disabled by default.enabled boolean required
enabled routes authentication traffic through the proxy.noProxy []string
noProxy lists additional hosts, domains or CIDRs excluded from proxying. Entries are merged with the in-cluster exclusions MKE generates (localhost, Kubernetes service names, .svc, .cluster.local); they never replace the generated ones.url string
url is the proxy url: an absolute http:// or https:// url with a host, for example http://proxy.example.com:3128. Credentials embedded in the url are rejected. For an authenticating proxy, supply the credentials as the proxyUsername and proxyPassword keys of the auth-credentials Secret (the one referenced by credentialsSecretName, or the operator-managed authentication-credentials Secret otherwise). Required when enabled.replicaCount integer
replicaCount is the number of Dex Pod replicas. Defaults to the number of control plane nodes.resources object
resources sets the Dex Pod resource requests and limits. Entries are merged over the defaults, which are the example values.limits map[string]int|string
limits sets the maximum amount of compute resources allowed.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/requests map[string]int|string
requests sets the minimum amount of compute resources required.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/saml object required
saml configures Security Assertion Markup Language (saml) authentication.ca string
ca is the path to the ca certificate file inside the Dex Pod. The file must be mounted manually. Alternative to caData.caData string
caData is the CA certificate, as base64-encoded PEM. Alternative to ca.emailAttr string
emailAttr is the email attribute in the returned assertions, mapped to ID token claims.enabled boolean required
enabled enables SAML authentication. Defaults to false.entityIssuer string
entityIssuer is the issuer value Dex sends in the AuthnRequest. It also replaces the redirect URI as the expected audience in AudienceRestriction checks.groupsAttr string
groupsAttr is the groups attribute in the returned assertions, mapped to ID token claims.groupsDelim string
groupsDelim is the delimiter for groups returned as a single attribute value. By default each group is a separate attribute with the same name.insecureSkipSignatureValidation boolean
insecureSkipSignatureValidation skips SAML response signature validation. For testing only.nameIDPolicyFormat string
nameIDPolicyFormat is the requested NameID format. The NameID is mapped to the user ID.
The last component of the URI is enough. For example, emailAddress resolves to:urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddressurn:oasis:names:tc:SAML:2.0:nameid-format:persistentssoIssuer string
ssoIssuer is the issuer value expected in the SAML response.ssoURL string
ssoURL is the IdP single sign-on URL.usernameAttr string
usernameAttr is the username attribute in the returned assertions, mapped to ID token claims.topologySpreadConstraints []object
topologySpreadConstraints sets the Pod topology spread constraints of the Dex addon.
See: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/labelSelector object
labelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.matchLabelKeys []string
matchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both matchLabelKeys and LabelSelector. matchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector.
This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).maxSkew integer (int32) required
maxSkew describes the degree to which pods may be unevenly distributed. When whenUnsatisfiable=DoNotSchedule, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, maxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1.
| zone1 | zone2 | zone3 |
| P P | P P | P |
- if maxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate maxSkew(1).
- if maxSkew is 2, incoming pod can be scheduled onto any zone. When whenUnsatisfiable=ScheduleAnyway, it is used to give higher precedence to topologies that satisfy it. It's a required field. Default value is 1 and 0 is not allowed.minDomains integer (int32)
minDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if minDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule.
For example, in a 3-zone cluster, MaxSkew is set to 2, minDomains is set to 5 and pods with the same labelSelector spread as 2/2/2:
| zone1 | zone2 | zone3 |
| P P | P P | P P |
The number of domains is less than 5(minDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.nodeAffinityPolicy string
nodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are:
- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.
- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
If this value is nil, the behavior is equivalent to the Honor policy.nodeTaintsPolicy string
nodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are:
- Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included.
- Ignore: node taints are ignored. All nodes are included.
If this value is nil, the behavior is equivalent to the Ignore policy.topologyKey string required
topologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If topologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if topologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field.whenUnsatisfiable string required
whenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint.
- DoNotSchedule (default) tells the scheduler not to schedule it.
- ScheduleAnyway tells the scheduler to schedule the pod in any location,
but giving higher precedence to topologies that would help reduce the
skew.
A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1:
| zone1 | zone2 | zone3 |
| P P P | P | P |
If whenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field.certificates object
certificates configures custom TLS certificates for customer-facing services.domainName string required
domainName is the fully qualified domain name used to reach the cluster with the custom certificate. An IP address is accepted if it is visible to the API server. Must differ from spec.apiServer.externalAddress.enabled boolean required
enabled enables the custom TLS certificate for customer-facing services.secretName string required
secretName is the name of the kubernetes.io/tls Secret holding the custom certificate. Put the CA in the ca.crt key.componentScheduling object
componentScheduling configures scheduling of MKE components. By default, component scheduling is enabled for the child control plane, Dex, Envoy Gateway and Prometheus.enabled boolean
enabled applies topology spread constraints to MKE components. Defaults to true.topologySpreadConstraints []object
topologySpreadConstraints sets the Pod topology spread constraints applied to MKE components. The example shows the defaults.
See: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/labelSelector object
labelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.matchLabelKeys []string
matchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both matchLabelKeys and LabelSelector. matchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector.
This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).maxSkew integer (int32) required
maxSkew describes the degree to which pods may be unevenly distributed. When whenUnsatisfiable=DoNotSchedule, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, maxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1.
| zone1 | zone2 | zone3 |
| P P | P P | P |
- if maxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate maxSkew(1).
- if maxSkew is 2, incoming pod can be scheduled onto any zone. When whenUnsatisfiable=ScheduleAnyway, it is used to give higher precedence to topologies that satisfy it. It's a required field. Default value is 1 and 0 is not allowed.minDomains integer (int32)
minDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if minDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule.
For example, in a 3-zone cluster, MaxSkew is set to 2, minDomains is set to 5 and pods with the same labelSelector spread as 2/2/2:
| zone1 | zone2 | zone3 |
| P P | P P | P P |
The number of domains is less than 5(minDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.nodeAffinityPolicy string
nodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are:
- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.
- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
If this value is nil, the behavior is equivalent to the Honor policy.nodeTaintsPolicy string
nodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are:
- Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included.
- Ignore: node taints are ignored. All nodes are included.
If this value is nil, the behavior is equivalent to the Ignore policy.topologyKey string required
topologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If topologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if topologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field.whenUnsatisfiable string required
whenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint.
- DoNotSchedule (default) tells the scheduler not to schedule it.
- ScheduleAnyway tells the scheduler to schedule the pod in any location,
but giving higher precedence to topologies that would help reduce the
skew.
A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1:
| zone1 | zone2 | zone3 |
| P P P | P | P |
If whenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field.controllerManager object
controllerManager configures kube-controller-manager.extraArgs map[string]string
extraArgs sets extra arguments passed to kube-controller-manager. They take precedence over the other fields here, such as profilingEnabled and terminatedPodGCThreshold.profilingEnabled boolean
profilingEnabled enables profiling on kube-controller-manager (sets the profiling argument).terminatedPodGCThreshold integer
terminatedPodGCThreshold is the number of terminated Pods kept before garbage collection starts (sets the terminated-pod-gc-threshold argument). Defaults to 12500.devicePlugins object
devicePlugins configures MKE device plugins.nvidiaGPU object
nvidiaGPU configures the NVIDIA GPU Operator, which installs and manages the NVIDIA components needed to run GPU workloads: drivers, the Kubernetes device plugin, the NVIDIA container runtime, node labelling and DCGM monitoring.
See: https://docs.mirantis.com/mke4k/latest/configuration/nvidia-gpu/enabled boolean required
enabled enables the NVIDIA GPU Operator. Defaults to false.mig object
mig configures Multi-Instance GPU (mig). mig partitions Ampere and later GPUs, such as the A100, into isolated GPU instances. Only the single strategy is supported.enabled boolean
enabled enables the MIG manager.dns object
dns configures CoreDNS.lameduck object
lameduck configures the CoreDNS lameduck option, which delays shutdown by a fixed duration.duration string
duration is how long shutdown is delayed. Defaults to 7s.enabled boolean
enabled sets the lameduck option on the CoreDNS health plugin.driftDetection object
driftDetection configures drift detection of MKE services. By default, drift detection and correction is enabled for all MKE services.disabled boolean
disabled disables drift detection for the child cluster services.driftExclusions []object
driftExclusions lists resource fields ignored by drift detection.paths []string required
paths is a slice of JSON6902 paths to exclude from configuration drift evaluation.target object
target points to the resources that the paths refers to.annotationSelector string
annotationSelector is a string that follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api It matches with the resource annotations.group string
group is the API group to select resources from. Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.mdkind string
kind of the API Group to select resources from. Together with Group and Version it is capable of unambiguously identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.mdlabelSelector string
labelSelector is a string that follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api It matches with the resource labels.name string
name to match resources with.namespace string
namespace to select resources from.version string
version of the API Group to select resources from. Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.mddriftIgnore []object
driftIgnore lists resources ignored by drift detection.annotationSelector string
annotationSelector is a string that follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api It matches with the resource annotations.group string
group is the API group to select resources from. Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.mdkind string
kind of the API Group to select resources from. Together with Group and Version it is capable of unambiguously identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.mdlabelSelector string
labelSelector is a string that follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api It matches with the resource labels.name string
name to match resources with.namespace string
namespace to select resources from.version string
version of the API Group to select resources from. Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.mdenvoyGateway object
envoyGateway configures Envoy Gateway, the Kubernetes Gateway API controller.nodeSelector map[string]string
nodeSelector sets the node labels the controller Pods must match. Merged with the default selectors:
- kubernetes.io/os: linux
- node-role.kubernetes.io/control-plane: "true"replicaCount integer
replicaCount is the number of Envoy Gateway controller replicas. Defaults to the number of control plane nodes.resources object
resources sets the resource requests and limits of the controller Pods.limits map[string]string
limits sets the resource limits.requests map[string]string
requests sets the resource requests.tolerations []object
tolerations sets the tolerations of the controller Pods. The example shows the defaults.effect string required
effect is the taint effect to match: NoSchedule, PreferNoSchedule or NoExecute. Empty matches all taint effects.key string required
key is the taint key the toleration applies to. Empty matches all taint keys; operator must then be Exists.operator string required
operator is the relationship between the key and the value: Equal or Exists. Exists matches any value of the key. Defaults to Equal.value string required
value is the taint value the toleration matches. Must be empty when operator is Exists.etcd object
etcd configures etcd.maintenanceService object
maintenanceService configures the etcd maintenance service on the child control plane nodes. When set, the service is installed from an OCI artifact fetched through the mothership API at node bootstrap.cleanupEnabled boolean required
cleanupEnabled enables scheduled cleanup of Kubernetes Events from etcd.cronExpression string required
cronExpression is the cron schedule for cleanup and, if enabled, defragmentation. Runs must be at least 72 hours apart.defragEnabled boolean
defragEnabled enables scheduled defragmentation, run right after cleanup.defragPauseSeconds integer required
defragPauseSeconds is the pause in seconds between defragmenting consecutive etcd members.defragTimeoutSeconds integer required
defragTimeoutSeconds is the timeout in seconds for each defragmentation command.grpcPort integer
grpcPort is the port of the maintenance service internal gRPC API. Defaults to 5557.httpPort integer
httpPort is the port of the maintenance service HTTP API. Defaults to
18088.minTTLToKeepSeconds integer
minTTLToKeepSeconds is the minimum remaining TTL, in seconds, an Event must have to survive cleanup.storageQuota string
storageQuota is the maximum etcd storage size, as a quantity in bytes, kibibytes, mebibytes, gibibytes or tebibytes, for example 8GiB. Units are case-insensitive; the b suffix is optional.tlsCipherSuites []string
tlsCipherSuites lists the TLS cipher suites enabled for the etcd API server.fips object
fips configures fips mode.enabled boolean required
enabled enables FIPS mode. Cannot be changed after creation.gatewayMKEIngress object
gatewayMKEIngress configures the Gateway that serves MKE's own endpoints, such as authentication.envoyProxy object
envoyProxy configures the Envoy proxy shared by the HTTP and HTTPS management Gateways.affinity object
affinity sets the affinity rules of the Envoy proxy Pods.nodeAffinity object
Describes node affinity scheduling rules for the pod.
preferredDuringSchedulingIgnoredDuringExecution []object
The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.
preference object required
A node selector term, associated with the corresponding weight.
matchExpressions []object
A list of node selector requirements by node's labels.
key string required
The label
key that the selector applies to.operator string required
Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
values []string
An array of string
values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.matchFields []object
A list of node selector requirements by node's fields.
key string required
The label
key that the selector applies to.operator string required
Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
values []string
An array of string
values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.weight integer (int32) required
weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.requiredDuringSchedulingIgnoredDuringExecution object
If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.
nodeSelectorTerms []object required
Required. A list of node selector terms. The terms are ORed.
matchExpressions []object
A list of node selector requirements by node's labels.
key string required
The label
key that the selector applies to.operator string required
Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
values []string
An array of string
values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.matchFields []object
A list of node selector requirements by node's fields.
key string required
The label
key that the selector applies to.operator string required
Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
values []string
An array of string
values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.podAffinity object
Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
preferredDuringSchedulingIgnoredDuringExecution []object
The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
podAffinityTerm object required
Required. A pod affinity term, associated with the corresponding weight.
labelSelector object
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.matchLabelKeys []string
matchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key in (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.mismatchLabelKeys []string
mismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key notin (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.namespaceSelector object
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.namespaces []string
namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".topologyKey string required
This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key
topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.weight integer (int32) required
weight associated with matching the corresponding podAffinityTerm, in the range 1-100.requiredDuringSchedulingIgnoredDuringExecution []object
If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
labelSelector object
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.matchLabelKeys []string
matchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key in (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.mismatchLabelKeys []string
mismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key notin (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.namespaceSelector object
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.namespaces []string
namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".topologyKey string required
This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key
topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.podAntiAffinity object
Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
preferredDuringSchedulingIgnoredDuringExecution []object
The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
podAffinityTerm object required
Required. A pod affinity term, associated with the corresponding weight.
labelSelector object
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.matchLabelKeys []string
matchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key in (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.mismatchLabelKeys []string
mismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key notin (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.namespaceSelector object
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.namespaces []string
namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".topologyKey string required
This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key
topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.weight integer (int32) required
weight associated with matching the corresponding podAffinityTerm, in the range 1-100.requiredDuringSchedulingIgnoredDuringExecution []object
If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
labelSelector object
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.matchLabelKeys []string
matchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key in (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.mismatchLabelKeys []string
mismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key notin (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.namespaceSelector object
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.key string required
key is the label key that the selector applies to.operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.matchLabels map[string]string
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.namespaces []string
namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".topologyKey string required
This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key
topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.defaultLoggingLevel string
defaultLoggingLevel is the default log level of the Envoy proxy Pods: trace, debug, info, warning, error, critical or off.nodeSelector map[string]string
nodeSelector sets the node labels the Envoy proxy Pods must match. Merged with the default selectors:
- kubernetes.io/os: linux
- node-role.kubernetes.io/control-plane: "true"podDisruptionBudget object
podDisruptionBudget configures the podDisruptionBudget of the Envoy proxy Pods.replicas integer
replicas is the number of Envoy proxy replicas.resources object
resources sets the resource requests and limits of the Envoy proxy Pods.limits map[string]string
limits sets the resource limits.requests map[string]string
requests sets the resource requests.tolerations []object
tolerations sets the tolerations of the Envoy proxy Pods.effect string required
effect is the taint effect to match: NoSchedule, PreferNoSchedule or NoExecute. Empty matches all taint effects.key string required
key is the taint key the toleration applies to. Empty matches all taint keys; operator must then be Exists.operator string required
operator is the relationship between the key and the value: Equal or Exists. Exists matches any value of the key. Defaults to Equal.value string required
value is the taint value the toleration matches. Must be empty when operator is Exists.gatewayClassName string
gatewayClassName is the name of the GatewayClass to use. Its controller must be Envoy Gateway.nodePorts object
nodePorts sets the node ports of the MKE Gateway listeners. They must be unique and within the cluster node port range. Only http and https are used. Default to 33000 and 33001 on the management cluster and 30000 and 30001 on child clusters.http integer
http is the node port of the external
http listener.https integer
https is the node port of the external
https listener.tcp map[string]integer
tcp maps tcp listener ports to node ports. Allocated from the node port range when empty. Ignored without tcpServices.udp map[string]integer
udp maps udp listener ports to node ports. Allocated from the node port range when empty. Ignored without udpServices.infrastructure object required
infrastructure configures the cluster infrastructure.clusterAnnotations map[string]string
clusterAnnotations sets annotations added to the CAPI Cluster.clusterLabels map[string]string
clusterLabels sets labels added to the CAPI Cluster.clusterTemplate string
clusterTemplate is the name of the k0rdent clusterTemplate. Allowed only with the custom provider.configuration any
configuration sets the ClusterTemplate Helm values. Defaults to the template chart defaults. The example shows aws values.controlPlaneNumber integer
controlPlaneNumber is the number of control plane nodes.credential string required
credential is the name of the k0rdent credential object.provider string required
provider is the infrastructure provider: aws, vsphere, remote or custom. Immutable.workersNumber integer
workersNumber is the number of worker nodes.ingressController object
ingressController configures the NGINX ingress controller.affinity object
affinity sets the affinity rules of the ingress controller Pods.nodeAffinity object required
nodeAffinity sets the node affinity scheduling rules of the Pod.preferredDuringSchedulingIgnoredDuringExecution []object
preferredDuringSchedulingIgnoredDuringExecution lists weighted node affinity preferences. The scheduler prefers the node with the greatest sum of matching weights, but may pick a node that matches none.preference object required
preference is the node selector term associated with weight.matchExpressions []object
matchExpressions lists node selector requirements by node labels.key string required
key is the label key the selector applies to.operator string required
operator is the relationship between the key and the values: In, NotIn, Exists, DoesNotExist, Gt or Lt.values []string
values lists the values. Must be non-empty for In and NotIn, empty for Exists and DoesNotExist, and a single integer for Gt and Lt.matchFields []object
matchFields lists node selector requirements by node fields.key string required
key is the label key the selector applies to.operator string required
operator is the relationship between the key and the values: In, NotIn, Exists, DoesNotExist, Gt or Lt.values []string
values lists the values. Must be non-empty for In and NotIn, empty for Exists and DoesNotExist, and a single integer for Gt and Lt.weight integer (int32) required
weight is the weight of a node matching preference, in the range 1-100.requiredDuringSchedulingIgnoredDuringExecution object
requiredDuringSchedulingIgnoredDuringExecution sets the node affinity requirements that must be met at scheduling time. Requirements that stop being met while the Pod runs do not evict it.nodeSelectorTerms []object required
nodeSelectorTerms lists the node selector terms. A node matches when any term matches.matchExpressions []object
matchExpressions lists node selector requirements by node labels.key string required
key is the label key the selector applies to.operator string required
operator is the relationship between the key and the values: In, NotIn, Exists, DoesNotExist, Gt or Lt.values []string
values lists the values. Must be non-empty for In and NotIn, empty for Exists and DoesNotExist, and a single integer for Gt and Lt.matchFields []object
matchFields lists node selector requirements by node fields.key string required
key is the label key the selector applies to.operator string required
operator is the relationship between the key and the values: In, NotIn, Exists, DoesNotExist, Gt or Lt.values []string
values lists the values. Must be non-empty for In and NotIn, empty for Exists and DoesNotExist, and a single integer for Gt and Lt.configMap map[string]string
configMap sets NGINX ingress controller configMap options. See the ingress-nginx documentation for the full list.disableHTTP boolean
disableHTTP disables the HTTP listener on the ingress controller Services.enableLoadBalancer boolean
enableLoadBalancer sets the ingress controller Service type to LoadBalancer.externalIPs []string
externalIPs lists the external IPs of the ingress controller Service.extraArgs object
extraArgs sets additional command-line arguments of the ingress controller.defaultSslCertificate string
defaultSslCertificate is the Secret with the certificate of the default (catch-all) HTTPS server, as namespace/name. For child clusters, create the Secret on the management cluster; it is synced to the child. Ignored when spec.certificates is enabled. Defaults to the MKE-generated mke/mke-ingress.tls.enableSslPassthrough boolean required
enableSslPassthrough enables SSL passthrough. Defaults to false.httpPort integer
httpPort is the container port for HTTP traffic. Defaults to
80.httpsPort integer
httpsPort is the container port for HTTPS traffic. Defaults to
443.nodePorts object
nodePorts sets the node ports of the external listeners. They must be unique and within the cluster node port range.http integer
http is the node port of the external
http listener.https integer
https is the node port of the external
https listener.tcp map[string]integer
tcp maps tcp listener ports to node ports. Allocated from the node port range when empty. Ignored without tcpServices.udp map[string]integer
udp maps udp listener ports to node ports. Allocated from the node port range when empty. Ignored without udpServices.ports object
preserveClientIP boolean
preserveClientIP preserves the source IP of inbound traffic.replicaCount integer
replicaCount is the number of ingress controller replicas. Defaults to 2.tcpServices map[string]string
tcpServices maps TCP ports to expose to namespace/service:port.
Example: "8080": "default/example-tcp-svc:9000" exposes port 9000 of that Service on port 8080.tolerations []object
tolerations sets the tolerations of the ingress controller Pods.effect string required
effect is the taint effect to match: NoSchedule, PreferNoSchedule or NoExecute. Empty matches all taint effects.key string required
key is the taint key the toleration applies to. Empty matches all taint keys; operator must then be Exists.operator string required
operator is the relationship between the key and the value: Equal or Exists. Exists matches any value of the key. Defaults to Equal.value string required
value is the taint value the toleration matches. Must be empty when operator is Exists.udpServices map[string]string
udpServices maps UDP ports to expose to namespace/service:port.
Example: "53": "kube-system/kube-dns:53" exposes port 53 of that Service on port 53.kubelet object
kubelet configures the kubelet.customProfiles []object
customProfiles lists named kubelet configuration profiles.name string required
name is the unique profile name. The names mke-default-manager and mke-default-worker are reserved.values object (any) required
values is the kubelet configuration overriding the k0s defaults. The following fields cannot be overridden:
- clusterDNS
- clusterDomain
- apiVersion
- kind
- staticPodURL
See: https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/eventRecordQPS integer
eventRecordQPS is the maximum number of events created per second. Must be non-negative; 0 means no limit. Defaults to 50.extraArgs map[string]string
extraArgs sets extra command-line flags passed to every kubelet.kubeletRootDir string
kubeletRootDir is the kubelet root directory. Defaults to /var/lib/kubelet.managerKubeReserved map[string]string
managerKubeReserved sets the resources reserved for Kubernetes system components on manager nodes, as resource name to quantity pairs, for example cpu: 200m. Supported resources are cpu, memory and ephemeral-storage (root file system). The example shows the defaults.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/managerProfile string
managerProfile is the kubelet profile for manager nodes: a customProfiles name or mke-default-manager. Defaults to mke-default-manager.maxParallelImagePulls integer
maxParallelImagePulls is the maximum number of images the kubelet pulls in parallel. Must be positive. Values above 1 require serializeImagePulls: false. Defaults to 1.maxPods integer
maxPods is the maximum number of Pods per node. Must be non-negative. Defaults to 110.podPidsLimit integer
podPidsLimit is the maximum number of PIDs in any Pod. -1 means no limit. Defaults to -1.podsPerCore integer required
podsPerCore is the maximum number of Pods per CPU core. Cannot exceed maxPods. Must be non-negative; 0 means no limit. Defaults to 0.protectKernelDefaults boolean required
protectKernelDefaults makes the kubelet fail when kernel flags differ from its expectations instead of changing them. Defaults to false.seccompDefault boolean required
seccompDefault uses RuntimeDefault as the default seccomp profile for all workloads. Defaults to false.serializeImagePulls boolean
serializeImagePulls pulls images one at a time. Set it to false to allow parallel pulls, bounded by maxParallelImagePulls. Parallel pulls are not recommended on nodes with an AuFS storage backend. Defaults to true.tlsCipherSuites []string
tlsCipherSuites lists the TLS cipher suites enabled for the kubelet.workerKubeReserved map[string]string
workerKubeReserved sets the resources reserved for Kubernetes system components on worker nodes, as resource name to quantity pairs, for example cpu: 200m. Supported resources are cpu, memory and ephemeral-storage (root file system). The example shows the defaults.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/workerProfile string
workerProfile is the kubelet profile for worker nodes: a customProfiles name or mke-default-worker. Defaults to mke-default-worker.license object
license is the Mirantis license of the MKE cluster.secretRef object
secretRef references a Secret in the MkeChildConfig namespace holding the license token. Takes precedence over the inline token.
See: https://pkg.go.dev/k8s.io/api/core/v1#SecretKeySelectorkey string required
The
key of the secret to select from. Must be a valid secret key.name string
name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#namesoptional boolean
Specify whether the Secret or its key must be defined
token string
token is the license as a JWT (RFC 7519): the base64-encoded <JOSE_HEADER>.<PAYLOAD>.<SIGNATURE>. It is signed by the Mirantis license generation tool and validated with the Mirantis public key.monitoring object
monitoring configures MKE monitoring.enableCAdvisor boolean required
enableCAdvisor enables cAdvisor container-level metrics. Defaults to false.prometheus object
prometheus configures prometheus.nodeSelector map[string]string
nodeSelector sets the node labels the Prometheus Pod must match.
See: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/resources object
resources sets the Prometheus Pod resource requests and limits.limits map[string]int|string
limits sets the maximum amount of compute resources allowed.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/requests map[string]int|string
requests sets the minimum amount of compute resources required.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/retention string
retention is how long metrics are kept in the Prometheus TSDB, as a Prometheus duration such as 24h or 7d.retentionSize string
retentionSize is the maximum on-disk storage Prometheus may use for TSDB blocks, as a byte size such as 50GB or 100MiB.scrapeInterval string
scrapeInterval is how often Prometheus scrapes targets, as a Prometheus duration such as 30s or 1m.network object
network configures the cluster network.kubeProxy object
kubeProxy configures kube-proxy. The example shows the defaults.disabled boolean
No Description Provided.
extraArgs map[string]string
Map of key-values (strings) for any extra arguments to pass down to kube-proxy process Any behavior triggered by these parameters is outside k0s support.
iptables object
KubeProxyIPTablesConfiguration contains iptables-related kube-proxy configuration @see https://github.com/kubernetes/kube-proxy/blob/v0.35.4/config/v1alpha1/types.go#L27-L48
localhostNodePorts boolean
No Description Provided.
masqueradeAll boolean
No Description Provided.
masqueradeBit integer (int32)
No Description Provided.
minSyncPeriod string
No Description Provided.
syncPeriod string
No Description Provided.
ipvs object
KubeProxyIPVSConfiguration contains ipvs-related kube-proxy configuration @see https://github.com/kubernetes/kube-proxy/blob/v0.35.4/config/v1alpha1/types.go#L52-L78
excludeCIDRs []string
No Description Provided.
minSyncPeriod string
No Description Provided.
scheduler string
No Description Provided.
strictARP boolean
No Description Provided.
syncPeriod string
No Description Provided.
tcpFinTimeout string
No Description Provided.
tcpTimeout string
No Description Provided.
udpTimeout string
No Description Provided.
metricsBindAddress string
No Description Provided.
mode string
mode defines the kube-proxy mode. Supported values are "iptables", "ipvs", "userspace" and "nft" Defaults to "iptables"nftables object
KubeProxyNFTablesConfiguration contains nftables-related kube-proxy configuration @see https://github.com/kubernetes/kube-proxy/blob/v0.35.4/config/v1alpha1/types.go#L82-L97
masqueradeAll boolean
No Description Provided.
masqueradeBit integer (int32)
No Description Provided.
minSyncPeriod string
No Description Provided.
syncPeriod string
No Description Provided.
nodePortAddresses []string
No Description Provided.
rawArgs []string
Slice of strings with raw arguments to pass to the kube-proxy process These arguments will be appended to the
ExtraArgs and aren't validated at all. ExtraArgs are recommended over rawArgs. If possible use ExtraArgs to set arguments.multus object
multus configures multus CNI.enabled boolean required
enabled installs Multus CNI alongside the main CNI provider. Defaults to false.provider object
provider configures the CNI provider. The specified provider is always enabled; its enabled flag is ignored. Defaults to Calico.enabled boolean required
enabled enables the CNI provider.extraConfig map[string]string
extraConfig sets additional configuration parameters of the CNI provider.
See: https://docs.mirantis.com/mke4k/latest/configuration/container-network-interface/configure-cni-providers/provider string required
provider is the CNI provider name. Defaults to calico.serviceCIDR string
serviceCIDR is the IPv4 range of Service IP addresses. Defaults to 10.96.0.0/16.nodeLocalDNS object
nodeLocalDNS configures nodeLocalDNS.enabled boolean required
enabled enables nodelocaldns. Defaults to false.nodeLocalConfigPersist boolean
nodeLocalConfigPersist creates the nodelocaldns ConfigMap with defaults and leaves it for users to edit. When false, the operator keeps overwriting it. Defaults to false.resources object
resources sets the resource requests of the nodelocaldns Pods.requests object
requests sets the resource requests.cpu string
cpu is the cpu request, for example 100m.memory string
memory is the memory request, for example 128Mi.policyController object
policyController configures MKE policy controllers.opaGatekeeper object required
opaGatekeeper configures the OPA Gatekeeper policy controller.enabled boolean required
enabled enables OPA Gatekeeper. Defaults to false.exemptNamespaces []string
exemptNamespaces lists namespaces exempt from the Gatekeeper admission webhook, in addition to the MKE system namespaces.registries object
registries configures the image and chart registries.chartRegistry object
chartRegistry is the registry of the MKE system Helm charts. The URL must start with oci://. Defaults to oci://ghcr.io/mirantiscontainers.caData string
caData is the PEM-encoded certificate of the CA that issued the registry TLS certificate. Required when the CA is not publicly trusted.credentialsSecretName string
credentialsSecretName is the name of a Secret in the mke namespace holding pull credentials for this registry. The Secret must be of type kubernetes.io/dockerconfigjson. When empty, the registry is accessed anonymously.url string
url is the registry address, with an optional port, followed by the project path holding the MKE artifacts. A trailing / is removed.imageRegistry object
imageRegistry is the registry of the MKE system images. Defaults to ghcr.io/mirantiscontainers.caData string
caData is the PEM-encoded certificate of the CA that issued the registry TLS certificate. Required when the CA is not publicly trusted.credentialsSecretName string
credentialsSecretName is the name of a Secret in the mke namespace holding pull credentials for this registry. The Secret must be of type kubernetes.io/dockerconfigjson. When empty, the registry is accessed anonymously.url string
url is the registry address, with an optional port, followed by the project path holding the MKE artifacts. A trailing / is removed.scheduler object
scheduler configures kube-scheduler.bindToAll boolean
bindToAll binds kube-scheduler to all interfaces (sets the bind-address argument).extraArgs map[string]string
extraArgs sets extra arguments passed to kube-scheduler. They take precedence over the other fields here, such as profilingEnabled and bindToAll.profilingEnabled boolean
profilingEnabled enables profiling on kube-scheduler (sets the profiling argument).services []object
services lists additional services to install on the cluster. Names of the default MKE services are reserved, including disabled ones.dependsOn []object
dependsOn specifies a list of other services that this service depends on.name string required
name is the release name on target cluster.namespace string
namespace is the release namespace on target cluster.disable boolean
disable can be set to disable handling of this service.helmAction string
HelmChartAction specifies action on an helm chart
helmOptions object
helmOptions are the options to be passed to the provider for helm installation or updatesatomic boolean
if set, the installation process deletes the installation/upgrades on failure. The --wait flag will be set automatically if --atomic is used
dependencyUpdate boolean
update dependencies if they are missing before installing the chart
description string
description is the description of an helm operationdisableHooks boolean
prevent hooks from running during install/upgrade/uninstall
disableOpenAPIValidation boolean
if set, the installation process will not validate rendered templates against the Kubernetes OpenAPI Schema
enableClientCache boolean
enableClientCache is a flag to enable Helm client cache. If it is not specified, it will be set to false.installOptions object
installOptions are options specific to helm installcreateNamespace boolean
Create the release namespace if not present. Defaults to true
disableHooks boolean
prevent hooks from running during install. If set to true, overrides
disableHooks in HelmOptions. Use this one when you want to selective disable hooks on install Default to falsereplace boolean
Replaces if set indicates to
replace an older release with this onelabels map[string]string
labels that would be added to release metadata.skipCRDs boolean
skipCRDs controls whether CRDs should be installed during install/upgrade operation. By default, CRDs are installed if not already present.skipSchemaValidation boolean
skipSchemaValidation determines if JSON schema validation is disabled.timeout string
time to wait for any individual Kubernetes operation (like Jobs for hooks) (default 5m0s)
uninstallOptions object
uninstallOptions are options specific to helm uninstalldeletionPropagation string
deletionPropagationdisableHooks boolean
prevent hooks from running during install. If set to true, overrides
disableHooks in HelmOptions. Use this one when you want to selective disable hooks on uninstall Default to falsekeepHistory boolean
When uninstall a chart with this flag, Helm removes the resources associated with the chart, but it keeps the release information. This allows to see details about the uninstalled release using the helm history command.
upgradeOptions object
upgradeOptions are options specific to helm upgradecleanupOnFail boolean
cleanupOnFail will, if true, cause the upgrade to delete newly-created resources on a failed update.disableHooks boolean
prevent hooks from running during install. If set to true, overrides
disableHooks in HelmOptions. Use this one when you want to selective disable hooks on upgrade Default to falseforce boolean
force will, if set to true, ignore certain warnings and perform the upgrade anyway. This should be used with caution.maxHistory integer
maxHistory limits the maximum number of revisions saved per release Default to 2recreate boolean
recreate will (if true) recreate pods after a rollback.resetThenReuseValues boolean
resetThenReuseValues will reset the values to the chart's built-ins then merge with user's last supplied values.resetValues boolean
resetValues will reset the values to the chart's built-ins rather than merging with existing.reuseValues boolean
reuseValues copies values from the current release to a new release if the new release does not have any values. If the request already has values, or if there are no values in the current release, this does nothing. This is skipped if the ResetValues flag is set, in which case the request values are not altered.subNotes boolean
subNotes determines whether sub-notes are rendered in the chart.upgradeCRDs boolean
upgradeCRDs upgrade CRDs from the Helm Chart's crds directory By default, CRDs are not applied during Helm upgrade action by Helm https://helm.sh/docs/chart_best_practices/custom_resource_definitions/wait boolean
if set, will
wait until all Pods, PVCs, Services, and minimum number of Pods of a Deployment, StatefulSet, or ReplicaSet are in a ready state before marking the release as successful. It will wait for as long as --timeoutwaitForJobs boolean
if set and --wait enabled, will wait until all Jobs have been completed before marking the release as successful. It will wait for as long as --timeout
name string required
name is the chart release.namespace string
namespace is the namespace the release will be installed in. It will default to "default" if not provided.template string required
template is a reference to a template object located in the same namespace.templateChain string
templateChain defines the ServiceTemplateChain object that will be used to deploy the service along with desired ServiceTemplate version.values string
values is the helm values to be passed to the chart used by the template. The string type is used in order to allow for templating.valuesFrom []object
valuesFrom can reference a ConfigMap or Secret containing helm values.kind string required
kind is the kind of the source.name string required
name is the name of the source.version string
version is the version of the service template.tls object
tls configures cluster-wide tls settings of the control plane components.useStrongCiphers boolean
useStrongCiphers restricts the TLS cipher suites used by the API server, kubelet and etcd to the strong set defined by control 4.2.12 (kubelet) of the CIS Kubernetes Benchmark v1.7.0. That set is also a subset of the suites control 1.2.31 permits for the API server. CIS defines no cipher-suite control for etcd, so applying the same set there is Mirantis policy rather than a benchmark requirement. It is the MKE 4 equivalent of the MKE 3 use_strong_tls_ciphers hardening option. Defaults to false.
A non-empty per-component tlsCipherSuites list takes precedence: it is used as-is and, when useStrongCiphers is true, every entry must belong to the strong set. An empty list (tlsCipherSuites: []) is treated as unset and does not override the strong set, so a component with no non-empty list gets the strong set when useStrongCiphers is true. Under FIPS mode (spec.fips.enabled), the non-FIPS ChaCha20 suites are excluded from the strong set.tracking object
tracking configures MKE telemetry.clusterLabel string
clusterLabel is a label included in the telemetry data sent to Mirantis.enabled boolean
enabled sends telemetry to Mirantis. Cannot be disabled on unlicensed clusters. Defaults to true.ui object
ui configures the MKE Dashboard (ui) deployment.resources object
resources sets the resource requests and limits of the MKE Dashboard Pod. Entries are merged over the defaults, which are the example values.limits map[string]int|string
limits sets the maximum amount of compute resources allowed.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/requests map[string]int|string
requests sets the minimum amount of compute resources required.
See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/version string required
version is the MKE cluster version.status object
status is the most recently observed status of the MkeChildConfig.addons []object
addons contains the status of all supported MKE addons.failureMessage string
failureMessage contains additional details when an addon fails.name string required
name is the canonical addon name from the MKE addon catalog.state string required
state is the current lifecycle state of the addon.authCaConfigMap object
authCaConfigMap reports which CA bundles the operator resolved into the authentication-ca ConfigMap. Dex and dex-http-server mount a CA file only for the connectors reported present here, including a CA taken from the fallback Secret when the caData field in spec is empty.ldapPresent boolean
ldapPresent reports whether an LDAP CA was resolved into the ConfigMap.oidcPresent boolean
oidcPresent reports whether an OIDC CA was resolved into the ConfigMap.samlPresent boolean
samlPresent reports whether a SAML CA was resolved into the ConfigMap.authCredentials object
authCredentials reports the resolved authentication credentials source.secretName string required
secretName is the effective Secret the operator resolved credentials from.source string required
source is how the Secret was resolved: SecretRef when it comes from spec.authentication.credentialsSecretName, Adopted when the operator adopted an existing well-known Secret.clusterID string
clusterID is the ID of the cluster that was created by this MKE config.conditions []object
conditions lists the current state conditions of the MkeChildConfig.lastTransitionTime string (date-time) required
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.message string required
message is a human readable message indicating details about the transition. This may be an empty string.observedGeneration integer (int64)
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.reason string required
reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.status string required
status of the condition, one of True, False, Unknown.type string required
type of condition in CamelCase or in foo.example.com/CamelCase.externalAddress string
externalAddress is the load balancer address of the ingress controller and MKE dashboard.kubeConfigSecret string
kubeConfigSecret is the name of the Secret holding the child cluster kubeconfig.licenseStatus object
licenseStatus is the loaded license details.expiration string (date-time)
expiration is when the license expires.licenseType string
licenseType is the license type. unlicensed and expired are reported when no valid license is loaded.maxEngines integer
maxEngines is the maximum number of engines the license allows.scanningEnabled boolean
scanningEnabled is the advanced claim of the license.subject string
subject is the license subject.tier string
tier is the license tier.observedGeneration integer (int64)
observedGeneration is the generation of this config resource most recently reconciled into its ClusterDeployment and reflected in Addons.