fluxcd.controlplane.io_resourcesetinputproviders.yaml

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: resourcesetinputproviders.fluxcd.controlplane.io
spec:
  group: fluxcd.controlplane.io
  names:
    kind: ResourceSetInputProvider
    listKind: ResourceSetInputProviderList
    plural: resourcesetinputproviders
    shortNames:
    - rsip
    singular: resourcesetinputprovider
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - jsonPath: .status.conditions[?(@.type=="Ready")].status
      name: Ready
      type: string
    - jsonPath: .status.conditions[?(@.type=="Ready")].message
      name: Status
      type: string
    name: v1
    schema:
      openAPIV3Schema:
        description: ResourceSetInputProvider is the Schema for the ResourceSetInputProviders
          API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: ResourceSetInputProviderSpec defines the desired state of
              ResourceSetInputProvider
            properties:
              audiences:
                description: |-
                  Audiences specifies the audience claim to be set in JWT credentials,
                  like the ServiceAccountToken credential. Required when using JWT
                  credentials.
                items:
                  type: string
                type: array
              certSecretRef:
                description: |-
                  CertSecretRef specifies the Kubernetes Secret containing either or both of

                  - a PEM-encoded CA certificate (`ca.crt`)
                  - a PEM-encoded client certificate (`tls.crt`) and private key (`tls.key`)

                  When connecting to a Git or OCI provider that uses self-signed certificates, the CA certificate
                  must be set in the Secret under the 'ca.crt' key to establish the trust relationship.
                  When connecting to an OCI provider that supports client certificates (mTLS), the client certificate
                  and private key must be set in the Secret under the 'tls.crt' and 'tls.key' keys, respectively.
                properties:
                  name:
                    description: Name of the referent.
                    type: string
                required:
                - name
                type: object
              credential:
                description: |-
                  Credential specifies the type of credential that will be sent to the input provider.
                  Supported values are:

                    - ServiceAccountToken: The operator will generate a Kubernetes ServiceAccount
                      token and send it as a bearer token to the provider. Currently supported only
                      for the OCIArtifactTag type when connecting to OCI registries that support
                      workload identity federation. If ServiceAccountName is not specified, the
                      ServiceAccount of the operator will be used to generate the token.
                enum:
                - ServiceAccountToken
                type: string
              defaultValues:
                additionalProperties:
                  x-kubernetes-preserve-unknown-fields: true
                description: |-
                  DefaultValues contains the default values for the inputs.
                  These values are used to populate the inputs when the provider
                  response does not contain them.
                type: object
              filter:
                description: Filter defines the filter to apply to the input provider
                  response.
                properties:
                  excludeBranch:
                    description: |-
                      ExcludeBranch specifies the regular expression to filter the branches
                      that the input provider should exclude.
                    type: string
                  excludeEnvironment:
                    description: |-
                      ExcludeEnvironment specifies the regular expression to filter the environments
                      that the input provider should exclude.
                    type: string
                  excludeTag:
                    description: |-
                      ExcludeTag specifies the regular expression to filter the tags
                      that the input provider should exclude.
                    type: string
                  includeBranch:
                    description: |-
                      IncludeBranch specifies the regular expression to filter the branches
                      that the input provider should include.
                    type: string
                  includeEnvironment:
                    description: |-
                      IncludeEnvironment specifies the regular expression to filter the environments
                      that the input provider should include.
                    type: string
                  includeTag:
                    description: |-
                      IncludeTag specifies the regular expression to filter the tags
                      that the input provider should include.
                    type: string
                  labels:
                    description: Labels specifies the list of labels to filter the
                      input provider response.
                    items:
                      type: string
                    type: array
                  limit:
                    default: 100
                    description: |-
                      Limit specifies the maximum number of input sets to return.
                      When not set, the default limit is 100.
                    type: integer
                  semver:
                    description: |-
                      Semver specifies a semantic version range to filter and sort the tags.
                      If this field is not specified, the tags will be sorted in reverse
                      alphabetical order.
                      Supported only for tags at the moment.
                    type: string
                type: object
              schedule:
                description: Schedule defines the schedules for the input provider
                  to run.
                items:
                  description: Schedule defines a schedule for something to run.
                  properties:
                    cron:
                      description: Cron specifies the cron expression for the schedule.
                      type: string
                    timeZone:
                      default: UTC
                      description: TimeZone specifies the time zone for the cron schedule.
                        Defaults to UTC.
                      type: string
                    window:
                      default: 0s
                      description: |-
                        Window defines the time window during which the execution is allowed.
                        Defaults to 0s, meaning no window is applied.
                      pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
                      type: string
                  required:
                  - cron
                  type: object
                type: array
              secretRef:
                description: |-
                  SecretRef specifies the Kubernetes Secret containing the basic-auth credentials
                  to access the input provider.
                  When connecting to a Git provider, the secret must contain the keys
                  'username' and 'password', and the password should be a personal access token
                  that grants read-only access to the repository.
                  When connecting to an OCI provider, the secret must contain a Kubernetes
                  Image Pull Secret, as if created by `kubectl create secret docker-registry`.
                properties:
                  name:
                    description: Name of the referent.
                    type: string
                required:
                - name
                type: object
              serviceAccountName:
                description: |-
                  ServiceAccountName specifies the name of the Kubernetes ServiceAccount
                  in the same namespace as the ResourceSetInputProvider used for
                  authentication with workload identity federation features. If
                  not specified, the authentication will use the ServiceAccount of the
                  operator (or any other environment authentication configuration, e.g.
                  for cloud providers). If Type is set to OCIArtifactTag and Credential
                  is not set, the image pull secrets of the ServiceAccount are used to
                  authenticate to the OCI registry.
                type: string
              skip:
                description: Skip defines whether we need to skip input provider response
                  updates.
                properties:
                  labels:
                    description: |-
                      Labels specifies list of labels to skip input provider response when any of the label conditions matched.
                      When prefixed with !, input provider response will be skipped if it does not have this label.
                    items:
                      type: string
                    type: array
                type: object
              type:
                description: Type specifies the type of the input provider.
                enum:
                - Static
                - GitHubBranch
                - GitHubTag
                - GitHubPullRequest
                - GitLabBranch
                - GitLabTag
                - GitLabMergeRequest
                - GitLabEnvironment
                - AzureDevOpsBranch
                - AzureDevOpsTag
                - AzureDevOpsPullRequest
                - OCIArtifactTag
                - ACRArtifactTag
                - ECRArtifactTag
                - GARArtifactTag
                type: string
              url:
                description: |-
                  URL specifies the HTTP/S or OCI address of the input provider API.
                  When connecting to a Git provider, the URL should point to the repository address.
                  When connecting to an OCI provider, the URL should point to the OCI repository address.
                pattern: ^((http|https|oci)://.*){0,1}$
                type: string
            required:
            - type
            type: object
            x-kubernetes-validations:
            - message: spec.url must be empty when spec.type is 'Static'
              rule: self.type != 'Static' || !has(self.url)
            - message: spec.url must not be empty when spec.type is not 'Static'
              rule: self.type == 'Static' || has(self.url)
            - message: spec.url must start with 'http://' or 'https://' when spec.type
                is a Git provider
              rule: '!self.type.startsWith(''Git'') || self.url.startsWith(''http'')'
            - message: spec.url must start with 'http://' or 'https://' when spec.type
                is a Git provider
              rule: '!self.type.startsWith(''AzureDevOps'') || self.url.startsWith(''http'')'
            - message: spec.url must start with 'oci://' when spec.type is an OCI
                provider
              rule: '!self.type.endsWith(''ArtifactTag'') || self.url.startsWith(''oci'')'
            - message: cannot specify spec.serviceAccountName when spec.type is not
                one of AzureDevOps* or *ArtifactTag
              rule: '!has(self.serviceAccountName) || self.type.startsWith(''AzureDevOps'')
                || self.type.endsWith(''ArtifactTag'')'
            - message: cannot specify spec.certSecretRef when spec.type is one of
                Static, AzureDevOps*, ACRArtifactTag, ECRArtifactTag or GARArtifactTag
              rule: '!has(self.certSecretRef) || !(self.url == ''Static'' || self.type.startsWith(''AzureDevOps'')
                || (self.type.endsWith(''ArtifactTag'') && self.type != ''OCIArtifactTag''))'
            - message: cannot specify spec.secretRef when spec.type is one of Static,
                ACRArtifactTag, ECRArtifactTag or GARArtifactTag
              rule: '!has(self.secretRef) || !(self.url == ''Static'' || (self.type.endsWith(''ArtifactTag'')
                && self.type != ''OCIArtifactTag''))'
            - message: spec.credential can be set to 'ServiceAccountToken' only when
                spec.type is 'OCIArtifactTag'
              rule: '!has(self.credential) || (self.credential == ''ServiceAccountToken''
                && self.type == ''OCIArtifactTag'')'
            - message: spec.audiences can be set only when spec.credential is set
                to 'ServiceAccountToken'
              rule: '!has(self.audiences) || size(self.audiences) == 0 || (has(self.credential)
                && self.credential == ''ServiceAccountToken'')'
            - message: spec.audiences must be set when spec.credential is set to 'ServiceAccountToken'
              rule: '!has(self.credential) || self.credential != ''ServiceAccountToken''
                || (has(self.audiences) && size(self.audiences) > 0)'
          status:
            description: ResourceSetInputProviderStatus defines the observed state
              of ResourceSetInputProvider.
            properties:
              conditions:
                description: Conditions contains the readiness conditions of the object.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
              exportedInputs:
                description: ExportedInputs contains the list of inputs exported by
                  the provider.
                items:
                  additionalProperties:
                    x-kubernetes-preserve-unknown-fields: true
                  description: ResourceSetInput defines the key-value pairs of the
                    ResourceSet input.
                  type: object
                type: array
              lastExportedRevision:
                description: |-
                  LastExportedRevision is the digest of the
                  inputs that were last reconcile.
                type: string
              lastHandledForceAt:
                description: |-
                  LastHandledForceAt holds the value of the most recent
                  force request value, so a change of the annotation value
                  can be detected.
                type: string
              lastHandledReconcileAt:
                description: |-
                  LastHandledReconcileAt holds the value of the most recent
                  reconcile request value, so a change of the annotation value
                  can be detected.
                type: string
              nextSchedule:
                description: NextSchedule is the next schedule when the input provider
                  will run.
                properties:
                  cron:
                    description: Cron specifies the cron expression for the schedule.
                    type: string
                  timeZone:
                    default: UTC
                    description: TimeZone specifies the time zone for the cron schedule.
                      Defaults to UTC.
                    type: string
                  when:
                    description: When is the next time the schedule will run.
                    format: date-time
                    type: string
                  window:
                    default: 0s
                    description: |-
                      Window defines the time window during which the execution is allowed.
                      Defaults to 0s, meaning no window is applied.
                    pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
                    type: string
                required:
                - cron
                - when
                type: object
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}