apiVersion: v1
kind: Namespace
metadata:
  name: cert-manager
---
apiVersion: v1
kind: Namespace
metadata:
  name: metallb-system
---
apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/name: monitoring
    app.kubernetes.io/part-of: observability-stack
    name: monitoring
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/warn: privileged
  name: monitoring
---
apiVersion: v1
kind: Namespace
metadata:
  name: plevion-local
---
apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/managed-by: helm
    app.kubernetes.io/name: tailscale
    app.kubernetes.io/part-of: tailscale-service
    name: tailscale
  name: tailscale
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: bfdprofiles.metallb.io
spec:
  group: metallb.io
  names:
    kind: BFDProfile
    listKind: BFDProfileList
    plural: bfdprofiles
    singular: bfdprofile
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.passiveMode
      name: Passive Mode
      type: boolean
    - jsonPath: .spec.transmitInterval
      name: Transmit Interval
      type: integer
    - jsonPath: .spec.receiveInterval
      name: Receive Interval
      type: integer
    - jsonPath: .spec.detectMultiplier
      name: Multiplier
      type: integer
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: |-
          BFDProfile represents the settings of the bfd session that can be
          optionally associated with a BGP session.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: BFDProfileSpec defines the desired state of BFDProfile.
            properties:
              detectMultiplier:
                description: |-
                  Configures the detection multiplier to determine
                  packet loss. The remote transmission interval will be multiplied
                  by this value to determine the connection loss detection timer.
                format: int32
                maximum: 255
                minimum: 2
                type: integer
              echoInterval:
                description: |-
                  Configures the minimal echo receive transmission
                  interval that this system is capable of handling in milliseconds.
                  Defaults to 50ms
                format: int32
                maximum: 60000
                minimum: 10
                type: integer
              echoMode:
                description: |-
                  Enables or disables the echo transmission mode.
                  This mode is disabled by default, and not supported on multi
                  hops setups.
                type: boolean
              minimumTtl:
                description: |-
                  For multi hop sessions only: configure the minimum
                  expected TTL for an incoming BFD control packet.
                format: int32
                maximum: 254
                minimum: 1
                type: integer
              passiveMode:
                description: |-
                  Mark session as passive: a passive session will not
                  attempt to start the connection and will wait for control packets
                  from peer before it begins replying.
                type: boolean
              receiveInterval:
                description: |-
                  The minimum interval that this system is capable of
                  receiving control packets in milliseconds.
                  Defaults to 300ms.
                format: int32
                maximum: 60000
                minimum: 10
                type: integer
              transmitInterval:
                description: |-
                  The minimum transmission interval (less jitter)
                  that this system wants to use to send BFD control packets in
                  milliseconds. Defaults to 300ms
                format: int32
                maximum: 60000
                minimum: 10
                type: integer
            type: object
          status:
            description: BFDProfileStatus defines the observed state of BFDProfile.
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: bgpadvertisements.metallb.io
spec:
  group: metallb.io
  names:
    kind: BGPAdvertisement
    listKind: BGPAdvertisementList
    plural: bgpadvertisements
    singular: bgpadvertisement
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.ipAddressPools
      name: IPAddressPools
      type: string
    - jsonPath: .spec.ipAddressPoolSelectors
      name: IPAddressPool Selectors
      type: string
    - jsonPath: .spec.peers
      name: Peers
      type: string
    - jsonPath: .spec.nodeSelectors
      name: Node Selectors
      priority: 10
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: |-
          BGPAdvertisement allows to advertise the IPs coming
          from the selected IPAddressPools via BGP, setting the parameters of the
          BGP Advertisement.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: BGPAdvertisementSpec defines the desired state of BGPAdvertisement.
            properties:
              aggregationLength:
                default: 32
                description: The aggregation-length advertisement option lets you
                  “roll up” the /32s into a larger prefix. Defaults to 32. Works for
                  IPv4 addresses.
                format: int32
                minimum: 1
                type: integer
              aggregationLengthV6:
                default: 128
                description: The aggregation-length advertisement option lets you
                  “roll up” the /128s into a larger prefix. Defaults to 128. Works
                  for IPv6 addresses.
                format: int32
                type: integer
              communities:
                description: |-
                  The BGP communities to be associated with the announcement. Each item can be a standard community of the
                  form 1234:1234, a large community of the form large:1234:1234:1234 or the name of an alias defined in the
                  Community CRD.
                items:
                  type: string
                type: array
              ipAddressPoolSelectors:
                description: |-
                  A selector for the IPAddressPools which would get advertised via this advertisement.
                  If no IPAddressPool is selected by this or by the list, the advertisement is applied to all the IPAddressPools.
                items:
                  description: |-
                    A label selector is a label query over a set of resources. The result of matchLabels and
                    matchExpressions are ANDed. An empty label selector matches all objects. A null
                    label selector matches no objects.
                  properties:
                    matchExpressions:
                      description: matchExpressions is a list of label selector requirements.
                        The requirements are ANDed.
                      items:
                        description: |-
                          A label selector requirement is a selector that contains values, a key, and an operator that
                          relates the key and values.
                        properties:
                          key:
                            description: key is the label key that the selector applies
                              to.
                            type: string
                          operator:
                            description: |-
                              operator represents a key's relationship to a set of values.
                              Valid operators are In, NotIn, Exists and DoesNotExist.
                            type: string
                          values:
                            description: |-
                              values is an array of string values. If the operator is In or NotIn,
                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                              the values array must be empty. This array is replaced during a strategic
                              merge patch.
                            items:
                              type: string
                            type: array
                            x-kubernetes-list-type: atomic
                        required:
                        - key
                        - operator
                        type: object
                      type: array
                      x-kubernetes-list-type: atomic
                    matchLabels:
                      additionalProperties:
                        type: string
                      description: |-
                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                      type: object
                  type: object
                  x-kubernetes-map-type: atomic
                type: array
              ipAddressPools:
                description: The list of IPAddressPools to advertise via this advertisement,
                  selected by name.
                items:
                  type: string
                type: array
              localPref:
                description: |-
                  The BGP LOCAL_PREF attribute which is used by BGP best path algorithm,
                  Path with higher localpref is preferred over one with lower localpref.
                format: int32
                type: integer
              nodeSelectors:
                description: NodeSelectors allows to limit the nodes to announce as
                  next hops for the LoadBalancer IP. When empty, all the nodes having  are
                  announced as next hops.
                items:
                  description: |-
                    A label selector is a label query over a set of resources. The result of matchLabels and
                    matchExpressions are ANDed. An empty label selector matches all objects. A null
                    label selector matches no objects.
                  properties:
                    matchExpressions:
                      description: matchExpressions is a list of label selector requirements.
                        The requirements are ANDed.
                      items:
                        description: |-
                          A label selector requirement is a selector that contains values, a key, and an operator that
                          relates the key and values.
                        properties:
                          key:
                            description: key is the label key that the selector applies
                              to.
                            type: string
                          operator:
                            description: |-
                              operator represents a key's relationship to a set of values.
                              Valid operators are In, NotIn, Exists and DoesNotExist.
                            type: string
                          values:
                            description: |-
                              values is an array of string values. If the operator is In or NotIn,
                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                              the values array must be empty. This array is replaced during a strategic
                              merge patch.
                            items:
                              type: string
                            type: array
                            x-kubernetes-list-type: atomic
                        required:
                        - key
                        - operator
                        type: object
                      type: array
                      x-kubernetes-list-type: atomic
                    matchLabels:
                      additionalProperties:
                        type: string
                      description: |-
                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                      type: object
                  type: object
                  x-kubernetes-map-type: atomic
                type: array
              peers:
                description: |-
                  Peers limits the bgppeer to advertise the ips of the selected pools to.
                  When empty, the loadbalancer IP is announced to all the BGPPeers configured.
                items:
                  type: string
                type: array
            type: object
          status:
            description: BGPAdvertisementStatus defines the observed state of BGPAdvertisement.
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: bgppeers.metallb.io
spec:
  conversion:
    strategy: Webhook
    webhook:
      clientConfig:
        service:
          name: metallb-webhook-service
          namespace: metallb-system
          path: /convert
      conversionReviewVersions:
      - v1beta1
      - v1beta2
  group: metallb.io
  names:
    kind: BGPPeer
    listKind: BGPPeerList
    plural: bgppeers
    singular: bgppeer
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.peerAddress
      name: Address
      type: string
    - jsonPath: .spec.peerASN
      name: ASN
      type: string
    - jsonPath: .spec.bfdProfile
      name: BFD Profile
      type: string
    - jsonPath: .spec.ebgpMultiHop
      name: Multi Hops
      type: string
    deprecated: true
    deprecationWarning: v1beta1 is deprecated, please use v1beta2
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: BGPPeer is the Schema for the peers API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: BGPPeerSpec defines the desired state of Peer.
            properties:
              bfdProfile:
                type: string
              ebgpMultiHop:
                description: EBGP peer is multi-hops away
                type: boolean
              holdTime:
                description: Requested BGP hold time, per RFC4271.
                type: string
              keepaliveTime:
                description: Requested BGP keepalive time, per RFC4271.
                type: string
              myASN:
                description: AS number to use for the local end of the session.
                format: int32
                maximum: 4294967295
                minimum: 0
                type: integer
              nodeSelectors:
                description: |-
                  Only connect to this peer on nodes that match one of these
                  selectors.
                items:
                  properties:
                    matchExpressions:
                      items:
                        properties:
                          key:
                            type: string
                          operator:
                            type: string
                          values:
                            items:
                              type: string
                            minItems: 1
                            type: array
                        required:
                        - key
                        - operator
                        - values
                        type: object
                      type: array
                    matchLabels:
                      additionalProperties:
                        type: string
                      type: object
                  type: object
                type: array
              password:
                description: Authentication password for routers enforcing TCP MD5
                  authenticated sessions
                type: string
              peerASN:
                description: AS number to expect from the remote end of the session.
                format: int32
                maximum: 4294967295
                minimum: 0
                type: integer
              peerAddress:
                description: Address to dial when establishing the session.
                type: string
              peerPort:
                description: Port to dial when establishing the session.
                maximum: 16384
                minimum: 0
                type: integer
              routerID:
                description: BGP router ID to advertise to the peer
                type: string
              sourceAddress:
                description: Source address to use when establishing the session.
                type: string
            required:
            - myASN
            - peerASN
            - peerAddress
            type: object
          status:
            description: BGPPeerStatus defines the observed state of Peer.
            type: object
        type: object
    served: true
    storage: false
    subresources:
      status: {}
  - additionalPrinterColumns:
    - jsonPath: .spec.peerAddress
      name: Address
      type: string
    - jsonPath: .spec.peerASN
      name: ASN
      type: string
    - jsonPath: .spec.bfdProfile
      name: BFD Profile
      type: string
    - jsonPath: .spec.ebgpMultiHop
      name: Multi Hops
      type: string
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: BGPPeer is the Schema for the peers API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: BGPPeerSpec defines the desired state of Peer.
            properties:
              bfdProfile:
                description: The name of the BFD Profile to be used for the BFD session
                  associated to the BGP session. If not set, the BFD session won't
                  be set up.
                type: string
              connectTime:
                description: Requested BGP connect time, controls how long BGP waits
                  between connection attempts to a neighbor.
                type: string
                x-kubernetes-validations:
                - message: connect time should be between 1 seconds to 65535
                  rule: duration(self).getSeconds() >= 1 && duration(self).getSeconds()
                    <= 65535
                - message: connect time should contain a whole number of seconds
                  rule: duration(self).getMilliseconds() % 1000 == 0
              disableMP:
                default: false
                description: |-
                  To set if we want to disable MP BGP that will separate IPv4 and IPv6 route exchanges into distinct BGP sessions.
                  Deprecated: DisableMP is deprecated in favor of dualStackAddressFamily.
                type: boolean
              dualStackAddressFamily:
                default: false
                description: |-
                  To set if we want to enable the neighbor not only for the ipfamily related to its session,
                  but also the other one. This allows to advertise/receive IPv4 prefixes over IPv6 sessions and vice versa.
                type: boolean
              dynamicASN:
                description: |-
                  DynamicASN detects the AS number to use for the remote end of the session
                  without explicitly setting it via the ASN field. Limited to:
                  internal - if the neighbor's ASN is different than MyASN connection is denied.
                  external - if the neighbor's ASN is the same as MyASN the connection is denied.
                  ASN and DynamicASN are mutually exclusive and one of them must be specified.
                enum:
                - internal
                - external
                type: string
              ebgpMultiHop:
                description: To set if the BGPPeer is multi-hops away. Needed for
                  FRR mode only.
                type: boolean
              enableGracefulRestart:
                description: |-
                  EnableGracefulRestart allows BGP peer to continue to forward data packets
                  along known routes while the routing protocol information is being
                  restored. This field is immutable because it requires restart of the BGP
                  session. Supported for FRR mode only.
                type: boolean
                x-kubernetes-validations:
                - message: EnableGracefulRestart cannot be changed after creation
                  rule: self == oldSelf
              holdTime:
                description: Requested BGP hold time, per RFC4271.
                type: string
              interface:
                description: |-
                  Interface is the node interface over which the unnumbered BGP peering will
                  be established. No API validation takes place as that string value
                  represents an interface name on the host and if user provides an invalid
                  value, only the actual BGP session will not be established.
                  Address and Interface are mutually exclusive and one of them must be specified.
                type: string
              keepaliveTime:
                description: Requested BGP keepalive time, per RFC4271.
                type: string
              myASN:
                description: AS number to use for the local end of the session.
                format: int32
                maximum: 4294967295
                minimum: 0
                type: integer
              nodeSelectors:
                description: |-
                  Only connect to this peer on nodes that match one of these
                  selectors.
                items:
                  description: |-
                    A label selector is a label query over a set of resources. The result of matchLabels and
                    matchExpressions are ANDed. An empty label selector matches all objects. A null
                    label selector matches no objects.
                  properties:
                    matchExpressions:
                      description: matchExpressions is a list of label selector requirements.
                        The requirements are ANDed.
                      items:
                        description: |-
                          A label selector requirement is a selector that contains values, a key, and an operator that
                          relates the key and values.
                        properties:
                          key:
                            description: key is the label key that the selector applies
                              to.
                            type: string
                          operator:
                            description: |-
                              operator represents a key's relationship to a set of values.
                              Valid operators are In, NotIn, Exists and DoesNotExist.
                            type: string
                          values:
                            description: |-
                              values is an array of string values. If the operator is In or NotIn,
                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                              the values array must be empty. This array is replaced during a strategic
                              merge patch.
                            items:
                              type: string
                            type: array
                            x-kubernetes-list-type: atomic
                        required:
                        - key
                        - operator
                        type: object
                      type: array
                      x-kubernetes-list-type: atomic
                    matchLabels:
                      additionalProperties:
                        type: string
                      description: |-
                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                      type: object
                  type: object
                  x-kubernetes-map-type: atomic
                type: array
              password:
                description: Authentication password for routers enforcing TCP MD5
                  authenticated sessions
                type: string
              passwordSecret:
                description: |-
                  passwordSecret is name of the authentication secret for BGP Peer.
                  the secret must be of type "kubernetes.io/basic-auth", and created in the
                  same namespace as the MetalLB deployment. The password is stored in the
                  secret as the key "password".
                properties:
                  name:
                    description: name is unique within a namespace to reference a
                      secret resource.
                    type: string
                  namespace:
                    description: namespace defines the space within which the secret
                      name must be unique.
                    type: string
                type: object
                x-kubernetes-map-type: atomic
              peerASN:
                description: |-
                  AS number to expect from the remote end of the session.
                  ASN and DynamicASN are mutually exclusive and one of them must be specified.
                format: int32
                maximum: 4294967295
                minimum: 0
                type: integer
              peerAddress:
                description: Address to dial when establishing the session.
                type: string
              peerPort:
                default: 179
                description: Port to dial when establishing the session.
                maximum: 16384
                minimum: 1
                type: integer
              routerID:
                description: BGP router ID to advertise to the peer
                type: string
              sourceAddress:
                description: Source address to use when establishing the session.
                type: string
              vrf:
                description: |-
                  To set if we want to peer with the BGPPeer using an interface belonging to
                  a host vrf
                type: string
            required:
            - myASN
            type: object
          status:
            description: BGPPeerStatus defines the observed state of Peer.
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    helm.sh/resource-policy: keep
  labels:
    app: cert-manager
    app.kubernetes.io/component: crds
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: certificaterequests.cert-manager.io
spec:
  group: cert-manager.io
  names:
    categories:
    - cert-manager
    kind: CertificateRequest
    listKind: CertificateRequestList
    plural: certificaterequests
    shortNames:
    - cr
    - crs
    singular: certificaterequest
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.conditions[?(@.type == "Approved")].status
      name: Approved
      type: string
    - jsonPath: .status.conditions[?(@.type == "Denied")].status
      name: Denied
      type: string
    - jsonPath: .status.conditions[?(@.type == "Ready")].status
      name: Ready
      type: string
    - jsonPath: .spec.issuerRef.name
      name: Issuer
      type: string
    - jsonPath: .spec.username
      name: Requester
      type: string
    - jsonPath: .status.conditions[?(@.type == "Ready")].message
      name: Status
      priority: 1
      type: string
    - description: CreationTimestamp is a timestamp representing the server time when
        this object was created. It is not guaranteed to be set in happens-before
        order across separate operations. Clients may not set this value. It is represented
        in RFC3339 form and is in UTC.
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1
    schema:
      openAPIV3Schema:
        description: |-
          A CertificateRequest is used to request a signed certificate from one of the
          configured issuers.

          All fields within the CertificateRequest's `spec` are immutable after creation.
          A CertificateRequest will either succeed or fail, as denoted by its `Ready` status
          condition and its `status.failureTime` field.

          A CertificateRequest is a one-shot resource, meaning it represents a single
          point in time request for a certificate and cannot be re-used.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: |-
              Specification of the desired state of the CertificateRequest resource.
              https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
            properties:
              duration:
                description: |-
                  Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
                  issuer may choose to ignore the requested duration, just like any other
                  requested attribute.
                type: string
              extra:
                additionalProperties:
                  items:
                    type: string
                  type: array
                description: |-
                  Extra contains extra attributes of the user that created the CertificateRequest.
                  Populated by the cert-manager webhook on creation and immutable.
                type: object
              groups:
                description: |-
                  Groups contains group membership of the user that created the CertificateRequest.
                  Populated by the cert-manager webhook on creation and immutable.
                items:
                  type: string
                type: array
                x-kubernetes-list-type: atomic
              isCA:
                description: |-
                  Requested basic constraints isCA value. Note that the issuer may choose
                  to ignore the requested isCA value, just like any other requested attribute.

                  NOTE: If the CSR in the `Request` field has a BasicConstraints extension,
                  it must have the same isCA value as specified here.

                  If true, this will automatically add the `cert sign` usage to the list
                  of requested `usages`.
                type: boolean
              issuerRef:
                description: |-
                  Reference to the issuer responsible for issuing the certificate.
                  If the issuer is namespace-scoped, it must be in the same namespace
                  as the Certificate. If the issuer is cluster-scoped, it can be used
                  from any namespace.

                  The `name` field of the reference must always be specified.
                properties:
                  group:
                    description: |-
                      Group of the issuer being referred to.
                      Defaults to 'cert-manager.io'.
                    type: string
                  kind:
                    description: |-
                      Kind of the issuer being referred to.
                      Defaults to 'Issuer'.
                    type: string
                  name:
                    description: Name of the issuer being referred to.
                    type: string
                required:
                - name
                type: object
              request:
                description: |-
                  The PEM-encoded X.509 certificate signing request to be submitted to the
                  issuer for signing.

                  If the CSR has a BasicConstraints extension, its isCA attribute must
                  match the `isCA` value of this CertificateRequest.
                  If the CSR has a KeyUsage extension, its key usages must match the
                  key usages in the `usages` field of this CertificateRequest.
                  If the CSR has a ExtKeyUsage extension, its extended key usages
                  must match the extended key usages in the `usages` field of this
                  CertificateRequest.
                format: byte
                type: string
              uid:
                description: |-
                  UID contains the uid of the user that created the CertificateRequest.
                  Populated by the cert-manager webhook on creation and immutable.
                type: string
              usages:
                description: |-
                  Requested key usages and extended key usages.

                  NOTE: If the CSR in the `Request` field has uses the KeyUsage or
                  ExtKeyUsage extension, these extensions must have the same values
                  as specified here without any additional values.

                  If unset, defaults to `digital signature` and `key encipherment`.
                items:
                  description: |-
                    KeyUsage specifies valid usage contexts for keys.
                    See:
                    https://tools.ietf.org/html/rfc5280#section-4.2.1.3
                    https://tools.ietf.org/html/rfc5280#section-4.2.1.12

                    Valid KeyUsage values are as follows:
                    "signing",
                    "digital signature",
                    "content commitment",
                    "key encipherment",
                    "key agreement",
                    "data encipherment",
                    "cert sign",
                    "crl sign",
                    "encipher only",
                    "decipher only",
                    "any",
                    "server auth",
                    "client auth",
                    "code signing",
                    "email protection",
                    "s/mime",
                    "ipsec end system",
                    "ipsec tunnel",
                    "ipsec user",
                    "timestamping",
                    "ocsp signing",
                    "microsoft sgc",
                    "netscape sgc"
                  enum:
                  - signing
                  - digital signature
                  - content commitment
                  - key encipherment
                  - key agreement
                  - data encipherment
                  - cert sign
                  - crl sign
                  - encipher only
                  - decipher only
                  - any
                  - server auth
                  - client auth
                  - code signing
                  - email protection
                  - s/mime
                  - ipsec end system
                  - ipsec tunnel
                  - ipsec user
                  - timestamping
                  - ocsp signing
                  - microsoft sgc
                  - netscape sgc
                  type: string
                type: array
                x-kubernetes-list-type: atomic
              username:
                description: |-
                  Username contains the name of the user that created the CertificateRequest.
                  Populated by the cert-manager webhook on creation and immutable.
                type: string
            required:
            - issuerRef
            - request
            type: object
          status:
            description: |-
              Status of the CertificateRequest.
              This is set and managed automatically.
              Read-only.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
            properties:
              ca:
                description: |-
                  The PEM encoded X.509 certificate of the signer, also known as the CA
                  (Certificate Authority).
                  This is set on a best-effort basis by different issuers.
                  If not set, the CA is assumed to be unknown/not available.
                format: byte
                type: string
              certificate:
                description: |-
                  The PEM encoded X.509 certificate resulting from the certificate
                  signing request.
                  If not set, the CertificateRequest has either not been completed or has
                  failed. More information on failure can be found by checking the
                  `conditions` field.
                format: byte
                type: string
              conditions:
                description: |-
                  List of status conditions to indicate the status of a CertificateRequest.
                  Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.
                items:
                  description: CertificateRequestCondition contains condition information
                    for a CertificateRequest.
                  properties:
                    lastTransitionTime:
                      description: |-
                        LastTransitionTime is the timestamp corresponding to the last status
                        change of this condition.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        Message is a human readable description of the details of the last
                        transition, complementing reason.
                      type: string
                    reason:
                      description: |-
                        Reason is a brief machine readable explanation for the condition's last
                        transition.
                      type: string
                    status:
                      description: Status of the condition, one of (`True`, `False`,
                        `Unknown`).
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: |-
                        Type of the condition, known values are (`Ready`, `InvalidRequest`,
                        `Approved`, `Denied`).
                      type: string
                  required:
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
              failureTime:
                description: |-
                  FailureTime stores the time that this CertificateRequest failed. This is
                  used to influence garbage collection and back-off.
                format: date-time
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    helm.sh/resource-policy: keep
  labels:
    app: cert-manager
    app.kubernetes.io/component: crds
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: certificates.cert-manager.io
spec:
  group: cert-manager.io
  names:
    categories:
    - cert-manager
    kind: Certificate
    listKind: CertificateList
    plural: certificates
    shortNames:
    - cert
    - certs
    singular: certificate
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.conditions[?(@.type == "Ready")].status
      name: Ready
      type: string
    - jsonPath: .spec.secretName
      name: Secret
      type: string
    - jsonPath: .spec.issuerRef.name
      name: Issuer
      priority: 1
      type: string
    - jsonPath: .status.conditions[?(@.type == "Ready")].message
      name: Status
      priority: 1
      type: string
    - description: CreationTimestamp is a timestamp representing the server time when
        this object was created. It is not guaranteed to be set in happens-before
        order across separate operations. Clients may not set this value. It is represented
        in RFC3339 form and is in UTC.
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1
    schema:
      openAPIV3Schema:
        description: |-
          A Certificate resource should be created to ensure an up to date and signed
          X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.

          The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: |-
              Specification of the desired state of the Certificate resource.
              https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
            properties:
              additionalOutputFormats:
                description: |-
                  Defines extra output formats of the private key and signed certificate chain
                  to be written to this Certificate's target Secret.
                items:
                  description: |-
                    CertificateAdditionalOutputFormat defines an additional output format of a
                    Certificate resource. These contain supplementary data formats of the signed
                    certificate chain and paired private key.
                  properties:
                    type:
                      description: |-
                        Type is the name of the format type that should be written to the
                        Certificate's target Secret.
                      enum:
                      - DER
                      - CombinedPEM
                      type: string
                  required:
                  - type
                  type: object
                type: array
                x-kubernetes-list-type: atomic
              commonName:
                description: |-
                  Requested common name X509 certificate subject attribute.
                  More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
                  NOTE: TLS clients will ignore this value when any subject alternative name is
                  set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).

                  Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
                  Cannot be set if the `literalSubject` field is set.
                type: string
              dnsNames:
                description: Requested DNS subject alternative names.
                items:
                  type: string
                type: array
                x-kubernetes-list-type: atomic
              duration:
                description: |-
                  Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
                  issuer may choose to ignore the requested duration, just like any other
                  requested attribute.

                  If unset, this defaults to 90 days.
                  Minimum accepted duration is 1 hour.
                  Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
                type: string
              emailAddresses:
                description: Requested email subject alternative names.
                items:
                  type: string
                type: array
                x-kubernetes-list-type: atomic
              encodeUsagesInRequest:
                description: |-
                  Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.

                  This option defaults to true, and should only be disabled if the target
                  issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
                type: boolean
              ipAddresses:
                description: Requested IP address subject alternative names.
                items:
                  type: string
                type: array
                x-kubernetes-list-type: atomic
              isCA:
                description: |-
                  Requested basic constraints isCA value.
                  The isCA value is used to set the `isCA` field on the created CertificateRequest
                  resources. Note that the issuer may choose to ignore the requested isCA value, just
                  like any other requested attribute.

                  If true, this will automatically add the `cert sign` usage to the list
                  of requested `usages`.
                type: boolean
              issuerRef:
                description: |-
                  Reference to the issuer responsible for issuing the certificate.
                  If the issuer is namespace-scoped, it must be in the same namespace
                  as the Certificate. If the issuer is cluster-scoped, it can be used
                  from any namespace.

                  The `name` field of the reference must always be specified.
                properties:
                  group:
                    description: |-
                      Group of the issuer being referred to.
                      Defaults to 'cert-manager.io'.
                    type: string
                  kind:
                    description: |-
                      Kind of the issuer being referred to.
                      Defaults to 'Issuer'.
                    type: string
                  name:
                    description: Name of the issuer being referred to.
                    type: string
                required:
                - name
                type: object
              keystores:
                description: Additional keystore output formats to be stored in the
                  Certificate's Secret.
                properties:
                  jks:
                    description: |-
                      JKS configures options for storing a JKS keystore in the
                      `spec.secretName` Secret resource.
                    properties:
                      alias:
                        description: |-
                          Alias specifies the alias of the key in the keystore, required by the JKS format.
                          If not provided, the default alias `certificate` will be used.
                        type: string
                      create:
                        description: |-
                          Create enables JKS keystore creation for the Certificate.
                          If true, a file named `keystore.jks` will be created in the target
                          Secret resource, encrypted using the password stored in
                          `passwordSecretRef` or `password`.
                          The keystore file will be updated immediately.
                          If the issuer provided a CA certificate, a file named `truststore.jks`
                          will also be created in the target Secret resource, encrypted using the
                          password stored in `passwordSecretRef`
                          containing the issuing Certificate Authority
                        type: boolean
                      password:
                        description: |-
                          Password provides a literal password used to encrypt the JKS keystore.
                          Mutually exclusive with passwordSecretRef.
                          One of password or passwordSecretRef must provide a password with a non-zero length.
                        type: string
                      passwordSecretRef:
                        description: |-
                          PasswordSecretRef is a reference to a non-empty key in a Secret resource
                          containing the password used to encrypt the JKS keystore.
                          Mutually exclusive with password.
                          One of password or passwordSecretRef must provide a password with a non-zero length.
                        properties:
                          key:
                            description: |-
                              The key of the entry in the Secret resource's `data` field to be used.
                              Some instances of this field may be defaulted, in others it may be
                              required.
                            type: string
                          name:
                            description: |-
                              Name of the resource being referred to.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        required:
                        - name
                        type: object
                    required:
                    - create
                    type: object
                  pkcs12:
                    description: |-
                      PKCS12 configures options for storing a PKCS12 keystore in the
                      `spec.secretName` Secret resource.
                    properties:
                      create:
                        description: |-
                          Create enables PKCS12 keystore creation for the Certificate.
                          If true, a file named `keystore.p12` will be created in the target
                          Secret resource, encrypted using the password stored in
                          `passwordSecretRef` or in `password`.
                          The keystore file will be updated immediately.
                          If the issuer provided a CA certificate, a file named `truststore.p12` will
                          also be created in the target Secret resource, encrypted using the
                          password stored in `passwordSecretRef` containing the issuing Certificate
                          Authority
                        type: boolean
                      password:
                        description: |-
                          Password provides a literal password used to encrypt the PKCS#12 keystore.
                          Mutually exclusive with passwordSecretRef.
                          One of password or passwordSecretRef must provide a password with a non-zero length.
                        type: string
                      passwordSecretRef:
                        description: |-
                          PasswordSecretRef is a reference to a non-empty key in a Secret resource
                          containing the password used to encrypt the PKCS#12 keystore.
                          Mutually exclusive with password.
                          One of password or passwordSecretRef must provide a password with a non-zero length.
                        properties:
                          key:
                            description: |-
                              The key of the entry in the Secret resource's `data` field to be used.
                              Some instances of this field may be defaulted, in others it may be
                              required.
                            type: string
                          name:
                            description: |-
                              Name of the resource being referred to.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        required:
                        - name
                        type: object
                      profile:
                        description: |-
                          Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
                          used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.

                          If provided, allowed values are:
                          `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
                          `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
                          `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
                          (e.g., because of company policy). Please note that the security of the algorithm is not that important
                          in reality, because the unencrypted certificate and private key are also stored in the Secret.
                        enum:
                        - LegacyRC2
                        - LegacyDES
                        - Modern2023
                        type: string
                    required:
                    - create
                    type: object
                type: object
              literalSubject:
                description: |-
                  Requested X.509 certificate subject, represented using the LDAP "String
                  Representation of a Distinguished Name" [1].
                  Important: the LDAP string format also specifies the order of the attributes
                  in the subject, this is important when issuing certs for LDAP authentication.
                  Example: `CN=foo,DC=corp,DC=example,DC=com`
                  More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
                  More info: https://github.com/cert-manager/cert-manager/issues/3203
                  More info: https://github.com/cert-manager/cert-manager/issues/4424

                  Cannot be set if the `subject` or `commonName` field is set.
                type: string
              nameConstraints:
                description: |-
                  x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
                  More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10

                  This is an Alpha Feature and is only enabled with the
                  `--feature-gates=NameConstraints=true` option set on both
                  the controller and webhook components.
                properties:
                  critical:
                    description: if true then the name constraints are marked critical.
                    type: boolean
                  excluded:
                    description: |-
                      Excluded contains the constraints which must be disallowed. Any name matching a
                      restriction in the excluded field is invalid regardless
                      of information appearing in the permitted
                    properties:
                      dnsDomains:
                        description: DNSDomains is a list of DNS domains that are
                          permitted or excluded.
                        items:
                          type: string
                        type: array
                        x-kubernetes-list-type: atomic
                      emailAddresses:
                        description: EmailAddresses is a list of Email Addresses that
                          are permitted or excluded.
                        items:
                          type: string
                        type: array
                        x-kubernetes-list-type: atomic
                      ipRanges:
                        description: |-
                          IPRanges is a list of IP Ranges that are permitted or excluded.
                          This should be a valid CIDR notation.
                        items:
                          type: string
                        type: array
                        x-kubernetes-list-type: atomic
                      uriDomains:
                        description: URIDomains is a list of URI domains that are
                          permitted or excluded.
                        items:
                          type: string
                        type: array
                        x-kubernetes-list-type: atomic
                    type: object
                  permitted:
                    description: Permitted contains the constraints in which the names
                      must be located.
                    properties:
                      dnsDomains:
                        description: DNSDomains is a list of DNS domains that are
                          permitted or excluded.
                        items:
                          type: string
                        type: array
                        x-kubernetes-list-type: atomic
                      emailAddresses:
                        description: EmailAddresses is a list of Email Addresses that
                          are permitted or excluded.
                        items:
                          type: string
                        type: array
                        x-kubernetes-list-type: atomic
                      ipRanges:
                        description: |-
                          IPRanges is a list of IP Ranges that are permitted or excluded.
                          This should be a valid CIDR notation.
                        items:
                          type: string
                        type: array
                        x-kubernetes-list-type: atomic
                      uriDomains:
                        description: URIDomains is a list of URI domains that are
                          permitted or excluded.
                        items:
                          type: string
                        type: array
                        x-kubernetes-list-type: atomic
                    type: object
                type: object
              otherNames:
                description: |-
                  `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
                  Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
                  Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
                  You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
                items:
                  properties:
                    oid:
                      description: |-
                        OID is the object identifier for the otherName SAN.
                        The object identifier must be expressed as a dotted string, for
                        example, "1.2.840.113556.1.4.221".
                      type: string
                    utf8Value:
                      description: |-
                        utf8Value is the string value of the otherName SAN.
                        The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
                      type: string
                  type: object
                type: array
                x-kubernetes-list-type: atomic
              privateKey:
                description: |-
                  Private key options. These include the key algorithm and size, the used
                  encoding and the rotation policy.
                properties:
                  algorithm:
                    description: |-
                      Algorithm is the private key algorithm of the corresponding private key
                      for this certificate.

                      If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
                      If `algorithm` is specified and `size` is not provided,
                      key size of 2048 will be used for `RSA` key algorithm and
                      key size of 256 will be used for `ECDSA` key algorithm.
                      key size is ignored when using the `Ed25519` key algorithm.
                    enum:
                    - RSA
                    - ECDSA
                    - Ed25519
                    type: string
                  encoding:
                    description: |-
                      The private key cryptography standards (PKCS) encoding for this
                      certificate's private key to be encoded in.

                      If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
                      and PKCS#8, respectively.
                      Defaults to `PKCS1` if not specified.
                    enum:
                    - PKCS1
                    - PKCS8
                    type: string
                  rotationPolicy:
                    description: |-
                      RotationPolicy controls how private keys should be regenerated when a
                      re-issuance is being processed.

                      If set to `Never`, a private key will only be generated if one does not
                      already exist in the target `spec.secretName`. If one does exist but it
                      does not have the correct algorithm or size, a warning will be raised
                      to await user intervention.
                      If set to `Always`, a private key matching the specified requirements
                      will be generated whenever a re-issuance occurs.
                      Default is `Always`.
                      The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
                      The new default can be disabled by setting the
                      `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
                      the controller component.
                    enum:
                    - Never
                    - Always
                    type: string
                  size:
                    description: |-
                      Size is the key bit size of the corresponding private key for this certificate.

                      If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
                      and will default to `2048` if not specified.
                      If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
                      and will default to `256` if not specified.
                      If `algorithm` is set to `Ed25519`, Size is ignored.
                      No other values are allowed.
                    type: integer
                type: object
              renewBefore:
                description: |-
                  How long before the currently issued certificate's expiry cert-manager should
                  renew the certificate. For example, if a certificate is valid for 60 minutes,
                  and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
                  50 minutes after it was issued (i.e. when there are 10 minutes remaining until
                  the certificate is no longer valid).

                  NOTE: The actual lifetime of the issued certificate is used to determine the
                  renewal time. If an issuer returns a certificate with a different lifetime than
                  the one requested, cert-manager will use the lifetime of the issued certificate.

                  If unset, this defaults to 1/3 of the issued certificate's lifetime.
                  Minimum accepted value is 5 minutes.
                  Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
                  Cannot be set if the `renewBeforePercentage` field is set.
                type: string
              renewBeforePercentage:
                description: |-
                  `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
                  rather than an absolute duration. For example, if a certificate is valid for 60
                  minutes, and  `renewBeforePercentage=25`, cert-manager will begin to attempt to
                  renew the certificate 45 minutes after it was issued (i.e. when there are 15
                  minutes (25%) remaining until the certificate is no longer valid).

                  NOTE: The actual lifetime of the issued certificate is used to determine the
                  renewal time. If an issuer returns a certificate with a different lifetime than
                  the one requested, cert-manager will use the lifetime of the issued certificate.

                  Value must be an integer in the range (0,100). The minimum effective
                  `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
                  minutes.
                  Cannot be set if the `renewBefore` field is set.
                format: int32
                type: integer
              revisionHistoryLimit:
                description: |-
                  The maximum number of CertificateRequest revisions that are maintained in
                  the Certificate's history. Each revision represents a single `CertificateRequest`
                  created by this Certificate, either when it was created, renewed, or Spec
                  was changed. Revisions will be removed by oldest first if the number of
                  revisions exceeds this number.

                  If set, revisionHistoryLimit must be a value of `1` or greater.
                  Default value is `1`.
                format: int32
                type: integer
              secretName:
                description: |-
                  Name of the Secret resource that will be automatically created and
                  managed by this Certificate resource. It will be populated with a
                  private key and certificate, signed by the denoted issuer. The Secret
                  resource lives in the same namespace as the Certificate resource.
                type: string
              secretTemplate:
                description: |-
                  Defines annotations and labels to be copied to the Certificate's Secret.
                  Labels and annotations on the Secret will be changed as they appear on the
                  SecretTemplate when added or removed. SecretTemplate annotations are added
                  in conjunction with, and cannot overwrite, the base set of annotations
                  cert-manager sets on the Certificate's Secret.
                properties:
                  annotations:
                    additionalProperties:
                      type: string
                    description: Annotations is a key value map to be copied to the
                      target Kubernetes Secret.
                    type: object
                  labels:
                    additionalProperties:
                      type: string
                    description: Labels is a key value map to be copied to the target
                      Kubernetes Secret.
                    type: object
                type: object
              signatureAlgorithm:
                description: |-
                  Signature algorithm to use.
                  Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.
                  Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.
                  Allowed values for Ed25519 keys: PureEd25519.
                enum:
                - SHA256WithRSA
                - SHA384WithRSA
                - SHA512WithRSA
                - ECDSAWithSHA256
                - ECDSAWithSHA384
                - ECDSAWithSHA512
                - PureEd25519
                type: string
              subject:
                description: |-
                  Requested set of X509 certificate subject attributes.
                  More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6

                  The common name attribute is specified separately in the `commonName` field.
                  Cannot be set if the `literalSubject` field is set.
                properties:
                  countries:
                    description: Countries to be used on the Certificate.
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                  localities:
                    description: Cities to be used on the Certificate.
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                  organizationalUnits:
                    description: Organizational Units to be used on the Certificate.
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                  organizations:
                    description: Organizations to be used on the Certificate.
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                  postalCodes:
                    description: Postal codes to be used on the Certificate.
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                  provinces:
                    description: State/Provinces to be used on the Certificate.
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                  serialNumber:
                    description: Serial number to be used on the Certificate.
                    type: string
                  streetAddresses:
                    description: Street addresses to be used on the Certificate.
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                type: object
              uris:
                description: Requested URI subject alternative names.
                items:
                  type: string
                type: array
                x-kubernetes-list-type: atomic
              usages:
                description: |-
                  Requested key usages and extended key usages.
                  These usages are used to set the `usages` field on the created CertificateRequest
                  resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
                  will additionally be encoded in the `request` field which contains the CSR blob.

                  If unset, defaults to `digital signature` and `key encipherment`.
                items:
                  description: |-
                    KeyUsage specifies valid usage contexts for keys.
                    See:
                    https://tools.ietf.org/html/rfc5280#section-4.2.1.3
                    https://tools.ietf.org/html/rfc5280#section-4.2.1.12

                    Valid KeyUsage values are as follows:
                    "signing",
                    "digital signature",
                    "content commitment",
                    "key encipherment",
                    "key agreement",
                    "data encipherment",
                    "cert sign",
                    "crl sign",
                    "encipher only",
                    "decipher only",
                    "any",
                    "server auth",
                    "client auth",
                    "code signing",
                    "email protection",
                    "s/mime",
                    "ipsec end system",
                    "ipsec tunnel",
                    "ipsec user",
                    "timestamping",
                    "ocsp signing",
                    "microsoft sgc",
                    "netscape sgc"
                  enum:
                  - signing
                  - digital signature
                  - content commitment
                  - key encipherment
                  - key agreement
                  - data encipherment
                  - cert sign
                  - crl sign
                  - encipher only
                  - decipher only
                  - any
                  - server auth
                  - client auth
                  - code signing
                  - email protection
                  - s/mime
                  - ipsec end system
                  - ipsec tunnel
                  - ipsec user
                  - timestamping
                  - ocsp signing
                  - microsoft sgc
                  - netscape sgc
                  type: string
                type: array
                x-kubernetes-list-type: atomic
            required:
            - issuerRef
            - secretName
            type: object
          status:
            description: |-
              Status of the Certificate.
              This is set and managed automatically.
              Read-only.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
            properties:
              conditions:
                description: |-
                  List of status conditions to indicate the status of certificates.
                  Known condition types are `Ready` and `Issuing`.
                items:
                  description: CertificateCondition contains condition information
                    for a Certificate.
                  properties:
                    lastTransitionTime:
                      description: |-
                        LastTransitionTime is the timestamp corresponding to the last status
                        change of this condition.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        Message is a human readable description of the details of the last
                        transition, complementing reason.
                      type: string
                    observedGeneration:
                      description: |-
                        If set, this represents the .metadata.generation that the condition was
                        set based upon.
                        For instance, if .metadata.generation is currently 12, but the
                        .status.condition[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the Certificate.
                      format: int64
                      type: integer
                    reason:
                      description: |-
                        Reason is a brief machine readable explanation for the condition's last
                        transition.
                      type: string
                    status:
                      description: Status of the condition, one of (`True`, `False`,
                        `Unknown`).
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: Type of the condition, known values are (`Ready`,
                        `Issuing`).
                      type: string
                  required:
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
              failedIssuanceAttempts:
                description: |-
                  The number of continuous failed issuance attempts up till now. This
                  field gets removed (if set) on a successful issuance and gets set to
                  1 if unset and an issuance has failed. If an issuance has failed, the
                  delay till the next issuance will be calculated using formula
                  time.Hour * 2 ^ (failedIssuanceAttempts - 1).
                type: integer
              lastFailureTime:
                description: |-
                  LastFailureTime is set only if the latest issuance for this
                  Certificate failed and contains the time of the failure. If an
                  issuance has failed, the delay till the next issuance will be
                  calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
                  1). If the latest issuance has succeeded this field will be unset.
                format: date-time
                type: string
              nextPrivateKeySecretName:
                description: |-
                  The name of the Secret resource containing the private key to be used
                  for the next certificate iteration.
                  The keymanager controller will automatically set this field if the
                  `Issuing` condition is set to `True`.
                  It will automatically unset this field when the Issuing condition is
                  not set or False.
                type: string
              notAfter:
                description: |-
                  The expiration time of the certificate stored in the secret named
                  by this resource in `spec.secretName`.
                format: date-time
                type: string
              notBefore:
                description: |-
                  The time after which the certificate stored in the secret named
                  by this resource in `spec.secretName` is valid.
                format: date-time
                type: string
              renewalTime:
                description: |-
                  RenewalTime is the time at which the certificate will be next
                  renewed.
                  If not set, no upcoming renewal is scheduled.
                format: date-time
                type: string
              revision:
                description: |-
                  The current 'revision' of the certificate as issued.

                  When a CertificateRequest resource is created, it will have the
                  `cert-manager.io/certificate-revision` set to one greater than the
                  current value of this field.

                  Upon issuance, this field will be set to the value of the annotation
                  on the CertificateRequest resource used to issue the certificate.

                  Persisting the value on the CertificateRequest resource allows the
                  certificates controller to know whether a request is part of an old
                  issuance or if it is part of the ongoing revision's issuance by
                  checking if the revision value in the annotation is greater than this
                  field.
                type: integer
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    helm.sh/resource-policy: keep
  labels:
    app: cert-manager
    app.kubernetes.io/component: crds
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: challenges.acme.cert-manager.io
spec:
  group: acme.cert-manager.io
  names:
    categories:
    - cert-manager
    - cert-manager-acme
    kind: Challenge
    listKind: ChallengeList
    plural: challenges
    singular: challenge
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.state
      name: State
      type: string
    - jsonPath: .spec.dnsName
      name: Domain
      type: string
    - jsonPath: .status.reason
      name: Reason
      priority: 1
      type: string
    - description: CreationTimestamp is a timestamp representing the server time when
        this object was created. It is not guaranteed to be set in happens-before
        order across separate operations. Clients may not set this value. It is represented
        in RFC3339 form and is in UTC.
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1
    schema:
      openAPIV3Schema:
        description: Challenge is a type to represent a Challenge request with an
          ACME server
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            properties:
              authorizationURL:
                description: |-
                  The URL to the ACME Authorization resource that this
                  challenge is a part of.
                type: string
              dnsName:
                description: |-
                  dnsName is the identifier that this challenge is for, e.g., example.com.
                  If the requested DNSName is a 'wildcard', this field MUST be set to the
                  non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`.
                type: string
              issuerRef:
                description: |-
                  References a properly configured ACME-type Issuer which should
                  be used to create this Challenge.
                  If the Issuer does not exist, processing will be retried.
                  If the Issuer is not an 'ACME' Issuer, an error will be returned and the
                  Challenge will be marked as failed.
                properties:
                  group:
                    description: |-
                      Group of the issuer being referred to.
                      Defaults to 'cert-manager.io'.
                    type: string
                  kind:
                    description: |-
                      Kind of the issuer being referred to.
                      Defaults to 'Issuer'.
                    type: string
                  name:
                    description: Name of the issuer being referred to.
                    type: string
                required:
                - name
                type: object
              key:
                description: |-
                  The ACME challenge key for this challenge
                  For HTTP01 challenges, this is the value that must be responded with to
                  complete the HTTP01 challenge in the format:
                  `<private key JWK thumbprint>.<key from acme server for challenge>`.
                  For DNS01 challenges, this is the base64 encoded SHA256 sum of the
                  `<private key JWK thumbprint>.<key from acme server for challenge>`
                  text that must be set as the TXT record content.
                type: string
              solver:
                description: |-
                  Contains the domain solving configuration that should be used to
                  solve this challenge resource.
                properties:
                  dns01:
                    description: |-
                      Configures cert-manager to attempt to complete authorizations by
                      performing the DNS01 challenge flow.
                    properties:
                      acmeDNS:
                        description: |-
                          Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
                          DNS01 challenge records.
                        properties:
                          accountSecretRef:
                            description: |-
                              A reference to a specific 'key' within a Secret resource.
                              In some instances, `key` is a required field.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                          host:
                            type: string
                        required:
                        - accountSecretRef
                        - host
                        type: object
                      akamai:
                        description: Use the Akamai DNS zone management API to manage
                          DNS01 challenge records.
                        properties:
                          accessTokenSecretRef:
                            description: |-
                              A reference to a specific 'key' within a Secret resource.
                              In some instances, `key` is a required field.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                          clientSecretSecretRef:
                            description: |-
                              A reference to a specific 'key' within a Secret resource.
                              In some instances, `key` is a required field.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                          clientTokenSecretRef:
                            description: |-
                              A reference to a specific 'key' within a Secret resource.
                              In some instances, `key` is a required field.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                          serviceConsumerDomain:
                            type: string
                        required:
                        - accessTokenSecretRef
                        - clientSecretSecretRef
                        - clientTokenSecretRef
                        - serviceConsumerDomain
                        type: object
                      azureDNS:
                        description: Use the Microsoft Azure DNS API to manage DNS01
                          challenge records.
                        properties:
                          clientID:
                            description: |-
                              Auth: Azure Service Principal:
                              The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
                              If set, ClientSecret and TenantID must also be set.
                            type: string
                          clientSecretSecretRef:
                            description: |-
                              Auth: Azure Service Principal:
                              A reference to a Secret containing the password associated with the Service Principal.
                              If set, ClientID and TenantID must also be set.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                          environment:
                            description: name of the Azure environment (default AzurePublicCloud)
                            enum:
                            - AzurePublicCloud
                            - AzureChinaCloud
                            - AzureGermanCloud
                            - AzureUSGovernmentCloud
                            type: string
                          hostedZoneName:
                            description: name of the DNS zone that should be used
                            type: string
                          managedIdentity:
                            description: |-
                              Auth: Azure Workload Identity or Azure Managed Service Identity:
                              Settings to enable Azure Workload Identity or Azure Managed Service Identity
                              If set, ClientID, ClientSecret and TenantID must not be set.
                            properties:
                              clientID:
                                description: client ID of the managed identity, cannot
                                  be used at the same time as resourceID
                                type: string
                              resourceID:
                                description: |-
                                  resource ID of the managed identity, cannot be used at the same time as clientID
                                  Cannot be used for Azure Managed Service Identity
                                type: string
                              tenantID:
                                description: tenant ID of the managed identity, cannot
                                  be used at the same time as resourceID
                                type: string
                            type: object
                          resourceGroupName:
                            description: resource group the DNS zone is located in
                            type: string
                          subscriptionID:
                            description: ID of the Azure subscription
                            type: string
                          tenantID:
                            description: |-
                              Auth: Azure Service Principal:
                              The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
                              If set, ClientID and ClientSecret must also be set.
                            type: string
                        required:
                        - resourceGroupName
                        - subscriptionID
                        type: object
                      cloudDNS:
                        description: Use the Google Cloud DNS API to manage DNS01
                          challenge records.
                        properties:
                          hostedZoneName:
                            description: |-
                              HostedZoneName is an optional field that tells cert-manager in which
                              Cloud DNS zone the challenge record has to be created.
                              If left empty cert-manager will automatically choose a zone.
                            type: string
                          project:
                            type: string
                          serviceAccountSecretRef:
                            description: |-
                              A reference to a specific 'key' within a Secret resource.
                              In some instances, `key` is a required field.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                        required:
                        - project
                        type: object
                      cloudflare:
                        description: Use the Cloudflare API to manage DNS01 challenge
                          records.
                        properties:
                          apiKeySecretRef:
                            description: |-
                              API key to use to authenticate with Cloudflare.
                              Note: using an API token to authenticate is now the recommended method
                              as it allows greater control of permissions.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                          apiTokenSecretRef:
                            description: API token used to authenticate with Cloudflare.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                          email:
                            description: Email of the account, only required when
                              using API key based authentication.
                            type: string
                        type: object
                      cnameStrategy:
                        description: |-
                          CNAMEStrategy configures how the DNS01 provider should handle CNAME
                          records when found in DNS zones.
                        enum:
                        - None
                        - Follow
                        type: string
                      digitalocean:
                        description: Use the DigitalOcean DNS API to manage DNS01
                          challenge records.
                        properties:
                          tokenSecretRef:
                            description: |-
                              A reference to a specific 'key' within a Secret resource.
                              In some instances, `key` is a required field.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                        required:
                        - tokenSecretRef
                        type: object
                      rfc2136:
                        description: |-
                          Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
                          to manage DNS01 challenge records.
                        properties:
                          nameserver:
                            description: |-
                              The IP address or hostname of an authoritative DNS server supporting
                              RFC2136 in the form host:port. If the host is an IPv6 address it must be
                              enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
                              This field is required.
                            type: string
                          protocol:
                            description: Protocol to use for dynamic DNS update queries.
                              Valid values are (case-sensitive) ``TCP`` and ``UDP``;
                              ``UDP`` (default).
                            enum:
                            - TCP
                            - UDP
                            type: string
                          tsigAlgorithm:
                            description: |-
                              The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
                              when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
                              Supported values are (case-insensitive): ``HMACMD5`` (default),
                              ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
                            type: string
                          tsigKeyName:
                            description: |-
                              The TSIG Key name configured in the DNS.
                              If ``tsigSecretSecretRef`` is defined, this field is required.
                            type: string
                          tsigSecretSecretRef:
                            description: |-
                              The name of the secret containing the TSIG value.
                              If ``tsigKeyName`` is defined, this field is required.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                        required:
                        - nameserver
                        type: object
                      route53:
                        description: Use the AWS Route53 API to manage DNS01 challenge
                          records.
                        properties:
                          accessKeyID:
                            description: |-
                              The AccessKeyID is used for authentication.
                              Cannot be set when SecretAccessKeyID is set.
                              If neither the Access Key nor Key ID are set, we fall-back to using env
                              vars, shared credentials file or AWS Instance metadata,
                              see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                            type: string
                          accessKeyIDSecretRef:
                            description: |-
                              The SecretAccessKey is used for authentication. If set, pull the AWS
                              access key ID from a key within a Kubernetes Secret.
                              Cannot be set when AccessKeyID is set.
                              If neither the Access Key nor Key ID are set, we fall-back to using env
                              vars, shared credentials file or AWS Instance metadata,
                              see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                          auth:
                            description: Auth configures how cert-manager authenticates.
                            properties:
                              kubernetes:
                                description: |-
                                  Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
                                  by passing a bound ServiceAccount token.
                                properties:
                                  serviceAccountRef:
                                    description: |-
                                      A reference to a service account that will be used to request a bound
                                      token (also known as "projected token"). To use this field, you must
                                      configure an RBAC rule to let cert-manager request a token.
                                    properties:
                                      audiences:
                                        description: |-
                                          TokenAudiences is an optional list of audiences to include in the
                                          token passed to AWS. The default token consisting of the issuer's namespace
                                          and name is always included.
                                          If unset the audience defaults to `sts.amazonaws.com`.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      name:
                                        description: Name of the ServiceAccount used
                                          to request a token.
                                        type: string
                                    required:
                                    - name
                                    type: object
                                required:
                                - serviceAccountRef
                                type: object
                            required:
                            - kubernetes
                            type: object
                          hostedZoneID:
                            description: If set, the provider will manage only this
                              zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName
                              api call.
                            type: string
                          region:
                            description: |-
                              Override the AWS region.

                              Route53 is a global service and does not have regional endpoints but the
                              region specified here (or via environment variables) is used as a hint to
                              help compute the correct AWS credential scope and partition when it
                              connects to Route53. See:
                              - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
                              - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)

                              If you omit this region field, cert-manager will use the region from
                              AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
                              in the cert-manager controller Pod.

                              The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
                              Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
                              [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
                              In this case this `region` field value is ignored.

                              The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
                              Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
                              [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
                              In this case this `region` field value is ignored.
                            type: string
                          role:
                            description: |-
                              Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
                              or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
                            type: string
                          secretAccessKeySecretRef:
                            description: |-
                              The SecretAccessKey is used for authentication.
                              If neither the Access Key nor Key ID are set, we fall-back to using env
                              vars, shared credentials file or AWS Instance metadata,
                              see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                        type: object
                      webhook:
                        description: |-
                          Configure an external webhook based DNS01 challenge solver to manage
                          DNS01 challenge records.
                        properties:
                          config:
                            description: |-
                              Additional configuration that should be passed to the webhook apiserver
                              when challenges are processed.
                              This can contain arbitrary JSON data.
                              Secret values should not be specified in this stanza.
                              If secret values are needed (e.g., credentials for a DNS service), you
                              should use a SecretKeySelector to reference a Secret resource.
                              For details on the schema of this field, consult the webhook provider
                              implementation's documentation.
                            x-kubernetes-preserve-unknown-fields: true
                          groupName:
                            description: |-
                              The API group name that should be used when POSTing ChallengePayload
                              resources to the webhook apiserver.
                              This should be the same as the GroupName specified in the webhook
                              provider implementation.
                            type: string
                          solverName:
                            description: |-
                              The name of the solver to use, as defined in the webhook provider
                              implementation.
                              This will typically be the name of the provider, e.g., 'cloudflare'.
                            type: string
                        required:
                        - groupName
                        - solverName
                        type: object
                    type: object
                  http01:
                    description: |-
                      Configures cert-manager to attempt to complete authorizations by
                      performing the HTTP01 challenge flow.
                      It is not possible to obtain certificates for wildcard domain names
                      (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
                    properties:
                      gatewayHTTPRoute:
                        description: |-
                          The Gateway API is a sig-network community API that models service networking
                          in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
                          create HTTPRoutes with the specified labels in the same namespace as the challenge.
                          This solver is experimental, and fields / behaviour may change in the future.
                        properties:
                          labels:
                            additionalProperties:
                              type: string
                            description: |-
                              Custom labels that will be applied to HTTPRoutes created by cert-manager
                              while solving HTTP-01 challenges.
                            type: object
                          parentRefs:
                            description: |-
                              When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
                              cert-manager needs to know which parentRefs should be used when creating
                              the HTTPRoute. Usually, the parentRef references a Gateway. See:
                              https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
                            items:
                              description: |-
                                ParentReference identifies an API object (usually a Gateway) that can be considered
                                a parent of this resource (usually a route). There are two kinds of parent resources
                                with "Core" support:

                                * Gateway (Gateway conformance profile)
                                * Service (Mesh conformance profile, ClusterIP Services only)

                                This API may be extended in the future to support additional kinds of parent
                                resources.

                                The API object must be valid in the cluster; the Group and Kind must
                                be registered in the cluster for this reference to be valid.
                              properties:
                                group:
                                  default: gateway.networking.k8s.io
                                  description: |-
                                    Group is the group of the referent.
                                    When unspecified, "gateway.networking.k8s.io" is inferred.
                                    To set the core API group (such as for a "Service" kind referent),
                                    Group must be explicitly set to "" (empty string).

                                    Support: Core
                                  maxLength: 253
                                  pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                  type: string
                                kind:
                                  default: Gateway
                                  description: |-
                                    Kind is kind of the referent.

                                    There are two kinds of parent resources with "Core" support:

                                    * Gateway (Gateway conformance profile)
                                    * Service (Mesh conformance profile, ClusterIP Services only)

                                    Support for other resources is Implementation-Specific.
                                  maxLength: 63
                                  minLength: 1
                                  pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                                  type: string
                                name:
                                  description: |-
                                    Name is the name of the referent.

                                    Support: Core
                                  maxLength: 253
                                  minLength: 1
                                  type: string
                                namespace:
                                  description: |-
                                    Namespace is the namespace of the referent. When unspecified, this refers
                                    to the local namespace of the Route.

                                    Note that there are specific rules for ParentRefs which cross namespace
                                    boundaries. Cross-namespace references are only valid if they are explicitly
                                    allowed by something in the namespace they are referring to. For example:
                                    Gateway has the AllowedRoutes field, and ReferenceGrant provides a
                                    generic way to enable any other kind of cross-namespace reference.

                                    <gateway:experimental:description>
                                    ParentRefs from a Route to a Service in the same namespace are "producer"
                                    routes, which apply default routing rules to inbound connections from
                                    any namespace to the Service.

                                    ParentRefs from a Route to a Service in a different namespace are
                                    "consumer" routes, and these routing rules are only applied to outbound
                                    connections originating from the same namespace as the Route, for which
                                    the intended destination of the connections are a Service targeted as a
                                    ParentRef of the Route.
                                    </gateway:experimental:description>

                                    Support: Core
                                  maxLength: 63
                                  minLength: 1
                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                                  type: string
                                port:
                                  description: |-
                                    Port is the network port this Route targets. It can be interpreted
                                    differently based on the type of parent resource.

                                    When the parent resource is a Gateway, this targets all listeners
                                    listening on the specified port that also support this kind of Route(and
                                    select this Route). It's not recommended to set `Port` unless the
                                    networking behaviors specified in a Route must apply to a specific port
                                    as opposed to a listener(s) whose port(s) may be changed. When both Port
                                    and SectionName are specified, the name and port of the selected listener
                                    must match both specified values.

                                    <gateway:experimental:description>
                                    When the parent resource is a Service, this targets a specific port in the
                                    Service spec. When both Port (experimental) and SectionName are specified,
                                    the name and port of the selected port must match both specified values.
                                    </gateway:experimental:description>

                                    Implementations MAY choose to support other parent resources.
                                    Implementations supporting other types of parent resources MUST clearly
                                    document how/if Port is interpreted.

                                    For the purpose of status, an attachment is considered successful as
                                    long as the parent resource accepts it partially. For example, Gateway
                                    listeners can restrict which Routes can attach to them by Route kind,
                                    namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
                                    from the referencing Route, the Route MUST be considered successfully
                                    attached. If no Gateway listeners accept attachment from this Route,
                                    the Route MUST be considered detached from the Gateway.

                                    Support: Extended
                                  format: int32
                                  maximum: 65535
                                  minimum: 1
                                  type: integer
                                sectionName:
                                  description: |-
                                    SectionName is the name of a section within the target resource. In the
                                    following resources, SectionName is interpreted as the following:

                                    * Gateway: Listener name. When both Port (experimental) and SectionName
                                    are specified, the name and port of the selected listener must match
                                    both specified values.
                                    * Service: Port name. When both Port (experimental) and SectionName
                                    are specified, the name and port of the selected listener must match
                                    both specified values.

                                    Implementations MAY choose to support attaching Routes to other resources.
                                    If that is the case, they MUST clearly document how SectionName is
                                    interpreted.

                                    When unspecified (empty string), this will reference the entire resource.
                                    For the purpose of status, an attachment is considered successful if at
                                    least one section in the parent resource accepts it. For example, Gateway
                                    listeners can restrict which Routes can attach to them by Route kind,
                                    namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
                                    the referencing Route, the Route MUST be considered successfully
                                    attached. If no Gateway listeners accept attachment from this Route, the
                                    Route MUST be considered detached from the Gateway.

                                    Support: Core
                                  maxLength: 253
                                  minLength: 1
                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                  type: string
                              required:
                              - name
                              type: object
                            type: array
                            x-kubernetes-list-type: atomic
                          podTemplate:
                            description: |-
                              Optional pod template used to configure the ACME challenge solver pods
                              used for HTTP01 challenges.
                            properties:
                              metadata:
                                description: |-
                                  ObjectMeta overrides for the pod used to solve HTTP01 challenges.
                                  Only the 'labels' and 'annotations' fields may be set.
                                  If labels or annotations overlap with in-built values, the values here
                                  will override the in-built values.
                                properties:
                                  annotations:
                                    additionalProperties:
                                      type: string
                                    description: Annotations that should be added
                                      to the created ACME HTTP01 solver pods.
                                    type: object
                                  labels:
                                    additionalProperties:
                                      type: string
                                    description: Labels that should be added to the
                                      created ACME HTTP01 solver pods.
                                    type: object
                                type: object
                              spec:
                                description: |-
                                  PodSpec defines overrides for the HTTP01 challenge solver pod.
                                  Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
                                  All other fields will be ignored.
                                properties:
                                  affinity:
                                    description: If specified, the pod's scheduling
                                      constraints
                                    properties:
                                      nodeAffinity:
                                        description: Describes node affinity scheduling
                                          rules for the pod.
                                        properties:
                                          preferredDuringSchedulingIgnoredDuringExecution:
                                            description: |-
                                              The scheduler will prefer to schedule pods to nodes that satisfy
                                              the affinity expressions specified by this field, but it may choose
                                              a node that violates one or more of the expressions. The node that is
                                              most preferred is the one with the greatest sum of weights, i.e.
                                              for each node that meets all of the scheduling requirements (resource
                                              request, requiredDuringScheduling affinity expressions, etc.),
                                              compute a sum by iterating through the elements of this field and adding
                                              "weight" to the sum if the node matches the corresponding matchExpressions; the
                                              node(s) with the highest sum are the most preferred.
                                            items:
                                              description: |-
                                                An empty preferred scheduling term matches all objects with implicit weight 0
                                                (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
                                              properties:
                                                preference:
                                                  description: A node selector term,
                                                    associated with the corresponding
                                                    weight.
                                                  properties:
                                                    matchExpressions:
                                                      description: A list of node
                                                        selector requirements by node's
                                                        labels.
                                                      items:
                                                        description: |-
                                                          A node selector requirement is a selector that contains values, a key, and an operator
                                                          that relates the key and values.
                                                        properties:
                                                          key:
                                                            description: The label
                                                              key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              Represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              An array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. If the operator is Gt or Lt, the values
                                                              array must have a single element, which will be interpreted as an integer.
                                                              This array is replaced during a strategic merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    matchFields:
                                                      description: A list of node
                                                        selector requirements by node's
                                                        fields.
                                                      items:
                                                        description: |-
                                                          A node selector requirement is a selector that contains values, a key, and an operator
                                                          that relates the key and values.
                                                        properties:
                                                          key:
                                                            description: The label
                                                              key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              Represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              An array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. If the operator is Gt or Lt, the values
                                                              array must have a single element, which will be interpreted as an integer.
                                                              This array is replaced during a strategic merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                                weight:
                                                  description: Weight associated with
                                                    matching the corresponding nodeSelectorTerm,
                                                    in the range 1-100.
                                                  format: int32
                                                  type: integer
                                              required:
                                              - preference
                                              - weight
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                          requiredDuringSchedulingIgnoredDuringExecution:
                                            description: |-
                                              If the affinity requirements specified by this field are not met at
                                              scheduling time, the pod will not be scheduled onto the node.
                                              If the affinity requirements specified by this field cease to be met
                                              at some point during pod execution (e.g. due to an update), the system
                                              may or may not try to eventually evict the pod from its node.
                                            properties:
                                              nodeSelectorTerms:
                                                description: Required. A list of node
                                                  selector terms. The terms are ORed.
                                                items:
                                                  description: |-
                                                    A null or empty node selector term matches no objects. The requirements of
                                                    them are ANDed.
                                                    The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
                                                  properties:
                                                    matchExpressions:
                                                      description: A list of node
                                                        selector requirements by node's
                                                        labels.
                                                      items:
                                                        description: |-
                                                          A node selector requirement is a selector that contains values, a key, and an operator
                                                          that relates the key and values.
                                                        properties:
                                                          key:
                                                            description: The label
                                                              key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              Represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              An array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. If the operator is Gt or Lt, the values
                                                              array must have a single element, which will be interpreted as an integer.
                                                              This array is replaced during a strategic merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    matchFields:
                                                      description: A list of node
                                                        selector requirements by node's
                                                        fields.
                                                      items:
                                                        description: |-
                                                          A node selector requirement is a selector that contains values, a key, and an operator
                                                          that relates the key and values.
                                                        properties:
                                                          key:
                                                            description: The label
                                                              key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              Represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              An array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. If the operator is Gt or Lt, the values
                                                              array must have a single element, which will be interpreted as an integer.
                                                              This array is replaced during a strategic merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - nodeSelectorTerms
                                            type: object
                                            x-kubernetes-map-type: atomic
                                        type: object
                                      podAffinity:
                                        description: Describes pod affinity scheduling
                                          rules (e.g. co-locate this pod in the same
                                          node, zone, etc. as some other pod(s)).
                                        properties:
                                          preferredDuringSchedulingIgnoredDuringExecution:
                                            description: |-
                                              The scheduler will prefer to schedule pods to nodes that satisfy
                                              the affinity expressions specified by this field, but it may choose
                                              a node that violates one or more of the expressions. The node that is
                                              most preferred is the one with the greatest sum of weights, i.e.
                                              for each node that meets all of the scheduling requirements (resource
                                              request, requiredDuringScheduling affinity expressions, etc.),
                                              compute a sum by iterating through the elements of this field and adding
                                              "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                              node(s) with the highest sum are the most preferred.
                                            items:
                                              description: The weights of all of the
                                                matched WeightedPodAffinityTerm fields
                                                are added per-node to find the most
                                                preferred node(s)
                                              properties:
                                                podAffinityTerm:
                                                  description: Required. A pod affinity
                                                    term, associated with the corresponding
                                                    weight.
                                                  properties:
                                                    labelSelector:
                                                      description: |-
                                                        A label query over a set of resources, in this case pods.
                                                        If it's null, this PodAffinityTerm matches with no Pods.
                                                      properties:
                                                        matchExpressions:
                                                          description: matchExpressions
                                                            is a list of label selector
                                                            requirements. The requirements
                                                            are ANDed.
                                                          items:
                                                            description: |-
                                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                                              relates the key and values.
                                                            properties:
                                                              key:
                                                                description: key is
                                                                  the label key that
                                                                  the selector applies
                                                                  to.
                                                                type: string
                                                              operator:
                                                                description: |-
                                                                  operator represents a key's relationship to a set of values.
                                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                type: string
                                                              values:
                                                                description: |-
                                                                  values is an array of string values. If the operator is In or NotIn,
                                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                  the values array must be empty. This array is replaced during a strategic
                                                                  merge patch.
                                                                items:
                                                                  type: string
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                            required:
                                                            - key
                                                            - operator
                                                            type: object
                                                          type: array
                                                          x-kubernetes-list-type: atomic
                                                        matchLabels:
                                                          additionalProperties:
                                                            type: string
                                                          description: |-
                                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                          type: object
                                                      type: object
                                                      x-kubernetes-map-type: atomic
                                                    matchLabelKeys:
                                                      description: |-
                                                        MatchLabelKeys is a set of pod label keys to select which pods will
                                                        be taken into consideration. The keys are used to lookup values from the
                                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                        to select the group of existing pods which pods will be taken into consideration
                                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                        pod labels will be ignored. The default value is empty.
                                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                      items:
                                                        type: string
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    mismatchLabelKeys:
                                                      description: |-
                                                        MismatchLabelKeys is a set of pod label keys to select which pods will
                                                        be taken into consideration. The keys are used to lookup values from the
                                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                        to select the group of existing pods which pods will be taken into consideration
                                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                        pod labels will be ignored. The default value is empty.
                                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                      items:
                                                        type: string
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    namespaceSelector:
                                                      description: |-
                                                        A label query over the set of namespaces that the term applies to.
                                                        The term is applied to the union of the namespaces selected by this field
                                                        and the ones listed in the namespaces field.
                                                        null selector and null or empty namespaces list means "this pod's namespace".
                                                        An empty selector ({}) matches all namespaces.
                                                      properties:
                                                        matchExpressions:
                                                          description: matchExpressions
                                                            is a list of label selector
                                                            requirements. The requirements
                                                            are ANDed.
                                                          items:
                                                            description: |-
                                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                                              relates the key and values.
                                                            properties:
                                                              key:
                                                                description: key is
                                                                  the label key that
                                                                  the selector applies
                                                                  to.
                                                                type: string
                                                              operator:
                                                                description: |-
                                                                  operator represents a key's relationship to a set of values.
                                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                type: string
                                                              values:
                                                                description: |-
                                                                  values is an array of string values. If the operator is In or NotIn,
                                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                  the values array must be empty. This array is replaced during a strategic
                                                                  merge patch.
                                                                items:
                                                                  type: string
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                            required:
                                                            - key
                                                            - operator
                                                            type: object
                                                          type: array
                                                          x-kubernetes-list-type: atomic
                                                        matchLabels:
                                                          additionalProperties:
                                                            type: string
                                                          description: |-
                                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                          type: object
                                                      type: object
                                                      x-kubernetes-map-type: atomic
                                                    namespaces:
                                                      description: |-
                                                        namespaces specifies a static list of namespace names that the term applies to.
                                                        The term is applied to the union of the namespaces listed in this field
                                                        and the ones selected by namespaceSelector.
                                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                      items:
                                                        type: string
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    topologyKey:
                                                      description: |-
                                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                        whose value of the label with key topologyKey matches that of any node on which any of the
                                                        selected pods is running.
                                                        Empty topologyKey is not allowed.
                                                      type: string
                                                  required:
                                                  - topologyKey
                                                  type: object
                                                weight:
                                                  description: |-
                                                    weight associated with matching the corresponding podAffinityTerm,
                                                    in the range 1-100.
                                                  format: int32
                                                  type: integer
                                              required:
                                              - podAffinityTerm
                                              - weight
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                          requiredDuringSchedulingIgnoredDuringExecution:
                                            description: |-
                                              If the affinity requirements specified by this field are not met at
                                              scheduling time, the pod will not be scheduled onto the node.
                                              If the affinity requirements specified by this field cease to be met
                                              at some point during pod execution (e.g. due to a pod label update), the
                                              system may or may not try to eventually evict the pod from its node.
                                              When there are multiple elements, the lists of nodes corresponding to each
                                              podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                            items:
                                              description: |-
                                                Defines a set of pods (namely those matching the labelSelector
                                                relative to the given namespace(s)) that this pod should be
                                                co-located (affinity) or not co-located (anti-affinity) with,
                                                where co-located is defined as running on a node whose value of
                                                the label with key <topologyKey> matches that of any node on which
                                                a pod of the set of pods is running
                                              properties:
                                                labelSelector:
                                                  description: |-
                                                    A label query over a set of resources, in this case pods.
                                                    If it's null, this PodAffinityTerm matches with no Pods.
                                                  properties:
                                                    matchExpressions:
                                                      description: matchExpressions
                                                        is a list of label selector
                                                        requirements. The requirements
                                                        are ANDed.
                                                      items:
                                                        description: |-
                                                          A label selector requirement is a selector that contains values, a key, and an operator that
                                                          relates the key and values.
                                                        properties:
                                                          key:
                                                            description: key is the
                                                              label key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              operator represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists and DoesNotExist.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              values is an array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. This array is replaced during a strategic
                                                              merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    matchLabels:
                                                      additionalProperties:
                                                        type: string
                                                      description: |-
                                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                      type: object
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                                matchLabelKeys:
                                                  description: |-
                                                    MatchLabelKeys is a set of pod label keys to select which pods will
                                                    be taken into consideration. The keys are used to lookup values from the
                                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                    to select the group of existing pods which pods will be taken into consideration
                                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                    pod labels will be ignored. The default value is empty.
                                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                mismatchLabelKeys:
                                                  description: |-
                                                    MismatchLabelKeys is a set of pod label keys to select which pods will
                                                    be taken into consideration. The keys are used to lookup values from the
                                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                    to select the group of existing pods which pods will be taken into consideration
                                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                    pod labels will be ignored. The default value is empty.
                                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                namespaceSelector:
                                                  description: |-
                                                    A label query over the set of namespaces that the term applies to.
                                                    The term is applied to the union of the namespaces selected by this field
                                                    and the ones listed in the namespaces field.
                                                    null selector and null or empty namespaces list means "this pod's namespace".
                                                    An empty selector ({}) matches all namespaces.
                                                  properties:
                                                    matchExpressions:
                                                      description: matchExpressions
                                                        is a list of label selector
                                                        requirements. The requirements
                                                        are ANDed.
                                                      items:
                                                        description: |-
                                                          A label selector requirement is a selector that contains values, a key, and an operator that
                                                          relates the key and values.
                                                        properties:
                                                          key:
                                                            description: key is the
                                                              label key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              operator represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists and DoesNotExist.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              values is an array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. This array is replaced during a strategic
                                                              merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    matchLabels:
                                                      additionalProperties:
                                                        type: string
                                                      description: |-
                                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                      type: object
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                                namespaces:
                                                  description: |-
                                                    namespaces specifies a static list of namespace names that the term applies to.
                                                    The term is applied to the union of the namespaces listed in this field
                                                    and the ones selected by namespaceSelector.
                                                    null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                topologyKey:
                                                  description: |-
                                                    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                    the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                    whose value of the label with key topologyKey matches that of any node on which any of the
                                                    selected pods is running.
                                                    Empty topologyKey is not allowed.
                                                  type: string
                                              required:
                                              - topologyKey
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                        type: object
                                      podAntiAffinity:
                                        description: Describes pod anti-affinity scheduling
                                          rules (e.g. avoid putting this pod in the
                                          same node, zone, etc. as some other pod(s)).
                                        properties:
                                          preferredDuringSchedulingIgnoredDuringExecution:
                                            description: |-
                                              The scheduler will prefer to schedule pods to nodes that satisfy
                                              the anti-affinity expressions specified by this field, but it may choose
                                              a node that violates one or more of the expressions. The node that is
                                              most preferred is the one with the greatest sum of weights, i.e.
                                              for each node that meets all of the scheduling requirements (resource
                                              request, requiredDuringScheduling anti-affinity expressions, etc.),
                                              compute a sum by iterating through the elements of this field and subtracting
                                              "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                              node(s) with the highest sum are the most preferred.
                                            items:
                                              description: The weights of all of the
                                                matched WeightedPodAffinityTerm fields
                                                are added per-node to find the most
                                                preferred node(s)
                                              properties:
                                                podAffinityTerm:
                                                  description: Required. A pod affinity
                                                    term, associated with the corresponding
                                                    weight.
                                                  properties:
                                                    labelSelector:
                                                      description: |-
                                                        A label query over a set of resources, in this case pods.
                                                        If it's null, this PodAffinityTerm matches with no Pods.
                                                      properties:
                                                        matchExpressions:
                                                          description: matchExpressions
                                                            is a list of label selector
                                                            requirements. The requirements
                                                            are ANDed.
                                                          items:
                                                            description: |-
                                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                                              relates the key and values.
                                                            properties:
                                                              key:
                                                                description: key is
                                                                  the label key that
                                                                  the selector applies
                                                                  to.
                                                                type: string
                                                              operator:
                                                                description: |-
                                                                  operator represents a key's relationship to a set of values.
                                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                type: string
                                                              values:
                                                                description: |-
                                                                  values is an array of string values. If the operator is In or NotIn,
                                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                  the values array must be empty. This array is replaced during a strategic
                                                                  merge patch.
                                                                items:
                                                                  type: string
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                            required:
                                                            - key
                                                            - operator
                                                            type: object
                                                          type: array
                                                          x-kubernetes-list-type: atomic
                                                        matchLabels:
                                                          additionalProperties:
                                                            type: string
                                                          description: |-
                                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                          type: object
                                                      type: object
                                                      x-kubernetes-map-type: atomic
                                                    matchLabelKeys:
                                                      description: |-
                                                        MatchLabelKeys is a set of pod label keys to select which pods will
                                                        be taken into consideration. The keys are used to lookup values from the
                                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                        to select the group of existing pods which pods will be taken into consideration
                                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                        pod labels will be ignored. The default value is empty.
                                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                      items:
                                                        type: string
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    mismatchLabelKeys:
                                                      description: |-
                                                        MismatchLabelKeys is a set of pod label keys to select which pods will
                                                        be taken into consideration. The keys are used to lookup values from the
                                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                        to select the group of existing pods which pods will be taken into consideration
                                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                        pod labels will be ignored. The default value is empty.
                                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                      items:
                                                        type: string
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    namespaceSelector:
                                                      description: |-
                                                        A label query over the set of namespaces that the term applies to.
                                                        The term is applied to the union of the namespaces selected by this field
                                                        and the ones listed in the namespaces field.
                                                        null selector and null or empty namespaces list means "this pod's namespace".
                                                        An empty selector ({}) matches all namespaces.
                                                      properties:
                                                        matchExpressions:
                                                          description: matchExpressions
                                                            is a list of label selector
                                                            requirements. The requirements
                                                            are ANDed.
                                                          items:
                                                            description: |-
                                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                                              relates the key and values.
                                                            properties:
                                                              key:
                                                                description: key is
                                                                  the label key that
                                                                  the selector applies
                                                                  to.
                                                                type: string
                                                              operator:
                                                                description: |-
                                                                  operator represents a key's relationship to a set of values.
                                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                type: string
                                                              values:
                                                                description: |-
                                                                  values is an array of string values. If the operator is In or NotIn,
                                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                  the values array must be empty. This array is replaced during a strategic
                                                                  merge patch.
                                                                items:
                                                                  type: string
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                            required:
                                                            - key
                                                            - operator
                                                            type: object
                                                          type: array
                                                          x-kubernetes-list-type: atomic
                                                        matchLabels:
                                                          additionalProperties:
                                                            type: string
                                                          description: |-
                                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                          type: object
                                                      type: object
                                                      x-kubernetes-map-type: atomic
                                                    namespaces:
                                                      description: |-
                                                        namespaces specifies a static list of namespace names that the term applies to.
                                                        The term is applied to the union of the namespaces listed in this field
                                                        and the ones selected by namespaceSelector.
                                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                      items:
                                                        type: string
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    topologyKey:
                                                      description: |-
                                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                        whose value of the label with key topologyKey matches that of any node on which any of the
                                                        selected pods is running.
                                                        Empty topologyKey is not allowed.
                                                      type: string
                                                  required:
                                                  - topologyKey
                                                  type: object
                                                weight:
                                                  description: |-
                                                    weight associated with matching the corresponding podAffinityTerm,
                                                    in the range 1-100.
                                                  format: int32
                                                  type: integer
                                              required:
                                              - podAffinityTerm
                                              - weight
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                          requiredDuringSchedulingIgnoredDuringExecution:
                                            description: |-
                                              If the anti-affinity requirements specified by this field are not met at
                                              scheduling time, the pod will not be scheduled onto the node.
                                              If the anti-affinity requirements specified by this field cease to be met
                                              at some point during pod execution (e.g. due to a pod label update), the
                                              system may or may not try to eventually evict the pod from its node.
                                              When there are multiple elements, the lists of nodes corresponding to each
                                              podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                            items:
                                              description: |-
                                                Defines a set of pods (namely those matching the labelSelector
                                                relative to the given namespace(s)) that this pod should be
                                                co-located (affinity) or not co-located (anti-affinity) with,
                                                where co-located is defined as running on a node whose value of
                                                the label with key <topologyKey> matches that of any node on which
                                                a pod of the set of pods is running
                                              properties:
                                                labelSelector:
                                                  description: |-
                                                    A label query over a set of resources, in this case pods.
                                                    If it's null, this PodAffinityTerm matches with no Pods.
                                                  properties:
                                                    matchExpressions:
                                                      description: matchExpressions
                                                        is a list of label selector
                                                        requirements. The requirements
                                                        are ANDed.
                                                      items:
                                                        description: |-
                                                          A label selector requirement is a selector that contains values, a key, and an operator that
                                                          relates the key and values.
                                                        properties:
                                                          key:
                                                            description: key is the
                                                              label key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              operator represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists and DoesNotExist.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              values is an array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. This array is replaced during a strategic
                                                              merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    matchLabels:
                                                      additionalProperties:
                                                        type: string
                                                      description: |-
                                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                      type: object
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                                matchLabelKeys:
                                                  description: |-
                                                    MatchLabelKeys is a set of pod label keys to select which pods will
                                                    be taken into consideration. The keys are used to lookup values from the
                                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                    to select the group of existing pods which pods will be taken into consideration
                                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                    pod labels will be ignored. The default value is empty.
                                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                mismatchLabelKeys:
                                                  description: |-
                                                    MismatchLabelKeys is a set of pod label keys to select which pods will
                                                    be taken into consideration. The keys are used to lookup values from the
                                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                    to select the group of existing pods which pods will be taken into consideration
                                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                    pod labels will be ignored. The default value is empty.
                                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                namespaceSelector:
                                                  description: |-
                                                    A label query over the set of namespaces that the term applies to.
                                                    The term is applied to the union of the namespaces selected by this field
                                                    and the ones listed in the namespaces field.
                                                    null selector and null or empty namespaces list means "this pod's namespace".
                                                    An empty selector ({}) matches all namespaces.
                                                  properties:
                                                    matchExpressions:
                                                      description: matchExpressions
                                                        is a list of label selector
                                                        requirements. The requirements
                                                        are ANDed.
                                                      items:
                                                        description: |-
                                                          A label selector requirement is a selector that contains values, a key, and an operator that
                                                          relates the key and values.
                                                        properties:
                                                          key:
                                                            description: key is the
                                                              label key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              operator represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists and DoesNotExist.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              values is an array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. This array is replaced during a strategic
                                                              merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    matchLabels:
                                                      additionalProperties:
                                                        type: string
                                                      description: |-
                                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                      type: object
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                                namespaces:
                                                  description: |-
                                                    namespaces specifies a static list of namespace names that the term applies to.
                                                    The term is applied to the union of the namespaces listed in this field
                                                    and the ones selected by namespaceSelector.
                                                    null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                topologyKey:
                                                  description: |-
                                                    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                    the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                    whose value of the label with key topologyKey matches that of any node on which any of the
                                                    selected pods is running.
                                                    Empty topologyKey is not allowed.
                                                  type: string
                                              required:
                                              - topologyKey
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                        type: object
                                    type: object
                                  imagePullSecrets:
                                    description: If specified, the pod's imagePullSecrets
                                    items:
                                      description: |-
                                        LocalObjectReference contains enough information to let you locate the
                                        referenced object inside the same namespace.
                                      properties:
                                        name:
                                          default: ""
                                          description: |-
                                            Name of the referent.
                                            This field is effectively required, but due to backwards compatibility is
                                            allowed to be empty. Instances of this type with an empty value here are
                                            almost certainly wrong.
                                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                          type: string
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    type: array
                                    x-kubernetes-list-map-keys:
                                    - name
                                    x-kubernetes-list-type: map
                                  nodeSelector:
                                    additionalProperties:
                                      type: string
                                    description: |-
                                      NodeSelector is a selector which must be true for the pod to fit on a node.
                                      Selector which must match a node's labels for the pod to be scheduled on that node.
                                      More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
                                    type: object
                                  priorityClassName:
                                    description: If specified, the pod's priorityClassName.
                                    type: string
                                  resources:
                                    description: |-
                                      If specified, the pod's resource requirements.
                                      These values override the global resource configuration flags.
                                      Note that when only specifying resource limits, ensure they are greater than or equal
                                      to the corresponding global resource requests configured via controller flags
                                      (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
                                      Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
                                    properties:
                                      limits:
                                        additionalProperties:
                                          anyOf:
                                          - type: integer
                                          - type: string
                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                          x-kubernetes-int-or-string: true
                                        description: |-
                                          Limits describes the maximum amount of compute resources allowed.
                                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                        type: object
                                      requests:
                                        additionalProperties:
                                          anyOf:
                                          - type: integer
                                          - type: string
                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                          x-kubernetes-int-or-string: true
                                        description: |-
                                          Requests describes the minimum amount of compute resources required.
                                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                                          otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
                                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                        type: object
                                    type: object
                                  securityContext:
                                    description: If specified, the pod's security
                                      context
                                    properties:
                                      fsGroup:
                                        description: |-
                                          A special supplemental group that applies to all containers in a pod.
                                          Some volume types allow the Kubelet to change the ownership of that volume
                                          to be owned by the pod:

                                          1. The owning GID will be the FSGroup
                                          2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
                                          3. The permission bits are OR'd with rw-rw----

                                          If unset, the Kubelet will not modify the ownership and permissions of any volume.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        format: int64
                                        type: integer
                                      fsGroupChangePolicy:
                                        description: |-
                                          fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
                                          before being exposed inside Pod. This field will only apply to
                                          volume types which support fsGroup based ownership(and permissions).
                                          It will have no effect on ephemeral volume types such as: secret, configmaps
                                          and emptydir.
                                          Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        type: string
                                      runAsGroup:
                                        description: |-
                                          The GID to run the entrypoint of the container process.
                                          Uses runtime default if unset.
                                          May also be set in SecurityContext.  If set in both SecurityContext and
                                          PodSecurityContext, the value specified in SecurityContext takes precedence
                                          for that container.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        format: int64
                                        type: integer
                                      runAsNonRoot:
                                        description: |-
                                          Indicates that the container must run as a non-root user.
                                          If true, the Kubelet will validate the image at runtime to ensure that it
                                          does not run as UID 0 (root) and fail to start the container if it does.
                                          If unset or false, no such validation will be performed.
                                          May also be set in SecurityContext.  If set in both SecurityContext and
                                          PodSecurityContext, the value specified in SecurityContext takes precedence.
                                        type: boolean
                                      runAsUser:
                                        description: |-
                                          The UID to run the entrypoint of the container process.
                                          Defaults to user specified in image metadata if unspecified.
                                          May also be set in SecurityContext.  If set in both SecurityContext and
                                          PodSecurityContext, the value specified in SecurityContext takes precedence
                                          for that container.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        format: int64
                                        type: integer
                                      seLinuxOptions:
                                        description: |-
                                          The SELinux context to be applied to all containers.
                                          If unspecified, the container runtime will allocate a random SELinux context for each
                                          container.  May also be set in SecurityContext.  If set in
                                          both SecurityContext and PodSecurityContext, the value specified in SecurityContext
                                          takes precedence for that container.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        properties:
                                          level:
                                            description: Level is SELinux level label
                                              that applies to the container.
                                            type: string
                                          role:
                                            description: Role is a SELinux role label
                                              that applies to the container.
                                            type: string
                                          type:
                                            description: Type is a SELinux type label
                                              that applies to the container.
                                            type: string
                                          user:
                                            description: User is a SELinux user label
                                              that applies to the container.
                                            type: string
                                        type: object
                                      seccompProfile:
                                        description: |-
                                          The seccomp options to use by the containers in this pod.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        properties:
                                          localhostProfile:
                                            description: |-
                                              localhostProfile indicates a profile defined in a file on the node should be used.
                                              The profile must be preconfigured on the node to work.
                                              Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                              Must be set if type is "Localhost". Must NOT be set for any other type.
                                            type: string
                                          type:
                                            description: |-
                                              type indicates which kind of seccomp profile will be applied.
                                              Valid options are:

                                              Localhost - a profile defined in a file on the node should be used.
                                              RuntimeDefault - the container runtime default profile should be used.
                                              Unconfined - no profile should be applied.
                                            type: string
                                        required:
                                        - type
                                        type: object
                                      supplementalGroups:
                                        description: |-
                                          A list of groups applied to the first process run in each container, in addition
                                          to the container's primary GID, the fsGroup (if specified), and group memberships
                                          defined in the container image for the uid of the container process. If unspecified,
                                          no additional groups are added to any container. Note that group memberships
                                          defined in the container image for the uid of the container process are still effective,
                                          even if they are not included in this list.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        items:
                                          format: int64
                                          type: integer
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      sysctls:
                                        description: |-
                                          Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
                                          sysctls (by the container runtime) might fail to launch.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        items:
                                          description: Sysctl defines a kernel parameter
                                            to be set
                                          properties:
                                            name:
                                              description: Name of a property to set
                                              type: string
                                            value:
                                              description: Value of a property to
                                                set
                                              type: string
                                          required:
                                          - name
                                          - value
                                          type: object
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    type: object
                                  serviceAccountName:
                                    description: If specified, the pod's service account
                                    type: string
                                  tolerations:
                                    description: If specified, the pod's tolerations.
                                    items:
                                      description: |-
                                        The pod this Toleration is attached to tolerates any taint that matches
                                        the triple <key,value,effect> using the matching operator <operator>.
                                      properties:
                                        effect:
                                          description: |-
                                            Effect indicates the taint effect to match. Empty means match all taint effects.
                                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                                          type: string
                                        key:
                                          description: |-
                                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
                                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                                          type: string
                                        operator:
                                          description: |-
                                            Operator represents a key's relationship to the value.
                                            Valid operators are Exists and Equal. Defaults to Equal.
                                            Exists is equivalent to wildcard for value, so that a pod can
                                            tolerate all taints of a particular category.
                                          type: string
                                        tolerationSeconds:
                                          description: |-
                                            TolerationSeconds represents the period of time the toleration (which must be
                                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
                                            it is not set, which means tolerate the taint forever (do not evict). Zero and
                                            negative values will be treated as 0 (evict immediately) by the system.
                                          format: int64
                                          type: integer
                                        value:
                                          description: |-
                                            Value is the taint value the toleration matches to.
                                            If the operator is Exists, the value should be empty, otherwise just a regular string.
                                          type: string
                                      type: object
                                    type: array
                                    x-kubernetes-list-type: atomic
                                type: object
                            type: object
                          serviceType:
                            description: |-
                              Optional service type for Kubernetes solver service. Supported values
                              are NodePort or ClusterIP. If unset, defaults to NodePort.
                            type: string
                        type: object
                      ingress:
                        description: |-
                          The ingress based HTTP01 challenge solver will solve challenges by
                          creating or modifying Ingress resources in order to route requests for
                          '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
                          provisioned by cert-manager for each Challenge to be completed.
                        properties:
                          class:
                            description: |-
                              This field configures the annotation `kubernetes.io/ingress.class` when
                              creating Ingress resources to solve ACME challenges that use this
                              challenge solver. Only one of `class`, `name` or `ingressClassName` may
                              be specified.
                            type: string
                          ingressClassName:
                            description: |-
                              This field configures the field `ingressClassName` on the created Ingress
                              resources used to solve ACME challenges that use this challenge solver.
                              This is the recommended way of configuring the ingress class. Only one of
                              `class`, `name` or `ingressClassName` may be specified.
                            type: string
                          ingressTemplate:
                            description: |-
                              Optional ingress template used to configure the ACME challenge solver
                              ingress used for HTTP01 challenges.
                            properties:
                              metadata:
                                description: |-
                                  ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
                                  Only the 'labels' and 'annotations' fields may be set.
                                  If labels or annotations overlap with in-built values, the values here
                                  will override the in-built values.
                                properties:
                                  annotations:
                                    additionalProperties:
                                      type: string
                                    description: Annotations that should be added
                                      to the created ACME HTTP01 solver ingress.
                                    type: object
                                  labels:
                                    additionalProperties:
                                      type: string
                                    description: Labels that should be added to the
                                      created ACME HTTP01 solver ingress.
                                    type: object
                                type: object
                            type: object
                          name:
                            description: |-
                              The name of the ingress resource that should have ACME challenge solving
                              routes inserted into it in order to solve HTTP01 challenges.
                              This is typically used in conjunction with ingress controllers like
                              ingress-gce, which maintains a 1:1 mapping between external IPs and
                              ingress resources. Only one of `class`, `name` or `ingressClassName` may
                              be specified.
                            type: string
                          podTemplate:
                            description: |-
                              Optional pod template used to configure the ACME challenge solver pods
                              used for HTTP01 challenges.
                            properties:
                              metadata:
                                description: |-
                                  ObjectMeta overrides for the pod used to solve HTTP01 challenges.
                                  Only the 'labels' and 'annotations' fields may be set.
                                  If labels or annotations overlap with in-built values, the values here
                                  will override the in-built values.
                                properties:
                                  annotations:
                                    additionalProperties:
                                      type: string
                                    description: Annotations that should be added
                                      to the created ACME HTTP01 solver pods.
                                    type: object
                                  labels:
                                    additionalProperties:
                                      type: string
                                    description: Labels that should be added to the
                                      created ACME HTTP01 solver pods.
                                    type: object
                                type: object
                              spec:
                                description: |-
                                  PodSpec defines overrides for the HTTP01 challenge solver pod.
                                  Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
                                  All other fields will be ignored.
                                properties:
                                  affinity:
                                    description: If specified, the pod's scheduling
                                      constraints
                                    properties:
                                      nodeAffinity:
                                        description: Describes node affinity scheduling
                                          rules for the pod.
                                        properties:
                                          preferredDuringSchedulingIgnoredDuringExecution:
                                            description: |-
                                              The scheduler will prefer to schedule pods to nodes that satisfy
                                              the affinity expressions specified by this field, but it may choose
                                              a node that violates one or more of the expressions. The node that is
                                              most preferred is the one with the greatest sum of weights, i.e.
                                              for each node that meets all of the scheduling requirements (resource
                                              request, requiredDuringScheduling affinity expressions, etc.),
                                              compute a sum by iterating through the elements of this field and adding
                                              "weight" to the sum if the node matches the corresponding matchExpressions; the
                                              node(s) with the highest sum are the most preferred.
                                            items:
                                              description: |-
                                                An empty preferred scheduling term matches all objects with implicit weight 0
                                                (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
                                              properties:
                                                preference:
                                                  description: A node selector term,
                                                    associated with the corresponding
                                                    weight.
                                                  properties:
                                                    matchExpressions:
                                                      description: A list of node
                                                        selector requirements by node's
                                                        labels.
                                                      items:
                                                        description: |-
                                                          A node selector requirement is a selector that contains values, a key, and an operator
                                                          that relates the key and values.
                                                        properties:
                                                          key:
                                                            description: The label
                                                              key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              Represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              An array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. If the operator is Gt or Lt, the values
                                                              array must have a single element, which will be interpreted as an integer.
                                                              This array is replaced during a strategic merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    matchFields:
                                                      description: A list of node
                                                        selector requirements by node's
                                                        fields.
                                                      items:
                                                        description: |-
                                                          A node selector requirement is a selector that contains values, a key, and an operator
                                                          that relates the key and values.
                                                        properties:
                                                          key:
                                                            description: The label
                                                              key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              Represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              An array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. If the operator is Gt or Lt, the values
                                                              array must have a single element, which will be interpreted as an integer.
                                                              This array is replaced during a strategic merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                                weight:
                                                  description: Weight associated with
                                                    matching the corresponding nodeSelectorTerm,
                                                    in the range 1-100.
                                                  format: int32
                                                  type: integer
                                              required:
                                              - preference
                                              - weight
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                          requiredDuringSchedulingIgnoredDuringExecution:
                                            description: |-
                                              If the affinity requirements specified by this field are not met at
                                              scheduling time, the pod will not be scheduled onto the node.
                                              If the affinity requirements specified by this field cease to be met
                                              at some point during pod execution (e.g. due to an update), the system
                                              may or may not try to eventually evict the pod from its node.
                                            properties:
                                              nodeSelectorTerms:
                                                description: Required. A list of node
                                                  selector terms. The terms are ORed.
                                                items:
                                                  description: |-
                                                    A null or empty node selector term matches no objects. The requirements of
                                                    them are ANDed.
                                                    The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
                                                  properties:
                                                    matchExpressions:
                                                      description: A list of node
                                                        selector requirements by node's
                                                        labels.
                                                      items:
                                                        description: |-
                                                          A node selector requirement is a selector that contains values, a key, and an operator
                                                          that relates the key and values.
                                                        properties:
                                                          key:
                                                            description: The label
                                                              key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              Represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              An array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. If the operator is Gt or Lt, the values
                                                              array must have a single element, which will be interpreted as an integer.
                                                              This array is replaced during a strategic merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    matchFields:
                                                      description: A list of node
                                                        selector requirements by node's
                                                        fields.
                                                      items:
                                                        description: |-
                                                          A node selector requirement is a selector that contains values, a key, and an operator
                                                          that relates the key and values.
                                                        properties:
                                                          key:
                                                            description: The label
                                                              key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              Represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              An array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. If the operator is Gt or Lt, the values
                                                              array must have a single element, which will be interpreted as an integer.
                                                              This array is replaced during a strategic merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - nodeSelectorTerms
                                            type: object
                                            x-kubernetes-map-type: atomic
                                        type: object
                                      podAffinity:
                                        description: Describes pod affinity scheduling
                                          rules (e.g. co-locate this pod in the same
                                          node, zone, etc. as some other pod(s)).
                                        properties:
                                          preferredDuringSchedulingIgnoredDuringExecution:
                                            description: |-
                                              The scheduler will prefer to schedule pods to nodes that satisfy
                                              the affinity expressions specified by this field, but it may choose
                                              a node that violates one or more of the expressions. The node that is
                                              most preferred is the one with the greatest sum of weights, i.e.
                                              for each node that meets all of the scheduling requirements (resource
                                              request, requiredDuringScheduling affinity expressions, etc.),
                                              compute a sum by iterating through the elements of this field and adding
                                              "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                              node(s) with the highest sum are the most preferred.
                                            items:
                                              description: The weights of all of the
                                                matched WeightedPodAffinityTerm fields
                                                are added per-node to find the most
                                                preferred node(s)
                                              properties:
                                                podAffinityTerm:
                                                  description: Required. A pod affinity
                                                    term, associated with the corresponding
                                                    weight.
                                                  properties:
                                                    labelSelector:
                                                      description: |-
                                                        A label query over a set of resources, in this case pods.
                                                        If it's null, this PodAffinityTerm matches with no Pods.
                                                      properties:
                                                        matchExpressions:
                                                          description: matchExpressions
                                                            is a list of label selector
                                                            requirements. The requirements
                                                            are ANDed.
                                                          items:
                                                            description: |-
                                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                                              relates the key and values.
                                                            properties:
                                                              key:
                                                                description: key is
                                                                  the label key that
                                                                  the selector applies
                                                                  to.
                                                                type: string
                                                              operator:
                                                                description: |-
                                                                  operator represents a key's relationship to a set of values.
                                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                type: string
                                                              values:
                                                                description: |-
                                                                  values is an array of string values. If the operator is In or NotIn,
                                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                  the values array must be empty. This array is replaced during a strategic
                                                                  merge patch.
                                                                items:
                                                                  type: string
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                            required:
                                                            - key
                                                            - operator
                                                            type: object
                                                          type: array
                                                          x-kubernetes-list-type: atomic
                                                        matchLabels:
                                                          additionalProperties:
                                                            type: string
                                                          description: |-
                                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                          type: object
                                                      type: object
                                                      x-kubernetes-map-type: atomic
                                                    matchLabelKeys:
                                                      description: |-
                                                        MatchLabelKeys is a set of pod label keys to select which pods will
                                                        be taken into consideration. The keys are used to lookup values from the
                                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                        to select the group of existing pods which pods will be taken into consideration
                                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                        pod labels will be ignored. The default value is empty.
                                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                      items:
                                                        type: string
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    mismatchLabelKeys:
                                                      description: |-
                                                        MismatchLabelKeys is a set of pod label keys to select which pods will
                                                        be taken into consideration. The keys are used to lookup values from the
                                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                        to select the group of existing pods which pods will be taken into consideration
                                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                        pod labels will be ignored. The default value is empty.
                                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                      items:
                                                        type: string
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    namespaceSelector:
                                                      description: |-
                                                        A label query over the set of namespaces that the term applies to.
                                                        The term is applied to the union of the namespaces selected by this field
                                                        and the ones listed in the namespaces field.
                                                        null selector and null or empty namespaces list means "this pod's namespace".
                                                        An empty selector ({}) matches all namespaces.
                                                      properties:
                                                        matchExpressions:
                                                          description: matchExpressions
                                                            is a list of label selector
                                                            requirements. The requirements
                                                            are ANDed.
                                                          items:
                                                            description: |-
                                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                                              relates the key and values.
                                                            properties:
                                                              key:
                                                                description: key is
                                                                  the label key that
                                                                  the selector applies
                                                                  to.
                                                                type: string
                                                              operator:
                                                                description: |-
                                                                  operator represents a key's relationship to a set of values.
                                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                type: string
                                                              values:
                                                                description: |-
                                                                  values is an array of string values. If the operator is In or NotIn,
                                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                  the values array must be empty. This array is replaced during a strategic
                                                                  merge patch.
                                                                items:
                                                                  type: string
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                            required:
                                                            - key
                                                            - operator
                                                            type: object
                                                          type: array
                                                          x-kubernetes-list-type: atomic
                                                        matchLabels:
                                                          additionalProperties:
                                                            type: string
                                                          description: |-
                                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                          type: object
                                                      type: object
                                                      x-kubernetes-map-type: atomic
                                                    namespaces:
                                                      description: |-
                                                        namespaces specifies a static list of namespace names that the term applies to.
                                                        The term is applied to the union of the namespaces listed in this field
                                                        and the ones selected by namespaceSelector.
                                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                      items:
                                                        type: string
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    topologyKey:
                                                      description: |-
                                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                        whose value of the label with key topologyKey matches that of any node on which any of the
                                                        selected pods is running.
                                                        Empty topologyKey is not allowed.
                                                      type: string
                                                  required:
                                                  - topologyKey
                                                  type: object
                                                weight:
                                                  description: |-
                                                    weight associated with matching the corresponding podAffinityTerm,
                                                    in the range 1-100.
                                                  format: int32
                                                  type: integer
                                              required:
                                              - podAffinityTerm
                                              - weight
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                          requiredDuringSchedulingIgnoredDuringExecution:
                                            description: |-
                                              If the affinity requirements specified by this field are not met at
                                              scheduling time, the pod will not be scheduled onto the node.
                                              If the affinity requirements specified by this field cease to be met
                                              at some point during pod execution (e.g. due to a pod label update), the
                                              system may or may not try to eventually evict the pod from its node.
                                              When there are multiple elements, the lists of nodes corresponding to each
                                              podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                            items:
                                              description: |-
                                                Defines a set of pods (namely those matching the labelSelector
                                                relative to the given namespace(s)) that this pod should be
                                                co-located (affinity) or not co-located (anti-affinity) with,
                                                where co-located is defined as running on a node whose value of
                                                the label with key <topologyKey> matches that of any node on which
                                                a pod of the set of pods is running
                                              properties:
                                                labelSelector:
                                                  description: |-
                                                    A label query over a set of resources, in this case pods.
                                                    If it's null, this PodAffinityTerm matches with no Pods.
                                                  properties:
                                                    matchExpressions:
                                                      description: matchExpressions
                                                        is a list of label selector
                                                        requirements. The requirements
                                                        are ANDed.
                                                      items:
                                                        description: |-
                                                          A label selector requirement is a selector that contains values, a key, and an operator that
                                                          relates the key and values.
                                                        properties:
                                                          key:
                                                            description: key is the
                                                              label key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              operator represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists and DoesNotExist.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              values is an array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. This array is replaced during a strategic
                                                              merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    matchLabels:
                                                      additionalProperties:
                                                        type: string
                                                      description: |-
                                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                      type: object
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                                matchLabelKeys:
                                                  description: |-
                                                    MatchLabelKeys is a set of pod label keys to select which pods will
                                                    be taken into consideration. The keys are used to lookup values from the
                                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                    to select the group of existing pods which pods will be taken into consideration
                                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                    pod labels will be ignored. The default value is empty.
                                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                mismatchLabelKeys:
                                                  description: |-
                                                    MismatchLabelKeys is a set of pod label keys to select which pods will
                                                    be taken into consideration. The keys are used to lookup values from the
                                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                    to select the group of existing pods which pods will be taken into consideration
                                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                    pod labels will be ignored. The default value is empty.
                                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                namespaceSelector:
                                                  description: |-
                                                    A label query over the set of namespaces that the term applies to.
                                                    The term is applied to the union of the namespaces selected by this field
                                                    and the ones listed in the namespaces field.
                                                    null selector and null or empty namespaces list means "this pod's namespace".
                                                    An empty selector ({}) matches all namespaces.
                                                  properties:
                                                    matchExpressions:
                                                      description: matchExpressions
                                                        is a list of label selector
                                                        requirements. The requirements
                                                        are ANDed.
                                                      items:
                                                        description: |-
                                                          A label selector requirement is a selector that contains values, a key, and an operator that
                                                          relates the key and values.
                                                        properties:
                                                          key:
                                                            description: key is the
                                                              label key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              operator represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists and DoesNotExist.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              values is an array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. This array is replaced during a strategic
                                                              merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    matchLabels:
                                                      additionalProperties:
                                                        type: string
                                                      description: |-
                                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                      type: object
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                                namespaces:
                                                  description: |-
                                                    namespaces specifies a static list of namespace names that the term applies to.
                                                    The term is applied to the union of the namespaces listed in this field
                                                    and the ones selected by namespaceSelector.
                                                    null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                topologyKey:
                                                  description: |-
                                                    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                    the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                    whose value of the label with key topologyKey matches that of any node on which any of the
                                                    selected pods is running.
                                                    Empty topologyKey is not allowed.
                                                  type: string
                                              required:
                                              - topologyKey
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                        type: object
                                      podAntiAffinity:
                                        description: Describes pod anti-affinity scheduling
                                          rules (e.g. avoid putting this pod in the
                                          same node, zone, etc. as some other pod(s)).
                                        properties:
                                          preferredDuringSchedulingIgnoredDuringExecution:
                                            description: |-
                                              The scheduler will prefer to schedule pods to nodes that satisfy
                                              the anti-affinity expressions specified by this field, but it may choose
                                              a node that violates one or more of the expressions. The node that is
                                              most preferred is the one with the greatest sum of weights, i.e.
                                              for each node that meets all of the scheduling requirements (resource
                                              request, requiredDuringScheduling anti-affinity expressions, etc.),
                                              compute a sum by iterating through the elements of this field and subtracting
                                              "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                              node(s) with the highest sum are the most preferred.
                                            items:
                                              description: The weights of all of the
                                                matched WeightedPodAffinityTerm fields
                                                are added per-node to find the most
                                                preferred node(s)
                                              properties:
                                                podAffinityTerm:
                                                  description: Required. A pod affinity
                                                    term, associated with the corresponding
                                                    weight.
                                                  properties:
                                                    labelSelector:
                                                      description: |-
                                                        A label query over a set of resources, in this case pods.
                                                        If it's null, this PodAffinityTerm matches with no Pods.
                                                      properties:
                                                        matchExpressions:
                                                          description: matchExpressions
                                                            is a list of label selector
                                                            requirements. The requirements
                                                            are ANDed.
                                                          items:
                                                            description: |-
                                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                                              relates the key and values.
                                                            properties:
                                                              key:
                                                                description: key is
                                                                  the label key that
                                                                  the selector applies
                                                                  to.
                                                                type: string
                                                              operator:
                                                                description: |-
                                                                  operator represents a key's relationship to a set of values.
                                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                type: string
                                                              values:
                                                                description: |-
                                                                  values is an array of string values. If the operator is In or NotIn,
                                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                  the values array must be empty. This array is replaced during a strategic
                                                                  merge patch.
                                                                items:
                                                                  type: string
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                            required:
                                                            - key
                                                            - operator
                                                            type: object
                                                          type: array
                                                          x-kubernetes-list-type: atomic
                                                        matchLabels:
                                                          additionalProperties:
                                                            type: string
                                                          description: |-
                                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                          type: object
                                                      type: object
                                                      x-kubernetes-map-type: atomic
                                                    matchLabelKeys:
                                                      description: |-
                                                        MatchLabelKeys is a set of pod label keys to select which pods will
                                                        be taken into consideration. The keys are used to lookup values from the
                                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                        to select the group of existing pods which pods will be taken into consideration
                                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                        pod labels will be ignored. The default value is empty.
                                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                      items:
                                                        type: string
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    mismatchLabelKeys:
                                                      description: |-
                                                        MismatchLabelKeys is a set of pod label keys to select which pods will
                                                        be taken into consideration. The keys are used to lookup values from the
                                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                        to select the group of existing pods which pods will be taken into consideration
                                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                        pod labels will be ignored. The default value is empty.
                                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                      items:
                                                        type: string
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    namespaceSelector:
                                                      description: |-
                                                        A label query over the set of namespaces that the term applies to.
                                                        The term is applied to the union of the namespaces selected by this field
                                                        and the ones listed in the namespaces field.
                                                        null selector and null or empty namespaces list means "this pod's namespace".
                                                        An empty selector ({}) matches all namespaces.
                                                      properties:
                                                        matchExpressions:
                                                          description: matchExpressions
                                                            is a list of label selector
                                                            requirements. The requirements
                                                            are ANDed.
                                                          items:
                                                            description: |-
                                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                                              relates the key and values.
                                                            properties:
                                                              key:
                                                                description: key is
                                                                  the label key that
                                                                  the selector applies
                                                                  to.
                                                                type: string
                                                              operator:
                                                                description: |-
                                                                  operator represents a key's relationship to a set of values.
                                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                type: string
                                                              values:
                                                                description: |-
                                                                  values is an array of string values. If the operator is In or NotIn,
                                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                  the values array must be empty. This array is replaced during a strategic
                                                                  merge patch.
                                                                items:
                                                                  type: string
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                            required:
                                                            - key
                                                            - operator
                                                            type: object
                                                          type: array
                                                          x-kubernetes-list-type: atomic
                                                        matchLabels:
                                                          additionalProperties:
                                                            type: string
                                                          description: |-
                                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                          type: object
                                                      type: object
                                                      x-kubernetes-map-type: atomic
                                                    namespaces:
                                                      description: |-
                                                        namespaces specifies a static list of namespace names that the term applies to.
                                                        The term is applied to the union of the namespaces listed in this field
                                                        and the ones selected by namespaceSelector.
                                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                      items:
                                                        type: string
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    topologyKey:
                                                      description: |-
                                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                        whose value of the label with key topologyKey matches that of any node on which any of the
                                                        selected pods is running.
                                                        Empty topologyKey is not allowed.
                                                      type: string
                                                  required:
                                                  - topologyKey
                                                  type: object
                                                weight:
                                                  description: |-
                                                    weight associated with matching the corresponding podAffinityTerm,
                                                    in the range 1-100.
                                                  format: int32
                                                  type: integer
                                              required:
                                              - podAffinityTerm
                                              - weight
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                          requiredDuringSchedulingIgnoredDuringExecution:
                                            description: |-
                                              If the anti-affinity requirements specified by this field are not met at
                                              scheduling time, the pod will not be scheduled onto the node.
                                              If the anti-affinity requirements specified by this field cease to be met
                                              at some point during pod execution (e.g. due to a pod label update), the
                                              system may or may not try to eventually evict the pod from its node.
                                              When there are multiple elements, the lists of nodes corresponding to each
                                              podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                            items:
                                              description: |-
                                                Defines a set of pods (namely those matching the labelSelector
                                                relative to the given namespace(s)) that this pod should be
                                                co-located (affinity) or not co-located (anti-affinity) with,
                                                where co-located is defined as running on a node whose value of
                                                the label with key <topologyKey> matches that of any node on which
                                                a pod of the set of pods is running
                                              properties:
                                                labelSelector:
                                                  description: |-
                                                    A label query over a set of resources, in this case pods.
                                                    If it's null, this PodAffinityTerm matches with no Pods.
                                                  properties:
                                                    matchExpressions:
                                                      description: matchExpressions
                                                        is a list of label selector
                                                        requirements. The requirements
                                                        are ANDed.
                                                      items:
                                                        description: |-
                                                          A label selector requirement is a selector that contains values, a key, and an operator that
                                                          relates the key and values.
                                                        properties:
                                                          key:
                                                            description: key is the
                                                              label key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              operator represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists and DoesNotExist.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              values is an array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. This array is replaced during a strategic
                                                              merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    matchLabels:
                                                      additionalProperties:
                                                        type: string
                                                      description: |-
                                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                      type: object
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                                matchLabelKeys:
                                                  description: |-
                                                    MatchLabelKeys is a set of pod label keys to select which pods will
                                                    be taken into consideration. The keys are used to lookup values from the
                                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                    to select the group of existing pods which pods will be taken into consideration
                                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                    pod labels will be ignored. The default value is empty.
                                                    The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                    Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                mismatchLabelKeys:
                                                  description: |-
                                                    MismatchLabelKeys is a set of pod label keys to select which pods will
                                                    be taken into consideration. The keys are used to lookup values from the
                                                    incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                    to select the group of existing pods which pods will be taken into consideration
                                                    for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                    pod labels will be ignored. The default value is empty.
                                                    The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                    Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                namespaceSelector:
                                                  description: |-
                                                    A label query over the set of namespaces that the term applies to.
                                                    The term is applied to the union of the namespaces selected by this field
                                                    and the ones listed in the namespaces field.
                                                    null selector and null or empty namespaces list means "this pod's namespace".
                                                    An empty selector ({}) matches all namespaces.
                                                  properties:
                                                    matchExpressions:
                                                      description: matchExpressions
                                                        is a list of label selector
                                                        requirements. The requirements
                                                        are ANDed.
                                                      items:
                                                        description: |-
                                                          A label selector requirement is a selector that contains values, a key, and an operator that
                                                          relates the key and values.
                                                        properties:
                                                          key:
                                                            description: key is the
                                                              label key that the selector
                                                              applies to.
                                                            type: string
                                                          operator:
                                                            description: |-
                                                              operator represents a key's relationship to a set of values.
                                                              Valid operators are In, NotIn, Exists and DoesNotExist.
                                                            type: string
                                                          values:
                                                            description: |-
                                                              values is an array of string values. If the operator is In or NotIn,
                                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                              the values array must be empty. This array is replaced during a strategic
                                                              merge patch.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        required:
                                                        - key
                                                        - operator
                                                        type: object
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                    matchLabels:
                                                      additionalProperties:
                                                        type: string
                                                      description: |-
                                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                      type: object
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                                namespaces:
                                                  description: |-
                                                    namespaces specifies a static list of namespace names that the term applies to.
                                                    The term is applied to the union of the namespaces listed in this field
                                                    and the ones selected by namespaceSelector.
                                                    null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                topologyKey:
                                                  description: |-
                                                    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                    the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                    whose value of the label with key topologyKey matches that of any node on which any of the
                                                    selected pods is running.
                                                    Empty topologyKey is not allowed.
                                                  type: string
                                              required:
                                              - topologyKey
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                        type: object
                                    type: object
                                  imagePullSecrets:
                                    description: If specified, the pod's imagePullSecrets
                                    items:
                                      description: |-
                                        LocalObjectReference contains enough information to let you locate the
                                        referenced object inside the same namespace.
                                      properties:
                                        name:
                                          default: ""
                                          description: |-
                                            Name of the referent.
                                            This field is effectively required, but due to backwards compatibility is
                                            allowed to be empty. Instances of this type with an empty value here are
                                            almost certainly wrong.
                                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                          type: string
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    type: array
                                    x-kubernetes-list-map-keys:
                                    - name
                                    x-kubernetes-list-type: map
                                  nodeSelector:
                                    additionalProperties:
                                      type: string
                                    description: |-
                                      NodeSelector is a selector which must be true for the pod to fit on a node.
                                      Selector which must match a node's labels for the pod to be scheduled on that node.
                                      More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
                                    type: object
                                  priorityClassName:
                                    description: If specified, the pod's priorityClassName.
                                    type: string
                                  resources:
                                    description: |-
                                      If specified, the pod's resource requirements.
                                      These values override the global resource configuration flags.
                                      Note that when only specifying resource limits, ensure they are greater than or equal
                                      to the corresponding global resource requests configured via controller flags
                                      (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
                                      Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
                                    properties:
                                      limits:
                                        additionalProperties:
                                          anyOf:
                                          - type: integer
                                          - type: string
                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                          x-kubernetes-int-or-string: true
                                        description: |-
                                          Limits describes the maximum amount of compute resources allowed.
                                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                        type: object
                                      requests:
                                        additionalProperties:
                                          anyOf:
                                          - type: integer
                                          - type: string
                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                          x-kubernetes-int-or-string: true
                                        description: |-
                                          Requests describes the minimum amount of compute resources required.
                                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                                          otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
                                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                        type: object
                                    type: object
                                  securityContext:
                                    description: If specified, the pod's security
                                      context
                                    properties:
                                      fsGroup:
                                        description: |-
                                          A special supplemental group that applies to all containers in a pod.
                                          Some volume types allow the Kubelet to change the ownership of that volume
                                          to be owned by the pod:

                                          1. The owning GID will be the FSGroup
                                          2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
                                          3. The permission bits are OR'd with rw-rw----

                                          If unset, the Kubelet will not modify the ownership and permissions of any volume.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        format: int64
                                        type: integer
                                      fsGroupChangePolicy:
                                        description: |-
                                          fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
                                          before being exposed inside Pod. This field will only apply to
                                          volume types which support fsGroup based ownership(and permissions).
                                          It will have no effect on ephemeral volume types such as: secret, configmaps
                                          and emptydir.
                                          Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        type: string
                                      runAsGroup:
                                        description: |-
                                          The GID to run the entrypoint of the container process.
                                          Uses runtime default if unset.
                                          May also be set in SecurityContext.  If set in both SecurityContext and
                                          PodSecurityContext, the value specified in SecurityContext takes precedence
                                          for that container.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        format: int64
                                        type: integer
                                      runAsNonRoot:
                                        description: |-
                                          Indicates that the container must run as a non-root user.
                                          If true, the Kubelet will validate the image at runtime to ensure that it
                                          does not run as UID 0 (root) and fail to start the container if it does.
                                          If unset or false, no such validation will be performed.
                                          May also be set in SecurityContext.  If set in both SecurityContext and
                                          PodSecurityContext, the value specified in SecurityContext takes precedence.
                                        type: boolean
                                      runAsUser:
                                        description: |-
                                          The UID to run the entrypoint of the container process.
                                          Defaults to user specified in image metadata if unspecified.
                                          May also be set in SecurityContext.  If set in both SecurityContext and
                                          PodSecurityContext, the value specified in SecurityContext takes precedence
                                          for that container.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        format: int64
                                        type: integer
                                      seLinuxOptions:
                                        description: |-
                                          The SELinux context to be applied to all containers.
                                          If unspecified, the container runtime will allocate a random SELinux context for each
                                          container.  May also be set in SecurityContext.  If set in
                                          both SecurityContext and PodSecurityContext, the value specified in SecurityContext
                                          takes precedence for that container.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        properties:
                                          level:
                                            description: Level is SELinux level label
                                              that applies to the container.
                                            type: string
                                          role:
                                            description: Role is a SELinux role label
                                              that applies to the container.
                                            type: string
                                          type:
                                            description: Type is a SELinux type label
                                              that applies to the container.
                                            type: string
                                          user:
                                            description: User is a SELinux user label
                                              that applies to the container.
                                            type: string
                                        type: object
                                      seccompProfile:
                                        description: |-
                                          The seccomp options to use by the containers in this pod.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        properties:
                                          localhostProfile:
                                            description: |-
                                              localhostProfile indicates a profile defined in a file on the node should be used.
                                              The profile must be preconfigured on the node to work.
                                              Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                              Must be set if type is "Localhost". Must NOT be set for any other type.
                                            type: string
                                          type:
                                            description: |-
                                              type indicates which kind of seccomp profile will be applied.
                                              Valid options are:

                                              Localhost - a profile defined in a file on the node should be used.
                                              RuntimeDefault - the container runtime default profile should be used.
                                              Unconfined - no profile should be applied.
                                            type: string
                                        required:
                                        - type
                                        type: object
                                      supplementalGroups:
                                        description: |-
                                          A list of groups applied to the first process run in each container, in addition
                                          to the container's primary GID, the fsGroup (if specified), and group memberships
                                          defined in the container image for the uid of the container process. If unspecified,
                                          no additional groups are added to any container. Note that group memberships
                                          defined in the container image for the uid of the container process are still effective,
                                          even if they are not included in this list.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        items:
                                          format: int64
                                          type: integer
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      sysctls:
                                        description: |-
                                          Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
                                          sysctls (by the container runtime) might fail to launch.
                                          Note that this field cannot be set when spec.os.name is windows.
                                        items:
                                          description: Sysctl defines a kernel parameter
                                            to be set
                                          properties:
                                            name:
                                              description: Name of a property to set
                                              type: string
                                            value:
                                              description: Value of a property to
                                                set
                                              type: string
                                          required:
                                          - name
                                          - value
                                          type: object
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    type: object
                                  serviceAccountName:
                                    description: If specified, the pod's service account
                                    type: string
                                  tolerations:
                                    description: If specified, the pod's tolerations.
                                    items:
                                      description: |-
                                        The pod this Toleration is attached to tolerates any taint that matches
                                        the triple <key,value,effect> using the matching operator <operator>.
                                      properties:
                                        effect:
                                          description: |-
                                            Effect indicates the taint effect to match. Empty means match all taint effects.
                                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                                          type: string
                                        key:
                                          description: |-
                                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
                                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                                          type: string
                                        operator:
                                          description: |-
                                            Operator represents a key's relationship to the value.
                                            Valid operators are Exists and Equal. Defaults to Equal.
                                            Exists is equivalent to wildcard for value, so that a pod can
                                            tolerate all taints of a particular category.
                                          type: string
                                        tolerationSeconds:
                                          description: |-
                                            TolerationSeconds represents the period of time the toleration (which must be
                                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
                                            it is not set, which means tolerate the taint forever (do not evict). Zero and
                                            negative values will be treated as 0 (evict immediately) by the system.
                                          format: int64
                                          type: integer
                                        value:
                                          description: |-
                                            Value is the taint value the toleration matches to.
                                            If the operator is Exists, the value should be empty, otherwise just a regular string.
                                          type: string
                                      type: object
                                    type: array
                                    x-kubernetes-list-type: atomic
                                type: object
                            type: object
                          serviceType:
                            description: |-
                              Optional service type for Kubernetes solver service. Supported values
                              are NodePort or ClusterIP. If unset, defaults to NodePort.
                            type: string
                        type: object
                    type: object
                  selector:
                    description: |-
                      Selector selects a set of DNSNames on the Certificate resource that
                      should be solved using this challenge solver.
                      If not specified, the solver will be treated as the 'default' solver
                      with the lowest priority, i.e. if any other solver has a more specific
                      match, it will be used instead.
                    properties:
                      dnsNames:
                        description: |-
                          List of DNSNames that this solver will be used to solve.
                          If specified and a match is found, a dnsNames selector will take
                          precedence over a dnsZones selector.
                          If multiple solvers match with the same dnsNames value, the solver
                          with the most matching labels in matchLabels will be selected.
                          If neither has more matches, the solver defined earlier in the list
                          will be selected.
                        items:
                          type: string
                        type: array
                        x-kubernetes-list-type: atomic
                      dnsZones:
                        description: |-
                          List of DNSZones that this solver will be used to solve.
                          The most specific DNS zone match specified here will take precedence
                          over other DNS zone matches, so a solver specifying sys.example.com
                          will be selected over one specifying example.com for the domain
                          www.sys.example.com.
                          If multiple solvers match with the same dnsZones value, the solver
                          with the most matching labels in matchLabels will be selected.
                          If neither has more matches, the solver defined earlier in the list
                          will be selected.
                        items:
                          type: string
                        type: array
                        x-kubernetes-list-type: atomic
                      matchLabels:
                        additionalProperties:
                          type: string
                        description: |-
                          A label selector that is used to refine the set of certificate's that
                          this challenge solver will apply to.
                        type: object
                    type: object
                type: object
              token:
                description: |-
                  The ACME challenge token for this challenge.
                  This is the raw value returned from the ACME server.
                type: string
              type:
                description: |-
                  The type of ACME challenge this resource represents.
                  One of "HTTP-01" or "DNS-01".
                enum:
                - HTTP-01
                - DNS-01
                type: string
              url:
                description: |-
                  The URL of the ACME Challenge resource for this challenge.
                  This can be used to lookup details about the status of this challenge.
                type: string
              wildcard:
                description: |-
                  wildcard will be true if this challenge is for a wildcard identifier,
                  for example '*.example.com'.
                type: boolean
            required:
            - authorizationURL
            - dnsName
            - issuerRef
            - key
            - solver
            - token
            - type
            - url
            type: object
          status:
            properties:
              presented:
                description: |-
                  presented will be set to true if the challenge values for this challenge
                  are currently 'presented'.
                  This *does not* imply the self check is passing. Only that the values
                  have been 'submitted' for the appropriate challenge mechanism (i.e. the
                  DNS01 TXT record has been presented, or the HTTP01 configuration has been
                  configured).
                type: boolean
              processing:
                description: |-
                  Used to denote whether this challenge should be processed or not.
                  This field will only be set to true by the 'scheduling' component.
                  It will only be set to false by the 'challenges' controller, after the
                  challenge has reached a final state or timed out.
                  If this field is set to false, the challenge controller will not take
                  any more action.
                type: boolean
              reason:
                description: |-
                  Contains human readable information on why the Challenge is in the
                  current state.
                type: string
              state:
                description: |-
                  Contains the current 'state' of the challenge.
                  If not set, the state of the challenge is unknown.
                enum:
                - valid
                - ready
                - pending
                - processing
                - invalid
                - expired
                - errored
                type: string
            type: object
        required:
        - metadata
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    helm.sh/resource-policy: keep
  labels:
    app: cert-manager
    app.kubernetes.io/component: crds
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: clusterissuers.cert-manager.io
spec:
  group: cert-manager.io
  names:
    categories:
    - cert-manager
    kind: ClusterIssuer
    listKind: ClusterIssuerList
    plural: clusterissuers
    shortNames:
    - ciss
    singular: clusterissuer
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.conditions[?(@.type == "Ready")].status
      name: Ready
      type: string
    - jsonPath: .status.conditions[?(@.type == "Ready")].message
      name: Status
      priority: 1
      type: string
    - description: CreationTimestamp is a timestamp representing the server time when
        this object was created. It is not guaranteed to be set in happens-before
        order across separate operations. Clients may not set this value. It is represented
        in RFC3339 form and is in UTC.
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1
    schema:
      openAPIV3Schema:
        description: |-
          A ClusterIssuer represents a certificate issuing authority which can be
          referenced as part of `issuerRef` fields.
          It is similar to an Issuer, however it is cluster-scoped and therefore can
          be referenced by resources that exist in *any* namespace, not just the same
          namespace as the referent.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Desired state of the ClusterIssuer resource.
            properties:
              acme:
                description: |-
                  ACME configures this issuer to communicate with a RFC8555 (ACME) server
                  to obtain signed x509 certificates.
                properties:
                  caBundle:
                    description: |-
                      Base64-encoded bundle of PEM CAs which can be used to validate the certificate
                      chain presented by the ACME server.
                      Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
                      kinds of security vulnerabilities.
                      If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
                      the container is used to validate the TLS connection.
                    format: byte
                    type: string
                  disableAccountKeyGeneration:
                    description: |-
                      Enables or disables generating a new ACME account key.
                      If true, the Issuer resource will *not* request a new account but will expect
                      the account key to be supplied via an existing secret.
                      If false, the cert-manager system will generate a new ACME account key
                      for the Issuer.
                      Defaults to false.
                    type: boolean
                  email:
                    description: |-
                      Email is the email address to be associated with the ACME account.
                      This field is optional, but it is strongly recommended to be set.
                      It will be used to contact you in case of issues with your account or
                      certificates, including expiry notification emails.
                      This field may be updated after the account is initially registered.
                    type: string
                  enableDurationFeature:
                    description: |-
                      Enables requesting a Not After date on certificates that matches the
                      duration of the certificate. This is not supported by all ACME servers
                      like Let's Encrypt. If set to true when the ACME server does not support
                      it, it will create an error on the Order.
                      Defaults to false.
                    type: boolean
                  externalAccountBinding:
                    description: |-
                      ExternalAccountBinding is a reference to a CA external account of the ACME
                      server.
                      If set, upon registration cert-manager will attempt to associate the given
                      external account credentials with the registered ACME account.
                    properties:
                      keyAlgorithm:
                        description: |-
                          Deprecated: keyAlgorithm field exists for historical compatibility
                          reasons and should not be used. The algorithm is now hardcoded to HS256
                          in golang/x/crypto/acme.
                        enum:
                        - HS256
                        - HS384
                        - HS512
                        type: string
                      keyID:
                        description: keyID is the ID of the CA key that the External
                          Account is bound to.
                        type: string
                      keySecretRef:
                        description: |-
                          keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
                          Secret which holds the symmetric MAC key of the External Account Binding.
                          The `key` is the index string that is paired with the key data in the
                          Secret and should not be confused with the key data itself, or indeed with
                          the External Account Binding keyID above.
                          The secret key stored in the Secret **must** be un-padded, base64 URL
                          encoded data.
                        properties:
                          key:
                            description: |-
                              The key of the entry in the Secret resource's `data` field to be used.
                              Some instances of this field may be defaulted, in others it may be
                              required.
                            type: string
                          name:
                            description: |-
                              Name of the resource being referred to.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        required:
                        - name
                        type: object
                    required:
                    - keyID
                    - keySecretRef
                    type: object
                  preferredChain:
                    description: |-
                      PreferredChain is the chain to use if the ACME server outputs multiple.
                      PreferredChain is no guarantee that this one gets delivered by the ACME
                      endpoint.
                      For example, for Let's Encrypt's DST cross-sign you would use:
                      "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
                      This value picks the first certificate bundle in the combined set of
                      ACME default and alternative chains that has a root-most certificate with
                      this value as its issuer's commonname.
                    maxLength: 64
                    type: string
                  privateKeySecretRef:
                    description: |-
                      PrivateKey is the name of a Kubernetes Secret resource that will be used to
                      store the automatically generated ACME account private key.
                      Optionally, a `key` may be specified to select a specific entry within
                      the named Secret resource.
                      If `key` is not specified, a default of `tls.key` will be used.
                    properties:
                      key:
                        description: |-
                          The key of the entry in the Secret resource's `data` field to be used.
                          Some instances of this field may be defaulted, in others it may be
                          required.
                        type: string
                      name:
                        description: |-
                          Name of the resource being referred to.
                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                        type: string
                    required:
                    - name
                    type: object
                  profile:
                    description: |-
                      Profile allows requesting a certificate profile from the ACME server.
                      Supported profiles are listed by the server's ACME directory URL.
                    type: string
                  server:
                    description: |-
                      Server is the URL used to access the ACME server's 'directory' endpoint.
                      For example, for Let's Encrypt's staging endpoint, you would use:
                      "https://acme-staging-v02.api.letsencrypt.org/directory".
                      Only ACME v2 endpoints (i.e. RFC 8555) are supported.
                    type: string
                  skipTLSVerify:
                    description: |-
                      INSECURE: Enables or disables validation of the ACME server TLS certificate.
                      If true, requests to the ACME server will not have the TLS certificate chain
                      validated.
                      Mutually exclusive with CABundle; prefer using CABundle to prevent various
                      kinds of security vulnerabilities.
                      Only enable this option in development environments.
                      If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
                      the container is used to validate the TLS connection.
                      Defaults to false.
                    type: boolean
                  solvers:
                    description: |-
                      Solvers is a list of challenge solvers that will be used to solve
                      ACME challenges for the matching domains.
                      Solver configurations must be provided in order to obtain certificates
                      from an ACME server.
                      For more information, see: https://cert-manager.io/docs/configuration/acme/
                    items:
                      description: |-
                        An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
                        A selector may be provided to use different solving strategies for different DNS names.
                        Only one of HTTP01 or DNS01 must be provided.
                      properties:
                        dns01:
                          description: |-
                            Configures cert-manager to attempt to complete authorizations by
                            performing the DNS01 challenge flow.
                          properties:
                            acmeDNS:
                              description: |-
                                Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
                                DNS01 challenge records.
                              properties:
                                accountSecretRef:
                                  description: |-
                                    A reference to a specific 'key' within a Secret resource.
                                    In some instances, `key` is a required field.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                host:
                                  type: string
                              required:
                              - accountSecretRef
                              - host
                              type: object
                            akamai:
                              description: Use the Akamai DNS zone management API
                                to manage DNS01 challenge records.
                              properties:
                                accessTokenSecretRef:
                                  description: |-
                                    A reference to a specific 'key' within a Secret resource.
                                    In some instances, `key` is a required field.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                clientSecretSecretRef:
                                  description: |-
                                    A reference to a specific 'key' within a Secret resource.
                                    In some instances, `key` is a required field.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                clientTokenSecretRef:
                                  description: |-
                                    A reference to a specific 'key' within a Secret resource.
                                    In some instances, `key` is a required field.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                serviceConsumerDomain:
                                  type: string
                              required:
                              - accessTokenSecretRef
                              - clientSecretSecretRef
                              - clientTokenSecretRef
                              - serviceConsumerDomain
                              type: object
                            azureDNS:
                              description: Use the Microsoft Azure DNS API to manage
                                DNS01 challenge records.
                              properties:
                                clientID:
                                  description: |-
                                    Auth: Azure Service Principal:
                                    The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
                                    If set, ClientSecret and TenantID must also be set.
                                  type: string
                                clientSecretSecretRef:
                                  description: |-
                                    Auth: Azure Service Principal:
                                    A reference to a Secret containing the password associated with the Service Principal.
                                    If set, ClientID and TenantID must also be set.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                environment:
                                  description: name of the Azure environment (default
                                    AzurePublicCloud)
                                  enum:
                                  - AzurePublicCloud
                                  - AzureChinaCloud
                                  - AzureGermanCloud
                                  - AzureUSGovernmentCloud
                                  type: string
                                hostedZoneName:
                                  description: name of the DNS zone that should be
                                    used
                                  type: string
                                managedIdentity:
                                  description: |-
                                    Auth: Azure Workload Identity or Azure Managed Service Identity:
                                    Settings to enable Azure Workload Identity or Azure Managed Service Identity
                                    If set, ClientID, ClientSecret and TenantID must not be set.
                                  properties:
                                    clientID:
                                      description: client ID of the managed identity,
                                        cannot be used at the same time as resourceID
                                      type: string
                                    resourceID:
                                      description: |-
                                        resource ID of the managed identity, cannot be used at the same time as clientID
                                        Cannot be used for Azure Managed Service Identity
                                      type: string
                                    tenantID:
                                      description: tenant ID of the managed identity,
                                        cannot be used at the same time as resourceID
                                      type: string
                                  type: object
                                resourceGroupName:
                                  description: resource group the DNS zone is located
                                    in
                                  type: string
                                subscriptionID:
                                  description: ID of the Azure subscription
                                  type: string
                                tenantID:
                                  description: |-
                                    Auth: Azure Service Principal:
                                    The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
                                    If set, ClientID and ClientSecret must also be set.
                                  type: string
                              required:
                              - resourceGroupName
                              - subscriptionID
                              type: object
                            cloudDNS:
                              description: Use the Google Cloud DNS API to manage
                                DNS01 challenge records.
                              properties:
                                hostedZoneName:
                                  description: |-
                                    HostedZoneName is an optional field that tells cert-manager in which
                                    Cloud DNS zone the challenge record has to be created.
                                    If left empty cert-manager will automatically choose a zone.
                                  type: string
                                project:
                                  type: string
                                serviceAccountSecretRef:
                                  description: |-
                                    A reference to a specific 'key' within a Secret resource.
                                    In some instances, `key` is a required field.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                              required:
                              - project
                              type: object
                            cloudflare:
                              description: Use the Cloudflare API to manage DNS01
                                challenge records.
                              properties:
                                apiKeySecretRef:
                                  description: |-
                                    API key to use to authenticate with Cloudflare.
                                    Note: using an API token to authenticate is now the recommended method
                                    as it allows greater control of permissions.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                apiTokenSecretRef:
                                  description: API token used to authenticate with
                                    Cloudflare.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                email:
                                  description: Email of the account, only required
                                    when using API key based authentication.
                                  type: string
                              type: object
                            cnameStrategy:
                              description: |-
                                CNAMEStrategy configures how the DNS01 provider should handle CNAME
                                records when found in DNS zones.
                              enum:
                              - None
                              - Follow
                              type: string
                            digitalocean:
                              description: Use the DigitalOcean DNS API to manage
                                DNS01 challenge records.
                              properties:
                                tokenSecretRef:
                                  description: |-
                                    A reference to a specific 'key' within a Secret resource.
                                    In some instances, `key` is a required field.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                              required:
                              - tokenSecretRef
                              type: object
                            rfc2136:
                              description: |-
                                Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
                                to manage DNS01 challenge records.
                              properties:
                                nameserver:
                                  description: |-
                                    The IP address or hostname of an authoritative DNS server supporting
                                    RFC2136 in the form host:port. If the host is an IPv6 address it must be
                                    enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
                                    This field is required.
                                  type: string
                                protocol:
                                  description: Protocol to use for dynamic DNS update
                                    queries. Valid values are (case-sensitive) ``TCP``
                                    and ``UDP``; ``UDP`` (default).
                                  enum:
                                  - TCP
                                  - UDP
                                  type: string
                                tsigAlgorithm:
                                  description: |-
                                    The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
                                    when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
                                    Supported values are (case-insensitive): ``HMACMD5`` (default),
                                    ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
                                  type: string
                                tsigKeyName:
                                  description: |-
                                    The TSIG Key name configured in the DNS.
                                    If ``tsigSecretSecretRef`` is defined, this field is required.
                                  type: string
                                tsigSecretSecretRef:
                                  description: |-
                                    The name of the secret containing the TSIG value.
                                    If ``tsigKeyName`` is defined, this field is required.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                              required:
                              - nameserver
                              type: object
                            route53:
                              description: Use the AWS Route53 API to manage DNS01
                                challenge records.
                              properties:
                                accessKeyID:
                                  description: |-
                                    The AccessKeyID is used for authentication.
                                    Cannot be set when SecretAccessKeyID is set.
                                    If neither the Access Key nor Key ID are set, we fall-back to using env
                                    vars, shared credentials file or AWS Instance metadata,
                                    see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                                  type: string
                                accessKeyIDSecretRef:
                                  description: |-
                                    The SecretAccessKey is used for authentication. If set, pull the AWS
                                    access key ID from a key within a Kubernetes Secret.
                                    Cannot be set when AccessKeyID is set.
                                    If neither the Access Key nor Key ID are set, we fall-back to using env
                                    vars, shared credentials file or AWS Instance metadata,
                                    see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                auth:
                                  description: Auth configures how cert-manager authenticates.
                                  properties:
                                    kubernetes:
                                      description: |-
                                        Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
                                        by passing a bound ServiceAccount token.
                                      properties:
                                        serviceAccountRef:
                                          description: |-
                                            A reference to a service account that will be used to request a bound
                                            token (also known as "projected token"). To use this field, you must
                                            configure an RBAC rule to let cert-manager request a token.
                                          properties:
                                            audiences:
                                              description: |-
                                                TokenAudiences is an optional list of audiences to include in the
                                                token passed to AWS. The default token consisting of the issuer's namespace
                                                and name is always included.
                                                If unset the audience defaults to `sts.amazonaws.com`.
                                              items:
                                                type: string
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            name:
                                              description: Name of the ServiceAccount
                                                used to request a token.
                                              type: string
                                          required:
                                          - name
                                          type: object
                                      required:
                                      - serviceAccountRef
                                      type: object
                                  required:
                                  - kubernetes
                                  type: object
                                hostedZoneID:
                                  description: If set, the provider will manage only
                                    this zone in Route53 and will not do a lookup
                                    using the route53:ListHostedZonesByName api call.
                                  type: string
                                region:
                                  description: |-
                                    Override the AWS region.

                                    Route53 is a global service and does not have regional endpoints but the
                                    region specified here (or via environment variables) is used as a hint to
                                    help compute the correct AWS credential scope and partition when it
                                    connects to Route53. See:
                                    - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
                                    - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)

                                    If you omit this region field, cert-manager will use the region from
                                    AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
                                    in the cert-manager controller Pod.

                                    The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
                                    Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
                                    [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
                                    In this case this `region` field value is ignored.

                                    The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
                                    Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
                                    [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
                                    In this case this `region` field value is ignored.
                                  type: string
                                role:
                                  description: |-
                                    Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
                                    or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
                                  type: string
                                secretAccessKeySecretRef:
                                  description: |-
                                    The SecretAccessKey is used for authentication.
                                    If neither the Access Key nor Key ID are set, we fall-back to using env
                                    vars, shared credentials file or AWS Instance metadata,
                                    see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                              type: object
                            webhook:
                              description: |-
                                Configure an external webhook based DNS01 challenge solver to manage
                                DNS01 challenge records.
                              properties:
                                config:
                                  description: |-
                                    Additional configuration that should be passed to the webhook apiserver
                                    when challenges are processed.
                                    This can contain arbitrary JSON data.
                                    Secret values should not be specified in this stanza.
                                    If secret values are needed (e.g., credentials for a DNS service), you
                                    should use a SecretKeySelector to reference a Secret resource.
                                    For details on the schema of this field, consult the webhook provider
                                    implementation's documentation.
                                  x-kubernetes-preserve-unknown-fields: true
                                groupName:
                                  description: |-
                                    The API group name that should be used when POSTing ChallengePayload
                                    resources to the webhook apiserver.
                                    This should be the same as the GroupName specified in the webhook
                                    provider implementation.
                                  type: string
                                solverName:
                                  description: |-
                                    The name of the solver to use, as defined in the webhook provider
                                    implementation.
                                    This will typically be the name of the provider, e.g., 'cloudflare'.
                                  type: string
                              required:
                              - groupName
                              - solverName
                              type: object
                          type: object
                        http01:
                          description: |-
                            Configures cert-manager to attempt to complete authorizations by
                            performing the HTTP01 challenge flow.
                            It is not possible to obtain certificates for wildcard domain names
                            (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
                          properties:
                            gatewayHTTPRoute:
                              description: |-
                                The Gateway API is a sig-network community API that models service networking
                                in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
                                create HTTPRoutes with the specified labels in the same namespace as the challenge.
                                This solver is experimental, and fields / behaviour may change in the future.
                              properties:
                                labels:
                                  additionalProperties:
                                    type: string
                                  description: |-
                                    Custom labels that will be applied to HTTPRoutes created by cert-manager
                                    while solving HTTP-01 challenges.
                                  type: object
                                parentRefs:
                                  description: |-
                                    When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
                                    cert-manager needs to know which parentRefs should be used when creating
                                    the HTTPRoute. Usually, the parentRef references a Gateway. See:
                                    https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
                                  items:
                                    description: |-
                                      ParentReference identifies an API object (usually a Gateway) that can be considered
                                      a parent of this resource (usually a route). There are two kinds of parent resources
                                      with "Core" support:

                                      * Gateway (Gateway conformance profile)
                                      * Service (Mesh conformance profile, ClusterIP Services only)

                                      This API may be extended in the future to support additional kinds of parent
                                      resources.

                                      The API object must be valid in the cluster; the Group and Kind must
                                      be registered in the cluster for this reference to be valid.
                                    properties:
                                      group:
                                        default: gateway.networking.k8s.io
                                        description: |-
                                          Group is the group of the referent.
                                          When unspecified, "gateway.networking.k8s.io" is inferred.
                                          To set the core API group (such as for a "Service" kind referent),
                                          Group must be explicitly set to "" (empty string).

                                          Support: Core
                                        maxLength: 253
                                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                        type: string
                                      kind:
                                        default: Gateway
                                        description: |-
                                          Kind is kind of the referent.

                                          There are two kinds of parent resources with "Core" support:

                                          * Gateway (Gateway conformance profile)
                                          * Service (Mesh conformance profile, ClusterIP Services only)

                                          Support for other resources is Implementation-Specific.
                                        maxLength: 63
                                        minLength: 1
                                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                                        type: string
                                      name:
                                        description: |-
                                          Name is the name of the referent.

                                          Support: Core
                                        maxLength: 253
                                        minLength: 1
                                        type: string
                                      namespace:
                                        description: |-
                                          Namespace is the namespace of the referent. When unspecified, this refers
                                          to the local namespace of the Route.

                                          Note that there are specific rules for ParentRefs which cross namespace
                                          boundaries. Cross-namespace references are only valid if they are explicitly
                                          allowed by something in the namespace they are referring to. For example:
                                          Gateway has the AllowedRoutes field, and ReferenceGrant provides a
                                          generic way to enable any other kind of cross-namespace reference.

                                          <gateway:experimental:description>
                                          ParentRefs from a Route to a Service in the same namespace are "producer"
                                          routes, which apply default routing rules to inbound connections from
                                          any namespace to the Service.

                                          ParentRefs from a Route to a Service in a different namespace are
                                          "consumer" routes, and these routing rules are only applied to outbound
                                          connections originating from the same namespace as the Route, for which
                                          the intended destination of the connections are a Service targeted as a
                                          ParentRef of the Route.
                                          </gateway:experimental:description>

                                          Support: Core
                                        maxLength: 63
                                        minLength: 1
                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                                        type: string
                                      port:
                                        description: |-
                                          Port is the network port this Route targets. It can be interpreted
                                          differently based on the type of parent resource.

                                          When the parent resource is a Gateway, this targets all listeners
                                          listening on the specified port that also support this kind of Route(and
                                          select this Route). It's not recommended to set `Port` unless the
                                          networking behaviors specified in a Route must apply to a specific port
                                          as opposed to a listener(s) whose port(s) may be changed. When both Port
                                          and SectionName are specified, the name and port of the selected listener
                                          must match both specified values.

                                          <gateway:experimental:description>
                                          When the parent resource is a Service, this targets a specific port in the
                                          Service spec. When both Port (experimental) and SectionName are specified,
                                          the name and port of the selected port must match both specified values.
                                          </gateway:experimental:description>

                                          Implementations MAY choose to support other parent resources.
                                          Implementations supporting other types of parent resources MUST clearly
                                          document how/if Port is interpreted.

                                          For the purpose of status, an attachment is considered successful as
                                          long as the parent resource accepts it partially. For example, Gateway
                                          listeners can restrict which Routes can attach to them by Route kind,
                                          namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
                                          from the referencing Route, the Route MUST be considered successfully
                                          attached. If no Gateway listeners accept attachment from this Route,
                                          the Route MUST be considered detached from the Gateway.

                                          Support: Extended
                                        format: int32
                                        maximum: 65535
                                        minimum: 1
                                        type: integer
                                      sectionName:
                                        description: |-
                                          SectionName is the name of a section within the target resource. In the
                                          following resources, SectionName is interpreted as the following:

                                          * Gateway: Listener name. When both Port (experimental) and SectionName
                                          are specified, the name and port of the selected listener must match
                                          both specified values.
                                          * Service: Port name. When both Port (experimental) and SectionName
                                          are specified, the name and port of the selected listener must match
                                          both specified values.

                                          Implementations MAY choose to support attaching Routes to other resources.
                                          If that is the case, they MUST clearly document how SectionName is
                                          interpreted.

                                          When unspecified (empty string), this will reference the entire resource.
                                          For the purpose of status, an attachment is considered successful if at
                                          least one section in the parent resource accepts it. For example, Gateway
                                          listeners can restrict which Routes can attach to them by Route kind,
                                          namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
                                          the referencing Route, the Route MUST be considered successfully
                                          attached. If no Gateway listeners accept attachment from this Route, the
                                          Route MUST be considered detached from the Gateway.

                                          Support: Core
                                        maxLength: 253
                                        minLength: 1
                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                        type: string
                                    required:
                                    - name
                                    type: object
                                  type: array
                                  x-kubernetes-list-type: atomic
                                podTemplate:
                                  description: |-
                                    Optional pod template used to configure the ACME challenge solver pods
                                    used for HTTP01 challenges.
                                  properties:
                                    metadata:
                                      description: |-
                                        ObjectMeta overrides for the pod used to solve HTTP01 challenges.
                                        Only the 'labels' and 'annotations' fields may be set.
                                        If labels or annotations overlap with in-built values, the values here
                                        will override the in-built values.
                                      properties:
                                        annotations:
                                          additionalProperties:
                                            type: string
                                          description: Annotations that should be
                                            added to the created ACME HTTP01 solver
                                            pods.
                                          type: object
                                        labels:
                                          additionalProperties:
                                            type: string
                                          description: Labels that should be added
                                            to the created ACME HTTP01 solver pods.
                                          type: object
                                      type: object
                                    spec:
                                      description: |-
                                        PodSpec defines overrides for the HTTP01 challenge solver pod.
                                        Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
                                        All other fields will be ignored.
                                      properties:
                                        affinity:
                                          description: If specified, the pod's scheduling
                                            constraints
                                          properties:
                                            nodeAffinity:
                                              description: Describes node affinity
                                                scheduling rules for the pod.
                                              properties:
                                                preferredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    The scheduler will prefer to schedule pods to nodes that satisfy
                                                    the affinity expressions specified by this field, but it may choose
                                                    a node that violates one or more of the expressions. The node that is
                                                    most preferred is the one with the greatest sum of weights, i.e.
                                                    for each node that meets all of the scheduling requirements (resource
                                                    request, requiredDuringScheduling affinity expressions, etc.),
                                                    compute a sum by iterating through the elements of this field and adding
                                                    "weight" to the sum if the node matches the corresponding matchExpressions; the
                                                    node(s) with the highest sum are the most preferred.
                                                  items:
                                                    description: |-
                                                      An empty preferred scheduling term matches all objects with implicit weight 0
                                                      (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
                                                    properties:
                                                      preference:
                                                        description: A node selector
                                                          term, associated with the
                                                          corresponding weight.
                                                        properties:
                                                          matchExpressions:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's labels.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchFields:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's fields.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      weight:
                                                        description: Weight associated
                                                          with matching the corresponding
                                                          nodeSelectorTerm, in the
                                                          range 1-100.
                                                        format: int32
                                                        type: integer
                                                    required:
                                                    - preference
                                                    - weight
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                requiredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    If the affinity requirements specified by this field are not met at
                                                    scheduling time, the pod will not be scheduled onto the node.
                                                    If the affinity requirements specified by this field cease to be met
                                                    at some point during pod execution (e.g. due to an update), the system
                                                    may or may not try to eventually evict the pod from its node.
                                                  properties:
                                                    nodeSelectorTerms:
                                                      description: Required. A list
                                                        of node selector terms. The
                                                        terms are ORed.
                                                      items:
                                                        description: |-
                                                          A null or empty node selector term matches no objects. The requirements of
                                                          them are ANDed.
                                                          The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
                                                        properties:
                                                          matchExpressions:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's labels.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchFields:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's fields.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                  required:
                                                  - nodeSelectorTerms
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                              type: object
                                            podAffinity:
                                              description: Describes pod affinity
                                                scheduling rules (e.g. co-locate this
                                                pod in the same node, zone, etc. as
                                                some other pod(s)).
                                              properties:
                                                preferredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    The scheduler will prefer to schedule pods to nodes that satisfy
                                                    the affinity expressions specified by this field, but it may choose
                                                    a node that violates one or more of the expressions. The node that is
                                                    most preferred is the one with the greatest sum of weights, i.e.
                                                    for each node that meets all of the scheduling requirements (resource
                                                    request, requiredDuringScheduling affinity expressions, etc.),
                                                    compute a sum by iterating through the elements of this field and adding
                                                    "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                                    node(s) with the highest sum are the most preferred.
                                                  items:
                                                    description: The weights of all
                                                      of the matched WeightedPodAffinityTerm
                                                      fields are added per-node to
                                                      find the most preferred node(s)
                                                    properties:
                                                      podAffinityTerm:
                                                        description: Required. A pod
                                                          affinity term, associated
                                                          with the corresponding weight.
                                                        properties:
                                                          labelSelector:
                                                            description: |-
                                                              A label query over a set of resources, in this case pods.
                                                              If it's null, this PodAffinityTerm matches with no Pods.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          matchLabelKeys:
                                                            description: |-
                                                              MatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                              Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          mismatchLabelKeys:
                                                            description: |-
                                                              MismatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                              Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          namespaceSelector:
                                                            description: |-
                                                              A label query over the set of namespaces that the term applies to.
                                                              The term is applied to the union of the namespaces selected by this field
                                                              and the ones listed in the namespaces field.
                                                              null selector and null or empty namespaces list means "this pod's namespace".
                                                              An empty selector ({}) matches all namespaces.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          namespaces:
                                                            description: |-
                                                              namespaces specifies a static list of namespace names that the term applies to.
                                                              The term is applied to the union of the namespaces listed in this field
                                                              and the ones selected by namespaceSelector.
                                                              null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          topologyKey:
                                                            description: |-
                                                              This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                              the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                              whose value of the label with key topologyKey matches that of any node on which any of the
                                                              selected pods is running.
                                                              Empty topologyKey is not allowed.
                                                            type: string
                                                        required:
                                                        - topologyKey
                                                        type: object
                                                      weight:
                                                        description: |-
                                                          weight associated with matching the corresponding podAffinityTerm,
                                                          in the range 1-100.
                                                        format: int32
                                                        type: integer
                                                    required:
                                                    - podAffinityTerm
                                                    - weight
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                requiredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    If the affinity requirements specified by this field are not met at
                                                    scheduling time, the pod will not be scheduled onto the node.
                                                    If the affinity requirements specified by this field cease to be met
                                                    at some point during pod execution (e.g. due to a pod label update), the
                                                    system may or may not try to eventually evict the pod from its node.
                                                    When there are multiple elements, the lists of nodes corresponding to each
                                                    podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                                  items:
                                                    description: |-
                                                      Defines a set of pods (namely those matching the labelSelector
                                                      relative to the given namespace(s)) that this pod should be
                                                      co-located (affinity) or not co-located (anti-affinity) with,
                                                      where co-located is defined as running on a node whose value of
                                                      the label with key <topologyKey> matches that of any node on which
                                                      a pod of the set of pods is running
                                                    properties:
                                                      labelSelector:
                                                        description: |-
                                                          A label query over a set of resources, in this case pods.
                                                          If it's null, this PodAffinityTerm matches with no Pods.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      matchLabelKeys:
                                                        description: |-
                                                          MatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      mismatchLabelKeys:
                                                        description: |-
                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      namespaceSelector:
                                                        description: |-
                                                          A label query over the set of namespaces that the term applies to.
                                                          The term is applied to the union of the namespaces selected by this field
                                                          and the ones listed in the namespaces field.
                                                          null selector and null or empty namespaces list means "this pod's namespace".
                                                          An empty selector ({}) matches all namespaces.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      namespaces:
                                                        description: |-
                                                          namespaces specifies a static list of namespace names that the term applies to.
                                                          The term is applied to the union of the namespaces listed in this field
                                                          and the ones selected by namespaceSelector.
                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      topologyKey:
                                                        description: |-
                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                          whose value of the label with key topologyKey matches that of any node on which any of the
                                                          selected pods is running.
                                                          Empty topologyKey is not allowed.
                                                        type: string
                                                    required:
                                                    - topologyKey
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              type: object
                                            podAntiAffinity:
                                              description: Describes pod anti-affinity
                                                scheduling rules (e.g. avoid putting
                                                this pod in the same node, zone, etc.
                                                as some other pod(s)).
                                              properties:
                                                preferredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    The scheduler will prefer to schedule pods to nodes that satisfy
                                                    the anti-affinity expressions specified by this field, but it may choose
                                                    a node that violates one or more of the expressions. The node that is
                                                    most preferred is the one with the greatest sum of weights, i.e.
                                                    for each node that meets all of the scheduling requirements (resource
                                                    request, requiredDuringScheduling anti-affinity expressions, etc.),
                                                    compute a sum by iterating through the elements of this field and subtracting
                                                    "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                                    node(s) with the highest sum are the most preferred.
                                                  items:
                                                    description: The weights of all
                                                      of the matched WeightedPodAffinityTerm
                                                      fields are added per-node to
                                                      find the most preferred node(s)
                                                    properties:
                                                      podAffinityTerm:
                                                        description: Required. A pod
                                                          affinity term, associated
                                                          with the corresponding weight.
                                                        properties:
                                                          labelSelector:
                                                            description: |-
                                                              A label query over a set of resources, in this case pods.
                                                              If it's null, this PodAffinityTerm matches with no Pods.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          matchLabelKeys:
                                                            description: |-
                                                              MatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                              Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          mismatchLabelKeys:
                                                            description: |-
                                                              MismatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                              Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          namespaceSelector:
                                                            description: |-
                                                              A label query over the set of namespaces that the term applies to.
                                                              The term is applied to the union of the namespaces selected by this field
                                                              and the ones listed in the namespaces field.
                                                              null selector and null or empty namespaces list means "this pod's namespace".
                                                              An empty selector ({}) matches all namespaces.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          namespaces:
                                                            description: |-
                                                              namespaces specifies a static list of namespace names that the term applies to.
                                                              The term is applied to the union of the namespaces listed in this field
                                                              and the ones selected by namespaceSelector.
                                                              null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          topologyKey:
                                                            description: |-
                                                              This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                              the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                              whose value of the label with key topologyKey matches that of any node on which any of the
                                                              selected pods is running.
                                                              Empty topologyKey is not allowed.
                                                            type: string
                                                        required:
                                                        - topologyKey
                                                        type: object
                                                      weight:
                                                        description: |-
                                                          weight associated with matching the corresponding podAffinityTerm,
                                                          in the range 1-100.
                                                        format: int32
                                                        type: integer
                                                    required:
                                                    - podAffinityTerm
                                                    - weight
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                requiredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    If the anti-affinity requirements specified by this field are not met at
                                                    scheduling time, the pod will not be scheduled onto the node.
                                                    If the anti-affinity requirements specified by this field cease to be met
                                                    at some point during pod execution (e.g. due to a pod label update), the
                                                    system may or may not try to eventually evict the pod from its node.
                                                    When there are multiple elements, the lists of nodes corresponding to each
                                                    podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                                  items:
                                                    description: |-
                                                      Defines a set of pods (namely those matching the labelSelector
                                                      relative to the given namespace(s)) that this pod should be
                                                      co-located (affinity) or not co-located (anti-affinity) with,
                                                      where co-located is defined as running on a node whose value of
                                                      the label with key <topologyKey> matches that of any node on which
                                                      a pod of the set of pods is running
                                                    properties:
                                                      labelSelector:
                                                        description: |-
                                                          A label query over a set of resources, in this case pods.
                                                          If it's null, this PodAffinityTerm matches with no Pods.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      matchLabelKeys:
                                                        description: |-
                                                          MatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      mismatchLabelKeys:
                                                        description: |-
                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      namespaceSelector:
                                                        description: |-
                                                          A label query over the set of namespaces that the term applies to.
                                                          The term is applied to the union of the namespaces selected by this field
                                                          and the ones listed in the namespaces field.
                                                          null selector and null or empty namespaces list means "this pod's namespace".
                                                          An empty selector ({}) matches all namespaces.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      namespaces:
                                                        description: |-
                                                          namespaces specifies a static list of namespace names that the term applies to.
                                                          The term is applied to the union of the namespaces listed in this field
                                                          and the ones selected by namespaceSelector.
                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      topologyKey:
                                                        description: |-
                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                          whose value of the label with key topologyKey matches that of any node on which any of the
                                                          selected pods is running.
                                                          Empty topologyKey is not allowed.
                                                        type: string
                                                    required:
                                                    - topologyKey
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              type: object
                                          type: object
                                        imagePullSecrets:
                                          description: If specified, the pod's imagePullSecrets
                                          items:
                                            description: |-
                                              LocalObjectReference contains enough information to let you locate the
                                              referenced object inside the same namespace.
                                            properties:
                                              name:
                                                default: ""
                                                description: |-
                                                  Name of the referent.
                                                  This field is effectively required, but due to backwards compatibility is
                                                  allowed to be empty. Instances of this type with an empty value here are
                                                  almost certainly wrong.
                                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                                type: string
                                            type: object
                                            x-kubernetes-map-type: atomic
                                          type: array
                                          x-kubernetes-list-map-keys:
                                          - name
                                          x-kubernetes-list-type: map
                                        nodeSelector:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            NodeSelector is a selector which must be true for the pod to fit on a node.
                                            Selector which must match a node's labels for the pod to be scheduled on that node.
                                            More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
                                          type: object
                                        priorityClassName:
                                          description: If specified, the pod's priorityClassName.
                                          type: string
                                        resources:
                                          description: |-
                                            If specified, the pod's resource requirements.
                                            These values override the global resource configuration flags.
                                            Note that when only specifying resource limits, ensure they are greater than or equal
                                            to the corresponding global resource requests configured via controller flags
                                            (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
                                            Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
                                          properties:
                                            limits:
                                              additionalProperties:
                                                anyOf:
                                                - type: integer
                                                - type: string
                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                                x-kubernetes-int-or-string: true
                                              description: |-
                                                Limits describes the maximum amount of compute resources allowed.
                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                              type: object
                                            requests:
                                              additionalProperties:
                                                anyOf:
                                                - type: integer
                                                - type: string
                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                                x-kubernetes-int-or-string: true
                                              description: |-
                                                Requests describes the minimum amount of compute resources required.
                                                If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                                                otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                              type: object
                                          type: object
                                        securityContext:
                                          description: If specified, the pod's security
                                            context
                                          properties:
                                            fsGroup:
                                              description: |-
                                                A special supplemental group that applies to all containers in a pod.
                                                Some volume types allow the Kubelet to change the ownership of that volume
                                                to be owned by the pod:

                                                1. The owning GID will be the FSGroup
                                                2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
                                                3. The permission bits are OR'd with rw-rw----

                                                If unset, the Kubelet will not modify the ownership and permissions of any volume.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              format: int64
                                              type: integer
                                            fsGroupChangePolicy:
                                              description: |-
                                                fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
                                                before being exposed inside Pod. This field will only apply to
                                                volume types which support fsGroup based ownership(and permissions).
                                                It will have no effect on ephemeral volume types such as: secret, configmaps
                                                and emptydir.
                                                Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              type: string
                                            runAsGroup:
                                              description: |-
                                                The GID to run the entrypoint of the container process.
                                                Uses runtime default if unset.
                                                May also be set in SecurityContext.  If set in both SecurityContext and
                                                PodSecurityContext, the value specified in SecurityContext takes precedence
                                                for that container.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              format: int64
                                              type: integer
                                            runAsNonRoot:
                                              description: |-
                                                Indicates that the container must run as a non-root user.
                                                If true, the Kubelet will validate the image at runtime to ensure that it
                                                does not run as UID 0 (root) and fail to start the container if it does.
                                                If unset or false, no such validation will be performed.
                                                May also be set in SecurityContext.  If set in both SecurityContext and
                                                PodSecurityContext, the value specified in SecurityContext takes precedence.
                                              type: boolean
                                            runAsUser:
                                              description: |-
                                                The UID to run the entrypoint of the container process.
                                                Defaults to user specified in image metadata if unspecified.
                                                May also be set in SecurityContext.  If set in both SecurityContext and
                                                PodSecurityContext, the value specified in SecurityContext takes precedence
                                                for that container.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              format: int64
                                              type: integer
                                            seLinuxOptions:
                                              description: |-
                                                The SELinux context to be applied to all containers.
                                                If unspecified, the container runtime will allocate a random SELinux context for each
                                                container.  May also be set in SecurityContext.  If set in
                                                both SecurityContext and PodSecurityContext, the value specified in SecurityContext
                                                takes precedence for that container.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              properties:
                                                level:
                                                  description: Level is SELinux level
                                                    label that applies to the container.
                                                  type: string
                                                role:
                                                  description: Role is a SELinux role
                                                    label that applies to the container.
                                                  type: string
                                                type:
                                                  description: Type is a SELinux type
                                                    label that applies to the container.
                                                  type: string
                                                user:
                                                  description: User is a SELinux user
                                                    label that applies to the container.
                                                  type: string
                                              type: object
                                            seccompProfile:
                                              description: |-
                                                The seccomp options to use by the containers in this pod.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              properties:
                                                localhostProfile:
                                                  description: |-
                                                    localhostProfile indicates a profile defined in a file on the node should be used.
                                                    The profile must be preconfigured on the node to work.
                                                    Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                                    Must be set if type is "Localhost". Must NOT be set for any other type.
                                                  type: string
                                                type:
                                                  description: |-
                                                    type indicates which kind of seccomp profile will be applied.
                                                    Valid options are:

                                                    Localhost - a profile defined in a file on the node should be used.
                                                    RuntimeDefault - the container runtime default profile should be used.
                                                    Unconfined - no profile should be applied.
                                                  type: string
                                              required:
                                              - type
                                              type: object
                                            supplementalGroups:
                                              description: |-
                                                A list of groups applied to the first process run in each container, in addition
                                                to the container's primary GID, the fsGroup (if specified), and group memberships
                                                defined in the container image for the uid of the container process. If unspecified,
                                                no additional groups are added to any container. Note that group memberships
                                                defined in the container image for the uid of the container process are still effective,
                                                even if they are not included in this list.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              items:
                                                format: int64
                                                type: integer
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            sysctls:
                                              description: |-
                                                Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
                                                sysctls (by the container runtime) might fail to launch.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              items:
                                                description: Sysctl defines a kernel
                                                  parameter to be set
                                                properties:
                                                  name:
                                                    description: Name of a property
                                                      to set
                                                    type: string
                                                  value:
                                                    description: Value of a property
                                                      to set
                                                    type: string
                                                required:
                                                - name
                                                - value
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                          type: object
                                        serviceAccountName:
                                          description: If specified, the pod's service
                                            account
                                          type: string
                                        tolerations:
                                          description: If specified, the pod's tolerations.
                                          items:
                                            description: |-
                                              The pod this Toleration is attached to tolerates any taint that matches
                                              the triple <key,value,effect> using the matching operator <operator>.
                                            properties:
                                              effect:
                                                description: |-
                                                  Effect indicates the taint effect to match. Empty means match all taint effects.
                                                  When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                                                type: string
                                              key:
                                                description: |-
                                                  Key is the taint key that the toleration applies to. Empty means match all taint keys.
                                                  If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                                                type: string
                                              operator:
                                                description: |-
                                                  Operator represents a key's relationship to the value.
                                                  Valid operators are Exists and Equal. Defaults to Equal.
                                                  Exists is equivalent to wildcard for value, so that a pod can
                                                  tolerate all taints of a particular category.
                                                type: string
                                              tolerationSeconds:
                                                description: |-
                                                  TolerationSeconds represents the period of time the toleration (which must be
                                                  of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
                                                  it is not set, which means tolerate the taint forever (do not evict). Zero and
                                                  negative values will be treated as 0 (evict immediately) by the system.
                                                format: int64
                                                type: integer
                                              value:
                                                description: |-
                                                  Value is the taint value the toleration matches to.
                                                  If the operator is Exists, the value should be empty, otherwise just a regular string.
                                                type: string
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      type: object
                                  type: object
                                serviceType:
                                  description: |-
                                    Optional service type for Kubernetes solver service. Supported values
                                    are NodePort or ClusterIP. If unset, defaults to NodePort.
                                  type: string
                              type: object
                            ingress:
                              description: |-
                                The ingress based HTTP01 challenge solver will solve challenges by
                                creating or modifying Ingress resources in order to route requests for
                                '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
                                provisioned by cert-manager for each Challenge to be completed.
                              properties:
                                class:
                                  description: |-
                                    This field configures the annotation `kubernetes.io/ingress.class` when
                                    creating Ingress resources to solve ACME challenges that use this
                                    challenge solver. Only one of `class`, `name` or `ingressClassName` may
                                    be specified.
                                  type: string
                                ingressClassName:
                                  description: |-
                                    This field configures the field `ingressClassName` on the created Ingress
                                    resources used to solve ACME challenges that use this challenge solver.
                                    This is the recommended way of configuring the ingress class. Only one of
                                    `class`, `name` or `ingressClassName` may be specified.
                                  type: string
                                ingressTemplate:
                                  description: |-
                                    Optional ingress template used to configure the ACME challenge solver
                                    ingress used for HTTP01 challenges.
                                  properties:
                                    metadata:
                                      description: |-
                                        ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
                                        Only the 'labels' and 'annotations' fields may be set.
                                        If labels or annotations overlap with in-built values, the values here
                                        will override the in-built values.
                                      properties:
                                        annotations:
                                          additionalProperties:
                                            type: string
                                          description: Annotations that should be
                                            added to the created ACME HTTP01 solver
                                            ingress.
                                          type: object
                                        labels:
                                          additionalProperties:
                                            type: string
                                          description: Labels that should be added
                                            to the created ACME HTTP01 solver ingress.
                                          type: object
                                      type: object
                                  type: object
                                name:
                                  description: |-
                                    The name of the ingress resource that should have ACME challenge solving
                                    routes inserted into it in order to solve HTTP01 challenges.
                                    This is typically used in conjunction with ingress controllers like
                                    ingress-gce, which maintains a 1:1 mapping between external IPs and
                                    ingress resources. Only one of `class`, `name` or `ingressClassName` may
                                    be specified.
                                  type: string
                                podTemplate:
                                  description: |-
                                    Optional pod template used to configure the ACME challenge solver pods
                                    used for HTTP01 challenges.
                                  properties:
                                    metadata:
                                      description: |-
                                        ObjectMeta overrides for the pod used to solve HTTP01 challenges.
                                        Only the 'labels' and 'annotations' fields may be set.
                                        If labels or annotations overlap with in-built values, the values here
                                        will override the in-built values.
                                      properties:
                                        annotations:
                                          additionalProperties:
                                            type: string
                                          description: Annotations that should be
                                            added to the created ACME HTTP01 solver
                                            pods.
                                          type: object
                                        labels:
                                          additionalProperties:
                                            type: string
                                          description: Labels that should be added
                                            to the created ACME HTTP01 solver pods.
                                          type: object
                                      type: object
                                    spec:
                                      description: |-
                                        PodSpec defines overrides for the HTTP01 challenge solver pod.
                                        Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
                                        All other fields will be ignored.
                                      properties:
                                        affinity:
                                          description: If specified, the pod's scheduling
                                            constraints
                                          properties:
                                            nodeAffinity:
                                              description: Describes node affinity
                                                scheduling rules for the pod.
                                              properties:
                                                preferredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    The scheduler will prefer to schedule pods to nodes that satisfy
                                                    the affinity expressions specified by this field, but it may choose
                                                    a node that violates one or more of the expressions. The node that is
                                                    most preferred is the one with the greatest sum of weights, i.e.
                                                    for each node that meets all of the scheduling requirements (resource
                                                    request, requiredDuringScheduling affinity expressions, etc.),
                                                    compute a sum by iterating through the elements of this field and adding
                                                    "weight" to the sum if the node matches the corresponding matchExpressions; the
                                                    node(s) with the highest sum are the most preferred.
                                                  items:
                                                    description: |-
                                                      An empty preferred scheduling term matches all objects with implicit weight 0
                                                      (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
                                                    properties:
                                                      preference:
                                                        description: A node selector
                                                          term, associated with the
                                                          corresponding weight.
                                                        properties:
                                                          matchExpressions:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's labels.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchFields:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's fields.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      weight:
                                                        description: Weight associated
                                                          with matching the corresponding
                                                          nodeSelectorTerm, in the
                                                          range 1-100.
                                                        format: int32
                                                        type: integer
                                                    required:
                                                    - preference
                                                    - weight
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                requiredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    If the affinity requirements specified by this field are not met at
                                                    scheduling time, the pod will not be scheduled onto the node.
                                                    If the affinity requirements specified by this field cease to be met
                                                    at some point during pod execution (e.g. due to an update), the system
                                                    may or may not try to eventually evict the pod from its node.
                                                  properties:
                                                    nodeSelectorTerms:
                                                      description: Required. A list
                                                        of node selector terms. The
                                                        terms are ORed.
                                                      items:
                                                        description: |-
                                                          A null or empty node selector term matches no objects. The requirements of
                                                          them are ANDed.
                                                          The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
                                                        properties:
                                                          matchExpressions:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's labels.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchFields:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's fields.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                  required:
                                                  - nodeSelectorTerms
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                              type: object
                                            podAffinity:
                                              description: Describes pod affinity
                                                scheduling rules (e.g. co-locate this
                                                pod in the same node, zone, etc. as
                                                some other pod(s)).
                                              properties:
                                                preferredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    The scheduler will prefer to schedule pods to nodes that satisfy
                                                    the affinity expressions specified by this field, but it may choose
                                                    a node that violates one or more of the expressions. The node that is
                                                    most preferred is the one with the greatest sum of weights, i.e.
                                                    for each node that meets all of the scheduling requirements (resource
                                                    request, requiredDuringScheduling affinity expressions, etc.),
                                                    compute a sum by iterating through the elements of this field and adding
                                                    "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                                    node(s) with the highest sum are the most preferred.
                                                  items:
                                                    description: The weights of all
                                                      of the matched WeightedPodAffinityTerm
                                                      fields are added per-node to
                                                      find the most preferred node(s)
                                                    properties:
                                                      podAffinityTerm:
                                                        description: Required. A pod
                                                          affinity term, associated
                                                          with the corresponding weight.
                                                        properties:
                                                          labelSelector:
                                                            description: |-
                                                              A label query over a set of resources, in this case pods.
                                                              If it's null, this PodAffinityTerm matches with no Pods.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          matchLabelKeys:
                                                            description: |-
                                                              MatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                              Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          mismatchLabelKeys:
                                                            description: |-
                                                              MismatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                              Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          namespaceSelector:
                                                            description: |-
                                                              A label query over the set of namespaces that the term applies to.
                                                              The term is applied to the union of the namespaces selected by this field
                                                              and the ones listed in the namespaces field.
                                                              null selector and null or empty namespaces list means "this pod's namespace".
                                                              An empty selector ({}) matches all namespaces.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          namespaces:
                                                            description: |-
                                                              namespaces specifies a static list of namespace names that the term applies to.
                                                              The term is applied to the union of the namespaces listed in this field
                                                              and the ones selected by namespaceSelector.
                                                              null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          topologyKey:
                                                            description: |-
                                                              This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                              the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                              whose value of the label with key topologyKey matches that of any node on which any of the
                                                              selected pods is running.
                                                              Empty topologyKey is not allowed.
                                                            type: string
                                                        required:
                                                        - topologyKey
                                                        type: object
                                                      weight:
                                                        description: |-
                                                          weight associated with matching the corresponding podAffinityTerm,
                                                          in the range 1-100.
                                                        format: int32
                                                        type: integer
                                                    required:
                                                    - podAffinityTerm
                                                    - weight
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                requiredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    If the affinity requirements specified by this field are not met at
                                                    scheduling time, the pod will not be scheduled onto the node.
                                                    If the affinity requirements specified by this field cease to be met
                                                    at some point during pod execution (e.g. due to a pod label update), the
                                                    system may or may not try to eventually evict the pod from its node.
                                                    When there are multiple elements, the lists of nodes corresponding to each
                                                    podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                                  items:
                                                    description: |-
                                                      Defines a set of pods (namely those matching the labelSelector
                                                      relative to the given namespace(s)) that this pod should be
                                                      co-located (affinity) or not co-located (anti-affinity) with,
                                                      where co-located is defined as running on a node whose value of
                                                      the label with key <topologyKey> matches that of any node on which
                                                      a pod of the set of pods is running
                                                    properties:
                                                      labelSelector:
                                                        description: |-
                                                          A label query over a set of resources, in this case pods.
                                                          If it's null, this PodAffinityTerm matches with no Pods.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      matchLabelKeys:
                                                        description: |-
                                                          MatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      mismatchLabelKeys:
                                                        description: |-
                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      namespaceSelector:
                                                        description: |-
                                                          A label query over the set of namespaces that the term applies to.
                                                          The term is applied to the union of the namespaces selected by this field
                                                          and the ones listed in the namespaces field.
                                                          null selector and null or empty namespaces list means "this pod's namespace".
                                                          An empty selector ({}) matches all namespaces.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      namespaces:
                                                        description: |-
                                                          namespaces specifies a static list of namespace names that the term applies to.
                                                          The term is applied to the union of the namespaces listed in this field
                                                          and the ones selected by namespaceSelector.
                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      topologyKey:
                                                        description: |-
                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                          whose value of the label with key topologyKey matches that of any node on which any of the
                                                          selected pods is running.
                                                          Empty topologyKey is not allowed.
                                                        type: string
                                                    required:
                                                    - topologyKey
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              type: object
                                            podAntiAffinity:
                                              description: Describes pod anti-affinity
                                                scheduling rules (e.g. avoid putting
                                                this pod in the same node, zone, etc.
                                                as some other pod(s)).
                                              properties:
                                                preferredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    The scheduler will prefer to schedule pods to nodes that satisfy
                                                    the anti-affinity expressions specified by this field, but it may choose
                                                    a node that violates one or more of the expressions. The node that is
                                                    most preferred is the one with the greatest sum of weights, i.e.
                                                    for each node that meets all of the scheduling requirements (resource
                                                    request, requiredDuringScheduling anti-affinity expressions, etc.),
                                                    compute a sum by iterating through the elements of this field and subtracting
                                                    "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                                    node(s) with the highest sum are the most preferred.
                                                  items:
                                                    description: The weights of all
                                                      of the matched WeightedPodAffinityTerm
                                                      fields are added per-node to
                                                      find the most preferred node(s)
                                                    properties:
                                                      podAffinityTerm:
                                                        description: Required. A pod
                                                          affinity term, associated
                                                          with the corresponding weight.
                                                        properties:
                                                          labelSelector:
                                                            description: |-
                                                              A label query over a set of resources, in this case pods.
                                                              If it's null, this PodAffinityTerm matches with no Pods.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          matchLabelKeys:
                                                            description: |-
                                                              MatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                              Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          mismatchLabelKeys:
                                                            description: |-
                                                              MismatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                              Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          namespaceSelector:
                                                            description: |-
                                                              A label query over the set of namespaces that the term applies to.
                                                              The term is applied to the union of the namespaces selected by this field
                                                              and the ones listed in the namespaces field.
                                                              null selector and null or empty namespaces list means "this pod's namespace".
                                                              An empty selector ({}) matches all namespaces.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          namespaces:
                                                            description: |-
                                                              namespaces specifies a static list of namespace names that the term applies to.
                                                              The term is applied to the union of the namespaces listed in this field
                                                              and the ones selected by namespaceSelector.
                                                              null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          topologyKey:
                                                            description: |-
                                                              This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                              the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                              whose value of the label with key topologyKey matches that of any node on which any of the
                                                              selected pods is running.
                                                              Empty topologyKey is not allowed.
                                                            type: string
                                                        required:
                                                        - topologyKey
                                                        type: object
                                                      weight:
                                                        description: |-
                                                          weight associated with matching the corresponding podAffinityTerm,
                                                          in the range 1-100.
                                                        format: int32
                                                        type: integer
                                                    required:
                                                    - podAffinityTerm
                                                    - weight
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                requiredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    If the anti-affinity requirements specified by this field are not met at
                                                    scheduling time, the pod will not be scheduled onto the node.
                                                    If the anti-affinity requirements specified by this field cease to be met
                                                    at some point during pod execution (e.g. due to a pod label update), the
                                                    system may or may not try to eventually evict the pod from its node.
                                                    When there are multiple elements, the lists of nodes corresponding to each
                                                    podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                                  items:
                                                    description: |-
                                                      Defines a set of pods (namely those matching the labelSelector
                                                      relative to the given namespace(s)) that this pod should be
                                                      co-located (affinity) or not co-located (anti-affinity) with,
                                                      where co-located is defined as running on a node whose value of
                                                      the label with key <topologyKey> matches that of any node on which
                                                      a pod of the set of pods is running
                                                    properties:
                                                      labelSelector:
                                                        description: |-
                                                          A label query over a set of resources, in this case pods.
                                                          If it's null, this PodAffinityTerm matches with no Pods.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      matchLabelKeys:
                                                        description: |-
                                                          MatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      mismatchLabelKeys:
                                                        description: |-
                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      namespaceSelector:
                                                        description: |-
                                                          A label query over the set of namespaces that the term applies to.
                                                          The term is applied to the union of the namespaces selected by this field
                                                          and the ones listed in the namespaces field.
                                                          null selector and null or empty namespaces list means "this pod's namespace".
                                                          An empty selector ({}) matches all namespaces.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      namespaces:
                                                        description: |-
                                                          namespaces specifies a static list of namespace names that the term applies to.
                                                          The term is applied to the union of the namespaces listed in this field
                                                          and the ones selected by namespaceSelector.
                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      topologyKey:
                                                        description: |-
                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                          whose value of the label with key topologyKey matches that of any node on which any of the
                                                          selected pods is running.
                                                          Empty topologyKey is not allowed.
                                                        type: string
                                                    required:
                                                    - topologyKey
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              type: object
                                          type: object
                                        imagePullSecrets:
                                          description: If specified, the pod's imagePullSecrets
                                          items:
                                            description: |-
                                              LocalObjectReference contains enough information to let you locate the
                                              referenced object inside the same namespace.
                                            properties:
                                              name:
                                                default: ""
                                                description: |-
                                                  Name of the referent.
                                                  This field is effectively required, but due to backwards compatibility is
                                                  allowed to be empty. Instances of this type with an empty value here are
                                                  almost certainly wrong.
                                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                                type: string
                                            type: object
                                            x-kubernetes-map-type: atomic
                                          type: array
                                          x-kubernetes-list-map-keys:
                                          - name
                                          x-kubernetes-list-type: map
                                        nodeSelector:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            NodeSelector is a selector which must be true for the pod to fit on a node.
                                            Selector which must match a node's labels for the pod to be scheduled on that node.
                                            More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
                                          type: object
                                        priorityClassName:
                                          description: If specified, the pod's priorityClassName.
                                          type: string
                                        resources:
                                          description: |-
                                            If specified, the pod's resource requirements.
                                            These values override the global resource configuration flags.
                                            Note that when only specifying resource limits, ensure they are greater than or equal
                                            to the corresponding global resource requests configured via controller flags
                                            (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
                                            Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
                                          properties:
                                            limits:
                                              additionalProperties:
                                                anyOf:
                                                - type: integer
                                                - type: string
                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                                x-kubernetes-int-or-string: true
                                              description: |-
                                                Limits describes the maximum amount of compute resources allowed.
                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                              type: object
                                            requests:
                                              additionalProperties:
                                                anyOf:
                                                - type: integer
                                                - type: string
                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                                x-kubernetes-int-or-string: true
                                              description: |-
                                                Requests describes the minimum amount of compute resources required.
                                                If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                                                otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                              type: object
                                          type: object
                                        securityContext:
                                          description: If specified, the pod's security
                                            context
                                          properties:
                                            fsGroup:
                                              description: |-
                                                A special supplemental group that applies to all containers in a pod.
                                                Some volume types allow the Kubelet to change the ownership of that volume
                                                to be owned by the pod:

                                                1. The owning GID will be the FSGroup
                                                2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
                                                3. The permission bits are OR'd with rw-rw----

                                                If unset, the Kubelet will not modify the ownership and permissions of any volume.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              format: int64
                                              type: integer
                                            fsGroupChangePolicy:
                                              description: |-
                                                fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
                                                before being exposed inside Pod. This field will only apply to
                                                volume types which support fsGroup based ownership(and permissions).
                                                It will have no effect on ephemeral volume types such as: secret, configmaps
                                                and emptydir.
                                                Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              type: string
                                            runAsGroup:
                                              description: |-
                                                The GID to run the entrypoint of the container process.
                                                Uses runtime default if unset.
                                                May also be set in SecurityContext.  If set in both SecurityContext and
                                                PodSecurityContext, the value specified in SecurityContext takes precedence
                                                for that container.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              format: int64
                                              type: integer
                                            runAsNonRoot:
                                              description: |-
                                                Indicates that the container must run as a non-root user.
                                                If true, the Kubelet will validate the image at runtime to ensure that it
                                                does not run as UID 0 (root) and fail to start the container if it does.
                                                If unset or false, no such validation will be performed.
                                                May also be set in SecurityContext.  If set in both SecurityContext and
                                                PodSecurityContext, the value specified in SecurityContext takes precedence.
                                              type: boolean
                                            runAsUser:
                                              description: |-
                                                The UID to run the entrypoint of the container process.
                                                Defaults to user specified in image metadata if unspecified.
                                                May also be set in SecurityContext.  If set in both SecurityContext and
                                                PodSecurityContext, the value specified in SecurityContext takes precedence
                                                for that container.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              format: int64
                                              type: integer
                                            seLinuxOptions:
                                              description: |-
                                                The SELinux context to be applied to all containers.
                                                If unspecified, the container runtime will allocate a random SELinux context for each
                                                container.  May also be set in SecurityContext.  If set in
                                                both SecurityContext and PodSecurityContext, the value specified in SecurityContext
                                                takes precedence for that container.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              properties:
                                                level:
                                                  description: Level is SELinux level
                                                    label that applies to the container.
                                                  type: string
                                                role:
                                                  description: Role is a SELinux role
                                                    label that applies to the container.
                                                  type: string
                                                type:
                                                  description: Type is a SELinux type
                                                    label that applies to the container.
                                                  type: string
                                                user:
                                                  description: User is a SELinux user
                                                    label that applies to the container.
                                                  type: string
                                              type: object
                                            seccompProfile:
                                              description: |-
                                                The seccomp options to use by the containers in this pod.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              properties:
                                                localhostProfile:
                                                  description: |-
                                                    localhostProfile indicates a profile defined in a file on the node should be used.
                                                    The profile must be preconfigured on the node to work.
                                                    Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                                    Must be set if type is "Localhost". Must NOT be set for any other type.
                                                  type: string
                                                type:
                                                  description: |-
                                                    type indicates which kind of seccomp profile will be applied.
                                                    Valid options are:

                                                    Localhost - a profile defined in a file on the node should be used.
                                                    RuntimeDefault - the container runtime default profile should be used.
                                                    Unconfined - no profile should be applied.
                                                  type: string
                                              required:
                                              - type
                                              type: object
                                            supplementalGroups:
                                              description: |-
                                                A list of groups applied to the first process run in each container, in addition
                                                to the container's primary GID, the fsGroup (if specified), and group memberships
                                                defined in the container image for the uid of the container process. If unspecified,
                                                no additional groups are added to any container. Note that group memberships
                                                defined in the container image for the uid of the container process are still effective,
                                                even if they are not included in this list.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              items:
                                                format: int64
                                                type: integer
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            sysctls:
                                              description: |-
                                                Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
                                                sysctls (by the container runtime) might fail to launch.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              items:
                                                description: Sysctl defines a kernel
                                                  parameter to be set
                                                properties:
                                                  name:
                                                    description: Name of a property
                                                      to set
                                                    type: string
                                                  value:
                                                    description: Value of a property
                                                      to set
                                                    type: string
                                                required:
                                                - name
                                                - value
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                          type: object
                                        serviceAccountName:
                                          description: If specified, the pod's service
                                            account
                                          type: string
                                        tolerations:
                                          description: If specified, the pod's tolerations.
                                          items:
                                            description: |-
                                              The pod this Toleration is attached to tolerates any taint that matches
                                              the triple <key,value,effect> using the matching operator <operator>.
                                            properties:
                                              effect:
                                                description: |-
                                                  Effect indicates the taint effect to match. Empty means match all taint effects.
                                                  When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                                                type: string
                                              key:
                                                description: |-
                                                  Key is the taint key that the toleration applies to. Empty means match all taint keys.
                                                  If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                                                type: string
                                              operator:
                                                description: |-
                                                  Operator represents a key's relationship to the value.
                                                  Valid operators are Exists and Equal. Defaults to Equal.
                                                  Exists is equivalent to wildcard for value, so that a pod can
                                                  tolerate all taints of a particular category.
                                                type: string
                                              tolerationSeconds:
                                                description: |-
                                                  TolerationSeconds represents the period of time the toleration (which must be
                                                  of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
                                                  it is not set, which means tolerate the taint forever (do not evict). Zero and
                                                  negative values will be treated as 0 (evict immediately) by the system.
                                                format: int64
                                                type: integer
                                              value:
                                                description: |-
                                                  Value is the taint value the toleration matches to.
                                                  If the operator is Exists, the value should be empty, otherwise just a regular string.
                                                type: string
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      type: object
                                  type: object
                                serviceType:
                                  description: |-
                                    Optional service type for Kubernetes solver service. Supported values
                                    are NodePort or ClusterIP. If unset, defaults to NodePort.
                                  type: string
                              type: object
                          type: object
                        selector:
                          description: |-
                            Selector selects a set of DNSNames on the Certificate resource that
                            should be solved using this challenge solver.
                            If not specified, the solver will be treated as the 'default' solver
                            with the lowest priority, i.e. if any other solver has a more specific
                            match, it will be used instead.
                          properties:
                            dnsNames:
                              description: |-
                                List of DNSNames that this solver will be used to solve.
                                If specified and a match is found, a dnsNames selector will take
                                precedence over a dnsZones selector.
                                If multiple solvers match with the same dnsNames value, the solver
                                with the most matching labels in matchLabels will be selected.
                                If neither has more matches, the solver defined earlier in the list
                                will be selected.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                            dnsZones:
                              description: |-
                                List of DNSZones that this solver will be used to solve.
                                The most specific DNS zone match specified here will take precedence
                                over other DNS zone matches, so a solver specifying sys.example.com
                                will be selected over one specifying example.com for the domain
                                www.sys.example.com.
                                If multiple solvers match with the same dnsZones value, the solver
                                with the most matching labels in matchLabels will be selected.
                                If neither has more matches, the solver defined earlier in the list
                                will be selected.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                            matchLabels:
                              additionalProperties:
                                type: string
                              description: |-
                                A label selector that is used to refine the set of certificate's that
                                this challenge solver will apply to.
                              type: object
                          type: object
                      type: object
                    type: array
                    x-kubernetes-list-type: atomic
                required:
                - privateKeySecretRef
                - server
                type: object
              ca:
                description: |-
                  CA configures this issuer to sign certificates using a signing CA keypair
                  stored in a Secret resource.
                  This is used to build internal PKIs that are managed by cert-manager.
                properties:
                  crlDistributionPoints:
                    description: |-
                      The CRL distribution points is an X.509 v3 certificate extension which identifies
                      the location of the CRL from which the revocation of this certificate can be checked.
                      If not set, certificates will be issued without distribution points set.
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                  issuingCertificateURLs:
                    description: |-
                      IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
                      it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
                      As an example, such a URL might be "http://ca.domain.com/ca.crt".
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                  ocspServers:
                    description: |-
                      The OCSP server list is an X.509 v3 extension that defines a list of
                      URLs of OCSP responders. The OCSP responders can be queried for the
                      revocation status of an issued certificate. If not set, the
                      certificate will be issued with no OCSP servers set. For example, an
                      OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                  secretName:
                    description: |-
                      SecretName is the name of the secret used to sign Certificates issued
                      by this Issuer.
                    type: string
                required:
                - secretName
                type: object
              selfSigned:
                description: |-
                  SelfSigned configures this issuer to 'self sign' certificates using the
                  private key used to create the CertificateRequest object.
                properties:
                  crlDistributionPoints:
                    description: |-
                      The CRL distribution points is an X.509 v3 certificate extension which identifies
                      the location of the CRL from which the revocation of this certificate can be checked.
                      If not set certificate will be issued without CDP. Values are strings.
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                type: object
              vault:
                description: |-
                  Vault configures this issuer to sign certificates using a HashiCorp Vault
                  PKI backend.
                properties:
                  auth:
                    description: Auth configures how cert-manager authenticates with
                      the Vault server.
                    properties:
                      appRole:
                        description: |-
                          AppRole authenticates with Vault using the App Role auth mechanism,
                          with the role and secret stored in a Kubernetes Secret resource.
                        properties:
                          path:
                            description: |-
                              Path where the App Role authentication backend is mounted in Vault, e.g:
                              "approle"
                            type: string
                          roleId:
                            description: |-
                              RoleID configured in the App Role authentication backend when setting
                              up the authentication backend in Vault.
                            type: string
                          secretRef:
                            description: |-
                              Reference to a key in a Secret that contains the App Role secret used
                              to authenticate with Vault.
                              The `key` field must be specified and denotes which entry within the Secret
                              resource is used as the app role secret.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                        required:
                        - path
                        - roleId
                        - secretRef
                        type: object
                      clientCertificate:
                        description: |-
                          ClientCertificate authenticates with Vault by presenting a client
                          certificate during the request's TLS handshake.
                          Works only when using HTTPS protocol.
                        properties:
                          mountPath:
                            description: |-
                              The Vault mountPath here is the mount path to use when authenticating with
                              Vault. For example, setting a value to `/v1/auth/foo`, will use the path
                              `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
                              default value "/v1/auth/cert" will be used.
                            type: string
                          name:
                            description: |-
                              Name of the certificate role to authenticate against.
                              If not set, matching any certificate role, if available.
                            type: string
                          secretName:
                            description: |-
                              Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
                              tls.crt and tls.key) used to authenticate to Vault using TLS client
                              authentication.
                            type: string
                        type: object
                      kubernetes:
                        description: |-
                          Kubernetes authenticates with Vault by passing the ServiceAccount
                          token stored in the named Secret resource to the Vault server.
                        properties:
                          mountPath:
                            description: |-
                              The Vault mountPath here is the mount path to use when authenticating with
                              Vault. For example, setting a value to `/v1/auth/foo`, will use the path
                              `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
                              default value "/v1/auth/kubernetes" will be used.
                            type: string
                          role:
                            description: |-
                              A required field containing the Vault Role to assume. A Role binds a
                              Kubernetes ServiceAccount with a set of Vault policies.
                            type: string
                          secretRef:
                            description: |-
                              The required Secret field containing a Kubernetes ServiceAccount JWT used
                              for authenticating with Vault. Use of 'ambient credentials' is not
                              supported.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                          serviceAccountRef:
                            description: |-
                              A reference to a service account that will be used to request a bound
                              token (also known as "projected token"). Compared to using "secretRef",
                              using this field means that you don't rely on statically bound tokens. To
                              use this field, you must configure an RBAC rule to let cert-manager
                              request a token.
                            properties:
                              audiences:
                                description: |-
                                  TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
                                  consisting of the issuer's namespace and name is always included.
                                items:
                                  type: string
                                type: array
                                x-kubernetes-list-type: atomic
                              name:
                                description: Name of the ServiceAccount used to request
                                  a token.
                                type: string
                            required:
                            - name
                            type: object
                        required:
                        - role
                        type: object
                      tokenSecretRef:
                        description: TokenSecretRef authenticates with Vault by presenting
                          a token.
                        properties:
                          key:
                            description: |-
                              The key of the entry in the Secret resource's `data` field to be used.
                              Some instances of this field may be defaulted, in others it may be
                              required.
                            type: string
                          name:
                            description: |-
                              Name of the resource being referred to.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        required:
                        - name
                        type: object
                    type: object
                  caBundle:
                    description: |-
                      Base64-encoded bundle of PEM CAs which will be used to validate the certificate
                      chain presented by Vault. Only used if using HTTPS to connect to Vault and
                      ignored for HTTP connections.
                      Mutually exclusive with CABundleSecretRef.
                      If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
                      the cert-manager controller container is used to validate the TLS connection.
                    format: byte
                    type: string
                  caBundleSecretRef:
                    description: |-
                      Reference to a Secret containing a bundle of PEM-encoded CAs to use when
                      verifying the certificate chain presented by Vault when using HTTPS.
                      Mutually exclusive with CABundle.
                      If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
                      the cert-manager controller container is used to validate the TLS connection.
                      If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
                    properties:
                      key:
                        description: |-
                          The key of the entry in the Secret resource's `data` field to be used.
                          Some instances of this field may be defaulted, in others it may be
                          required.
                        type: string
                      name:
                        description: |-
                          Name of the resource being referred to.
                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                        type: string
                    required:
                    - name
                    type: object
                  clientCertSecretRef:
                    description: |-
                      Reference to a Secret containing a PEM-encoded Client Certificate to use when the
                      Vault server requires mTLS.
                    properties:
                      key:
                        description: |-
                          The key of the entry in the Secret resource's `data` field to be used.
                          Some instances of this field may be defaulted, in others it may be
                          required.
                        type: string
                      name:
                        description: |-
                          Name of the resource being referred to.
                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                        type: string
                    required:
                    - name
                    type: object
                  clientKeySecretRef:
                    description: |-
                      Reference to a Secret containing a PEM-encoded Client Private Key to use when the
                      Vault server requires mTLS.
                    properties:
                      key:
                        description: |-
                          The key of the entry in the Secret resource's `data` field to be used.
                          Some instances of this field may be defaulted, in others it may be
                          required.
                        type: string
                      name:
                        description: |-
                          Name of the resource being referred to.
                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                        type: string
                    required:
                    - name
                    type: object
                  namespace:
                    description: |-
                      Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
                      More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
                    type: string
                  path:
                    description: |-
                      Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
                      "my_pki_mount/sign/my-role-name".
                    type: string
                  server:
                    description: 'Server is the connection address for the Vault server,
                      e.g: "https://vault.example.com:8200".'
                    type: string
                  serverName:
                    description: |-
                      ServerName is used to verify the hostname on the returned certificates
                      by the Vault server.
                    type: string
                required:
                - auth
                - path
                - server
                type: object
              venafi:
                description: |-
                  Venafi configures this issuer to sign certificates using a Venafi TPP
                  or Venafi Cloud policy zone.
                properties:
                  cloud:
                    description: |-
                      Cloud specifies the Venafi cloud configuration settings.
                      Only one of TPP or Cloud may be specified.
                    properties:
                      apiTokenSecretRef:
                        description: APITokenSecretRef is a secret key selector for
                          the Venafi Cloud API token.
                        properties:
                          key:
                            description: |-
                              The key of the entry in the Secret resource's `data` field to be used.
                              Some instances of this field may be defaulted, in others it may be
                              required.
                            type: string
                          name:
                            description: |-
                              Name of the resource being referred to.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        required:
                        - name
                        type: object
                      url:
                        description: |-
                          URL is the base URL for Venafi Cloud.
                          Defaults to "https://api.venafi.cloud/".
                        type: string
                    required:
                    - apiTokenSecretRef
                    type: object
                  tpp:
                    description: |-
                      TPP specifies Trust Protection Platform configuration settings.
                      Only one of TPP or Cloud may be specified.
                    properties:
                      caBundle:
                        description: |-
                          Base64-encoded bundle of PEM CAs which will be used to validate the certificate
                          chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
                          If undefined, the certificate bundle in the cert-manager controller container
                          is used to validate the chain.
                        format: byte
                        type: string
                      caBundleSecretRef:
                        description: |-
                          Reference to a Secret containing a base64-encoded bundle of PEM CAs
                          which will be used to validate the certificate chain presented by the TPP server.
                          Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
                          If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
                          the cert-manager controller container is used to validate the TLS connection.
                        properties:
                          key:
                            description: |-
                              The key of the entry in the Secret resource's `data` field to be used.
                              Some instances of this field may be defaulted, in others it may be
                              required.
                            type: string
                          name:
                            description: |-
                              Name of the resource being referred to.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        required:
                        - name
                        type: object
                      credentialsRef:
                        description: |-
                          CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
                          The secret must contain the key 'access-token' for the Access Token Authentication,
                          or two keys, 'username' and 'password' for the API Keys Authentication.
                        properties:
                          name:
                            description: |-
                              Name of the resource being referred to.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        required:
                        - name
                        type: object
                      url:
                        description: |-
                          URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
                          for example: "https://tpp.example.com/vedsdk".
                        type: string
                    required:
                    - credentialsRef
                    - url
                    type: object
                  zone:
                    description: |-
                      Zone is the Venafi Policy Zone to use for this issuer.
                      All requests made to the Venafi platform will be restricted by the named
                      zone policy.
                      This field is required.
                    type: string
                required:
                - zone
                type: object
            type: object
          status:
            description: Status of the ClusterIssuer. This is set and managed automatically.
            properties:
              acme:
                description: |-
                  ACME specific status options.
                  This field should only be set if the Issuer is configured to use an ACME
                  server to issue certificates.
                properties:
                  lastPrivateKeyHash:
                    description: |-
                      LastPrivateKeyHash is a hash of the private key associated with the latest
                      registered ACME account, in order to track changes made to registered account
                      associated with the Issuer
                    type: string
                  lastRegisteredEmail:
                    description: |-
                      LastRegisteredEmail is the email associated with the latest registered
                      ACME account, in order to track changes made to registered account
                      associated with the  Issuer
                    type: string
                  uri:
                    description: |-
                      URI is the unique account identifier, which can also be used to retrieve
                      account details from the CA
                    type: string
                type: object
              conditions:
                description: |-
                  List of status conditions to indicate the status of a CertificateRequest.
                  Known condition types are `Ready`.
                items:
                  description: IssuerCondition contains condition information for
                    an Issuer.
                  properties:
                    lastTransitionTime:
                      description: |-
                        LastTransitionTime is the timestamp corresponding to the last status
                        change of this condition.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        Message is a human readable description of the details of the last
                        transition, complementing reason.
                      type: string
                    observedGeneration:
                      description: |-
                        If set, this represents the .metadata.generation that the condition was
                        set based upon.
                        For instance, if .metadata.generation is currently 12, but the
                        .status.condition[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the Issuer.
                      format: int64
                      type: integer
                    reason:
                      description: |-
                        Reason is a brief machine readable explanation for the condition's last
                        transition.
                      type: string
                    status:
                      description: Status of the condition, one of (`True`, `False`,
                        `Unknown`).
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: Type of the condition, known values are (`Ready`).
                      type: string
                  required:
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: communities.metallb.io
spec:
  group: metallb.io
  names:
    kind: Community
    listKind: CommunityList
    plural: communities
    singular: community
  scope: Namespaced
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: |-
          Community is a collection of aliases for communities.
          Users can define named aliases to be used in the BGPPeer CRD.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: CommunitySpec defines the desired state of Community.
            properties:
              communities:
                items:
                  properties:
                    name:
                      description: The name of the alias for the community.
                      type: string
                    value:
                      description: |-
                        The BGP community value corresponding to the given name. Can be a standard community of the form 1234:1234
                        or a large community of the form large:1234:1234:1234.
                      type: string
                  type: object
                type: array
            type: object
          status:
            description: CommunityStatus defines the observed state of Community.
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: configurationstates.metallb.io
spec:
  group: metallb.io
  names:
    kind: ConfigurationState
    listKind: ConfigurationStateList
    plural: configurationstates
    singular: configurationstate
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.result
      name: Result
      type: string
    - jsonPath: .status.errorSummary
      name: ErrorSummary
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: |-
          ConfigurationState is a status-only CRD that reports configuration validation results from MetalLB components.
          Labels:
            - metallb.io/component-type: "controller" or "speaker"
            - metallb.io/node-name: node name (only for speaker)
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          status:
            description: ConfigurationStateStatus defines the observed state of ConfigurationState.
            properties:
              conditions:
                description: Conditions contains the status conditions from the reconcilers
                  running in this component.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
              errorSummary:
                description: |-
                  ErrorSummary contains the aggregated error messages from reconciliation failures.
                  This field is empty when Result is "Valid".
                type: string
              result:
                description: Result indicates the configuration validation result.
                enum:
                - Valid
                - Invalid
                - Unknown
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.17.0
  name: connectors.tailscale.com
spec:
  group: tailscale.com
  names:
    kind: Connector
    listKind: ConnectorList
    plural: connectors
    shortNames:
    - cn
    singular: connector
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - description: CIDR ranges exposed to tailnet by a subnet router defined via this
        Connector instance.
      jsonPath: .status.subnetRoutes
      name: SubnetRoutes
      type: string
    - description: Whether this Connector instance defines an exit node.
      jsonPath: .status.isExitNode
      name: IsExitNode
      type: string
    - description: Whether this Connector instance is an app connector.
      jsonPath: .status.isAppConnector
      name: IsAppConnector
      type: string
    - description: Status of the deployed Connector resources.
      jsonPath: .status.conditions[?(@.type == "ConnectorReady")].reason
      name: Status
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: |-
          Connector defines a Tailscale node that will be deployed in the cluster. The
          node can be configured to act as a Tailscale subnet router and/or a Tailscale
          exit node.
          Connector is a cluster-scoped resource.
          More info:
          https://tailscale.com/kb/1441/kubernetes-operator-connector
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: |-
              ConnectorSpec describes the desired Tailscale component.
              More info:
              https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
            properties:
              appConnector:
                description: |-
                  AppConnector defines whether the Connector device should act as a Tailscale app connector. A Connector that is
                  configured as an app connector cannot be a subnet router or an exit node. If this field is unset, the
                  Connector does not act as an app connector.
                  Note that you will need to manually configure the permissions and the domains for the app connector via the
                  Admin panel.
                  Note also that the main tested and supported use case of this config option is to deploy an app connector on
                  Kubernetes to access SaaS applications available on the public internet. Using the app connector to expose
                  cluster workloads or other internal workloads to tailnet might work, but this is not a use case that we have
                  tested or optimised for.
                  If you are using the app connector to access SaaS applications because you need a predictable egress IP that
                  can be whitelisted, it is also your responsibility to ensure that cluster traffic from the connector flows
                  via that predictable IP, for example by enforcing that cluster egress traffic is routed via an egress NAT
                  device with a static IP address.
                  https://tailscale.com/kb/1281/app-connectors
                properties:
                  routes:
                    description: |-
                      Routes are optional preconfigured routes for the domains routed via the app connector.
                      If not set, routes for the domains will be discovered dynamically.
                      If set, the app connector will immediately be able to route traffic using the preconfigured routes, but may
                      also dynamically discover other routes.
                      https://tailscale.com/kb/1332/apps-best-practices#preconfiguration
                    items:
                      format: cidr
                      type: string
                    minItems: 1
                    type: array
                type: object
              exitNode:
                description: |-
                  ExitNode defines whether the Connector device should act as a Tailscale exit node. Defaults to false.
                  This field is mutually exclusive with the appConnector field.
                  https://tailscale.com/kb/1103/exit-nodes
                type: boolean
              hostname:
                description: |-
                  Hostname is the tailnet hostname that should be assigned to the
                  Connector node. If unset, hostname defaults to <connector
                  name>-connector. Hostname can contain lower case letters, numbers and
                  dashes, it must not start or end with a dash and must be between 2
                  and 63 characters long. This field should only be used when creating a connector
                  with an unspecified number of replicas, or a single replica.
                pattern: ^[a-z0-9][a-z0-9-]{0,61}[a-z0-9]$
                type: string
              hostnamePrefix:
                description: |-
                  HostnamePrefix specifies the hostname prefix for each
                  replica. Each device will have the integer number
                  from its StatefulSet pod appended to this prefix to form the full hostname.
                  HostnamePrefix can contain lower case letters, numbers and dashes, it
                  must not start with a dash and must be between 1 and 62 characters long.
                pattern: ^[a-z0-9][a-z0-9-]{0,61}$
                type: string
              proxyClass:
                description: |-
                  ProxyClass is the name of the ProxyClass custom resource that
                  contains configuration options that should be applied to the
                  resources created for this Connector. If unset, the operator will
                  create resources with the default configuration.
                type: string
              replicas:
                description: |-
                  Replicas specifies how many devices to create. Set this to enable
                  high availability for app connectors, subnet routers, or exit nodes.
                  https://tailscale.com/kb/1115/high-availability. Defaults to 1.
                format: int32
                minimum: 0
                type: integer
              subnetRouter:
                description: |-
                  SubnetRouter defines subnet routes that the Connector device should
                  expose to tailnet as a Tailscale subnet router.
                  https://tailscale.com/kb/1019/subnets/
                  If this field is unset, the device does not get configured as a Tailscale subnet router.
                  This field is mutually exclusive with the appConnector field.
                properties:
                  advertiseRoutes:
                    description: |-
                      AdvertiseRoutes refer to CIDRs that the subnet router should make
                      available. Route values must be strings that represent a valid IPv4
                      or IPv6 CIDR range. Values can be Tailscale 4via6 subnet routes.
                      https://tailscale.com/kb/1201/4via6-subnets/
                    items:
                      format: cidr
                      type: string
                    minItems: 1
                    type: array
                required:
                - advertiseRoutes
                type: object
              tags:
                description: |-
                  Tags that the Tailscale node will be tagged with.
                  Defaults to [tag:k8s].
                  To autoapprove the subnet routes or exit node defined by a Connector,
                  you can configure Tailscale ACLs to give these tags the necessary
                  permissions.
                  See https://tailscale.com/kb/1337/acl-syntax#autoapprovers.
                  If you specify custom tags here, you must also make the operator an owner of these tags.
                  See  https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.
                  Tags cannot be changed once a Connector node has been created.
                  Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.
                items:
                  pattern: ^tag:[a-zA-Z][a-zA-Z0-9-]*$
                  type: string
                type: array
            type: object
            x-kubernetes-validations:
            - message: A Connector needs to have at least one of exit node, subnet
                router or app connector configured.
              rule: has(self.subnetRouter) || (has(self.exitNode) && self.exitNode
                == true) || has(self.appConnector)
            - message: The appConnector field is mutually exclusive with exitNode
                and subnetRouter fields.
              rule: '!((has(self.subnetRouter) || (has(self.exitNode)  && self.exitNode
                == true)) && has(self.appConnector))'
            - message: The hostname field cannot be specified when replicas is greater
                than 1.
              rule: '!(has(self.hostname) && has(self.replicas) && self.replicas >
                1)'
            - message: The hostname and hostnamePrefix fields are mutually exclusive.
              rule: '!(has(self.hostname) && has(self.hostnamePrefix))'
          status:
            description: |-
              ConnectorStatus describes the status of the Connector. This is set
              and managed by the Tailscale operator.
            properties:
              conditions:
                description: |-
                  List of status conditions to indicate the status of the Connector.
                  Known condition types are `ConnectorReady`.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
              devices:
                description: Devices contains information on each device managed by
                  the Connector resource.
                items:
                  properties:
                    hostname:
                      description: |-
                        Hostname is the fully qualified domain name of the Connector replica.
                        If MagicDNS is enabled in your tailnet, it is the MagicDNS name of the
                        node.
                      type: string
                    tailnetIPs:
                      description: |-
                        TailnetIPs is the set of tailnet IP addresses (both IPv4 and IPv6)
                        assigned to the Connector replica.
                      items:
                        type: string
                      type: array
                  type: object
                type: array
              hostname:
                description: |-
                  Hostname is the fully qualified domain name of the Connector node.
                  If MagicDNS is enabled in your tailnet, it is the MagicDNS name of the
                  node. When using multiple replicas, this field will be populated with the
                  first replica's hostname. Use the Hostnames field for the full list
                  of hostnames.
                type: string
              isAppConnector:
                description: IsAppConnector is set to true if the Connector acts as
                  an app connector.
                type: boolean
              isExitNode:
                description: IsExitNode is set to true if the Connector acts as an
                  exit node.
                type: boolean
              subnetRoutes:
                description: |-
                  SubnetRoutes are the routes currently exposed to tailnet via this
                  Connector instance.
                type: string
              tailnetIPs:
                description: |-
                  TailnetIPs is the set of tailnet IP addresses (both IPv4 and IPv6)
                  assigned to the Connector node.
                items:
                  type: string
                type: array
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.17.0
  name: dnsconfigs.tailscale.com
spec:
  group: tailscale.com
  names:
    kind: DNSConfig
    listKind: DNSConfigList
    plural: dnsconfigs
    shortNames:
    - dc
    singular: dnsconfig
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - description: Service IP address of the nameserver
      jsonPath: .status.nameserver.ip
      name: NameserverIP
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: |-
          DNSConfig can be deployed to cluster to make a subset of Tailscale MagicDNS
          names resolvable by cluster workloads. Use this if: A) you need to refer to
          tailnet services, exposed to cluster via Tailscale Kubernetes operator egress
          proxies by the MagicDNS names of those tailnet services (usually because the
          services run over HTTPS)
          B) you have exposed a cluster workload to the tailnet using Tailscale Ingress
          and you also want to refer to the workload from within the cluster over the
          Ingress's MagicDNS name (usually because you have some callback component
          that needs to use the same URL as that used by a non-cluster client on
          tailnet).
          When a DNSConfig is applied to a cluster, Tailscale Kubernetes operator will
          deploy a nameserver for ts.net DNS names and automatically populate it with records
          for any Tailscale egress or Ingress proxies deployed to that cluster.
          Currently you must manually update your cluster DNS configuration to add the
          IP address of the deployed nameserver as a ts.net stub nameserver.
          Instructions for how to do it:
          https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/#configuration-of-stub-domain-and-upstream-nameserver-using-coredns (for CoreDNS),
          https://cloud.google.com/kubernetes-engine/docs/how-to/kube-dns (for kube-dns).
          Tailscale Kubernetes operator will write the address of a Service fronting
          the nameserver to dsnconfig.status.nameserver.ip.
          DNSConfig is a singleton - you must not create more than one.
          NB: if you want cluster workloads to be able to refer to Tailscale Ingress
          using its MagicDNS name, you must also annotate the Ingress resource with
          tailscale.com/experimental-forward-cluster-traffic-via-ingress annotation to
          ensure that the proxy created for the Ingress listens on its Pod IP address.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: |-
              Spec describes the desired DNS configuration.
              More info:
              https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
            properties:
              nameserver:
                description: |-
                  Configuration for a nameserver that can resolve ts.net DNS names
                  associated with in-cluster proxies for Tailscale egress Services and
                  Tailscale Ingresses. The operator will always deploy this nameserver
                  when a DNSConfig is applied.
                properties:
                  image:
                    description: Nameserver image. Defaults to tailscale/k8s-nameserver:unstable.
                    properties:
                      repo:
                        description: Repo defaults to tailscale/k8s-nameserver.
                        type: string
                      tag:
                        description: Tag defaults to unstable.
                        type: string
                    type: object
                  pod:
                    description: Pod configuration.
                    properties:
                      tolerations:
                        description: If specified, applies tolerations to the pods
                          deployed by the DNSConfig resource.
                        items:
                          description: |-
                            The pod this Toleration is attached to tolerates any taint that matches
                            the triple <key,value,effect> using the matching operator <operator>.
                          properties:
                            effect:
                              description: |-
                                Effect indicates the taint effect to match. Empty means match all taint effects.
                                When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                              type: string
                            key:
                              description: |-
                                Key is the taint key that the toleration applies to. Empty means match all taint keys.
                                If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                              type: string
                            operator:
                              description: |-
                                Operator represents a key's relationship to the value.
                                Valid operators are Exists and Equal. Defaults to Equal.
                                Exists is equivalent to wildcard for value, so that a pod can
                                tolerate all taints of a particular category.
                              type: string
                            tolerationSeconds:
                              description: |-
                                TolerationSeconds represents the period of time the toleration (which must be
                                of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
                                it is not set, which means tolerate the taint forever (do not evict). Zero and
                                negative values will be treated as 0 (evict immediately) by the system.
                              format: int64
                              type: integer
                            value:
                              description: |-
                                Value is the taint value the toleration matches to.
                                If the operator is Exists, the value should be empty, otherwise just a regular string.
                              type: string
                          type: object
                        type: array
                    type: object
                  replicas:
                    description: Replicas specifies how many Pods to create. Defaults
                      to 1.
                    format: int32
                    minimum: 0
                    type: integer
                  service:
                    description: Service configuration.
                    properties:
                      clusterIP:
                        description: ClusterIP sets the static IP of the service used
                          by the nameserver.
                        type: string
                    type: object
                type: object
            required:
            - nameserver
            type: object
          status:
            description: |-
              Status describes the status of the DNSConfig. This is set
              and managed by the Tailscale operator.
            properties:
              conditions:
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
              nameserver:
                description: Nameserver describes the status of nameserver cluster
                  resources.
                properties:
                  ip:
                    description: |-
                      IP is the ClusterIP of the Service fronting the deployed ts.net nameserver.
                      Currently, you must manually update your cluster DNS config to add
                      this address as a stub nameserver for ts.net for cluster workloads to be
                      able to resolve MagicDNS names associated with egress or Ingress
                      proxies.
                      The IP address will change if you delete and recreate the DNSConfig.
                    type: string
                type: object
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: ingressclassparameterses.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    kind: IngressClassParameters
    listKind: IngressClassParametersList
    plural: ingressclassparameterses
    singular: ingressclassparameters
  scope: Namespaced
  versions:
  - name: v1alpha1
    schema:
      openAPIV3Schema:
        description: IngressClassParameters is the Schema for the IngressClassParameters
          API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: Spec is the IngressClassParameters specification.
            properties:
              enableLegacyRegexDetection:
                default: false
                description: EnableLegacyRegexDetection automatically detects if ImplementationSpecific
                  Ingress paths are regular expression paths using the legacy 2.x
                  heuristic. The controller adds the "~" prefix to those paths if
                  the Kong version is 3.0 or higher.
                type: boolean
              serviceUpstream:
                default: false
                description: Offload load-balancing to kube-proxy or sidecar.
                type: boolean
            type: object
        type: object
    served: true
    storage: true
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: ipaddresspools.metallb.io
spec:
  group: metallb.io
  names:
    kind: IPAddressPool
    listKind: IPAddressPoolList
    plural: ipaddresspools
    singular: ipaddresspool
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.autoAssign
      name: Auto Assign
      type: boolean
    - jsonPath: .spec.avoidBuggyIPs
      name: Avoid Buggy IPs
      type: boolean
    - jsonPath: .spec.addresses
      name: Addresses
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: |-
          IPAddressPool represents a pool of IP addresses that can be allocated
          to LoadBalancer services.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: IPAddressPoolSpec defines the desired state of IPAddressPool.
            properties:
              addresses:
                description: |-
                  A list of IP address ranges over which MetalLB has authority.
                  You can list multiple ranges in a single pool, they will all share the
                  same settings. Each range can be either a CIDR prefix, or an explicit
                  start-end range of IPs.
                items:
                  type: string
                type: array
              autoAssign:
                default: true
                description: |-
                  AutoAssign flag used to prevent MetallB from automatic allocation
                  for a pool.
                type: boolean
              avoidBuggyIPs:
                default: false
                description: |-
                  AvoidBuggyIPs prevents addresses ending with .0 and .255
                  to be used by a pool.
                type: boolean
              serviceAllocation:
                description: |-
                  AllocateTo makes ip pool allocation to specific namespace and/or service.
                  The controller will use the pool with lowest value of priority in case of
                  multiple matches. A pool with no priority set will be used only if the
                  pools with priority can't be used. If multiple matching IPAddressPools are
                  available it will check for the availability of IPs sorting the matching
                  IPAddressPools by priority, starting from the highest to the lowest. If
                  multiple IPAddressPools have the same priority, choice will be random.
                properties:
                  namespaceSelectors:
                    description: |-
                      NamespaceSelectors list of label selectors to select namespace(s) for ip pool,
                      an alternative to using namespace list.
                    items:
                      description: |-
                        A label selector is a label query over a set of resources. The result of matchLabels and
                        matchExpressions are ANDed. An empty label selector matches all objects. A null
                        label selector matches no objects.
                      properties:
                        matchExpressions:
                          description: matchExpressions is a list of label selector
                            requirements. The requirements are ANDed.
                          items:
                            description: |-
                              A label selector requirement is a selector that contains values, a key, and an operator that
                              relates the key and values.
                            properties:
                              key:
                                description: key is the label key that the selector
                                  applies to.
                                type: string
                              operator:
                                description: |-
                                  operator represents a key's relationship to a set of values.
                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                type: string
                              values:
                                description: |-
                                  values is an array of string values. If the operator is In or NotIn,
                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                  the values array must be empty. This array is replaced during a strategic
                                  merge patch.
                                items:
                                  type: string
                                type: array
                                x-kubernetes-list-type: atomic
                            required:
                            - key
                            - operator
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                        matchLabels:
                          additionalProperties:
                            type: string
                          description: |-
                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                          type: object
                      type: object
                      x-kubernetes-map-type: atomic
                    type: array
                  namespaces:
                    description: Namespaces list of namespace(s) on which ip pool
                      can be attached.
                    items:
                      type: string
                    type: array
                  priority:
                    description: Priority priority given for ip pool while ip allocation
                      on a service.
                    type: integer
                  serviceSelectors:
                    description: |-
                      ServiceSelectors list of label selector to select service(s) for which ip pool
                      can be used for ip allocation.
                    items:
                      description: |-
                        A label selector is a label query over a set of resources. The result of matchLabels and
                        matchExpressions are ANDed. An empty label selector matches all objects. A null
                        label selector matches no objects.
                      properties:
                        matchExpressions:
                          description: matchExpressions is a list of label selector
                            requirements. The requirements are ANDed.
                          items:
                            description: |-
                              A label selector requirement is a selector that contains values, a key, and an operator that
                              relates the key and values.
                            properties:
                              key:
                                description: key is the label key that the selector
                                  applies to.
                                type: string
                              operator:
                                description: |-
                                  operator represents a key's relationship to a set of values.
                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                type: string
                              values:
                                description: |-
                                  values is an array of string values. If the operator is In or NotIn,
                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                  the values array must be empty. This array is replaced during a strategic
                                  merge patch.
                                items:
                                  type: string
                                type: array
                                x-kubernetes-list-type: atomic
                            required:
                            - key
                            - operator
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                        matchLabels:
                          additionalProperties:
                            type: string
                          description: |-
                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                          type: object
                      type: object
                      x-kubernetes-map-type: atomic
                    type: array
                type: object
            required:
            - addresses
            type: object
          status:
            description: IPAddressPoolStatus defines the observed state of IPAddressPool.
            properties:
              assignedIPv4:
                description: AssignedIPv4 is the number of assigned IPv4 addresses.
                format: int64
                type: integer
              assignedIPv6:
                description: AssignedIPv6 is the number of assigned IPv6 addresses.
                format: int64
                type: integer
              availableIPv4:
                description: AvailableIPv4 is the number of available IPv4 addresses.
                format: int64
                type: integer
              availableIPv6:
                description: AvailableIPv6 is the number of available IPv6 addresses.
                format: int64
                type: integer
            required:
            - assignedIPv4
            - assignedIPv6
            - availableIPv4
            - availableIPv6
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    helm.sh/resource-policy: keep
  labels:
    app: cert-manager
    app.kubernetes.io/component: crds
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: issuers.cert-manager.io
spec:
  group: cert-manager.io
  names:
    categories:
    - cert-manager
    kind: Issuer
    listKind: IssuerList
    plural: issuers
    shortNames:
    - iss
    singular: issuer
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.conditions[?(@.type == "Ready")].status
      name: Ready
      type: string
    - jsonPath: .status.conditions[?(@.type == "Ready")].message
      name: Status
      priority: 1
      type: string
    - description: CreationTimestamp is a timestamp representing the server time when
        this object was created. It is not guaranteed to be set in happens-before
        order across separate operations. Clients may not set this value. It is represented
        in RFC3339 form and is in UTC.
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1
    schema:
      openAPIV3Schema:
        description: |-
          An Issuer represents a certificate issuing authority which can be
          referenced as part of `issuerRef` fields.
          It is scoped to a single namespace and can therefore only be referenced by
          resources within the same namespace.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Desired state of the Issuer resource.
            properties:
              acme:
                description: |-
                  ACME configures this issuer to communicate with a RFC8555 (ACME) server
                  to obtain signed x509 certificates.
                properties:
                  caBundle:
                    description: |-
                      Base64-encoded bundle of PEM CAs which can be used to validate the certificate
                      chain presented by the ACME server.
                      Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
                      kinds of security vulnerabilities.
                      If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
                      the container is used to validate the TLS connection.
                    format: byte
                    type: string
                  disableAccountKeyGeneration:
                    description: |-
                      Enables or disables generating a new ACME account key.
                      If true, the Issuer resource will *not* request a new account but will expect
                      the account key to be supplied via an existing secret.
                      If false, the cert-manager system will generate a new ACME account key
                      for the Issuer.
                      Defaults to false.
                    type: boolean
                  email:
                    description: |-
                      Email is the email address to be associated with the ACME account.
                      This field is optional, but it is strongly recommended to be set.
                      It will be used to contact you in case of issues with your account or
                      certificates, including expiry notification emails.
                      This field may be updated after the account is initially registered.
                    type: string
                  enableDurationFeature:
                    description: |-
                      Enables requesting a Not After date on certificates that matches the
                      duration of the certificate. This is not supported by all ACME servers
                      like Let's Encrypt. If set to true when the ACME server does not support
                      it, it will create an error on the Order.
                      Defaults to false.
                    type: boolean
                  externalAccountBinding:
                    description: |-
                      ExternalAccountBinding is a reference to a CA external account of the ACME
                      server.
                      If set, upon registration cert-manager will attempt to associate the given
                      external account credentials with the registered ACME account.
                    properties:
                      keyAlgorithm:
                        description: |-
                          Deprecated: keyAlgorithm field exists for historical compatibility
                          reasons and should not be used. The algorithm is now hardcoded to HS256
                          in golang/x/crypto/acme.
                        enum:
                        - HS256
                        - HS384
                        - HS512
                        type: string
                      keyID:
                        description: keyID is the ID of the CA key that the External
                          Account is bound to.
                        type: string
                      keySecretRef:
                        description: |-
                          keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
                          Secret which holds the symmetric MAC key of the External Account Binding.
                          The `key` is the index string that is paired with the key data in the
                          Secret and should not be confused with the key data itself, or indeed with
                          the External Account Binding keyID above.
                          The secret key stored in the Secret **must** be un-padded, base64 URL
                          encoded data.
                        properties:
                          key:
                            description: |-
                              The key of the entry in the Secret resource's `data` field to be used.
                              Some instances of this field may be defaulted, in others it may be
                              required.
                            type: string
                          name:
                            description: |-
                              Name of the resource being referred to.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        required:
                        - name
                        type: object
                    required:
                    - keyID
                    - keySecretRef
                    type: object
                  preferredChain:
                    description: |-
                      PreferredChain is the chain to use if the ACME server outputs multiple.
                      PreferredChain is no guarantee that this one gets delivered by the ACME
                      endpoint.
                      For example, for Let's Encrypt's DST cross-sign you would use:
                      "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
                      This value picks the first certificate bundle in the combined set of
                      ACME default and alternative chains that has a root-most certificate with
                      this value as its issuer's commonname.
                    maxLength: 64
                    type: string
                  privateKeySecretRef:
                    description: |-
                      PrivateKey is the name of a Kubernetes Secret resource that will be used to
                      store the automatically generated ACME account private key.
                      Optionally, a `key` may be specified to select a specific entry within
                      the named Secret resource.
                      If `key` is not specified, a default of `tls.key` will be used.
                    properties:
                      key:
                        description: |-
                          The key of the entry in the Secret resource's `data` field to be used.
                          Some instances of this field may be defaulted, in others it may be
                          required.
                        type: string
                      name:
                        description: |-
                          Name of the resource being referred to.
                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                        type: string
                    required:
                    - name
                    type: object
                  profile:
                    description: |-
                      Profile allows requesting a certificate profile from the ACME server.
                      Supported profiles are listed by the server's ACME directory URL.
                    type: string
                  server:
                    description: |-
                      Server is the URL used to access the ACME server's 'directory' endpoint.
                      For example, for Let's Encrypt's staging endpoint, you would use:
                      "https://acme-staging-v02.api.letsencrypt.org/directory".
                      Only ACME v2 endpoints (i.e. RFC 8555) are supported.
                    type: string
                  skipTLSVerify:
                    description: |-
                      INSECURE: Enables or disables validation of the ACME server TLS certificate.
                      If true, requests to the ACME server will not have the TLS certificate chain
                      validated.
                      Mutually exclusive with CABundle; prefer using CABundle to prevent various
                      kinds of security vulnerabilities.
                      Only enable this option in development environments.
                      If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
                      the container is used to validate the TLS connection.
                      Defaults to false.
                    type: boolean
                  solvers:
                    description: |-
                      Solvers is a list of challenge solvers that will be used to solve
                      ACME challenges for the matching domains.
                      Solver configurations must be provided in order to obtain certificates
                      from an ACME server.
                      For more information, see: https://cert-manager.io/docs/configuration/acme/
                    items:
                      description: |-
                        An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of.
                        A selector may be provided to use different solving strategies for different DNS names.
                        Only one of HTTP01 or DNS01 must be provided.
                      properties:
                        dns01:
                          description: |-
                            Configures cert-manager to attempt to complete authorizations by
                            performing the DNS01 challenge flow.
                          properties:
                            acmeDNS:
                              description: |-
                                Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage
                                DNS01 challenge records.
                              properties:
                                accountSecretRef:
                                  description: |-
                                    A reference to a specific 'key' within a Secret resource.
                                    In some instances, `key` is a required field.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                host:
                                  type: string
                              required:
                              - accountSecretRef
                              - host
                              type: object
                            akamai:
                              description: Use the Akamai DNS zone management API
                                to manage DNS01 challenge records.
                              properties:
                                accessTokenSecretRef:
                                  description: |-
                                    A reference to a specific 'key' within a Secret resource.
                                    In some instances, `key` is a required field.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                clientSecretSecretRef:
                                  description: |-
                                    A reference to a specific 'key' within a Secret resource.
                                    In some instances, `key` is a required field.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                clientTokenSecretRef:
                                  description: |-
                                    A reference to a specific 'key' within a Secret resource.
                                    In some instances, `key` is a required field.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                serviceConsumerDomain:
                                  type: string
                              required:
                              - accessTokenSecretRef
                              - clientSecretSecretRef
                              - clientTokenSecretRef
                              - serviceConsumerDomain
                              type: object
                            azureDNS:
                              description: Use the Microsoft Azure DNS API to manage
                                DNS01 challenge records.
                              properties:
                                clientID:
                                  description: |-
                                    Auth: Azure Service Principal:
                                    The ClientID of the Azure Service Principal used to authenticate with Azure DNS.
                                    If set, ClientSecret and TenantID must also be set.
                                  type: string
                                clientSecretSecretRef:
                                  description: |-
                                    Auth: Azure Service Principal:
                                    A reference to a Secret containing the password associated with the Service Principal.
                                    If set, ClientID and TenantID must also be set.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                environment:
                                  description: name of the Azure environment (default
                                    AzurePublicCloud)
                                  enum:
                                  - AzurePublicCloud
                                  - AzureChinaCloud
                                  - AzureGermanCloud
                                  - AzureUSGovernmentCloud
                                  type: string
                                hostedZoneName:
                                  description: name of the DNS zone that should be
                                    used
                                  type: string
                                managedIdentity:
                                  description: |-
                                    Auth: Azure Workload Identity or Azure Managed Service Identity:
                                    Settings to enable Azure Workload Identity or Azure Managed Service Identity
                                    If set, ClientID, ClientSecret and TenantID must not be set.
                                  properties:
                                    clientID:
                                      description: client ID of the managed identity,
                                        cannot be used at the same time as resourceID
                                      type: string
                                    resourceID:
                                      description: |-
                                        resource ID of the managed identity, cannot be used at the same time as clientID
                                        Cannot be used for Azure Managed Service Identity
                                      type: string
                                    tenantID:
                                      description: tenant ID of the managed identity,
                                        cannot be used at the same time as resourceID
                                      type: string
                                  type: object
                                resourceGroupName:
                                  description: resource group the DNS zone is located
                                    in
                                  type: string
                                subscriptionID:
                                  description: ID of the Azure subscription
                                  type: string
                                tenantID:
                                  description: |-
                                    Auth: Azure Service Principal:
                                    The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
                                    If set, ClientID and ClientSecret must also be set.
                                  type: string
                              required:
                              - resourceGroupName
                              - subscriptionID
                              type: object
                            cloudDNS:
                              description: Use the Google Cloud DNS API to manage
                                DNS01 challenge records.
                              properties:
                                hostedZoneName:
                                  description: |-
                                    HostedZoneName is an optional field that tells cert-manager in which
                                    Cloud DNS zone the challenge record has to be created.
                                    If left empty cert-manager will automatically choose a zone.
                                  type: string
                                project:
                                  type: string
                                serviceAccountSecretRef:
                                  description: |-
                                    A reference to a specific 'key' within a Secret resource.
                                    In some instances, `key` is a required field.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                              required:
                              - project
                              type: object
                            cloudflare:
                              description: Use the Cloudflare API to manage DNS01
                                challenge records.
                              properties:
                                apiKeySecretRef:
                                  description: |-
                                    API key to use to authenticate with Cloudflare.
                                    Note: using an API token to authenticate is now the recommended method
                                    as it allows greater control of permissions.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                apiTokenSecretRef:
                                  description: API token used to authenticate with
                                    Cloudflare.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                email:
                                  description: Email of the account, only required
                                    when using API key based authentication.
                                  type: string
                              type: object
                            cnameStrategy:
                              description: |-
                                CNAMEStrategy configures how the DNS01 provider should handle CNAME
                                records when found in DNS zones.
                              enum:
                              - None
                              - Follow
                              type: string
                            digitalocean:
                              description: Use the DigitalOcean DNS API to manage
                                DNS01 challenge records.
                              properties:
                                tokenSecretRef:
                                  description: |-
                                    A reference to a specific 'key' within a Secret resource.
                                    In some instances, `key` is a required field.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                              required:
                              - tokenSecretRef
                              type: object
                            rfc2136:
                              description: |-
                                Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/)
                                to manage DNS01 challenge records.
                              properties:
                                nameserver:
                                  description: |-
                                    The IP address or hostname of an authoritative DNS server supporting
                                    RFC2136 in the form host:port. If the host is an IPv6 address it must be
                                    enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
                                    This field is required.
                                  type: string
                                protocol:
                                  description: Protocol to use for dynamic DNS update
                                    queries. Valid values are (case-sensitive) ``TCP``
                                    and ``UDP``; ``UDP`` (default).
                                  enum:
                                  - TCP
                                  - UDP
                                  type: string
                                tsigAlgorithm:
                                  description: |-
                                    The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
                                    when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
                                    Supported values are (case-insensitive): ``HMACMD5`` (default),
                                    ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
                                  type: string
                                tsigKeyName:
                                  description: |-
                                    The TSIG Key name configured in the DNS.
                                    If ``tsigSecretSecretRef`` is defined, this field is required.
                                  type: string
                                tsigSecretSecretRef:
                                  description: |-
                                    The name of the secret containing the TSIG value.
                                    If ``tsigKeyName`` is defined, this field is required.
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                              required:
                              - nameserver
                              type: object
                            route53:
                              description: Use the AWS Route53 API to manage DNS01
                                challenge records.
                              properties:
                                accessKeyID:
                                  description: |-
                                    The AccessKeyID is used for authentication.
                                    Cannot be set when SecretAccessKeyID is set.
                                    If neither the Access Key nor Key ID are set, we fall-back to using env
                                    vars, shared credentials file or AWS Instance metadata,
                                    see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                                  type: string
                                accessKeyIDSecretRef:
                                  description: |-
                                    The SecretAccessKey is used for authentication. If set, pull the AWS
                                    access key ID from a key within a Kubernetes Secret.
                                    Cannot be set when AccessKeyID is set.
                                    If neither the Access Key nor Key ID are set, we fall-back to using env
                                    vars, shared credentials file or AWS Instance metadata,
                                    see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                                auth:
                                  description: Auth configures how cert-manager authenticates.
                                  properties:
                                    kubernetes:
                                      description: |-
                                        Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity
                                        by passing a bound ServiceAccount token.
                                      properties:
                                        serviceAccountRef:
                                          description: |-
                                            A reference to a service account that will be used to request a bound
                                            token (also known as "projected token"). To use this field, you must
                                            configure an RBAC rule to let cert-manager request a token.
                                          properties:
                                            audiences:
                                              description: |-
                                                TokenAudiences is an optional list of audiences to include in the
                                                token passed to AWS. The default token consisting of the issuer's namespace
                                                and name is always included.
                                                If unset the audience defaults to `sts.amazonaws.com`.
                                              items:
                                                type: string
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            name:
                                              description: Name of the ServiceAccount
                                                used to request a token.
                                              type: string
                                          required:
                                          - name
                                          type: object
                                      required:
                                      - serviceAccountRef
                                      type: object
                                  required:
                                  - kubernetes
                                  type: object
                                hostedZoneID:
                                  description: If set, the provider will manage only
                                    this zone in Route53 and will not do a lookup
                                    using the route53:ListHostedZonesByName api call.
                                  type: string
                                region:
                                  description: |-
                                    Override the AWS region.

                                    Route53 is a global service and does not have regional endpoints but the
                                    region specified here (or via environment variables) is used as a hint to
                                    help compute the correct AWS credential scope and partition when it
                                    connects to Route53. See:
                                    - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)
                                    - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)

                                    If you omit this region field, cert-manager will use the region from
                                    AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set
                                    in the cert-manager controller Pod.

                                    The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
                                    Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
                                    [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).
                                    In this case this `region` field value is ignored.

                                    The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).
                                    Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by:
                                    [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),
                                    In this case this `region` field value is ignored.
                                  type: string
                                role:
                                  description: |-
                                    Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
                                    or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
                                  type: string
                                secretAccessKeySecretRef:
                                  description: |-
                                    The SecretAccessKey is used for authentication.
                                    If neither the Access Key nor Key ID are set, we fall-back to using env
                                    vars, shared credentials file or AWS Instance metadata,
                                    see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                                  properties:
                                    key:
                                      description: |-
                                        The key of the entry in the Secret resource's `data` field to be used.
                                        Some instances of this field may be defaulted, in others it may be
                                        required.
                                      type: string
                                    name:
                                      description: |-
                                        Name of the resource being referred to.
                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                      type: string
                                  required:
                                  - name
                                  type: object
                              type: object
                            webhook:
                              description: |-
                                Configure an external webhook based DNS01 challenge solver to manage
                                DNS01 challenge records.
                              properties:
                                config:
                                  description: |-
                                    Additional configuration that should be passed to the webhook apiserver
                                    when challenges are processed.
                                    This can contain arbitrary JSON data.
                                    Secret values should not be specified in this stanza.
                                    If secret values are needed (e.g., credentials for a DNS service), you
                                    should use a SecretKeySelector to reference a Secret resource.
                                    For details on the schema of this field, consult the webhook provider
                                    implementation's documentation.
                                  x-kubernetes-preserve-unknown-fields: true
                                groupName:
                                  description: |-
                                    The API group name that should be used when POSTing ChallengePayload
                                    resources to the webhook apiserver.
                                    This should be the same as the GroupName specified in the webhook
                                    provider implementation.
                                  type: string
                                solverName:
                                  description: |-
                                    The name of the solver to use, as defined in the webhook provider
                                    implementation.
                                    This will typically be the name of the provider, e.g., 'cloudflare'.
                                  type: string
                              required:
                              - groupName
                              - solverName
                              type: object
                          type: object
                        http01:
                          description: |-
                            Configures cert-manager to attempt to complete authorizations by
                            performing the HTTP01 challenge flow.
                            It is not possible to obtain certificates for wildcard domain names
                            (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
                          properties:
                            gatewayHTTPRoute:
                              description: |-
                                The Gateway API is a sig-network community API that models service networking
                                in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will
                                create HTTPRoutes with the specified labels in the same namespace as the challenge.
                                This solver is experimental, and fields / behaviour may change in the future.
                              properties:
                                labels:
                                  additionalProperties:
                                    type: string
                                  description: |-
                                    Custom labels that will be applied to HTTPRoutes created by cert-manager
                                    while solving HTTP-01 challenges.
                                  type: object
                                parentRefs:
                                  description: |-
                                    When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
                                    cert-manager needs to know which parentRefs should be used when creating
                                    the HTTPRoute. Usually, the parentRef references a Gateway. See:
                                    https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
                                  items:
                                    description: |-
                                      ParentReference identifies an API object (usually a Gateway) that can be considered
                                      a parent of this resource (usually a route). There are two kinds of parent resources
                                      with "Core" support:

                                      * Gateway (Gateway conformance profile)
                                      * Service (Mesh conformance profile, ClusterIP Services only)

                                      This API may be extended in the future to support additional kinds of parent
                                      resources.

                                      The API object must be valid in the cluster; the Group and Kind must
                                      be registered in the cluster for this reference to be valid.
                                    properties:
                                      group:
                                        default: gateway.networking.k8s.io
                                        description: |-
                                          Group is the group of the referent.
                                          When unspecified, "gateway.networking.k8s.io" is inferred.
                                          To set the core API group (such as for a "Service" kind referent),
                                          Group must be explicitly set to "" (empty string).

                                          Support: Core
                                        maxLength: 253
                                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                        type: string
                                      kind:
                                        default: Gateway
                                        description: |-
                                          Kind is kind of the referent.

                                          There are two kinds of parent resources with "Core" support:

                                          * Gateway (Gateway conformance profile)
                                          * Service (Mesh conformance profile, ClusterIP Services only)

                                          Support for other resources is Implementation-Specific.
                                        maxLength: 63
                                        minLength: 1
                                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                                        type: string
                                      name:
                                        description: |-
                                          Name is the name of the referent.

                                          Support: Core
                                        maxLength: 253
                                        minLength: 1
                                        type: string
                                      namespace:
                                        description: |-
                                          Namespace is the namespace of the referent. When unspecified, this refers
                                          to the local namespace of the Route.

                                          Note that there are specific rules for ParentRefs which cross namespace
                                          boundaries. Cross-namespace references are only valid if they are explicitly
                                          allowed by something in the namespace they are referring to. For example:
                                          Gateway has the AllowedRoutes field, and ReferenceGrant provides a
                                          generic way to enable any other kind of cross-namespace reference.

                                          <gateway:experimental:description>
                                          ParentRefs from a Route to a Service in the same namespace are "producer"
                                          routes, which apply default routing rules to inbound connections from
                                          any namespace to the Service.

                                          ParentRefs from a Route to a Service in a different namespace are
                                          "consumer" routes, and these routing rules are only applied to outbound
                                          connections originating from the same namespace as the Route, for which
                                          the intended destination of the connections are a Service targeted as a
                                          ParentRef of the Route.
                                          </gateway:experimental:description>

                                          Support: Core
                                        maxLength: 63
                                        minLength: 1
                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                                        type: string
                                      port:
                                        description: |-
                                          Port is the network port this Route targets. It can be interpreted
                                          differently based on the type of parent resource.

                                          When the parent resource is a Gateway, this targets all listeners
                                          listening on the specified port that also support this kind of Route(and
                                          select this Route). It's not recommended to set `Port` unless the
                                          networking behaviors specified in a Route must apply to a specific port
                                          as opposed to a listener(s) whose port(s) may be changed. When both Port
                                          and SectionName are specified, the name and port of the selected listener
                                          must match both specified values.

                                          <gateway:experimental:description>
                                          When the parent resource is a Service, this targets a specific port in the
                                          Service spec. When both Port (experimental) and SectionName are specified,
                                          the name and port of the selected port must match both specified values.
                                          </gateway:experimental:description>

                                          Implementations MAY choose to support other parent resources.
                                          Implementations supporting other types of parent resources MUST clearly
                                          document how/if Port is interpreted.

                                          For the purpose of status, an attachment is considered successful as
                                          long as the parent resource accepts it partially. For example, Gateway
                                          listeners can restrict which Routes can attach to them by Route kind,
                                          namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
                                          from the referencing Route, the Route MUST be considered successfully
                                          attached. If no Gateway listeners accept attachment from this Route,
                                          the Route MUST be considered detached from the Gateway.

                                          Support: Extended
                                        format: int32
                                        maximum: 65535
                                        minimum: 1
                                        type: integer
                                      sectionName:
                                        description: |-
                                          SectionName is the name of a section within the target resource. In the
                                          following resources, SectionName is interpreted as the following:

                                          * Gateway: Listener name. When both Port (experimental) and SectionName
                                          are specified, the name and port of the selected listener must match
                                          both specified values.
                                          * Service: Port name. When both Port (experimental) and SectionName
                                          are specified, the name and port of the selected listener must match
                                          both specified values.

                                          Implementations MAY choose to support attaching Routes to other resources.
                                          If that is the case, they MUST clearly document how SectionName is
                                          interpreted.

                                          When unspecified (empty string), this will reference the entire resource.
                                          For the purpose of status, an attachment is considered successful if at
                                          least one section in the parent resource accepts it. For example, Gateway
                                          listeners can restrict which Routes can attach to them by Route kind,
                                          namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
                                          the referencing Route, the Route MUST be considered successfully
                                          attached. If no Gateway listeners accept attachment from this Route, the
                                          Route MUST be considered detached from the Gateway.

                                          Support: Core
                                        maxLength: 253
                                        minLength: 1
                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                        type: string
                                    required:
                                    - name
                                    type: object
                                  type: array
                                  x-kubernetes-list-type: atomic
                                podTemplate:
                                  description: |-
                                    Optional pod template used to configure the ACME challenge solver pods
                                    used for HTTP01 challenges.
                                  properties:
                                    metadata:
                                      description: |-
                                        ObjectMeta overrides for the pod used to solve HTTP01 challenges.
                                        Only the 'labels' and 'annotations' fields may be set.
                                        If labels or annotations overlap with in-built values, the values here
                                        will override the in-built values.
                                      properties:
                                        annotations:
                                          additionalProperties:
                                            type: string
                                          description: Annotations that should be
                                            added to the created ACME HTTP01 solver
                                            pods.
                                          type: object
                                        labels:
                                          additionalProperties:
                                            type: string
                                          description: Labels that should be added
                                            to the created ACME HTTP01 solver pods.
                                          type: object
                                      type: object
                                    spec:
                                      description: |-
                                        PodSpec defines overrides for the HTTP01 challenge solver pod.
                                        Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
                                        All other fields will be ignored.
                                      properties:
                                        affinity:
                                          description: If specified, the pod's scheduling
                                            constraints
                                          properties:
                                            nodeAffinity:
                                              description: Describes node affinity
                                                scheduling rules for the pod.
                                              properties:
                                                preferredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    The scheduler will prefer to schedule pods to nodes that satisfy
                                                    the affinity expressions specified by this field, but it may choose
                                                    a node that violates one or more of the expressions. The node that is
                                                    most preferred is the one with the greatest sum of weights, i.e.
                                                    for each node that meets all of the scheduling requirements (resource
                                                    request, requiredDuringScheduling affinity expressions, etc.),
                                                    compute a sum by iterating through the elements of this field and adding
                                                    "weight" to the sum if the node matches the corresponding matchExpressions; the
                                                    node(s) with the highest sum are the most preferred.
                                                  items:
                                                    description: |-
                                                      An empty preferred scheduling term matches all objects with implicit weight 0
                                                      (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
                                                    properties:
                                                      preference:
                                                        description: A node selector
                                                          term, associated with the
                                                          corresponding weight.
                                                        properties:
                                                          matchExpressions:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's labels.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchFields:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's fields.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      weight:
                                                        description: Weight associated
                                                          with matching the corresponding
                                                          nodeSelectorTerm, in the
                                                          range 1-100.
                                                        format: int32
                                                        type: integer
                                                    required:
                                                    - preference
                                                    - weight
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                requiredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    If the affinity requirements specified by this field are not met at
                                                    scheduling time, the pod will not be scheduled onto the node.
                                                    If the affinity requirements specified by this field cease to be met
                                                    at some point during pod execution (e.g. due to an update), the system
                                                    may or may not try to eventually evict the pod from its node.
                                                  properties:
                                                    nodeSelectorTerms:
                                                      description: Required. A list
                                                        of node selector terms. The
                                                        terms are ORed.
                                                      items:
                                                        description: |-
                                                          A null or empty node selector term matches no objects. The requirements of
                                                          them are ANDed.
                                                          The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
                                                        properties:
                                                          matchExpressions:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's labels.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchFields:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's fields.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                  required:
                                                  - nodeSelectorTerms
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                              type: object
                                            podAffinity:
                                              description: Describes pod affinity
                                                scheduling rules (e.g. co-locate this
                                                pod in the same node, zone, etc. as
                                                some other pod(s)).
                                              properties:
                                                preferredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    The scheduler will prefer to schedule pods to nodes that satisfy
                                                    the affinity expressions specified by this field, but it may choose
                                                    a node that violates one or more of the expressions. The node that is
                                                    most preferred is the one with the greatest sum of weights, i.e.
                                                    for each node that meets all of the scheduling requirements (resource
                                                    request, requiredDuringScheduling affinity expressions, etc.),
                                                    compute a sum by iterating through the elements of this field and adding
                                                    "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                                    node(s) with the highest sum are the most preferred.
                                                  items:
                                                    description: The weights of all
                                                      of the matched WeightedPodAffinityTerm
                                                      fields are added per-node to
                                                      find the most preferred node(s)
                                                    properties:
                                                      podAffinityTerm:
                                                        description: Required. A pod
                                                          affinity term, associated
                                                          with the corresponding weight.
                                                        properties:
                                                          labelSelector:
                                                            description: |-
                                                              A label query over a set of resources, in this case pods.
                                                              If it's null, this PodAffinityTerm matches with no Pods.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          matchLabelKeys:
                                                            description: |-
                                                              MatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                              Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          mismatchLabelKeys:
                                                            description: |-
                                                              MismatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                              Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          namespaceSelector:
                                                            description: |-
                                                              A label query over the set of namespaces that the term applies to.
                                                              The term is applied to the union of the namespaces selected by this field
                                                              and the ones listed in the namespaces field.
                                                              null selector and null or empty namespaces list means "this pod's namespace".
                                                              An empty selector ({}) matches all namespaces.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          namespaces:
                                                            description: |-
                                                              namespaces specifies a static list of namespace names that the term applies to.
                                                              The term is applied to the union of the namespaces listed in this field
                                                              and the ones selected by namespaceSelector.
                                                              null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          topologyKey:
                                                            description: |-
                                                              This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                              the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                              whose value of the label with key topologyKey matches that of any node on which any of the
                                                              selected pods is running.
                                                              Empty topologyKey is not allowed.
                                                            type: string
                                                        required:
                                                        - topologyKey
                                                        type: object
                                                      weight:
                                                        description: |-
                                                          weight associated with matching the corresponding podAffinityTerm,
                                                          in the range 1-100.
                                                        format: int32
                                                        type: integer
                                                    required:
                                                    - podAffinityTerm
                                                    - weight
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                requiredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    If the affinity requirements specified by this field are not met at
                                                    scheduling time, the pod will not be scheduled onto the node.
                                                    If the affinity requirements specified by this field cease to be met
                                                    at some point during pod execution (e.g. due to a pod label update), the
                                                    system may or may not try to eventually evict the pod from its node.
                                                    When there are multiple elements, the lists of nodes corresponding to each
                                                    podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                                  items:
                                                    description: |-
                                                      Defines a set of pods (namely those matching the labelSelector
                                                      relative to the given namespace(s)) that this pod should be
                                                      co-located (affinity) or not co-located (anti-affinity) with,
                                                      where co-located is defined as running on a node whose value of
                                                      the label with key <topologyKey> matches that of any node on which
                                                      a pod of the set of pods is running
                                                    properties:
                                                      labelSelector:
                                                        description: |-
                                                          A label query over a set of resources, in this case pods.
                                                          If it's null, this PodAffinityTerm matches with no Pods.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      matchLabelKeys:
                                                        description: |-
                                                          MatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      mismatchLabelKeys:
                                                        description: |-
                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      namespaceSelector:
                                                        description: |-
                                                          A label query over the set of namespaces that the term applies to.
                                                          The term is applied to the union of the namespaces selected by this field
                                                          and the ones listed in the namespaces field.
                                                          null selector and null or empty namespaces list means "this pod's namespace".
                                                          An empty selector ({}) matches all namespaces.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      namespaces:
                                                        description: |-
                                                          namespaces specifies a static list of namespace names that the term applies to.
                                                          The term is applied to the union of the namespaces listed in this field
                                                          and the ones selected by namespaceSelector.
                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      topologyKey:
                                                        description: |-
                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                          whose value of the label with key topologyKey matches that of any node on which any of the
                                                          selected pods is running.
                                                          Empty topologyKey is not allowed.
                                                        type: string
                                                    required:
                                                    - topologyKey
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              type: object
                                            podAntiAffinity:
                                              description: Describes pod anti-affinity
                                                scheduling rules (e.g. avoid putting
                                                this pod in the same node, zone, etc.
                                                as some other pod(s)).
                                              properties:
                                                preferredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    The scheduler will prefer to schedule pods to nodes that satisfy
                                                    the anti-affinity expressions specified by this field, but it may choose
                                                    a node that violates one or more of the expressions. The node that is
                                                    most preferred is the one with the greatest sum of weights, i.e.
                                                    for each node that meets all of the scheduling requirements (resource
                                                    request, requiredDuringScheduling anti-affinity expressions, etc.),
                                                    compute a sum by iterating through the elements of this field and subtracting
                                                    "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                                    node(s) with the highest sum are the most preferred.
                                                  items:
                                                    description: The weights of all
                                                      of the matched WeightedPodAffinityTerm
                                                      fields are added per-node to
                                                      find the most preferred node(s)
                                                    properties:
                                                      podAffinityTerm:
                                                        description: Required. A pod
                                                          affinity term, associated
                                                          with the corresponding weight.
                                                        properties:
                                                          labelSelector:
                                                            description: |-
                                                              A label query over a set of resources, in this case pods.
                                                              If it's null, this PodAffinityTerm matches with no Pods.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          matchLabelKeys:
                                                            description: |-
                                                              MatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                              Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          mismatchLabelKeys:
                                                            description: |-
                                                              MismatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                              Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          namespaceSelector:
                                                            description: |-
                                                              A label query over the set of namespaces that the term applies to.
                                                              The term is applied to the union of the namespaces selected by this field
                                                              and the ones listed in the namespaces field.
                                                              null selector and null or empty namespaces list means "this pod's namespace".
                                                              An empty selector ({}) matches all namespaces.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          namespaces:
                                                            description: |-
                                                              namespaces specifies a static list of namespace names that the term applies to.
                                                              The term is applied to the union of the namespaces listed in this field
                                                              and the ones selected by namespaceSelector.
                                                              null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          topologyKey:
                                                            description: |-
                                                              This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                              the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                              whose value of the label with key topologyKey matches that of any node on which any of the
                                                              selected pods is running.
                                                              Empty topologyKey is not allowed.
                                                            type: string
                                                        required:
                                                        - topologyKey
                                                        type: object
                                                      weight:
                                                        description: |-
                                                          weight associated with matching the corresponding podAffinityTerm,
                                                          in the range 1-100.
                                                        format: int32
                                                        type: integer
                                                    required:
                                                    - podAffinityTerm
                                                    - weight
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                requiredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    If the anti-affinity requirements specified by this field are not met at
                                                    scheduling time, the pod will not be scheduled onto the node.
                                                    If the anti-affinity requirements specified by this field cease to be met
                                                    at some point during pod execution (e.g. due to a pod label update), the
                                                    system may or may not try to eventually evict the pod from its node.
                                                    When there are multiple elements, the lists of nodes corresponding to each
                                                    podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                                  items:
                                                    description: |-
                                                      Defines a set of pods (namely those matching the labelSelector
                                                      relative to the given namespace(s)) that this pod should be
                                                      co-located (affinity) or not co-located (anti-affinity) with,
                                                      where co-located is defined as running on a node whose value of
                                                      the label with key <topologyKey> matches that of any node on which
                                                      a pod of the set of pods is running
                                                    properties:
                                                      labelSelector:
                                                        description: |-
                                                          A label query over a set of resources, in this case pods.
                                                          If it's null, this PodAffinityTerm matches with no Pods.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      matchLabelKeys:
                                                        description: |-
                                                          MatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      mismatchLabelKeys:
                                                        description: |-
                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      namespaceSelector:
                                                        description: |-
                                                          A label query over the set of namespaces that the term applies to.
                                                          The term is applied to the union of the namespaces selected by this field
                                                          and the ones listed in the namespaces field.
                                                          null selector and null or empty namespaces list means "this pod's namespace".
                                                          An empty selector ({}) matches all namespaces.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      namespaces:
                                                        description: |-
                                                          namespaces specifies a static list of namespace names that the term applies to.
                                                          The term is applied to the union of the namespaces listed in this field
                                                          and the ones selected by namespaceSelector.
                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      topologyKey:
                                                        description: |-
                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                          whose value of the label with key topologyKey matches that of any node on which any of the
                                                          selected pods is running.
                                                          Empty topologyKey is not allowed.
                                                        type: string
                                                    required:
                                                    - topologyKey
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              type: object
                                          type: object
                                        imagePullSecrets:
                                          description: If specified, the pod's imagePullSecrets
                                          items:
                                            description: |-
                                              LocalObjectReference contains enough information to let you locate the
                                              referenced object inside the same namespace.
                                            properties:
                                              name:
                                                default: ""
                                                description: |-
                                                  Name of the referent.
                                                  This field is effectively required, but due to backwards compatibility is
                                                  allowed to be empty. Instances of this type with an empty value here are
                                                  almost certainly wrong.
                                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                                type: string
                                            type: object
                                            x-kubernetes-map-type: atomic
                                          type: array
                                          x-kubernetes-list-map-keys:
                                          - name
                                          x-kubernetes-list-type: map
                                        nodeSelector:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            NodeSelector is a selector which must be true for the pod to fit on a node.
                                            Selector which must match a node's labels for the pod to be scheduled on that node.
                                            More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
                                          type: object
                                        priorityClassName:
                                          description: If specified, the pod's priorityClassName.
                                          type: string
                                        resources:
                                          description: |-
                                            If specified, the pod's resource requirements.
                                            These values override the global resource configuration flags.
                                            Note that when only specifying resource limits, ensure they are greater than or equal
                                            to the corresponding global resource requests configured via controller flags
                                            (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
                                            Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
                                          properties:
                                            limits:
                                              additionalProperties:
                                                anyOf:
                                                - type: integer
                                                - type: string
                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                                x-kubernetes-int-or-string: true
                                              description: |-
                                                Limits describes the maximum amount of compute resources allowed.
                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                              type: object
                                            requests:
                                              additionalProperties:
                                                anyOf:
                                                - type: integer
                                                - type: string
                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                                x-kubernetes-int-or-string: true
                                              description: |-
                                                Requests describes the minimum amount of compute resources required.
                                                If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                                                otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                              type: object
                                          type: object
                                        securityContext:
                                          description: If specified, the pod's security
                                            context
                                          properties:
                                            fsGroup:
                                              description: |-
                                                A special supplemental group that applies to all containers in a pod.
                                                Some volume types allow the Kubelet to change the ownership of that volume
                                                to be owned by the pod:

                                                1. The owning GID will be the FSGroup
                                                2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
                                                3. The permission bits are OR'd with rw-rw----

                                                If unset, the Kubelet will not modify the ownership and permissions of any volume.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              format: int64
                                              type: integer
                                            fsGroupChangePolicy:
                                              description: |-
                                                fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
                                                before being exposed inside Pod. This field will only apply to
                                                volume types which support fsGroup based ownership(and permissions).
                                                It will have no effect on ephemeral volume types such as: secret, configmaps
                                                and emptydir.
                                                Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              type: string
                                            runAsGroup:
                                              description: |-
                                                The GID to run the entrypoint of the container process.
                                                Uses runtime default if unset.
                                                May also be set in SecurityContext.  If set in both SecurityContext and
                                                PodSecurityContext, the value specified in SecurityContext takes precedence
                                                for that container.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              format: int64
                                              type: integer
                                            runAsNonRoot:
                                              description: |-
                                                Indicates that the container must run as a non-root user.
                                                If true, the Kubelet will validate the image at runtime to ensure that it
                                                does not run as UID 0 (root) and fail to start the container if it does.
                                                If unset or false, no such validation will be performed.
                                                May also be set in SecurityContext.  If set in both SecurityContext and
                                                PodSecurityContext, the value specified in SecurityContext takes precedence.
                                              type: boolean
                                            runAsUser:
                                              description: |-
                                                The UID to run the entrypoint of the container process.
                                                Defaults to user specified in image metadata if unspecified.
                                                May also be set in SecurityContext.  If set in both SecurityContext and
                                                PodSecurityContext, the value specified in SecurityContext takes precedence
                                                for that container.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              format: int64
                                              type: integer
                                            seLinuxOptions:
                                              description: |-
                                                The SELinux context to be applied to all containers.
                                                If unspecified, the container runtime will allocate a random SELinux context for each
                                                container.  May also be set in SecurityContext.  If set in
                                                both SecurityContext and PodSecurityContext, the value specified in SecurityContext
                                                takes precedence for that container.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              properties:
                                                level:
                                                  description: Level is SELinux level
                                                    label that applies to the container.
                                                  type: string
                                                role:
                                                  description: Role is a SELinux role
                                                    label that applies to the container.
                                                  type: string
                                                type:
                                                  description: Type is a SELinux type
                                                    label that applies to the container.
                                                  type: string
                                                user:
                                                  description: User is a SELinux user
                                                    label that applies to the container.
                                                  type: string
                                              type: object
                                            seccompProfile:
                                              description: |-
                                                The seccomp options to use by the containers in this pod.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              properties:
                                                localhostProfile:
                                                  description: |-
                                                    localhostProfile indicates a profile defined in a file on the node should be used.
                                                    The profile must be preconfigured on the node to work.
                                                    Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                                    Must be set if type is "Localhost". Must NOT be set for any other type.
                                                  type: string
                                                type:
                                                  description: |-
                                                    type indicates which kind of seccomp profile will be applied.
                                                    Valid options are:

                                                    Localhost - a profile defined in a file on the node should be used.
                                                    RuntimeDefault - the container runtime default profile should be used.
                                                    Unconfined - no profile should be applied.
                                                  type: string
                                              required:
                                              - type
                                              type: object
                                            supplementalGroups:
                                              description: |-
                                                A list of groups applied to the first process run in each container, in addition
                                                to the container's primary GID, the fsGroup (if specified), and group memberships
                                                defined in the container image for the uid of the container process. If unspecified,
                                                no additional groups are added to any container. Note that group memberships
                                                defined in the container image for the uid of the container process are still effective,
                                                even if they are not included in this list.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              items:
                                                format: int64
                                                type: integer
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            sysctls:
                                              description: |-
                                                Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
                                                sysctls (by the container runtime) might fail to launch.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              items:
                                                description: Sysctl defines a kernel
                                                  parameter to be set
                                                properties:
                                                  name:
                                                    description: Name of a property
                                                      to set
                                                    type: string
                                                  value:
                                                    description: Value of a property
                                                      to set
                                                    type: string
                                                required:
                                                - name
                                                - value
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                          type: object
                                        serviceAccountName:
                                          description: If specified, the pod's service
                                            account
                                          type: string
                                        tolerations:
                                          description: If specified, the pod's tolerations.
                                          items:
                                            description: |-
                                              The pod this Toleration is attached to tolerates any taint that matches
                                              the triple <key,value,effect> using the matching operator <operator>.
                                            properties:
                                              effect:
                                                description: |-
                                                  Effect indicates the taint effect to match. Empty means match all taint effects.
                                                  When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                                                type: string
                                              key:
                                                description: |-
                                                  Key is the taint key that the toleration applies to. Empty means match all taint keys.
                                                  If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                                                type: string
                                              operator:
                                                description: |-
                                                  Operator represents a key's relationship to the value.
                                                  Valid operators are Exists and Equal. Defaults to Equal.
                                                  Exists is equivalent to wildcard for value, so that a pod can
                                                  tolerate all taints of a particular category.
                                                type: string
                                              tolerationSeconds:
                                                description: |-
                                                  TolerationSeconds represents the period of time the toleration (which must be
                                                  of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
                                                  it is not set, which means tolerate the taint forever (do not evict). Zero and
                                                  negative values will be treated as 0 (evict immediately) by the system.
                                                format: int64
                                                type: integer
                                              value:
                                                description: |-
                                                  Value is the taint value the toleration matches to.
                                                  If the operator is Exists, the value should be empty, otherwise just a regular string.
                                                type: string
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      type: object
                                  type: object
                                serviceType:
                                  description: |-
                                    Optional service type for Kubernetes solver service. Supported values
                                    are NodePort or ClusterIP. If unset, defaults to NodePort.
                                  type: string
                              type: object
                            ingress:
                              description: |-
                                The ingress based HTTP01 challenge solver will solve challenges by
                                creating or modifying Ingress resources in order to route requests for
                                '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
                                provisioned by cert-manager for each Challenge to be completed.
                              properties:
                                class:
                                  description: |-
                                    This field configures the annotation `kubernetes.io/ingress.class` when
                                    creating Ingress resources to solve ACME challenges that use this
                                    challenge solver. Only one of `class`, `name` or `ingressClassName` may
                                    be specified.
                                  type: string
                                ingressClassName:
                                  description: |-
                                    This field configures the field `ingressClassName` on the created Ingress
                                    resources used to solve ACME challenges that use this challenge solver.
                                    This is the recommended way of configuring the ingress class. Only one of
                                    `class`, `name` or `ingressClassName` may be specified.
                                  type: string
                                ingressTemplate:
                                  description: |-
                                    Optional ingress template used to configure the ACME challenge solver
                                    ingress used for HTTP01 challenges.
                                  properties:
                                    metadata:
                                      description: |-
                                        ObjectMeta overrides for the ingress used to solve HTTP01 challenges.
                                        Only the 'labels' and 'annotations' fields may be set.
                                        If labels or annotations overlap with in-built values, the values here
                                        will override the in-built values.
                                      properties:
                                        annotations:
                                          additionalProperties:
                                            type: string
                                          description: Annotations that should be
                                            added to the created ACME HTTP01 solver
                                            ingress.
                                          type: object
                                        labels:
                                          additionalProperties:
                                            type: string
                                          description: Labels that should be added
                                            to the created ACME HTTP01 solver ingress.
                                          type: object
                                      type: object
                                  type: object
                                name:
                                  description: |-
                                    The name of the ingress resource that should have ACME challenge solving
                                    routes inserted into it in order to solve HTTP01 challenges.
                                    This is typically used in conjunction with ingress controllers like
                                    ingress-gce, which maintains a 1:1 mapping between external IPs and
                                    ingress resources. Only one of `class`, `name` or `ingressClassName` may
                                    be specified.
                                  type: string
                                podTemplate:
                                  description: |-
                                    Optional pod template used to configure the ACME challenge solver pods
                                    used for HTTP01 challenges.
                                  properties:
                                    metadata:
                                      description: |-
                                        ObjectMeta overrides for the pod used to solve HTTP01 challenges.
                                        Only the 'labels' and 'annotations' fields may be set.
                                        If labels or annotations overlap with in-built values, the values here
                                        will override the in-built values.
                                      properties:
                                        annotations:
                                          additionalProperties:
                                            type: string
                                          description: Annotations that should be
                                            added to the created ACME HTTP01 solver
                                            pods.
                                          type: object
                                        labels:
                                          additionalProperties:
                                            type: string
                                          description: Labels that should be added
                                            to the created ACME HTTP01 solver pods.
                                          type: object
                                      type: object
                                    spec:
                                      description: |-
                                        PodSpec defines overrides for the HTTP01 challenge solver pod.
                                        Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
                                        All other fields will be ignored.
                                      properties:
                                        affinity:
                                          description: If specified, the pod's scheduling
                                            constraints
                                          properties:
                                            nodeAffinity:
                                              description: Describes node affinity
                                                scheduling rules for the pod.
                                              properties:
                                                preferredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    The scheduler will prefer to schedule pods to nodes that satisfy
                                                    the affinity expressions specified by this field, but it may choose
                                                    a node that violates one or more of the expressions. The node that is
                                                    most preferred is the one with the greatest sum of weights, i.e.
                                                    for each node that meets all of the scheduling requirements (resource
                                                    request, requiredDuringScheduling affinity expressions, etc.),
                                                    compute a sum by iterating through the elements of this field and adding
                                                    "weight" to the sum if the node matches the corresponding matchExpressions; the
                                                    node(s) with the highest sum are the most preferred.
                                                  items:
                                                    description: |-
                                                      An empty preferred scheduling term matches all objects with implicit weight 0
                                                      (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
                                                    properties:
                                                      preference:
                                                        description: A node selector
                                                          term, associated with the
                                                          corresponding weight.
                                                        properties:
                                                          matchExpressions:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's labels.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchFields:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's fields.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      weight:
                                                        description: Weight associated
                                                          with matching the corresponding
                                                          nodeSelectorTerm, in the
                                                          range 1-100.
                                                        format: int32
                                                        type: integer
                                                    required:
                                                    - preference
                                                    - weight
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                requiredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    If the affinity requirements specified by this field are not met at
                                                    scheduling time, the pod will not be scheduled onto the node.
                                                    If the affinity requirements specified by this field cease to be met
                                                    at some point during pod execution (e.g. due to an update), the system
                                                    may or may not try to eventually evict the pod from its node.
                                                  properties:
                                                    nodeSelectorTerms:
                                                      description: Required. A list
                                                        of node selector terms. The
                                                        terms are ORed.
                                                      items:
                                                        description: |-
                                                          A null or empty node selector term matches no objects. The requirements of
                                                          them are ANDed.
                                                          The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
                                                        properties:
                                                          matchExpressions:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's labels.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchFields:
                                                            description: A list of
                                                              node selector requirements
                                                              by node's fields.
                                                            items:
                                                              description: |-
                                                                A node selector requirement is a selector that contains values, a key, and an operator
                                                                that relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: The
                                                                    label key that
                                                                    the selector applies
                                                                    to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    Represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    An array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. If the operator is Gt or Lt, the values
                                                                    array must have a single element, which will be interpreted as an integer.
                                                                    This array is replaced during a strategic merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      type: array
                                                      x-kubernetes-list-type: atomic
                                                  required:
                                                  - nodeSelectorTerms
                                                  type: object
                                                  x-kubernetes-map-type: atomic
                                              type: object
                                            podAffinity:
                                              description: Describes pod affinity
                                                scheduling rules (e.g. co-locate this
                                                pod in the same node, zone, etc. as
                                                some other pod(s)).
                                              properties:
                                                preferredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    The scheduler will prefer to schedule pods to nodes that satisfy
                                                    the affinity expressions specified by this field, but it may choose
                                                    a node that violates one or more of the expressions. The node that is
                                                    most preferred is the one with the greatest sum of weights, i.e.
                                                    for each node that meets all of the scheduling requirements (resource
                                                    request, requiredDuringScheduling affinity expressions, etc.),
                                                    compute a sum by iterating through the elements of this field and adding
                                                    "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                                    node(s) with the highest sum are the most preferred.
                                                  items:
                                                    description: The weights of all
                                                      of the matched WeightedPodAffinityTerm
                                                      fields are added per-node to
                                                      find the most preferred node(s)
                                                    properties:
                                                      podAffinityTerm:
                                                        description: Required. A pod
                                                          affinity term, associated
                                                          with the corresponding weight.
                                                        properties:
                                                          labelSelector:
                                                            description: |-
                                                              A label query over a set of resources, in this case pods.
                                                              If it's null, this PodAffinityTerm matches with no Pods.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          matchLabelKeys:
                                                            description: |-
                                                              MatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                              Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          mismatchLabelKeys:
                                                            description: |-
                                                              MismatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                              Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          namespaceSelector:
                                                            description: |-
                                                              A label query over the set of namespaces that the term applies to.
                                                              The term is applied to the union of the namespaces selected by this field
                                                              and the ones listed in the namespaces field.
                                                              null selector and null or empty namespaces list means "this pod's namespace".
                                                              An empty selector ({}) matches all namespaces.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          namespaces:
                                                            description: |-
                                                              namespaces specifies a static list of namespace names that the term applies to.
                                                              The term is applied to the union of the namespaces listed in this field
                                                              and the ones selected by namespaceSelector.
                                                              null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          topologyKey:
                                                            description: |-
                                                              This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                              the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                              whose value of the label with key topologyKey matches that of any node on which any of the
                                                              selected pods is running.
                                                              Empty topologyKey is not allowed.
                                                            type: string
                                                        required:
                                                        - topologyKey
                                                        type: object
                                                      weight:
                                                        description: |-
                                                          weight associated with matching the corresponding podAffinityTerm,
                                                          in the range 1-100.
                                                        format: int32
                                                        type: integer
                                                    required:
                                                    - podAffinityTerm
                                                    - weight
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                requiredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    If the affinity requirements specified by this field are not met at
                                                    scheduling time, the pod will not be scheduled onto the node.
                                                    If the affinity requirements specified by this field cease to be met
                                                    at some point during pod execution (e.g. due to a pod label update), the
                                                    system may or may not try to eventually evict the pod from its node.
                                                    When there are multiple elements, the lists of nodes corresponding to each
                                                    podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                                  items:
                                                    description: |-
                                                      Defines a set of pods (namely those matching the labelSelector
                                                      relative to the given namespace(s)) that this pod should be
                                                      co-located (affinity) or not co-located (anti-affinity) with,
                                                      where co-located is defined as running on a node whose value of
                                                      the label with key <topologyKey> matches that of any node on which
                                                      a pod of the set of pods is running
                                                    properties:
                                                      labelSelector:
                                                        description: |-
                                                          A label query over a set of resources, in this case pods.
                                                          If it's null, this PodAffinityTerm matches with no Pods.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      matchLabelKeys:
                                                        description: |-
                                                          MatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      mismatchLabelKeys:
                                                        description: |-
                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      namespaceSelector:
                                                        description: |-
                                                          A label query over the set of namespaces that the term applies to.
                                                          The term is applied to the union of the namespaces selected by this field
                                                          and the ones listed in the namespaces field.
                                                          null selector and null or empty namespaces list means "this pod's namespace".
                                                          An empty selector ({}) matches all namespaces.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      namespaces:
                                                        description: |-
                                                          namespaces specifies a static list of namespace names that the term applies to.
                                                          The term is applied to the union of the namespaces listed in this field
                                                          and the ones selected by namespaceSelector.
                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      topologyKey:
                                                        description: |-
                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                          whose value of the label with key topologyKey matches that of any node on which any of the
                                                          selected pods is running.
                                                          Empty topologyKey is not allowed.
                                                        type: string
                                                    required:
                                                    - topologyKey
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              type: object
                                            podAntiAffinity:
                                              description: Describes pod anti-affinity
                                                scheduling rules (e.g. avoid putting
                                                this pod in the same node, zone, etc.
                                                as some other pod(s)).
                                              properties:
                                                preferredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    The scheduler will prefer to schedule pods to nodes that satisfy
                                                    the anti-affinity expressions specified by this field, but it may choose
                                                    a node that violates one or more of the expressions. The node that is
                                                    most preferred is the one with the greatest sum of weights, i.e.
                                                    for each node that meets all of the scheduling requirements (resource
                                                    request, requiredDuringScheduling anti-affinity expressions, etc.),
                                                    compute a sum by iterating through the elements of this field and subtracting
                                                    "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                                    node(s) with the highest sum are the most preferred.
                                                  items:
                                                    description: The weights of all
                                                      of the matched WeightedPodAffinityTerm
                                                      fields are added per-node to
                                                      find the most preferred node(s)
                                                    properties:
                                                      podAffinityTerm:
                                                        description: Required. A pod
                                                          affinity term, associated
                                                          with the corresponding weight.
                                                        properties:
                                                          labelSelector:
                                                            description: |-
                                                              A label query over a set of resources, in this case pods.
                                                              If it's null, this PodAffinityTerm matches with no Pods.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          matchLabelKeys:
                                                            description: |-
                                                              MatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                              Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          mismatchLabelKeys:
                                                            description: |-
                                                              MismatchLabelKeys is a set of pod label keys to select which pods will
                                                              be taken into consideration. The keys are used to lookup values from the
                                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                              to select the group of existing pods which pods will be taken into consideration
                                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                              pod labels will be ignored. The default value is empty.
                                                              The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                              Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          namespaceSelector:
                                                            description: |-
                                                              A label query over the set of namespaces that the term applies to.
                                                              The term is applied to the union of the namespaces selected by this field
                                                              and the ones listed in the namespaces field.
                                                              null selector and null or empty namespaces list means "this pod's namespace".
                                                              An empty selector ({}) matches all namespaces.
                                                            properties:
                                                              matchExpressions:
                                                                description: matchExpressions
                                                                  is a list of label
                                                                  selector requirements.
                                                                  The requirements
                                                                  are ANDed.
                                                                items:
                                                                  description: |-
                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                                                    relates the key and values.
                                                                  properties:
                                                                    key:
                                                                      description: key
                                                                        is the label
                                                                        key that the
                                                                        selector applies
                                                                        to.
                                                                      type: string
                                                                    operator:
                                                                      description: |-
                                                                        operator represents a key's relationship to a set of values.
                                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                      type: string
                                                                    values:
                                                                      description: |-
                                                                        values is an array of string values. If the operator is In or NotIn,
                                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                        the values array must be empty. This array is replaced during a strategic
                                                                        merge patch.
                                                                      items:
                                                                        type: string
                                                                      type: array
                                                                      x-kubernetes-list-type: atomic
                                                                  required:
                                                                  - key
                                                                  - operator
                                                                  type: object
                                                                type: array
                                                                x-kubernetes-list-type: atomic
                                                              matchLabels:
                                                                additionalProperties:
                                                                  type: string
                                                                description: |-
                                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                                type: object
                                                            type: object
                                                            x-kubernetes-map-type: atomic
                                                          namespaces:
                                                            description: |-
                                                              namespaces specifies a static list of namespace names that the term applies to.
                                                              The term is applied to the union of the namespaces listed in this field
                                                              and the ones selected by namespaceSelector.
                                                              null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                            items:
                                                              type: string
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          topologyKey:
                                                            description: |-
                                                              This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                              the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                              whose value of the label with key topologyKey matches that of any node on which any of the
                                                              selected pods is running.
                                                              Empty topologyKey is not allowed.
                                                            type: string
                                                        required:
                                                        - topologyKey
                                                        type: object
                                                      weight:
                                                        description: |-
                                                          weight associated with matching the corresponding podAffinityTerm,
                                                          in the range 1-100.
                                                        format: int32
                                                        type: integer
                                                    required:
                                                    - podAffinityTerm
                                                    - weight
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                                requiredDuringSchedulingIgnoredDuringExecution:
                                                  description: |-
                                                    If the anti-affinity requirements specified by this field are not met at
                                                    scheduling time, the pod will not be scheduled onto the node.
                                                    If the anti-affinity requirements specified by this field cease to be met
                                                    at some point during pod execution (e.g. due to a pod label update), the
                                                    system may or may not try to eventually evict the pod from its node.
                                                    When there are multiple elements, the lists of nodes corresponding to each
                                                    podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                                  items:
                                                    description: |-
                                                      Defines a set of pods (namely those matching the labelSelector
                                                      relative to the given namespace(s)) that this pod should be
                                                      co-located (affinity) or not co-located (anti-affinity) with,
                                                      where co-located is defined as running on a node whose value of
                                                      the label with key <topologyKey> matches that of any node on which
                                                      a pod of the set of pods is running
                                                    properties:
                                                      labelSelector:
                                                        description: |-
                                                          A label query over a set of resources, in this case pods.
                                                          If it's null, this PodAffinityTerm matches with no Pods.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      matchLabelKeys:
                                                        description: |-
                                                          MatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      mismatchLabelKeys:
                                                        description: |-
                                                          MismatchLabelKeys is a set of pod label keys to select which pods will
                                                          be taken into consideration. The keys are used to lookup values from the
                                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                                          to select the group of existing pods which pods will be taken into consideration
                                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                                          pod labels will be ignored. The default value is empty.
                                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      namespaceSelector:
                                                        description: |-
                                                          A label query over the set of namespaces that the term applies to.
                                                          The term is applied to the union of the namespaces selected by this field
                                                          and the ones listed in the namespaces field.
                                                          null selector and null or empty namespaces list means "this pod's namespace".
                                                          An empty selector ({}) matches all namespaces.
                                                        properties:
                                                          matchExpressions:
                                                            description: matchExpressions
                                                              is a list of label selector
                                                              requirements. The requirements
                                                              are ANDed.
                                                            items:
                                                              description: |-
                                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                                relates the key and values.
                                                              properties:
                                                                key:
                                                                  description: key
                                                                    is the label key
                                                                    that the selector
                                                                    applies to.
                                                                  type: string
                                                                operator:
                                                                  description: |-
                                                                    operator represents a key's relationship to a set of values.
                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                                  type: string
                                                                values:
                                                                  description: |-
                                                                    values is an array of string values. If the operator is In or NotIn,
                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                                    the values array must be empty. This array is replaced during a strategic
                                                                    merge patch.
                                                                  items:
                                                                    type: string
                                                                  type: array
                                                                  x-kubernetes-list-type: atomic
                                                              required:
                                                              - key
                                                              - operator
                                                              type: object
                                                            type: array
                                                            x-kubernetes-list-type: atomic
                                                          matchLabels:
                                                            additionalProperties:
                                                              type: string
                                                            description: |-
                                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                                            type: object
                                                        type: object
                                                        x-kubernetes-map-type: atomic
                                                      namespaces:
                                                        description: |-
                                                          namespaces specifies a static list of namespace names that the term applies to.
                                                          The term is applied to the union of the namespaces listed in this field
                                                          and the ones selected by namespaceSelector.
                                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                                        items:
                                                          type: string
                                                        type: array
                                                        x-kubernetes-list-type: atomic
                                                      topologyKey:
                                                        description: |-
                                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                                          whose value of the label with key topologyKey matches that of any node on which any of the
                                                          selected pods is running.
                                                          Empty topologyKey is not allowed.
                                                        type: string
                                                    required:
                                                    - topologyKey
                                                    type: object
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              type: object
                                          type: object
                                        imagePullSecrets:
                                          description: If specified, the pod's imagePullSecrets
                                          items:
                                            description: |-
                                              LocalObjectReference contains enough information to let you locate the
                                              referenced object inside the same namespace.
                                            properties:
                                              name:
                                                default: ""
                                                description: |-
                                                  Name of the referent.
                                                  This field is effectively required, but due to backwards compatibility is
                                                  allowed to be empty. Instances of this type with an empty value here are
                                                  almost certainly wrong.
                                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                                type: string
                                            type: object
                                            x-kubernetes-map-type: atomic
                                          type: array
                                          x-kubernetes-list-map-keys:
                                          - name
                                          x-kubernetes-list-type: map
                                        nodeSelector:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            NodeSelector is a selector which must be true for the pod to fit on a node.
                                            Selector which must match a node's labels for the pod to be scheduled on that node.
                                            More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
                                          type: object
                                        priorityClassName:
                                          description: If specified, the pod's priorityClassName.
                                          type: string
                                        resources:
                                          description: |-
                                            If specified, the pod's resource requirements.
                                            These values override the global resource configuration flags.
                                            Note that when only specifying resource limits, ensure they are greater than or equal
                                            to the corresponding global resource requests configured via controller flags
                                            (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).
                                            Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures.
                                          properties:
                                            limits:
                                              additionalProperties:
                                                anyOf:
                                                - type: integer
                                                - type: string
                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                                x-kubernetes-int-or-string: true
                                              description: |-
                                                Limits describes the maximum amount of compute resources allowed.
                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                              type: object
                                            requests:
                                              additionalProperties:
                                                anyOf:
                                                - type: integer
                                                - type: string
                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                                x-kubernetes-int-or-string: true
                                              description: |-
                                                Requests describes the minimum amount of compute resources required.
                                                If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                                                otherwise to the global values configured via controller flags. Requests cannot exceed Limits.
                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                              type: object
                                          type: object
                                        securityContext:
                                          description: If specified, the pod's security
                                            context
                                          properties:
                                            fsGroup:
                                              description: |-
                                                A special supplemental group that applies to all containers in a pod.
                                                Some volume types allow the Kubelet to change the ownership of that volume
                                                to be owned by the pod:

                                                1. The owning GID will be the FSGroup
                                                2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
                                                3. The permission bits are OR'd with rw-rw----

                                                If unset, the Kubelet will not modify the ownership and permissions of any volume.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              format: int64
                                              type: integer
                                            fsGroupChangePolicy:
                                              description: |-
                                                fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
                                                before being exposed inside Pod. This field will only apply to
                                                volume types which support fsGroup based ownership(and permissions).
                                                It will have no effect on ephemeral volume types such as: secret, configmaps
                                                and emptydir.
                                                Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              type: string
                                            runAsGroup:
                                              description: |-
                                                The GID to run the entrypoint of the container process.
                                                Uses runtime default if unset.
                                                May also be set in SecurityContext.  If set in both SecurityContext and
                                                PodSecurityContext, the value specified in SecurityContext takes precedence
                                                for that container.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              format: int64
                                              type: integer
                                            runAsNonRoot:
                                              description: |-
                                                Indicates that the container must run as a non-root user.
                                                If true, the Kubelet will validate the image at runtime to ensure that it
                                                does not run as UID 0 (root) and fail to start the container if it does.
                                                If unset or false, no such validation will be performed.
                                                May also be set in SecurityContext.  If set in both SecurityContext and
                                                PodSecurityContext, the value specified in SecurityContext takes precedence.
                                              type: boolean
                                            runAsUser:
                                              description: |-
                                                The UID to run the entrypoint of the container process.
                                                Defaults to user specified in image metadata if unspecified.
                                                May also be set in SecurityContext.  If set in both SecurityContext and
                                                PodSecurityContext, the value specified in SecurityContext takes precedence
                                                for that container.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              format: int64
                                              type: integer
                                            seLinuxOptions:
                                              description: |-
                                                The SELinux context to be applied to all containers.
                                                If unspecified, the container runtime will allocate a random SELinux context for each
                                                container.  May also be set in SecurityContext.  If set in
                                                both SecurityContext and PodSecurityContext, the value specified in SecurityContext
                                                takes precedence for that container.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              properties:
                                                level:
                                                  description: Level is SELinux level
                                                    label that applies to the container.
                                                  type: string
                                                role:
                                                  description: Role is a SELinux role
                                                    label that applies to the container.
                                                  type: string
                                                type:
                                                  description: Type is a SELinux type
                                                    label that applies to the container.
                                                  type: string
                                                user:
                                                  description: User is a SELinux user
                                                    label that applies to the container.
                                                  type: string
                                              type: object
                                            seccompProfile:
                                              description: |-
                                                The seccomp options to use by the containers in this pod.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              properties:
                                                localhostProfile:
                                                  description: |-
                                                    localhostProfile indicates a profile defined in a file on the node should be used.
                                                    The profile must be preconfigured on the node to work.
                                                    Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                                    Must be set if type is "Localhost". Must NOT be set for any other type.
                                                  type: string
                                                type:
                                                  description: |-
                                                    type indicates which kind of seccomp profile will be applied.
                                                    Valid options are:

                                                    Localhost - a profile defined in a file on the node should be used.
                                                    RuntimeDefault - the container runtime default profile should be used.
                                                    Unconfined - no profile should be applied.
                                                  type: string
                                              required:
                                              - type
                                              type: object
                                            supplementalGroups:
                                              description: |-
                                                A list of groups applied to the first process run in each container, in addition
                                                to the container's primary GID, the fsGroup (if specified), and group memberships
                                                defined in the container image for the uid of the container process. If unspecified,
                                                no additional groups are added to any container. Note that group memberships
                                                defined in the container image for the uid of the container process are still effective,
                                                even if they are not included in this list.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              items:
                                                format: int64
                                                type: integer
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            sysctls:
                                              description: |-
                                                Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
                                                sysctls (by the container runtime) might fail to launch.
                                                Note that this field cannot be set when spec.os.name is windows.
                                              items:
                                                description: Sysctl defines a kernel
                                                  parameter to be set
                                                properties:
                                                  name:
                                                    description: Name of a property
                                                      to set
                                                    type: string
                                                  value:
                                                    description: Value of a property
                                                      to set
                                                    type: string
                                                required:
                                                - name
                                                - value
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                          type: object
                                        serviceAccountName:
                                          description: If specified, the pod's service
                                            account
                                          type: string
                                        tolerations:
                                          description: If specified, the pod's tolerations.
                                          items:
                                            description: |-
                                              The pod this Toleration is attached to tolerates any taint that matches
                                              the triple <key,value,effect> using the matching operator <operator>.
                                            properties:
                                              effect:
                                                description: |-
                                                  Effect indicates the taint effect to match. Empty means match all taint effects.
                                                  When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                                                type: string
                                              key:
                                                description: |-
                                                  Key is the taint key that the toleration applies to. Empty means match all taint keys.
                                                  If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                                                type: string
                                              operator:
                                                description: |-
                                                  Operator represents a key's relationship to the value.
                                                  Valid operators are Exists and Equal. Defaults to Equal.
                                                  Exists is equivalent to wildcard for value, so that a pod can
                                                  tolerate all taints of a particular category.
                                                type: string
                                              tolerationSeconds:
                                                description: |-
                                                  TolerationSeconds represents the period of time the toleration (which must be
                                                  of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
                                                  it is not set, which means tolerate the taint forever (do not evict). Zero and
                                                  negative values will be treated as 0 (evict immediately) by the system.
                                                format: int64
                                                type: integer
                                              value:
                                                description: |-
                                                  Value is the taint value the toleration matches to.
                                                  If the operator is Exists, the value should be empty, otherwise just a regular string.
                                                type: string
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      type: object
                                  type: object
                                serviceType:
                                  description: |-
                                    Optional service type for Kubernetes solver service. Supported values
                                    are NodePort or ClusterIP. If unset, defaults to NodePort.
                                  type: string
                              type: object
                          type: object
                        selector:
                          description: |-
                            Selector selects a set of DNSNames on the Certificate resource that
                            should be solved using this challenge solver.
                            If not specified, the solver will be treated as the 'default' solver
                            with the lowest priority, i.e. if any other solver has a more specific
                            match, it will be used instead.
                          properties:
                            dnsNames:
                              description: |-
                                List of DNSNames that this solver will be used to solve.
                                If specified and a match is found, a dnsNames selector will take
                                precedence over a dnsZones selector.
                                If multiple solvers match with the same dnsNames value, the solver
                                with the most matching labels in matchLabels will be selected.
                                If neither has more matches, the solver defined earlier in the list
                                will be selected.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                            dnsZones:
                              description: |-
                                List of DNSZones that this solver will be used to solve.
                                The most specific DNS zone match specified here will take precedence
                                over other DNS zone matches, so a solver specifying sys.example.com
                                will be selected over one specifying example.com for the domain
                                www.sys.example.com.
                                If multiple solvers match with the same dnsZones value, the solver
                                with the most matching labels in matchLabels will be selected.
                                If neither has more matches, the solver defined earlier in the list
                                will be selected.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                            matchLabels:
                              additionalProperties:
                                type: string
                              description: |-
                                A label selector that is used to refine the set of certificate's that
                                this challenge solver will apply to.
                              type: object
                          type: object
                      type: object
                    type: array
                    x-kubernetes-list-type: atomic
                required:
                - privateKeySecretRef
                - server
                type: object
              ca:
                description: |-
                  CA configures this issuer to sign certificates using a signing CA keypair
                  stored in a Secret resource.
                  This is used to build internal PKIs that are managed by cert-manager.
                properties:
                  crlDistributionPoints:
                    description: |-
                      The CRL distribution points is an X.509 v3 certificate extension which identifies
                      the location of the CRL from which the revocation of this certificate can be checked.
                      If not set, certificates will be issued without distribution points set.
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                  issuingCertificateURLs:
                    description: |-
                      IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates
                      it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.
                      As an example, such a URL might be "http://ca.domain.com/ca.crt".
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                  ocspServers:
                    description: |-
                      The OCSP server list is an X.509 v3 extension that defines a list of
                      URLs of OCSP responders. The OCSP responders can be queried for the
                      revocation status of an issued certificate. If not set, the
                      certificate will be issued with no OCSP servers set. For example, an
                      OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org".
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                  secretName:
                    description: |-
                      SecretName is the name of the secret used to sign Certificates issued
                      by this Issuer.
                    type: string
                required:
                - secretName
                type: object
              selfSigned:
                description: |-
                  SelfSigned configures this issuer to 'self sign' certificates using the
                  private key used to create the CertificateRequest object.
                properties:
                  crlDistributionPoints:
                    description: |-
                      The CRL distribution points is an X.509 v3 certificate extension which identifies
                      the location of the CRL from which the revocation of this certificate can be checked.
                      If not set certificate will be issued without CDP. Values are strings.
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: atomic
                type: object
              vault:
                description: |-
                  Vault configures this issuer to sign certificates using a HashiCorp Vault
                  PKI backend.
                properties:
                  auth:
                    description: Auth configures how cert-manager authenticates with
                      the Vault server.
                    properties:
                      appRole:
                        description: |-
                          AppRole authenticates with Vault using the App Role auth mechanism,
                          with the role and secret stored in a Kubernetes Secret resource.
                        properties:
                          path:
                            description: |-
                              Path where the App Role authentication backend is mounted in Vault, e.g:
                              "approle"
                            type: string
                          roleId:
                            description: |-
                              RoleID configured in the App Role authentication backend when setting
                              up the authentication backend in Vault.
                            type: string
                          secretRef:
                            description: |-
                              Reference to a key in a Secret that contains the App Role secret used
                              to authenticate with Vault.
                              The `key` field must be specified and denotes which entry within the Secret
                              resource is used as the app role secret.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                        required:
                        - path
                        - roleId
                        - secretRef
                        type: object
                      clientCertificate:
                        description: |-
                          ClientCertificate authenticates with Vault by presenting a client
                          certificate during the request's TLS handshake.
                          Works only when using HTTPS protocol.
                        properties:
                          mountPath:
                            description: |-
                              The Vault mountPath here is the mount path to use when authenticating with
                              Vault. For example, setting a value to `/v1/auth/foo`, will use the path
                              `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
                              default value "/v1/auth/cert" will be used.
                            type: string
                          name:
                            description: |-
                              Name of the certificate role to authenticate against.
                              If not set, matching any certificate role, if available.
                            type: string
                          secretName:
                            description: |-
                              Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing
                              tls.crt and tls.key) used to authenticate to Vault using TLS client
                              authentication.
                            type: string
                        type: object
                      kubernetes:
                        description: |-
                          Kubernetes authenticates with Vault by passing the ServiceAccount
                          token stored in the named Secret resource to the Vault server.
                        properties:
                          mountPath:
                            description: |-
                              The Vault mountPath here is the mount path to use when authenticating with
                              Vault. For example, setting a value to `/v1/auth/foo`, will use the path
                              `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
                              default value "/v1/auth/kubernetes" will be used.
                            type: string
                          role:
                            description: |-
                              A required field containing the Vault Role to assume. A Role binds a
                              Kubernetes ServiceAccount with a set of Vault policies.
                            type: string
                          secretRef:
                            description: |-
                              The required Secret field containing a Kubernetes ServiceAccount JWT used
                              for authenticating with Vault. Use of 'ambient credentials' is not
                              supported.
                            properties:
                              key:
                                description: |-
                                  The key of the entry in the Secret resource's `data` field to be used.
                                  Some instances of this field may be defaulted, in others it may be
                                  required.
                                type: string
                              name:
                                description: |-
                                  Name of the resource being referred to.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                            required:
                            - name
                            type: object
                          serviceAccountRef:
                            description: |-
                              A reference to a service account that will be used to request a bound
                              token (also known as "projected token"). Compared to using "secretRef",
                              using this field means that you don't rely on statically bound tokens. To
                              use this field, you must configure an RBAC rule to let cert-manager
                              request a token.
                            properties:
                              audiences:
                                description: |-
                                  TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
                                  consisting of the issuer's namespace and name is always included.
                                items:
                                  type: string
                                type: array
                                x-kubernetes-list-type: atomic
                              name:
                                description: Name of the ServiceAccount used to request
                                  a token.
                                type: string
                            required:
                            - name
                            type: object
                        required:
                        - role
                        type: object
                      tokenSecretRef:
                        description: TokenSecretRef authenticates with Vault by presenting
                          a token.
                        properties:
                          key:
                            description: |-
                              The key of the entry in the Secret resource's `data` field to be used.
                              Some instances of this field may be defaulted, in others it may be
                              required.
                            type: string
                          name:
                            description: |-
                              Name of the resource being referred to.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        required:
                        - name
                        type: object
                    type: object
                  caBundle:
                    description: |-
                      Base64-encoded bundle of PEM CAs which will be used to validate the certificate
                      chain presented by Vault. Only used if using HTTPS to connect to Vault and
                      ignored for HTTP connections.
                      Mutually exclusive with CABundleSecretRef.
                      If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
                      the cert-manager controller container is used to validate the TLS connection.
                    format: byte
                    type: string
                  caBundleSecretRef:
                    description: |-
                      Reference to a Secret containing a bundle of PEM-encoded CAs to use when
                      verifying the certificate chain presented by Vault when using HTTPS.
                      Mutually exclusive with CABundle.
                      If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in
                      the cert-manager controller container is used to validate the TLS connection.
                      If no key for the Secret is specified, cert-manager will default to 'ca.crt'.
                    properties:
                      key:
                        description: |-
                          The key of the entry in the Secret resource's `data` field to be used.
                          Some instances of this field may be defaulted, in others it may be
                          required.
                        type: string
                      name:
                        description: |-
                          Name of the resource being referred to.
                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                        type: string
                    required:
                    - name
                    type: object
                  clientCertSecretRef:
                    description: |-
                      Reference to a Secret containing a PEM-encoded Client Certificate to use when the
                      Vault server requires mTLS.
                    properties:
                      key:
                        description: |-
                          The key of the entry in the Secret resource's `data` field to be used.
                          Some instances of this field may be defaulted, in others it may be
                          required.
                        type: string
                      name:
                        description: |-
                          Name of the resource being referred to.
                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                        type: string
                    required:
                    - name
                    type: object
                  clientKeySecretRef:
                    description: |-
                      Reference to a Secret containing a PEM-encoded Client Private Key to use when the
                      Vault server requires mTLS.
                    properties:
                      key:
                        description: |-
                          The key of the entry in the Secret resource's `data` field to be used.
                          Some instances of this field may be defaulted, in others it may be
                          required.
                        type: string
                      name:
                        description: |-
                          Name of the resource being referred to.
                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                        type: string
                    required:
                    - name
                    type: object
                  namespace:
                    description: |-
                      Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1"
                      More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
                    type: string
                  path:
                    description: |-
                      Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
                      "my_pki_mount/sign/my-role-name".
                    type: string
                  server:
                    description: 'Server is the connection address for the Vault server,
                      e.g: "https://vault.example.com:8200".'
                    type: string
                  serverName:
                    description: |-
                      ServerName is used to verify the hostname on the returned certificates
                      by the Vault server.
                    type: string
                required:
                - auth
                - path
                - server
                type: object
              venafi:
                description: |-
                  Venafi configures this issuer to sign certificates using a Venafi TPP
                  or Venafi Cloud policy zone.
                properties:
                  cloud:
                    description: |-
                      Cloud specifies the Venafi cloud configuration settings.
                      Only one of TPP or Cloud may be specified.
                    properties:
                      apiTokenSecretRef:
                        description: APITokenSecretRef is a secret key selector for
                          the Venafi Cloud API token.
                        properties:
                          key:
                            description: |-
                              The key of the entry in the Secret resource's `data` field to be used.
                              Some instances of this field may be defaulted, in others it may be
                              required.
                            type: string
                          name:
                            description: |-
                              Name of the resource being referred to.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        required:
                        - name
                        type: object
                      url:
                        description: |-
                          URL is the base URL for Venafi Cloud.
                          Defaults to "https://api.venafi.cloud/".
                        type: string
                    required:
                    - apiTokenSecretRef
                    type: object
                  tpp:
                    description: |-
                      TPP specifies Trust Protection Platform configuration settings.
                      Only one of TPP or Cloud may be specified.
                    properties:
                      caBundle:
                        description: |-
                          Base64-encoded bundle of PEM CAs which will be used to validate the certificate
                          chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
                          If undefined, the certificate bundle in the cert-manager controller container
                          is used to validate the chain.
                        format: byte
                        type: string
                      caBundleSecretRef:
                        description: |-
                          Reference to a Secret containing a base64-encoded bundle of PEM CAs
                          which will be used to validate the certificate chain presented by the TPP server.
                          Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
                          If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
                          the cert-manager controller container is used to validate the TLS connection.
                        properties:
                          key:
                            description: |-
                              The key of the entry in the Secret resource's `data` field to be used.
                              Some instances of this field may be defaulted, in others it may be
                              required.
                            type: string
                          name:
                            description: |-
                              Name of the resource being referred to.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        required:
                        - name
                        type: object
                      credentialsRef:
                        description: |-
                          CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
                          The secret must contain the key 'access-token' for the Access Token Authentication,
                          or two keys, 'username' and 'password' for the API Keys Authentication.
                        properties:
                          name:
                            description: |-
                              Name of the resource being referred to.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        required:
                        - name
                        type: object
                      url:
                        description: |-
                          URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
                          for example: "https://tpp.example.com/vedsdk".
                        type: string
                    required:
                    - credentialsRef
                    - url
                    type: object
                  zone:
                    description: |-
                      Zone is the Venafi Policy Zone to use for this issuer.
                      All requests made to the Venafi platform will be restricted by the named
                      zone policy.
                      This field is required.
                    type: string
                required:
                - zone
                type: object
            type: object
          status:
            description: Status of the Issuer. This is set and managed automatically.
            properties:
              acme:
                description: |-
                  ACME specific status options.
                  This field should only be set if the Issuer is configured to use an ACME
                  server to issue certificates.
                properties:
                  lastPrivateKeyHash:
                    description: |-
                      LastPrivateKeyHash is a hash of the private key associated with the latest
                      registered ACME account, in order to track changes made to registered account
                      associated with the Issuer
                    type: string
                  lastRegisteredEmail:
                    description: |-
                      LastRegisteredEmail is the email associated with the latest registered
                      ACME account, in order to track changes made to registered account
                      associated with the  Issuer
                    type: string
                  uri:
                    description: |-
                      URI is the unique account identifier, which can also be used to retrieve
                      account details from the CA
                    type: string
                type: object
              conditions:
                description: |-
                  List of status conditions to indicate the status of a CertificateRequest.
                  Known condition types are `Ready`.
                items:
                  description: IssuerCondition contains condition information for
                    an Issuer.
                  properties:
                    lastTransitionTime:
                      description: |-
                        LastTransitionTime is the timestamp corresponding to the last status
                        change of this condition.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        Message is a human readable description of the details of the last
                        transition, complementing reason.
                      type: string
                    observedGeneration:
                      description: |-
                        If set, this represents the .metadata.generation that the condition was
                        set based upon.
                        For instance, if .metadata.generation is currently 12, but the
                        .status.condition[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the Issuer.
                      format: int64
                      type: integer
                    reason:
                      description: |-
                        Reason is a brief machine readable explanation for the condition's last
                        transition.
                      type: string
                    status:
                      description: Status of the condition, one of (`True`, `False`,
                        `Unknown`).
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: Type of the condition, known values are (`Ready`).
                      type: string
                  required:
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: kongclusterplugins.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: KongClusterPlugin
    listKind: KongClusterPluginList
    plural: kongclusterplugins
    shortNames:
    - kcp
    singular: kongclusterplugin
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - description: Name of the plugin
      jsonPath: .plugin
      name: Plugin-Type
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - description: Indicates if the plugin is disabled
      jsonPath: .disabled
      name: Disabled
      priority: 1
      type: boolean
    - description: Configuration of the plugin
      jsonPath: .config
      name: Config
      priority: 1
      type: string
    - jsonPath: .status.conditions[?(@.type=="Programmed")].status
      name: Programmed
      type: string
    name: v1
    schema:
      openAPIV3Schema:
        description: KongClusterPlugin is the Schema for the kongclusterplugins API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          config:
            description: Config contains the plugin configuration. It's a list of
              keys and values required to configure the plugin. Please read the documentation
              of the plugin being configured to set values in here. For any plugin
              in Kong, anything that goes in the `config` JSON key in the Admin API
              request, goes into this property. Only one of `config` or `configFrom`
              may be used in a KongClusterPlugin, not both at once.
            type: object
            x-kubernetes-preserve-unknown-fields: true
          configFrom:
            description: ConfigFrom references a secret containing the plugin configuration.
              This should be used when the plugin configuration contains sensitive
              information, such as AWS credentials in the Lambda plugin or the client
              secret in the OIDC plugin. Only one of `config` or `configFrom` may
              be used in a KongClusterPlugin, not both at once.
            properties:
              secretKeyRef:
                description: Specifies a name, a namespace, and a key of a secret
                  to refer to.
                properties:
                  key:
                    description: The key containing the value.
                    type: string
                  name:
                    description: The secret containing the key.
                    type: string
                  namespace:
                    description: The namespace containing the secret.
                    type: string
                required:
                - key
                - name
                - namespace
                type: object
            type: object
          consumerRef:
            description: ConsumerRef is a reference to a particular consumer.
            type: string
          disabled:
            description: Disabled set if the plugin is disabled or not.
            type: boolean
          instance_name:
            description: InstanceName is an optional custom name to identify an instance
              of the plugin. This is useful when running the same plugin in multiple
              contexts, for example, on multiple services.
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          ordering:
            description: 'Ordering overrides the normal plugin execution order. It''s
              only available on Kong Enterprise. `<phase>` is a request processing
              phase (for example, `access` or `body_filter`) and `<plugin>` is the
              name of the plugin that will run before or after the KongPlugin. For
              example, a KongPlugin with `plugin: rate-limiting` and `before.access:
              ["key-auth"]` will create a rate limiting plugin that limits requests
              _before_ they are authenticated.'
            properties:
              after:
                additionalProperties:
                  items:
                    type: string
                  type: array
                description: PluginOrderingPhase indicates which plugins in a phase
                  should affect the target plugin's order
                type: object
              before:
                additionalProperties:
                  items:
                    type: string
                  type: array
                description: PluginOrderingPhase indicates which plugins in a phase
                  should affect the target plugin's order
                type: object
            type: object
          plugin:
            description: PluginName is the name of the plugin to which to apply the
              config.
            type: string
          protocols:
            description: Protocols configures plugin to run on requests received on
              specific protocols.
            items:
              description: KongProtocol is a valid Kong protocol. This alias is necessary
                to deal with https://github.com/kubernetes-sigs/controller-tools/issues/342
              enum:
              - http
              - https
              - grpc
              - grpcs
              - tcp
              - tls
              - udp
              type: string
            type: array
          run_on:
            description: RunOn configures the plugin to run on the first or the second
              or both nodes in case of a service mesh deployment.
            enum:
            - first
            - second
            - all
            type: string
          status:
            description: Status represents the current status of the KongClusterPlugin
              resource.
            properties:
              conditions:
                default:
                - lastTransitionTime: "1970-01-01T00:00:00Z"
                  message: Waiting for controller
                  reason: Pending
                  status: Unknown
                  type: Programmed
                description: "Conditions describe the current conditions of the KongClusterPluginStatus.
                  \n Known condition types are: \n * \"Programmed\""
                items:
                  description: "Condition contains details for one aspect of the current
                    state of this API Resource. --- This struct is intended for direct
                    use as an array at the field path .status.conditions.  For example,
                    \n type FooStatus struct{ // Represents the observations of a
                    foo's current state. // Known .status.conditions.type are: \"Available\",
                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                  properties:
                    lastTransitionTime:
                      description: lastTransitionTime is the last time the condition
                        transitioned from one status to another. This should be when
                        the underlying condition changed.  If that is not known, then
                        using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: message is a human readable message indicating
                        details about the transition. This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: observedGeneration represents the .metadata.generation
                        that the condition was set based upon. For instance, if .metadata.generation
                        is currently 12, but the .status.conditions[x].observedGeneration
                        is 9, the condition is out of date with respect to the current
                        state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: reason contains a programmatic identifier indicating
                        the reason for the condition's last transition. Producers
                        of specific condition types may define expected values and
                        meanings for this field, and whether the values are considered
                        a guaranteed API. The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                        --- Many .condition.type values are consistent across resources
                        like Available, but because arbitrary conditions can be useful
                        (see .node.status.conditions), the ability to deconflict is
                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                maxItems: 8
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        required:
        - plugin
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: kongconsumergroups.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: KongConsumerGroup
    listKind: KongConsumerGroupList
    plural: kongconsumergroups
    shortNames:
    - kcg
    singular: kongconsumergroup
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - jsonPath: .status.conditions[?(@.type=="Programmed")].status
      name: Programmed
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: KongConsumerGroup is the Schema for the kongconsumergroups API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          status:
            description: Status represents the current status of the KongConsumer
              resource.
            properties:
              conditions:
                default:
                - lastTransitionTime: "1970-01-01T00:00:00Z"
                  message: Waiting for controller
                  reason: Pending
                  status: Unknown
                  type: Programmed
                description: "Conditions describe the current conditions of the KongConsumerGroup.
                  \n Known condition types are: \n * \"Programmed\""
                items:
                  description: "Condition contains details for one aspect of the current
                    state of this API Resource. --- This struct is intended for direct
                    use as an array at the field path .status.conditions.  For example,
                    \n type FooStatus struct{ // Represents the observations of a
                    foo's current state. // Known .status.conditions.type are: \"Available\",
                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                  properties:
                    lastTransitionTime:
                      description: lastTransitionTime is the last time the condition
                        transitioned from one status to another. This should be when
                        the underlying condition changed.  If that is not known, then
                        using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: message is a human readable message indicating
                        details about the transition. This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: observedGeneration represents the .metadata.generation
                        that the condition was set based upon. For instance, if .metadata.generation
                        is currently 12, but the .status.conditions[x].observedGeneration
                        is 9, the condition is out of date with respect to the current
                        state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: reason contains a programmatic identifier indicating
                        the reason for the condition's last transition. Producers
                        of specific condition types may define expected values and
                        meanings for this field, and whether the values are considered
                        a guaranteed API. The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                        --- Many .condition.type values are consistent across resources
                        like Available, but because arbitrary conditions can be useful
                        (see .node.status.conditions), the ability to deconflict is
                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                maxItems: 8
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: kongconsumers.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: KongConsumer
    listKind: KongConsumerList
    plural: kongconsumers
    shortNames:
    - kc
    singular: kongconsumer
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Username of a Kong Consumer
      jsonPath: .username
      name: Username
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - jsonPath: .status.conditions[?(@.type=="Programmed")].status
      name: Programmed
      type: string
    name: v1
    schema:
      openAPIV3Schema:
        description: KongConsumer is the Schema for the kongconsumers API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          consumerGroups:
            description: ConsumerGroups are references to consumer groups (that consumer
              wants to be part of) provisioned in Kong.
            items:
              type: string
            type: array
          credentials:
            description: Credentials are references to secrets containing a credential
              to be provisioned in Kong.
            items:
              type: string
            type: array
          custom_id:
            description: CustomID is a Kong cluster-unique existing ID for the consumer
              - useful for mapping Kong with users in your existing database.
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          status:
            description: Status represents the current status of the KongConsumer
              resource.
            properties:
              conditions:
                default:
                - lastTransitionTime: "1970-01-01T00:00:00Z"
                  message: Waiting for controller
                  reason: Pending
                  status: Unknown
                  type: Programmed
                description: "Conditions describe the current conditions of the KongConsumer.
                  \n Known condition types are: \n * \"Programmed\""
                items:
                  description: "Condition contains details for one aspect of the current
                    state of this API Resource. --- This struct is intended for direct
                    use as an array at the field path .status.conditions.  For example,
                    \n type FooStatus struct{ // Represents the observations of a
                    foo's current state. // Known .status.conditions.type are: \"Available\",
                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                  properties:
                    lastTransitionTime:
                      description: lastTransitionTime is the last time the condition
                        transitioned from one status to another. This should be when
                        the underlying condition changed.  If that is not known, then
                        using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: message is a human readable message indicating
                        details about the transition. This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: observedGeneration represents the .metadata.generation
                        that the condition was set based upon. For instance, if .metadata.generation
                        is currently 12, but the .status.conditions[x].observedGeneration
                        is 9, the condition is out of date with respect to the current
                        state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: reason contains a programmatic identifier indicating
                        the reason for the condition's last transition. Producers
                        of specific condition types may define expected values and
                        meanings for this field, and whether the values are considered
                        a guaranteed API. The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                        --- Many .condition.type values are consistent across resources
                        like Available, but because arbitrary conditions can be useful
                        (see .node.status.conditions), the ability to deconflict is
                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                maxItems: 8
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
          username:
            description: Username is a Kong cluster-unique username of the consumer.
            type: string
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: kongingresses.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: KongIngress
    listKind: KongIngressList
    plural: kongingresses
    shortNames:
    - ki
    singular: kongingress
  scope: Namespaced
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: KongIngress is the Schema for the kongingresses API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          proxy:
            description: Proxy defines additional connection options for the routes
              to be configured in the Kong Gateway, e.g. `connection_timeout`, `retries`,
              etc.
            properties:
              connect_timeout:
                description: "The timeout in milliseconds for\testablishing a connection
                  to the upstream server. Deprecated: use Service's \"konghq.com/connect-timeout\"
                  annotation instead."
                minimum: 0
                type: integer
              path:
                description: '(optional) The path to be used in requests to the upstream
                  server. Deprecated: use Service''s "konghq.com/path" annotation
                  instead.'
                pattern: ^/.*$
                type: string
              protocol:
                description: 'The protocol used to communicate with the upstream.
                  Deprecated: use Service''s "konghq.com/protocol" annotation instead.'
                enum:
                - http
                - https
                - grpc
                - grpcs
                - tcp
                - tls
                - udp
                type: string
              read_timeout:
                description: 'The timeout in milliseconds between two successive read
                  operations for transmitting a request to the upstream server. Deprecated:
                  use Service''s "konghq.com/read-timeout" annotation instead.'
                minimum: 0
                type: integer
              retries:
                description: 'The number of retries to execute upon failure to proxy.
                  Deprecated: use Service''s "konghq.com/retries" annotation instead.'
                minimum: 0
                type: integer
              write_timeout:
                description: 'The timeout in milliseconds between two successive write
                  operations for transmitting a request to the upstream server. Deprecated:
                  use Service''s "konghq.com/write-timeout" annotation instead.'
                minimum: 0
                type: integer
            type: object
          route:
            description: Route define rules to match client requests. Each Route is
              associated with a Service, and a Service may have multiple Routes associated
              to it.
            properties:
              headers:
                additionalProperties:
                  items:
                    type: string
                  type: array
                description: 'Headers contains one or more lists of values indexed
                  by header name that will cause this Route to match if present in
                  the request. The Host header cannot be used with this attribute.
                  Deprecated: use Ingress'' "konghq.com/headers" annotation instead.'
                type: object
              https_redirect_status_code:
                description: 'HTTPSRedirectStatusCode is the status code Kong responds
                  with when all properties of a Route match except the protocol. Deprecated:
                  use Ingress'' "ingress.kubernetes.io/force-ssl-redirect" or "konghq.com/https-redirect-status-code"
                  annotations instead.'
                type: integer
              methods:
                description: 'Methods is a list of HTTP methods that match this Route.
                  Deprecated: use Ingress'' "konghq.com/methods" annotation instead.'
                items:
                  type: string
                type: array
              path_handling:
                description: 'PathHandling controls how the Service path, Route path
                  and requested path are combined when sending a request to the upstream.
                  Deprecated: use Ingress'' "konghq.com/path-handling" annotation
                  instead.'
                enum:
                - v0
                - v1
                type: string
              preserve_host:
                description: 'PreserveHost sets When matching a Route via one of the
                  hosts domain names, use the request Host header in the upstream
                  request headers. If set to false, the upstream Host header will
                  be that of the Service’s host. Deprecated: use Ingress'' "konghq.com/preserve-host"
                  annotation instead.'
                type: boolean
              protocols:
                description: 'Protocols is an array of the protocols this Route should
                  allow. Deprecated: use Ingress'' "konghq.com/protocols" annotation
                  instead.'
                items:
                  description: KongProtocol is a valid Kong protocol. This alias is
                    necessary to deal with https://github.com/kubernetes-sigs/controller-tools/issues/342
                  enum:
                  - http
                  - https
                  - grpc
                  - grpcs
                  - tcp
                  - tls
                  - udp
                  type: string
                type: array
              regex_priority:
                description: 'RegexPriority is a number used to choose which route
                  resolves a given request when several routes match it using regexes
                  simultaneously. Deprecated: use Ingress'' "konghq.com/regex-priority"
                  annotation instead.'
                type: integer
              request_buffering:
                description: 'RequestBuffering sets whether to enable request body
                  buffering or not. Deprecated: use Ingress'' "konghq.com/request-buffering"
                  annotation instead.'
                type: boolean
              response_buffering:
                description: 'ResponseBuffering sets whether to enable response body
                  buffering or not. Deprecated: use Ingress'' "konghq.com/response-buffering"
                  annotation instead.'
                type: boolean
              snis:
                description: 'SNIs is a list of SNIs that match this Route when using
                  stream routing. Deprecated: use Ingress'' "konghq.com/snis" annotation
                  instead.'
                items:
                  type: string
                type: array
              strip_path:
                description: 'StripPath sets When matching a Route via one of the
                  paths strip the matching prefix from the upstream request URL. Deprecated:
                  use Ingress'' "konghq.com/strip-path" annotation instead.'
                type: boolean
            type: object
          upstream:
            description: Upstream represents a virtual hostname and can be used to
              loadbalance incoming requests over multiple targets (e.g. Kubernetes
              `Services` can be a target, OR `Endpoints` can be targets).
            properties:
              algorithm:
                description: 'Algorithm is the load balancing algorithm to use. Accepted
                  values are: "round-robin", "consistent-hashing", "least-connections",
                  "latency".'
                enum:
                - round-robin
                - consistent-hashing
                - least-connections
                - latency
                type: string
              hash_fallback:
                description: 'HashFallback defines What to use as hashing input if
                  the primary hash_on does not return a hash. Accepted values are:
                  "none", "consumer", "ip", "header", "cookie".'
                type: string
              hash_fallback_header:
                description: HashFallbackHeader is the header name to take the value
                  from as hash input. Only required when "hash_fallback" is set to
                  "header".
                type: string
              hash_fallback_query_arg:
                description: HashFallbackQueryArg is the "hash_fallback" version of
                  HashOnQueryArg.
                type: string
              hash_fallback_uri_capture:
                description: HashFallbackURICapture is the "hash_fallback" version
                  of HashOnURICapture.
                type: string
              hash_on:
                description: 'HashOn defines what to use as hashing input. Accepted
                  values are: "none", "consumer", "ip", "header", "cookie", "path",
                  "query_arg", "uri_capture".'
                type: string
              hash_on_cookie:
                description: The cookie name to take the value from as hash input.
                  Only required when "hash_on" or "hash_fallback" is set to "cookie".
                type: string
              hash_on_cookie_path:
                description: The cookie path to set in the response headers. Only
                  required when "hash_on" or "hash_fallback" is set to "cookie".
                type: string
              hash_on_header:
                description: HashOnHeader defines the header name to take the value
                  from as hash input. Only required when "hash_on" is set to "header".
                type: string
              hash_on_query_arg:
                description: HashOnQueryArg is the query string parameter whose value
                  is the hash input when "hash_on" is set to "query_arg".
                type: string
              hash_on_uri_capture:
                description: HashOnURICapture is the name of the capture group whose
                  value is the hash input when "hash_on" is set to "uri_capture".
                type: string
              healthchecks:
                description: Healthchecks defines the health check configurations
                  in Kong.
                properties:
                  active:
                    description: ActiveHealthcheck configures active health check
                      probing.
                    properties:
                      concurrency:
                        minimum: 1
                        type: integer
                      headers:
                        additionalProperties:
                          items:
                            type: string
                          type: array
                        type: object
                      healthy:
                        description: Healthy configures thresholds and HTTP status
                          codes to mark targets healthy for an upstream.
                        properties:
                          http_statuses:
                            items:
                              type: integer
                            type: array
                          interval:
                            minimum: 0
                            type: integer
                          successes:
                            minimum: 0
                            type: integer
                        type: object
                      http_path:
                        pattern: ^/.*$
                        type: string
                      https_sni:
                        type: string
                      https_verify_certificate:
                        type: boolean
                      timeout:
                        minimum: 0
                        type: integer
                      type:
                        type: string
                      unhealthy:
                        description: Unhealthy configures thresholds and HTTP status
                          codes to mark targets unhealthy.
                        properties:
                          http_failures:
                            minimum: 0
                            type: integer
                          http_statuses:
                            items:
                              type: integer
                            type: array
                          interval:
                            minimum: 0
                            type: integer
                          tcp_failures:
                            minimum: 0
                            type: integer
                          timeouts:
                            minimum: 0
                            type: integer
                        type: object
                    type: object
                  passive:
                    description: PassiveHealthcheck configures passive checks around
                      passive health checks.
                    properties:
                      healthy:
                        description: Healthy configures thresholds and HTTP status
                          codes to mark targets healthy for an upstream.
                        properties:
                          http_statuses:
                            items:
                              type: integer
                            type: array
                          interval:
                            minimum: 0
                            type: integer
                          successes:
                            minimum: 0
                            type: integer
                        type: object
                      type:
                        type: string
                      unhealthy:
                        description: Unhealthy configures thresholds and HTTP status
                          codes to mark targets unhealthy.
                        properties:
                          http_failures:
                            minimum: 0
                            type: integer
                          http_statuses:
                            items:
                              type: integer
                            type: array
                          interval:
                            minimum: 0
                            type: integer
                          tcp_failures:
                            minimum: 0
                            type: integer
                          timeouts:
                            minimum: 0
                            type: integer
                        type: object
                    type: object
                  threshold:
                    type: number
                type: object
              host_header:
                description: HostHeader is The hostname to be used as Host header
                  when proxying requests through Kong.
                type: string
              slots:
                description: Slots is the number of slots in the load balancer algorithm.
                minimum: 10
                type: integer
            type: object
        type: object
        x-kubernetes-validations:
        - message: '''proxy'' field is no longer supported, use Service''s annotations
            instead'
          rule: '!has(self.proxy)'
        - message: '''route'' field is no longer supported, use Ingress'' annotations
            instead'
          rule: '!has(self.route)'
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: kongplugins.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: KongPlugin
    listKind: KongPluginList
    plural: kongplugins
    shortNames:
    - kp
    singular: kongplugin
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Name of the plugin
      jsonPath: .plugin
      name: Plugin-Type
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - description: Indicates if the plugin is disabled
      jsonPath: .disabled
      name: Disabled
      priority: 1
      type: boolean
    - description: Configuration of the plugin
      jsonPath: .config
      name: Config
      priority: 1
      type: string
    - jsonPath: .status.conditions[?(@.type=="Programmed")].status
      name: Programmed
      type: string
    name: v1
    schema:
      openAPIV3Schema:
        description: KongPlugin is the Schema for the kongplugins API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          config:
            description: Config contains the plugin configuration. It's a list of
              keys and values required to configure the plugin. Please read the documentation
              of the plugin being configured to set values in here. For any plugin
              in Kong, anything that goes in the `config` JSON key in the Admin API
              request, goes into this property. Only one of `config` or `configFrom`
              may be used in a KongPlugin, not both at once.
            type: object
            x-kubernetes-preserve-unknown-fields: true
          configFrom:
            description: ConfigFrom references a secret containing the plugin configuration.
              This should be used when the plugin configuration contains sensitive
              information, such as AWS credentials in the Lambda plugin or the client
              secret in the OIDC plugin. Only one of `config` or `configFrom` may
              be used in a KongPlugin, not both at once.
            properties:
              secretKeyRef:
                description: Specifies a name and a key of a secret to refer to. The
                  namespace is implicitly set to the one of referring object.
                properties:
                  key:
                    description: The key containing the value.
                    type: string
                  name:
                    description: The secret containing the key.
                    type: string
                required:
                - key
                - name
                type: object
            type: object
          consumerRef:
            description: ConsumerRef is a reference to a particular consumer.
            type: string
          disabled:
            description: Disabled set if the plugin is disabled or not.
            type: boolean
          instance_name:
            description: InstanceName is an optional custom name to identify an instance
              of the plugin. This is useful when running the same plugin in multiple
              contexts, for example, on multiple services.
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          ordering:
            description: 'Ordering overrides the normal plugin execution order. It''s
              only available on Kong Enterprise. `<phase>` is a request processing
              phase (for example, `access` or `body_filter`) and `<plugin>` is the
              name of the plugin that will run before or after the KongPlugin. For
              example, a KongPlugin with `plugin: rate-limiting` and `before.access:
              ["key-auth"]` will create a rate limiting plugin that limits requests
              _before_ they are authenticated.'
            properties:
              after:
                additionalProperties:
                  items:
                    type: string
                  type: array
                description: PluginOrderingPhase indicates which plugins in a phase
                  should affect the target plugin's order
                type: object
              before:
                additionalProperties:
                  items:
                    type: string
                  type: array
                description: PluginOrderingPhase indicates which plugins in a phase
                  should affect the target plugin's order
                type: object
            type: object
          plugin:
            description: PluginName is the name of the plugin to which to apply the
              config.
            type: string
          protocols:
            description: Protocols configures plugin to run on requests received on
              specific protocols.
            items:
              description: KongProtocol is a valid Kong protocol. This alias is necessary
                to deal with https://github.com/kubernetes-sigs/controller-tools/issues/342
              enum:
              - http
              - https
              - grpc
              - grpcs
              - tcp
              - tls
              - udp
              type: string
            type: array
          run_on:
            description: RunOn configures the plugin to run on the first or the second
              or both nodes in case of a service mesh deployment.
            enum:
            - first
            - second
            - all
            type: string
          status:
            description: Status represents the current status of the KongPlugin resource.
            properties:
              conditions:
                default:
                - lastTransitionTime: "1970-01-01T00:00:00Z"
                  message: Waiting for controller
                  reason: Pending
                  status: Unknown
                  type: Programmed
                description: "Conditions describe the current conditions of the KongPluginStatus.
                  \n Known condition types are: \n * \"Programmed\""
                items:
                  description: "Condition contains details for one aspect of the current
                    state of this API Resource. --- This struct is intended for direct
                    use as an array at the field path .status.conditions.  For example,
                    \n type FooStatus struct{ // Represents the observations of a
                    foo's current state. // Known .status.conditions.type are: \"Available\",
                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                  properties:
                    lastTransitionTime:
                      description: lastTransitionTime is the last time the condition
                        transitioned from one status to another. This should be when
                        the underlying condition changed.  If that is not known, then
                        using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: message is a human readable message indicating
                        details about the transition. This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: observedGeneration represents the .metadata.generation
                        that the condition was set based upon. For instance, if .metadata.generation
                        is currently 12, but the .status.conditions[x].observedGeneration
                        is 9, the condition is out of date with respect to the current
                        state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: reason contains a programmatic identifier indicating
                        the reason for the condition's last transition. Producers
                        of specific condition types may define expected values and
                        meanings for this field, and whether the values are considered
                        a guaranteed API. The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                        --- Many .condition.type values are consistent across resources
                        like Available, but because arbitrary conditions can be useful
                        (see .node.status.conditions), the ability to deconflict is
                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                maxItems: 8
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        required:
        - plugin
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  labels:
    gateway.networking.k8s.io/policy: direct
  name: kongupstreampolicies.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: KongUpstreamPolicy
    listKind: KongUpstreamPolicyList
    plural: kongupstreampolicies
    shortNames:
    - kup
    singular: kongupstreampolicy
  scope: Namespaced
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: "KongUpstreamPolicy allows configuring algorithm that should
          be used for load balancing traffic between Kong Upstream's Targets. It also
          allows configuring health checks for Kong Upstream's Targets. \n Its configuration
          is similar to Kong Upstream object (https://docs.konghq.com/gateway/latest/admin-api/#upstream-object),
          and it is applied to Kong Upstream objects created by the controller. \n
          It can be attached to Services. To attach it to a Service, it has to be
          annotated with `konghq.com/upstream-policy: <name>`, where `<name>` is the
          name of the KongUpstreamPolicy object in the same namespace as the Service.
          \n When attached to a Service, it will affect all Kong Upstreams created
          for the Service. \n When attached to a Service used in a Gateway API *Route
          rule with multiple BackendRefs, all of its Services MUST be configured with
          the same KongUpstreamPolicy. Otherwise, the controller will *ignore* the
          KongUpstreamPolicy. \n Note: KongUpstreamPolicy doesn't implement Gateway
          API's GEP-713 strictly. In particular, it doesn't use the TargetRef for
          attaching to Services and Gateway API *Routes - annotations are used instead.
          This is to allow reusing the same KongUpstreamPolicy for multiple Services
          and Gateway API *Routes."
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: Spec contains the configuration of the Kong upstream.
            properties:
              algorithm:
                description: 'Algorithm is the load balancing algorithm to use. Accepted
                  values are: "round-robin", "consistent-hashing", "least-connections",
                  "latency".'
                enum:
                - round-robin
                - consistent-hashing
                - least-connections
                - latency
                type: string
              hashOn:
                description: HashOn defines how to calculate hash for consistent-hashing
                  load balancing algorithm. Algorithm must be set to "consistent-hashing"
                  for this field to have effect.
                properties:
                  cookie:
                    description: Cookie is the name of the cookie to use as hash input.
                    type: string
                  cookiePath:
                    description: CookiePath is cookie path to set in the response
                      headers.
                    type: string
                  header:
                    description: Header is the name of the header to use as hash input.
                    type: string
                  input:
                    description: Input allows using one of the predefined inputs (ip,
                      consumer, path). For other parametrized inputs, use one of the
                      fields below.
                    enum:
                    - ip
                    - consumer
                    - path
                    type: string
                  queryArg:
                    description: QueryArg is the name of the query argument to use
                      as hash input.
                    type: string
                  uriCapture:
                    description: URICapture is the name of the URI capture group to
                      use as hash input.
                    type: string
                type: object
              hashOnFallback:
                description: HashOnFallback defines how to calculate hash for consistent-hashing
                  load balancing algorithm if the primary hash function fails. Algorithm
                  must be set to "consistent-hashing" for this field to have effect.
                properties:
                  cookie:
                    description: Cookie is the name of the cookie to use as hash input.
                    type: string
                  cookiePath:
                    description: CookiePath is cookie path to set in the response
                      headers.
                    type: string
                  header:
                    description: Header is the name of the header to use as hash input.
                    type: string
                  input:
                    description: Input allows using one of the predefined inputs (ip,
                      consumer, path). For other parametrized inputs, use one of the
                      fields below.
                    enum:
                    - ip
                    - consumer
                    - path
                    type: string
                  queryArg:
                    description: QueryArg is the name of the query argument to use
                      as hash input.
                    type: string
                  uriCapture:
                    description: URICapture is the name of the URI capture group to
                      use as hash input.
                    type: string
                type: object
              healthchecks:
                description: Healthchecks defines the health check configurations
                  in Kong.
                properties:
                  active:
                    description: Active configures active health check probing.
                    properties:
                      concurrency:
                        description: Concurrency is the number of targets to check
                          concurrently.
                        minimum: 1
                        type: integer
                      headers:
                        additionalProperties:
                          items:
                            type: string
                          type: array
                        description: Headers is a list of HTTP headers to add to the
                          probe request.
                        type: object
                      healthy:
                        description: Healthy configures thresholds and HTTP status
                          codes to mark targets healthy for an upstream.
                        properties:
                          httpStatuses:
                            description: HTTPStatuses is a list of HTTP status codes
                              that Kong considers a success.
                            items:
                              description: HTTPStatus is an HTTP status code.
                              maximum: 599
                              minimum: 100
                              type: integer
                            type: array
                          interval:
                            description: Interval is the interval between active health
                              checks for an upstream in seconds when in a healthy
                              state.
                            minimum: 0
                            type: integer
                          successes:
                            description: Successes is the number of successes to consider
                              a target healthy.
                            minimum: 0
                            type: integer
                        type: object
                      httpPath:
                        description: HTTPPath is the path to use in GET HTTP request
                          to run as a probe.
                        pattern: ^/.*$
                        type: string
                      httpsSni:
                        description: HTTPSSNI is the SNI to use in GET HTTPS request
                          to run as a probe.
                        type: string
                      httpsVerifyCertificate:
                        description: HTTPSVerifyCertificate is a boolean value that
                          indicates if the certificate should be verified.
                        type: boolean
                      timeout:
                        description: Timeout is the probe timeout in seconds.
                        minimum: 0
                        type: integer
                      type:
                        description: Type determines whether to perform active health
                          checks using HTTP or HTTPS, or just attempt a TCP connection.
                          Accepted values are "http", "https", "tcp", "grpc", "grpcs".
                        enum:
                        - http
                        - https
                        - tcp
                        - grpc
                        - grpcs
                        type: string
                      unhealthy:
                        description: Unhealthy configures thresholds and HTTP status
                          codes to mark targets unhealthy for an upstream.
                        properties:
                          httpFailures:
                            description: HTTPFailures is the number of failures to
                              consider a target unhealthy.
                            minimum: 0
                            type: integer
                          httpStatuses:
                            description: HTTPStatuses is a list of HTTP status codes
                              that Kong considers a failure.
                            items:
                              description: HTTPStatus is an HTTP status code.
                              maximum: 599
                              minimum: 100
                              type: integer
                            type: array
                          interval:
                            description: Interval is the interval between active health
                              checks for an upstream in seconds when in an unhealthy
                              state.
                            minimum: 0
                            type: integer
                          tcpFailures:
                            description: TCPFailures is the number of TCP failures
                              in a row to consider a target unhealthy.
                            minimum: 0
                            type: integer
                          timeouts:
                            description: Timeouts is the number of timeouts in a row
                              to consider a target unhealthy.
                            minimum: 0
                            type: integer
                        type: object
                    type: object
                  passive:
                    description: Passive configures passive health check probing.
                    properties:
                      healthy:
                        description: Healthy configures thresholds and HTTP status
                          codes to mark targets healthy for an upstream.
                        properties:
                          httpStatuses:
                            description: HTTPStatuses is a list of HTTP status codes
                              that Kong considers a success.
                            items:
                              description: HTTPStatus is an HTTP status code.
                              maximum: 599
                              minimum: 100
                              type: integer
                            type: array
                          interval:
                            description: Interval is the interval between active health
                              checks for an upstream in seconds when in a healthy
                              state.
                            minimum: 0
                            type: integer
                          successes:
                            description: Successes is the number of successes to consider
                              a target healthy.
                            minimum: 0
                            type: integer
                        type: object
                      type:
                        description: Type determines whether to perform passive health
                          checks interpreting HTTP/HTTPS statuses, or just check for
                          TCP connection success. Accepted values are "http", "https",
                          "tcp", "grpc", "grpcs".
                        enum:
                        - http
                        - https
                        - tcp
                        - grpc
                        - grpcs
                        type: string
                      unhealthy:
                        description: Unhealthy configures thresholds and HTTP status
                          codes to mark targets unhealthy.
                        properties:
                          httpFailures:
                            description: HTTPFailures is the number of failures to
                              consider a target unhealthy.
                            minimum: 0
                            type: integer
                          httpStatuses:
                            description: HTTPStatuses is a list of HTTP status codes
                              that Kong considers a failure.
                            items:
                              description: HTTPStatus is an HTTP status code.
                              maximum: 599
                              minimum: 100
                              type: integer
                            type: array
                          interval:
                            description: Interval is the interval between active health
                              checks for an upstream in seconds when in an unhealthy
                              state.
                            minimum: 0
                            type: integer
                          tcpFailures:
                            description: TCPFailures is the number of TCP failures
                              in a row to consider a target unhealthy.
                            minimum: 0
                            type: integer
                          timeouts:
                            description: Timeouts is the number of timeouts in a row
                              to consider a target unhealthy.
                            minimum: 0
                            type: integer
                        type: object
                    type: object
                  threshold:
                    description: Threshold is the minimum percentage of the upstream’s
                      targets’ weight that must be available for the whole upstream
                      to be considered healthy.
                    type: integer
                type: object
              slots:
                description: Slots is the number of slots in the load balancer algorithm.
                  If not set, the default value in Kong for the algorithm is used.
                maximum: 65536
                minimum: 10
                type: integer
            type: object
        type: object
        x-kubernetes-validations:
        - message: Only one of spec.hashOn.(input|cookie|header|uriCapture|queryArg)
            can be set.
          rule: 'has(self.spec.hashOn) ? [has(self.spec.hashOn.input), has(self.spec.hashOn.cookie),
            has(self.spec.hashOn.header), has(self.spec.hashOn.uriCapture), has(self.spec.hashOn.queryArg)].filter(fieldSet,
            fieldSet == true).size() <= 1 : true'
        - message: When spec.hashOn.cookie is set, spec.hashOn.cookiePath is required.
          rule: 'has(self.spec.hashOn) && has(self.spec.hashOn.cookie) ? has(self.spec.hashOn.cookiePath)
            : true'
        - message: When spec.hashOn.cookiePath is set, spec.hashOn.cookie is required.
          rule: 'has(self.spec.hashOn) && has(self.spec.hashOn.cookiePath) ? has(self.spec.hashOn.cookie)
            : true'
        - message: spec.algorithm must be set to "consistent-hashing" when spec.hashOn
            is set.
          rule: 'has(self.spec.hashOn) ? has(self.spec.algorithm) && self.spec.algorithm
            == "consistent-hashing" : true'
        - message: Only one of spec.hashOnFallback.(input|header|uriCapture|queryArg)
            can be set.
          rule: 'has(self.spec.hashOnFallback) ? [has(self.spec.hashOnFallback.input),
            has(self.spec.hashOnFallback.header), has(self.spec.hashOnFallback.uriCapture),
            has(self.spec.hashOnFallback.queryArg)].filter(fieldSet, fieldSet == true).size()
            <= 1 : true'
        - message: spec.algorithm must be set to "consistent-hashing" when spec.hashOnFallback
            is set.
          rule: 'has(self.spec.hashOnFallback) ? has(self.spec.algorithm) && self.spec.algorithm
            == "consistent-hashing" : true'
        - message: spec.hashOnFallback.cookie must not be set.
          rule: 'has(self.spec.hashOnFallback) ? !has(self.spec.hashOnFallback.cookie)
            : true'
        - message: spec.hashOnFallback.cookiePath must not be set.
          rule: 'has(self.spec.hashOnFallback) ? !has(self.spec.hashOnFallback.cookiePath)
            : true'
        - message: spec.healthchecks.passive.healthy.interval must not be set.
          rule: 'has(self.spec.healthchecks) && has(self.spec.healthchecks.passive)
            && has(self.spec.healthchecks.passive.healthy) ? !has(self.spec.healthchecks.passive.healthy.interval)
            : true'
        - message: spec.healthchecks.passive.unhealthy.interval must not be set.
          rule: 'has(self.spec.healthchecks) && has(self.spec.healthchecks.passive)
            && has(self.spec.healthchecks.passive.unhealthy) ? !has(self.spec.healthchecks.passive.unhealthy.interval)
            : true'
        - message: spec.hashOnFallback must not be set when spec.hashOn.cookie is
            set.
          rule: 'has(self.spec.hashOn) && has(self.spec.hashOn.cookie) ? !has(self.spec.hashOnFallback)
            : true'
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: l2advertisements.metallb.io
spec:
  group: metallb.io
  names:
    kind: L2Advertisement
    listKind: L2AdvertisementList
    plural: l2advertisements
    singular: l2advertisement
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.ipAddressPools
      name: IPAddressPools
      type: string
    - jsonPath: .spec.ipAddressPoolSelectors
      name: IPAddressPool Selectors
      type: string
    - jsonPath: .spec.interfaces
      name: Interfaces
      type: string
    - jsonPath: .spec.nodeSelectors
      name: Node Selectors
      priority: 10
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: |-
          L2Advertisement allows to advertise the LoadBalancer IPs provided
          by the selected pools via L2.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: L2AdvertisementSpec defines the desired state of L2Advertisement.
            properties:
              interfaces:
                description: |-
                  A list of interfaces to announce from. The LB IP will be announced only from these interfaces.
                  If the field is not set, we advertise from all the interfaces on the host.
                items:
                  type: string
                type: array
              ipAddressPoolSelectors:
                description: |-
                  A selector for the IPAddressPools which would get advertised via this advertisement.
                  If no IPAddressPool is selected by this or by the list, the advertisement is applied to all the IPAddressPools.
                items:
                  description: |-
                    A label selector is a label query over a set of resources. The result of matchLabels and
                    matchExpressions are ANDed. An empty label selector matches all objects. A null
                    label selector matches no objects.
                  properties:
                    matchExpressions:
                      description: matchExpressions is a list of label selector requirements.
                        The requirements are ANDed.
                      items:
                        description: |-
                          A label selector requirement is a selector that contains values, a key, and an operator that
                          relates the key and values.
                        properties:
                          key:
                            description: key is the label key that the selector applies
                              to.
                            type: string
                          operator:
                            description: |-
                              operator represents a key's relationship to a set of values.
                              Valid operators are In, NotIn, Exists and DoesNotExist.
                            type: string
                          values:
                            description: |-
                              values is an array of string values. If the operator is In or NotIn,
                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                              the values array must be empty. This array is replaced during a strategic
                              merge patch.
                            items:
                              type: string
                            type: array
                            x-kubernetes-list-type: atomic
                        required:
                        - key
                        - operator
                        type: object
                      type: array
                      x-kubernetes-list-type: atomic
                    matchLabels:
                      additionalProperties:
                        type: string
                      description: |-
                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                      type: object
                  type: object
                  x-kubernetes-map-type: atomic
                type: array
              ipAddressPools:
                description: The list of IPAddressPools to advertise via this advertisement,
                  selected by name.
                items:
                  type: string
                type: array
              nodeSelectors:
                description: NodeSelectors allows to limit the nodes to announce as
                  next hops for the LoadBalancer IP. When empty, all the nodes having  are
                  announced as next hops.
                items:
                  description: |-
                    A label selector is a label query over a set of resources. The result of matchLabels and
                    matchExpressions are ANDed. An empty label selector matches all objects. A null
                    label selector matches no objects.
                  properties:
                    matchExpressions:
                      description: matchExpressions is a list of label selector requirements.
                        The requirements are ANDed.
                      items:
                        description: |-
                          A label selector requirement is a selector that contains values, a key, and an operator that
                          relates the key and values.
                        properties:
                          key:
                            description: key is the label key that the selector applies
                              to.
                            type: string
                          operator:
                            description: |-
                              operator represents a key's relationship to a set of values.
                              Valid operators are In, NotIn, Exists and DoesNotExist.
                            type: string
                          values:
                            description: |-
                              values is an array of string values. If the operator is In or NotIn,
                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                              the values array must be empty. This array is replaced during a strategic
                              merge patch.
                            items:
                              type: string
                            type: array
                            x-kubernetes-list-type: atomic
                        required:
                        - key
                        - operator
                        type: object
                      type: array
                      x-kubernetes-list-type: atomic
                    matchLabels:
                      additionalProperties:
                        type: string
                      description: |-
                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                      type: object
                  type: object
                  x-kubernetes-map-type: atomic
                type: array
            type: object
          status:
            description: L2AdvertisementStatus defines the observed state of L2Advertisement.
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    helm.sh/resource-policy: keep
  labels:
    app: cert-manager
    app.kubernetes.io/component: crds
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: orders.acme.cert-manager.io
spec:
  group: acme.cert-manager.io
  names:
    categories:
    - cert-manager
    - cert-manager-acme
    kind: Order
    listKind: OrderList
    plural: orders
    singular: order
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.state
      name: State
      type: string
    - jsonPath: .spec.issuerRef.name
      name: Issuer
      priority: 1
      type: string
    - jsonPath: .status.reason
      name: Reason
      priority: 1
      type: string
    - description: CreationTimestamp is a timestamp representing the server time when
        this object was created. It is not guaranteed to be set in happens-before
        order across separate operations. Clients may not set this value. It is represented
        in RFC3339 form and is in UTC.
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1
    schema:
      openAPIV3Schema:
        description: Order is a type to represent an Order with an ACME server
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            properties:
              commonName:
                description: |-
                  CommonName is the common name as specified on the DER encoded CSR.
                  If specified, this value must also be present in `dnsNames` or `ipAddresses`.
                  This field must match the corresponding field on the DER encoded CSR.
                type: string
              dnsNames:
                description: |-
                  DNSNames is a list of DNS names that should be included as part of the Order
                  validation process.
                  This field must match the corresponding field on the DER encoded CSR.
                items:
                  type: string
                type: array
                x-kubernetes-list-type: atomic
              duration:
                description: |-
                  Duration is the duration for the not after date for the requested certificate.
                  this is set on order creation as pe the ACME spec.
                type: string
              ipAddresses:
                description: |-
                  IPAddresses is a list of IP addresses that should be included as part of the Order
                  validation process.
                  This field must match the corresponding field on the DER encoded CSR.
                items:
                  type: string
                type: array
                x-kubernetes-list-type: atomic
              issuerRef:
                description: |-
                  IssuerRef references a properly configured ACME-type Issuer which should
                  be used to create this Order.
                  If the Issuer does not exist, processing will be retried.
                  If the Issuer is not an 'ACME' Issuer, an error will be returned and the
                  Order will be marked as failed.
                properties:
                  group:
                    description: |-
                      Group of the issuer being referred to.
                      Defaults to 'cert-manager.io'.
                    type: string
                  kind:
                    description: |-
                      Kind of the issuer being referred to.
                      Defaults to 'Issuer'.
                    type: string
                  name:
                    description: Name of the issuer being referred to.
                    type: string
                required:
                - name
                type: object
              profile:
                description: |-
                  Profile allows requesting a certificate profile from the ACME server.
                  Supported profiles are listed by the server's ACME directory URL.
                type: string
              request:
                description: |-
                  Certificate signing request bytes in DER encoding.
                  This will be used when finalizing the order.
                  This field must be set on the order.
                format: byte
                type: string
            required:
            - issuerRef
            - request
            type: object
          status:
            properties:
              authorizations:
                description: |-
                  Authorizations contains data returned from the ACME server on what
                  authorizations must be completed in order to validate the DNS names
                  specified on the Order.
                items:
                  description: |-
                    ACMEAuthorization contains data returned from the ACME server on an
                    authorization that must be completed in order validate a DNS name on an ACME
                    Order resource.
                  properties:
                    challenges:
                      description: |-
                        Challenges specifies the challenge types offered by the ACME server.
                        One of these challenge types will be selected when validating the DNS
                        name and an appropriate Challenge resource will be created to perform
                        the ACME challenge process.
                      items:
                        description: |-
                          Challenge specifies a challenge offered by the ACME server for an Order.
                          An appropriate Challenge resource can be created to perform the ACME
                          challenge process.
                        properties:
                          token:
                            description: |-
                              Token is the token that must be presented for this challenge.
                              This is used to compute the 'key' that must also be presented.
                            type: string
                          type:
                            description: |-
                              Type is the type of challenge being offered, e.g., 'http-01', 'dns-01',
                              'tls-sni-01', etc.
                              This is the raw value retrieved from the ACME server.
                              Only 'http-01' and 'dns-01' are supported by cert-manager, other values
                              will be ignored.
                            type: string
                          url:
                            description: |-
                              URL is the URL of this challenge. It can be used to retrieve additional
                              metadata about the Challenge from the ACME server.
                            type: string
                        required:
                        - token
                        - type
                        - url
                        type: object
                      type: array
                      x-kubernetes-list-type: atomic
                    identifier:
                      description: Identifier is the DNS name to be validated as part
                        of this authorization
                      type: string
                    initialState:
                      description: |-
                        InitialState is the initial state of the ACME authorization when first
                        fetched from the ACME server.
                        If an Authorization is already 'valid', the Order controller will not
                        create a Challenge resource for the authorization. This will occur when
                        working with an ACME server that enables 'authz reuse' (such as Let's
                        Encrypt's production endpoint).
                        If not set and 'identifier' is set, the state is assumed to be pending
                        and a Challenge will be created.
                      enum:
                      - valid
                      - ready
                      - pending
                      - processing
                      - invalid
                      - expired
                      - errored
                      type: string
                    url:
                      description: URL is the URL of the Authorization that must be
                        completed
                      type: string
                    wildcard:
                      description: |-
                        Wildcard will be true if this authorization is for a wildcard DNS name.
                        If this is true, the identifier will be the *non-wildcard* version of
                        the DNS name.
                        For example, if '*.example.com' is the DNS name being validated, this
                        field will be 'true' and the 'identifier' field will be 'example.com'.
                      type: boolean
                  required:
                  - url
                  type: object
                type: array
                x-kubernetes-list-type: atomic
              certificate:
                description: |-
                  Certificate is a copy of the PEM encoded certificate for this Order.
                  This field will be populated after the order has been successfully
                  finalized with the ACME server, and the order has transitioned to the
                  'valid' state.
                format: byte
                type: string
              failureTime:
                description: |-
                  FailureTime stores the time that this order failed.
                  This is used to influence garbage collection and back-off.
                format: date-time
                type: string
              finalizeURL:
                description: |-
                  FinalizeURL of the Order.
                  This is used to obtain certificates for this order once it has been completed.
                type: string
              reason:
                description: |-
                  Reason optionally provides more information about a why the order is in
                  the current state.
                type: string
              state:
                description: |-
                  State contains the current state of this Order resource.
                  States 'success' and 'expired' are 'final'
                enum:
                - valid
                - ready
                - pending
                - processing
                - invalid
                - expired
                - errored
                type: string
              url:
                description: |-
                  URL of the Order.
                  This will initially be empty when the resource is first created.
                  The Order controller will populate this field when the Order is first processed.
                  This field will be immutable after it is initially set.
                type: string
            type: object
        required:
        - metadata
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.17.0
  name: proxyclasses.tailscale.com
spec:
  group: tailscale.com
  names:
    kind: ProxyClass
    listKind: ProxyClassList
    plural: proxyclasses
    singular: proxyclass
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - description: Status of the ProxyClass.
      jsonPath: .status.conditions[?(@.type == "ProxyClassReady")].reason
      name: Status
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: |-
          ProxyClass describes a set of configuration parameters that can be applied to
          proxy resources created by the Tailscale Kubernetes operator.
          To apply a given ProxyClass to resources created for a tailscale Ingress or
          Service, use tailscale.com/proxy-class=<proxyclass-name> label. To apply a
          given ProxyClass to resources created for a Connector, use
          connector.spec.proxyClass field.
          ProxyClass is a cluster scoped resource.
          More info:
          https://tailscale.com/kb/1445/kubernetes-operator-customization#cluster-resource-customization-using-proxyclass-custom-resource
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: |-
              Specification of the desired state of the ProxyClass resource.
              https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
            properties:
              metrics:
                description: |-
                  Configuration for proxy metrics. Metrics are currently not supported
                  for egress proxies and for Ingress proxies that have been configured
                  with tailscale.com/experimental-forward-cluster-traffic-via-ingress
                  annotation. Note that the metrics are currently considered unstable
                  and will likely change in breaking ways in the future - we only
                  recommend that you use those for debugging purposes.
                properties:
                  enable:
                    description: |-
                      Setting enable to true will make the proxy serve Tailscale metrics
                      at <pod-ip>:9002/metrics.
                      A metrics Service named <proxy-statefulset>-metrics will also be created in the operator's namespace and will
                      serve the metrics at <service-ip>:9002/metrics.

                      In 1.78.x and 1.80.x, this field also serves as the default value for
                      .spec.statefulSet.pod.tailscaleContainer.debug.enable. From 1.82.0, both
                      fields will independently default to false.

                      Defaults to false.
                    type: boolean
                  serviceMonitor:
                    description: |-
                      Enable to create a Prometheus ServiceMonitor for scraping the proxy's Tailscale metrics.
                      The ServiceMonitor will select the metrics Service that gets created when metrics are enabled.
                      The ingested metrics for each Service monitor will have labels to identify the proxy:
                      ts_proxy_type: ingress_service|ingress_resource|connector|proxygroup
                      ts_proxy_parent_name: name of the parent resource (i.e name of the Connector, Tailscale Ingress, Tailscale Service or ProxyGroup)
                      ts_proxy_parent_namespace: namespace of the parent resource (if the parent resource is not cluster scoped)
                      job: ts_<proxy type>_[<parent namespace>]_<parent_name>
                    properties:
                      enable:
                        description: If Enable is set to true, a Prometheus ServiceMonitor
                          will be created. Enable can only be set to true if metrics
                          are enabled.
                        type: boolean
                      labels:
                        additionalProperties:
                          maxLength: 63
                          pattern: ^(([a-zA-Z0-9][-._a-zA-Z0-9]*)?[a-zA-Z0-9])?$
                          type: string
                        description: |-
                          Labels to add to the ServiceMonitor.
                          Labels must be valid Kubernetes labels.
                          https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
                        type: object
                    required:
                    - enable
                    type: object
                required:
                - enable
                type: object
                x-kubernetes-validations:
                - message: ServiceMonitor can only be enabled if metrics are enabled
                  rule: '!(has(self.serviceMonitor) && self.serviceMonitor.enable  &&
                    !self.enable)'
              statefulSet:
                description: |-
                  Configuration parameters for the proxy's StatefulSet. Tailscale
                  Kubernetes operator deploys a StatefulSet for each of the user
                  configured proxies (Tailscale Ingress, Tailscale Service, Connector).
                properties:
                  annotations:
                    additionalProperties:
                      type: string
                    description: |-
                      Annotations that will be added to the StatefulSet created for the proxy.
                      Any Annotations specified here will be merged with the default annotations
                      applied to the StatefulSet by the Tailscale Kubernetes operator as
                      well as any other annotations that might have been applied by other
                      actors.
                      Annotations must be valid Kubernetes annotations.
                      https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set
                    type: object
                  labels:
                    additionalProperties:
                      maxLength: 63
                      pattern: ^(([a-zA-Z0-9][-._a-zA-Z0-9]*)?[a-zA-Z0-9])?$
                      type: string
                    description: |-
                      Labels that will be added to the StatefulSet created for the proxy.
                      Any labels specified here will be merged with the default labels
                      applied to the StatefulSet by the Tailscale Kubernetes operator as
                      well as any other labels that might have been applied by other
                      actors.
                      Label keys and values must be valid Kubernetes label keys and values.
                      https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
                    type: object
                  pod:
                    description: Configuration for the proxy Pod.
                    properties:
                      affinity:
                        description: |-
                          Proxy Pod's affinity rules.
                          By default, the Tailscale Kubernetes operator does not apply any affinity rules.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#affinity
                        properties:
                          nodeAffinity:
                            description: Describes node affinity scheduling rules
                              for the pod.
                            properties:
                              preferredDuringSchedulingIgnoredDuringExecution:
                                description: |-
                                  The scheduler will prefer to schedule pods to nodes that satisfy
                                  the affinity expressions specified by this field, but it may choose
                                  a node that violates one or more of the expressions. The node that is
                                  most preferred is the one with the greatest sum of weights, i.e.
                                  for each node that meets all of the scheduling requirements (resource
                                  request, requiredDuringScheduling affinity expressions, etc.),
                                  compute a sum by iterating through the elements of this field and adding
                                  "weight" to the sum if the node matches the corresponding matchExpressions; the
                                  node(s) with the highest sum are the most preferred.
                                items:
                                  description: |-
                                    An empty preferred scheduling term matches all objects with implicit weight 0
                                    (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
                                  properties:
                                    preference:
                                      description: A node selector term, associated
                                        with the corresponding weight.
                                      properties:
                                        matchExpressions:
                                          description: A list of node selector requirements
                                            by node's labels.
                                          items:
                                            description: |-
                                              A node selector requirement is a selector that contains values, a key, and an operator
                                              that relates the key and values.
                                            properties:
                                              key:
                                                description: The label key that the
                                                  selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  Represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                type: string
                                              values:
                                                description: |-
                                                  An array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. If the operator is Gt or Lt, the values
                                                  array must have a single element, which will be interpreted as an integer.
                                                  This array is replaced during a strategic merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchFields:
                                          description: A list of node selector requirements
                                            by node's fields.
                                          items:
                                            description: |-
                                              A node selector requirement is a selector that contains values, a key, and an operator
                                              that relates the key and values.
                                            properties:
                                              key:
                                                description: The label key that the
                                                  selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  Represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                type: string
                                              values:
                                                description: |-
                                                  An array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. If the operator is Gt or Lt, the values
                                                  array must have a single element, which will be interpreted as an integer.
                                                  This array is replaced during a strategic merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    weight:
                                      description: Weight associated with matching
                                        the corresponding nodeSelectorTerm, in the
                                        range 1-100.
                                      format: int32
                                      type: integer
                                  required:
                                  - preference
                                  - weight
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              requiredDuringSchedulingIgnoredDuringExecution:
                                description: |-
                                  If the affinity requirements specified by this field are not met at
                                  scheduling time, the pod will not be scheduled onto the node.
                                  If the affinity requirements specified by this field cease to be met
                                  at some point during pod execution (e.g. due to an update), the system
                                  may or may not try to eventually evict the pod from its node.
                                properties:
                                  nodeSelectorTerms:
                                    description: Required. A list of node selector
                                      terms. The terms are ORed.
                                    items:
                                      description: |-
                                        A null or empty node selector term matches no objects. The requirements of
                                        them are ANDed.
                                        The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
                                      properties:
                                        matchExpressions:
                                          description: A list of node selector requirements
                                            by node's labels.
                                          items:
                                            description: |-
                                              A node selector requirement is a selector that contains values, a key, and an operator
                                              that relates the key and values.
                                            properties:
                                              key:
                                                description: The label key that the
                                                  selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  Represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                type: string
                                              values:
                                                description: |-
                                                  An array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. If the operator is Gt or Lt, the values
                                                  array must have a single element, which will be interpreted as an integer.
                                                  This array is replaced during a strategic merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchFields:
                                          description: A list of node selector requirements
                                            by node's fields.
                                          items:
                                            description: |-
                                              A node selector requirement is a selector that contains values, a key, and an operator
                                              that relates the key and values.
                                            properties:
                                              key:
                                                description: The label key that the
                                                  selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  Represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                type: string
                                              values:
                                                description: |-
                                                  An array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. If the operator is Gt or Lt, the values
                                                  array must have a single element, which will be interpreted as an integer.
                                                  This array is replaced during a strategic merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                - nodeSelectorTerms
                                type: object
                                x-kubernetes-map-type: atomic
                            type: object
                          podAffinity:
                            description: Describes pod affinity scheduling rules (e.g.
                              co-locate this pod in the same node, zone, etc. as some
                              other pod(s)).
                            properties:
                              preferredDuringSchedulingIgnoredDuringExecution:
                                description: |-
                                  The scheduler will prefer to schedule pods to nodes that satisfy
                                  the affinity expressions specified by this field, but it may choose
                                  a node that violates one or more of the expressions. The node that is
                                  most preferred is the one with the greatest sum of weights, i.e.
                                  for each node that meets all of the scheduling requirements (resource
                                  request, requiredDuringScheduling affinity expressions, etc.),
                                  compute a sum by iterating through the elements of this field and adding
                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                  node(s) with the highest sum are the most preferred.
                                items:
                                  description: The weights of all of the matched WeightedPodAffinityTerm
                                    fields are added per-node to find the most preferred
                                    node(s)
                                  properties:
                                    podAffinityTerm:
                                      description: Required. A pod affinity term,
                                        associated with the corresponding weight.
                                      properties:
                                        labelSelector:
                                          description: |-
                                            A label query over a set of resources, in this case pods.
                                            If it's null, this PodAffinityTerm matches with no Pods.
                                          properties:
                                            matchExpressions:
                                              description: matchExpressions is a list
                                                of label selector requirements. The
                                                requirements are ANDed.
                                              items:
                                                description: |-
                                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                                  relates the key and values.
                                                properties:
                                                  key:
                                                    description: key is the label
                                                      key that the selector applies
                                                      to.
                                                    type: string
                                                  operator:
                                                    description: |-
                                                      operator represents a key's relationship to a set of values.
                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                                    type: string
                                                  values:
                                                    description: |-
                                                      values is an array of string values. If the operator is In or NotIn,
                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                      the values array must be empty. This array is replaced during a strategic
                                                      merge patch.
                                                    items:
                                                      type: string
                                                    type: array
                                                    x-kubernetes-list-type: atomic
                                                required:
                                                - key
                                                - operator
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            matchLabels:
                                              additionalProperties:
                                                type: string
                                              description: |-
                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                                              type: object
                                          type: object
                                          x-kubernetes-map-type: atomic
                                        matchLabelKeys:
                                          description: |-
                                            MatchLabelKeys is a set of pod label keys to select which pods will
                                            be taken into consideration. The keys are used to lookup values from the
                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                            to select the group of existing pods which pods will be taken into consideration
                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                            pod labels will be ignored. The default value is empty.
                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        mismatchLabelKeys:
                                          description: |-
                                            MismatchLabelKeys is a set of pod label keys to select which pods will
                                            be taken into consideration. The keys are used to lookup values from the
                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                            to select the group of existing pods which pods will be taken into consideration
                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                            pod labels will be ignored. The default value is empty.
                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        namespaceSelector:
                                          description: |-
                                            A label query over the set of namespaces that the term applies to.
                                            The term is applied to the union of the namespaces selected by this field
                                            and the ones listed in the namespaces field.
                                            null selector and null or empty namespaces list means "this pod's namespace".
                                            An empty selector ({}) matches all namespaces.
                                          properties:
                                            matchExpressions:
                                              description: matchExpressions is a list
                                                of label selector requirements. The
                                                requirements are ANDed.
                                              items:
                                                description: |-
                                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                                  relates the key and values.
                                                properties:
                                                  key:
                                                    description: key is the label
                                                      key that the selector applies
                                                      to.
                                                    type: string
                                                  operator:
                                                    description: |-
                                                      operator represents a key's relationship to a set of values.
                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                                    type: string
                                                  values:
                                                    description: |-
                                                      values is an array of string values. If the operator is In or NotIn,
                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                      the values array must be empty. This array is replaced during a strategic
                                                      merge patch.
                                                    items:
                                                      type: string
                                                    type: array
                                                    x-kubernetes-list-type: atomic
                                                required:
                                                - key
                                                - operator
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            matchLabels:
                                              additionalProperties:
                                                type: string
                                              description: |-
                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                                              type: object
                                          type: object
                                          x-kubernetes-map-type: atomic
                                        namespaces:
                                          description: |-
                                            namespaces specifies a static list of namespace names that the term applies to.
                                            The term is applied to the union of the namespaces listed in this field
                                            and the ones selected by namespaceSelector.
                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        topologyKey:
                                          description: |-
                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                            whose value of the label with key topologyKey matches that of any node on which any of the
                                            selected pods is running.
                                            Empty topologyKey is not allowed.
                                          type: string
                                      required:
                                      - topologyKey
                                      type: object
                                    weight:
                                      description: |-
                                        weight associated with matching the corresponding podAffinityTerm,
                                        in the range 1-100.
                                      format: int32
                                      type: integer
                                  required:
                                  - podAffinityTerm
                                  - weight
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              requiredDuringSchedulingIgnoredDuringExecution:
                                description: |-
                                  If the affinity requirements specified by this field are not met at
                                  scheduling time, the pod will not be scheduled onto the node.
                                  If the affinity requirements specified by this field cease to be met
                                  at some point during pod execution (e.g. due to a pod label update), the
                                  system may or may not try to eventually evict the pod from its node.
                                  When there are multiple elements, the lists of nodes corresponding to each
                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                items:
                                  description: |-
                                    Defines a set of pods (namely those matching the labelSelector
                                    relative to the given namespace(s)) that this pod should be
                                    co-located (affinity) or not co-located (anti-affinity) with,
                                    where co-located is defined as running on a node whose value of
                                    the label with key <topologyKey> matches that of any node on which
                                    a pod of the set of pods is running
                                  properties:
                                    labelSelector:
                                      description: |-
                                        A label query over a set of resources, in this case pods.
                                        If it's null, this PodAffinityTerm matches with no Pods.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    matchLabelKeys:
                                      description: |-
                                        MatchLabelKeys is a set of pod label keys to select which pods will
                                        be taken into consideration. The keys are used to lookup values from the
                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                        to select the group of existing pods which pods will be taken into consideration
                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    mismatchLabelKeys:
                                      description: |-
                                        MismatchLabelKeys is a set of pod label keys to select which pods will
                                        be taken into consideration. The keys are used to lookup values from the
                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                        to select the group of existing pods which pods will be taken into consideration
                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    namespaceSelector:
                                      description: |-
                                        A label query over the set of namespaces that the term applies to.
                                        The term is applied to the union of the namespaces selected by this field
                                        and the ones listed in the namespaces field.
                                        null selector and null or empty namespaces list means "this pod's namespace".
                                        An empty selector ({}) matches all namespaces.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    namespaces:
                                      description: |-
                                        namespaces specifies a static list of namespace names that the term applies to.
                                        The term is applied to the union of the namespaces listed in this field
                                        and the ones selected by namespaceSelector.
                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    topologyKey:
                                      description: |-
                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                        whose value of the label with key topologyKey matches that of any node on which any of the
                                        selected pods is running.
                                        Empty topologyKey is not allowed.
                                      type: string
                                  required:
                                  - topologyKey
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                          podAntiAffinity:
                            description: Describes pod anti-affinity scheduling rules
                              (e.g. avoid putting this pod in the same node, zone,
                              etc. as some other pod(s)).
                            properties:
                              preferredDuringSchedulingIgnoredDuringExecution:
                                description: |-
                                  The scheduler will prefer to schedule pods to nodes that satisfy
                                  the anti-affinity expressions specified by this field, but it may choose
                                  a node that violates one or more of the expressions. The node that is
                                  most preferred is the one with the greatest sum of weights, i.e.
                                  for each node that meets all of the scheduling requirements (resource
                                  request, requiredDuringScheduling anti-affinity expressions, etc.),
                                  compute a sum by iterating through the elements of this field and adding
                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                  node(s) with the highest sum are the most preferred.
                                items:
                                  description: The weights of all of the matched WeightedPodAffinityTerm
                                    fields are added per-node to find the most preferred
                                    node(s)
                                  properties:
                                    podAffinityTerm:
                                      description: Required. A pod affinity term,
                                        associated with the corresponding weight.
                                      properties:
                                        labelSelector:
                                          description: |-
                                            A label query over a set of resources, in this case pods.
                                            If it's null, this PodAffinityTerm matches with no Pods.
                                          properties:
                                            matchExpressions:
                                              description: matchExpressions is a list
                                                of label selector requirements. The
                                                requirements are ANDed.
                                              items:
                                                description: |-
                                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                                  relates the key and values.
                                                properties:
                                                  key:
                                                    description: key is the label
                                                      key that the selector applies
                                                      to.
                                                    type: string
                                                  operator:
                                                    description: |-
                                                      operator represents a key's relationship to a set of values.
                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                                    type: string
                                                  values:
                                                    description: |-
                                                      values is an array of string values. If the operator is In or NotIn,
                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                      the values array must be empty. This array is replaced during a strategic
                                                      merge patch.
                                                    items:
                                                      type: string
                                                    type: array
                                                    x-kubernetes-list-type: atomic
                                                required:
                                                - key
                                                - operator
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            matchLabels:
                                              additionalProperties:
                                                type: string
                                              description: |-
                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                                              type: object
                                          type: object
                                          x-kubernetes-map-type: atomic
                                        matchLabelKeys:
                                          description: |-
                                            MatchLabelKeys is a set of pod label keys to select which pods will
                                            be taken into consideration. The keys are used to lookup values from the
                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                            to select the group of existing pods which pods will be taken into consideration
                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                            pod labels will be ignored. The default value is empty.
                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        mismatchLabelKeys:
                                          description: |-
                                            MismatchLabelKeys is a set of pod label keys to select which pods will
                                            be taken into consideration. The keys are used to lookup values from the
                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                            to select the group of existing pods which pods will be taken into consideration
                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                            pod labels will be ignored. The default value is empty.
                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        namespaceSelector:
                                          description: |-
                                            A label query over the set of namespaces that the term applies to.
                                            The term is applied to the union of the namespaces selected by this field
                                            and the ones listed in the namespaces field.
                                            null selector and null or empty namespaces list means "this pod's namespace".
                                            An empty selector ({}) matches all namespaces.
                                          properties:
                                            matchExpressions:
                                              description: matchExpressions is a list
                                                of label selector requirements. The
                                                requirements are ANDed.
                                              items:
                                                description: |-
                                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                                  relates the key and values.
                                                properties:
                                                  key:
                                                    description: key is the label
                                                      key that the selector applies
                                                      to.
                                                    type: string
                                                  operator:
                                                    description: |-
                                                      operator represents a key's relationship to a set of values.
                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                                    type: string
                                                  values:
                                                    description: |-
                                                      values is an array of string values. If the operator is In or NotIn,
                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                      the values array must be empty. This array is replaced during a strategic
                                                      merge patch.
                                                    items:
                                                      type: string
                                                    type: array
                                                    x-kubernetes-list-type: atomic
                                                required:
                                                - key
                                                - operator
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            matchLabels:
                                              additionalProperties:
                                                type: string
                                              description: |-
                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                                              type: object
                                          type: object
                                          x-kubernetes-map-type: atomic
                                        namespaces:
                                          description: |-
                                            namespaces specifies a static list of namespace names that the term applies to.
                                            The term is applied to the union of the namespaces listed in this field
                                            and the ones selected by namespaceSelector.
                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        topologyKey:
                                          description: |-
                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                            whose value of the label with key topologyKey matches that of any node on which any of the
                                            selected pods is running.
                                            Empty topologyKey is not allowed.
                                          type: string
                                      required:
                                      - topologyKey
                                      type: object
                                    weight:
                                      description: |-
                                        weight associated with matching the corresponding podAffinityTerm,
                                        in the range 1-100.
                                      format: int32
                                      type: integer
                                  required:
                                  - podAffinityTerm
                                  - weight
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              requiredDuringSchedulingIgnoredDuringExecution:
                                description: |-
                                  If the anti-affinity requirements specified by this field are not met at
                                  scheduling time, the pod will not be scheduled onto the node.
                                  If the anti-affinity requirements specified by this field cease to be met
                                  at some point during pod execution (e.g. due to a pod label update), the
                                  system may or may not try to eventually evict the pod from its node.
                                  When there are multiple elements, the lists of nodes corresponding to each
                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                items:
                                  description: |-
                                    Defines a set of pods (namely those matching the labelSelector
                                    relative to the given namespace(s)) that this pod should be
                                    co-located (affinity) or not co-located (anti-affinity) with,
                                    where co-located is defined as running on a node whose value of
                                    the label with key <topologyKey> matches that of any node on which
                                    a pod of the set of pods is running
                                  properties:
                                    labelSelector:
                                      description: |-
                                        A label query over a set of resources, in this case pods.
                                        If it's null, this PodAffinityTerm matches with no Pods.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    matchLabelKeys:
                                      description: |-
                                        MatchLabelKeys is a set of pod label keys to select which pods will
                                        be taken into consideration. The keys are used to lookup values from the
                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                        to select the group of existing pods which pods will be taken into consideration
                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    mismatchLabelKeys:
                                      description: |-
                                        MismatchLabelKeys is a set of pod label keys to select which pods will
                                        be taken into consideration. The keys are used to lookup values from the
                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                        to select the group of existing pods which pods will be taken into consideration
                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    namespaceSelector:
                                      description: |-
                                        A label query over the set of namespaces that the term applies to.
                                        The term is applied to the union of the namespaces selected by this field
                                        and the ones listed in the namespaces field.
                                        null selector and null or empty namespaces list means "this pod's namespace".
                                        An empty selector ({}) matches all namespaces.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    namespaces:
                                      description: |-
                                        namespaces specifies a static list of namespace names that the term applies to.
                                        The term is applied to the union of the namespaces listed in this field
                                        and the ones selected by namespaceSelector.
                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    topologyKey:
                                      description: |-
                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                        whose value of the label with key topologyKey matches that of any node on which any of the
                                        selected pods is running.
                                        Empty topologyKey is not allowed.
                                      type: string
                                  required:
                                  - topologyKey
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                        type: object
                      annotations:
                        additionalProperties:
                          type: string
                        description: |-
                          Annotations that will be added to the proxy Pod.
                          Any annotations specified here will be merged with the default
                          annotations applied to the Pod by the Tailscale Kubernetes operator.
                          Annotations must be valid Kubernetes annotations.
                          https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set
                        type: object
                      dnsConfig:
                        description: |-
                          DNSConfig defines DNS parameters for the proxy Pod in addition to those generated from DNSPolicy.
                          When DNSPolicy is set to "None", DNSConfig must be specified.
                          https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
                        properties:
                          nameservers:
                            description: |-
                              A list of DNS name server IP addresses.
                              This will be appended to the base nameservers generated from DNSPolicy.
                              Duplicated nameservers will be removed.
                            items:
                              type: string
                            type: array
                            x-kubernetes-list-type: atomic
                          options:
                            description: |-
                              A list of DNS resolver options.
                              This will be merged with the base options generated from DNSPolicy.
                              Duplicated entries will be removed. Resolution options given in Options
                              will override those that appear in the base DNSPolicy.
                            items:
                              description: PodDNSConfigOption defines DNS resolver
                                options of a pod.
                              properties:
                                name:
                                  description: |-
                                    Name is this DNS resolver option's name.
                                    Required.
                                  type: string
                                value:
                                  description: Value is this DNS resolver option's
                                    value.
                                  type: string
                              type: object
                            type: array
                            x-kubernetes-list-type: atomic
                          searches:
                            description: |-
                              A list of DNS search domains for host-name lookup.
                              This will be appended to the base search paths generated from DNSPolicy.
                              Duplicated search paths will be removed.
                            items:
                              type: string
                            type: array
                            x-kubernetes-list-type: atomic
                        type: object
                      dnsPolicy:
                        description: |-
                          DNSPolicy defines how DNS will be configured for the proxy Pod.
                          By default the Tailscale Kubernetes Operator does not set a DNS policy (uses cluster default).
                          https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
                        enum:
                        - ClusterFirstWithHostNet
                        - ClusterFirst
                        - Default
                        - None
                        type: string
                      imagePullSecrets:
                        description: |-
                          Proxy Pod's image pull Secrets.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec
                        items:
                          description: |-
                            LocalObjectReference contains enough information to let you locate the
                            referenced object inside the same namespace.
                          properties:
                            name:
                              default: ""
                              description: |-
                                Name of the referent.
                                This field is effectively required, but due to backwards compatibility is
                                allowed to be empty. Instances of this type with an empty value here are
                                almost certainly wrong.
                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                              type: string
                          type: object
                          x-kubernetes-map-type: atomic
                        type: array
                      labels:
                        additionalProperties:
                          maxLength: 63
                          pattern: ^(([a-zA-Z0-9][-._a-zA-Z0-9]*)?[a-zA-Z0-9])?$
                          type: string
                        description: |-
                          Labels that will be added to the proxy Pod.
                          Any labels specified here will be merged with the default labels
                          applied to the Pod by the Tailscale Kubernetes operator.
                          Label keys and values must be valid Kubernetes label keys and values.
                          https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
                        type: object
                      nodeName:
                        description: |-
                          Proxy Pod's node name.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
                        type: string
                      nodeSelector:
                        additionalProperties:
                          type: string
                        description: |-
                          Proxy Pod's node selector.
                          By default Tailscale Kubernetes operator does not apply any node
                          selector.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
                        type: object
                      priorityClassName:
                        description: |-
                          PriorityClassName for the proxy Pod.
                          By default Tailscale Kubernetes operator does not apply any priority class.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
                        type: string
                      securityContext:
                        description: |-
                          Proxy Pod's security context.
                          By default Tailscale Kubernetes operator does not apply any Pod
                          security context.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-2
                        properties:
                          appArmorProfile:
                            description: |-
                              appArmorProfile is the AppArmor options to use by the containers in this pod.
                              Note that this field cannot be set when spec.os.name is windows.
                            properties:
                              localhostProfile:
                                description: |-
                                  localhostProfile indicates a profile loaded on the node that should be used.
                                  The profile must be preconfigured on the node to work.
                                  Must match the loaded name of the profile.
                                  Must be set if and only if type is "Localhost".
                                type: string
                              type:
                                description: |-
                                  type indicates which kind of AppArmor profile will be applied.
                                  Valid options are:
                                    Localhost - a profile pre-loaded on the node.
                                    RuntimeDefault - the container runtime's default profile.
                                    Unconfined - no AppArmor enforcement.
                                type: string
                            required:
                            - type
                            type: object
                          fsGroup:
                            description: |-
                              A special supplemental group that applies to all containers in a pod.
                              Some volume types allow the Kubelet to change the ownership of that volume
                              to be owned by the pod:

                              1. The owning GID will be the FSGroup
                              2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
                              3. The permission bits are OR'd with rw-rw----

                              If unset, the Kubelet will not modify the ownership and permissions of any volume.
                              Note that this field cannot be set when spec.os.name is windows.
                            format: int64
                            type: integer
                          fsGroupChangePolicy:
                            description: |-
                              fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
                              before being exposed inside Pod. This field will only apply to
                              volume types which support fsGroup based ownership(and permissions).
                              It will have no effect on ephemeral volume types such as: secret, configmaps
                              and emptydir.
                              Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
                              Note that this field cannot be set when spec.os.name is windows.
                            type: string
                          runAsGroup:
                            description: |-
                              The GID to run the entrypoint of the container process.
                              Uses runtime default if unset.
                              May also be set in SecurityContext.  If set in both SecurityContext and
                              PodSecurityContext, the value specified in SecurityContext takes precedence
                              for that container.
                              Note that this field cannot be set when spec.os.name is windows.
                            format: int64
                            type: integer
                          runAsNonRoot:
                            description: |-
                              Indicates that the container must run as a non-root user.
                              If true, the Kubelet will validate the image at runtime to ensure that it
                              does not run as UID 0 (root) and fail to start the container if it does.
                              If unset or false, no such validation will be performed.
                              May also be set in SecurityContext.  If set in both SecurityContext and
                              PodSecurityContext, the value specified in SecurityContext takes precedence.
                            type: boolean
                          runAsUser:
                            description: |-
                              The UID to run the entrypoint of the container process.
                              Defaults to user specified in image metadata if unspecified.
                              May also be set in SecurityContext.  If set in both SecurityContext and
                              PodSecurityContext, the value specified in SecurityContext takes precedence
                              for that container.
                              Note that this field cannot be set when spec.os.name is windows.
                            format: int64
                            type: integer
                          seLinuxChangePolicy:
                            description: |-
                              seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.
                              It has no effect on nodes that do not support SELinux or to volumes does not support SELinux.
                              Valid values are "MountOption" and "Recursive".

                              "Recursive" means relabeling of all files on all Pod volumes by the container runtime.
                              This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.

                              "MountOption" mounts all eligible Pod volumes with `-o context` mount option.
                              This requires all Pods that share the same volume to use the same SELinux label.
                              It is not possible to share the same volume among privileged and unprivileged Pods.
                              Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
                              whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
                              CSIDriver instance. Other volumes are always re-labelled recursively.
                              "MountOption" value is allowed only when SELinuxMount feature gate is enabled.

                              If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
                              If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
                              and "Recursive" for all other volumes.

                              This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.

                              All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.
                              Note that this field cannot be set when spec.os.name is windows.
                            type: string
                          seLinuxOptions:
                            description: |-
                              The SELinux context to be applied to all containers.
                              If unspecified, the container runtime will allocate a random SELinux context for each
                              container.  May also be set in SecurityContext.  If set in
                              both SecurityContext and PodSecurityContext, the value specified in SecurityContext
                              takes precedence for that container.
                              Note that this field cannot be set when spec.os.name is windows.
                            properties:
                              level:
                                description: Level is SELinux level label that applies
                                  to the container.
                                type: string
                              role:
                                description: Role is a SELinux role label that applies
                                  to the container.
                                type: string
                              type:
                                description: Type is a SELinux type label that applies
                                  to the container.
                                type: string
                              user:
                                description: User is a SELinux user label that applies
                                  to the container.
                                type: string
                            type: object
                          seccompProfile:
                            description: |-
                              The seccomp options to use by the containers in this pod.
                              Note that this field cannot be set when spec.os.name is windows.
                            properties:
                              localhostProfile:
                                description: |-
                                  localhostProfile indicates a profile defined in a file on the node should be used.
                                  The profile must be preconfigured on the node to work.
                                  Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                  Must be set if type is "Localhost". Must NOT be set for any other type.
                                type: string
                              type:
                                description: |-
                                  type indicates which kind of seccomp profile will be applied.
                                  Valid options are:

                                  Localhost - a profile defined in a file on the node should be used.
                                  RuntimeDefault - the container runtime default profile should be used.
                                  Unconfined - no profile should be applied.
                                type: string
                            required:
                            - type
                            type: object
                          supplementalGroups:
                            description: |-
                              A list of groups applied to the first process run in each container, in
                              addition to the container's primary GID and fsGroup (if specified).  If
                              the SupplementalGroupsPolicy feature is enabled, the
                              supplementalGroupsPolicy field determines whether these are in addition
                              to or instead of any group memberships defined in the container image.
                              If unspecified, no additional groups are added, though group memberships
                              defined in the container image may still be used, depending on the
                              supplementalGroupsPolicy field.
                              Note that this field cannot be set when spec.os.name is windows.
                            items:
                              format: int64
                              type: integer
                            type: array
                            x-kubernetes-list-type: atomic
                          supplementalGroupsPolicy:
                            description: |-
                              Defines how supplemental groups of the first container processes are calculated.
                              Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
                              (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
                              and the container runtime must implement support for this feature.
                              Note that this field cannot be set when spec.os.name is windows.
                            type: string
                          sysctls:
                            description: |-
                              Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
                              sysctls (by the container runtime) might fail to launch.
                              Note that this field cannot be set when spec.os.name is windows.
                            items:
                              description: Sysctl defines a kernel parameter to be
                                set
                              properties:
                                name:
                                  description: Name of a property to set
                                  type: string
                                value:
                                  description: Value of a property to set
                                  type: string
                              required:
                              - name
                              - value
                              type: object
                            type: array
                            x-kubernetes-list-type: atomic
                          windowsOptions:
                            description: |-
                              The Windows specific settings applied to all containers.
                              If unspecified, the options within a container's SecurityContext will be used.
                              If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
                              Note that this field cannot be set when spec.os.name is linux.
                            properties:
                              gmsaCredentialSpec:
                                description: |-
                                  GMSACredentialSpec is where the GMSA admission webhook
                                  (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
                                  GMSA credential spec named by the GMSACredentialSpecName field.
                                type: string
                              gmsaCredentialSpecName:
                                description: GMSACredentialSpecName is the name of
                                  the GMSA credential spec to use.
                                type: string
                              hostProcess:
                                description: |-
                                  HostProcess determines if a container should be run as a 'Host Process' container.
                                  All of a Pod's containers must have the same effective HostProcess value
                                  (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
                                  In addition, if HostProcess is true then HostNetwork must also be set to true.
                                type: boolean
                              runAsUserName:
                                description: |-
                                  The UserName in Windows to run the entrypoint of the container process.
                                  Defaults to the user specified in image metadata if unspecified.
                                  May also be set in PodSecurityContext. If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                type: string
                            type: object
                        type: object
                      tailscaleContainer:
                        description: Configuration for the proxy container running
                          tailscale.
                        properties:
                          debug:
                            description: |-
                              Configuration for enabling extra debug information in the container.
                              Not recommended for production use.
                            properties:
                              enable:
                                description: |-
                                  Enable tailscaled's HTTP pprof endpoints at <pod-ip>:9001/debug/pprof/
                                  and internal debug metrics endpoint at <pod-ip>:9001/debug/metrics, where
                                  9001 is a container port named "debug". The endpoints and their responses
                                  may change in backwards incompatible ways in the future, and should not
                                  be considered stable.

                                  In 1.78.x and 1.80.x, this setting will default to the value of
                                  .spec.metrics.enable, and requests to the "metrics" port matching the
                                  mux pattern /debug/ will be forwarded to the "debug" port. In 1.82.x,
                                  this setting will default to false, and no requests will be proxied.
                                type: boolean
                            type: object
                          env:
                            description: |-
                              List of environment variables to set in the container.
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables
                              Note that environment variables provided here will take precedence
                              over Tailscale-specific environment variables set by the operator,
                              however running proxies with custom values for Tailscale environment
                              variables (i.e TS_USERSPACE) is not recommended and might break in
                              the future.
                            items:
                              properties:
                                name:
                                  description: Name of the environment variable. Must
                                    be a C_IDENTIFIER.
                                  pattern: ^[-._a-zA-Z][-._a-zA-Z0-9]*$
                                  type: string
                                value:
                                  description: |-
                                    Variable references $(VAR_NAME) are expanded using the previously defined
                                     environment variables in the container and any service environment
                                    variables. If a variable cannot be resolved, the reference in the input
                                    string will be unchanged. Double $$ are reduced to a single $, which
                                    allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
                                    produce the string literal "$(VAR_NAME)". Escaped references will never
                                    be expanded, regardless of whether the variable exists or not. Defaults
                                    to "".
                                  type: string
                              required:
                              - name
                              type: object
                            type: array
                          image:
                            description: |-
                              Container image name. By default images are pulled from docker.io/tailscale,
                              but the official images are also available at ghcr.io/tailscale.

                              For all uses except on ProxyGroups of type "kube-apiserver", this image must
                              be either tailscale/tailscale, or an equivalent mirror of that image.
                              To apply to ProxyGroups of type "kube-apiserver", this image must be
                              tailscale/k8s-proxy or a mirror of that image.

                              For "tailscale/tailscale"-based proxies, specifying image name here will
                              override any proxy image values specified via the Kubernetes operator's
                              Helm chart values or PROXY_IMAGE env var in the operator Deployment.
                              For "tailscale/k8s-proxy"-based proxies, there is currently no way to
                              configure your own default, and this field is the only way to use a
                              custom image.

                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
                            type: string
                          imagePullPolicy:
                            description: |-
                              Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always.
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
                            enum:
                            - Always
                            - Never
                            - IfNotPresent
                            type: string
                          resources:
                            description: |-
                              Container resource requirements.
                              By default Tailscale Kubernetes operator does not apply any resource
                              requirements. The amount of resources required wil depend on the
                              amount of resources the operator needs to parse, usage patterns and
                              cluster size.
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources
                            properties:
                              claims:
                                description: |-
                                  Claims lists the names of resources, defined in spec.resourceClaims,
                                  that are used by this container.

                                  This is an alpha field and requires enabling the
                                  DynamicResourceAllocation feature gate.

                                  This field is immutable. It can only be set for containers.
                                items:
                                  description: ResourceClaim references one entry
                                    in PodSpec.ResourceClaims.
                                  properties:
                                    name:
                                      description: |-
                                        Name must match the name of one entry in pod.spec.resourceClaims of
                                        the Pod where this field is used. It makes that resource available
                                        inside a container.
                                      type: string
                                    request:
                                      description: |-
                                        Request is the name chosen for a request in the referenced claim.
                                        If empty, everything from the claim is made available, otherwise
                                        only the result of this request.
                                      type: string
                                  required:
                                  - name
                                  type: object
                                type: array
                                x-kubernetes-list-map-keys:
                                - name
                                x-kubernetes-list-type: map
                              limits:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: |-
                                  Limits describes the maximum amount of compute resources allowed.
                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                type: object
                              requests:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: |-
                                  Requests describes the minimum amount of compute resources required.
                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                type: object
                            type: object
                          securityContext:
                            description: |-
                              Container security context.
                              Security context specified here will override the security context set by the operator.
                              By default the operator sets the Tailscale container and the Tailscale init container to privileged
                              for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
                              You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
                              installing device plugin in your cluster and configuring the proxies tun device to be created
                              by the device plugin, see  https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
                            properties:
                              allowPrivilegeEscalation:
                                description: |-
                                  AllowPrivilegeEscalation controls whether a process can gain more
                                  privileges than its parent process. This bool directly controls if
                                  the no_new_privs flag will be set on the container process.
                                  AllowPrivilegeEscalation is true always when the container is:
                                  1) run as Privileged
                                  2) has CAP_SYS_ADMIN
                                  Note that this field cannot be set when spec.os.name is windows.
                                type: boolean
                              appArmorProfile:
                                description: |-
                                  appArmorProfile is the AppArmor options to use by this container. If set, this profile
                                  overrides the pod's appArmorProfile.
                                  Note that this field cannot be set when spec.os.name is windows.
                                properties:
                                  localhostProfile:
                                    description: |-
                                      localhostProfile indicates a profile loaded on the node that should be used.
                                      The profile must be preconfigured on the node to work.
                                      Must match the loaded name of the profile.
                                      Must be set if and only if type is "Localhost".
                                    type: string
                                  type:
                                    description: |-
                                      type indicates which kind of AppArmor profile will be applied.
                                      Valid options are:
                                        Localhost - a profile pre-loaded on the node.
                                        RuntimeDefault - the container runtime's default profile.
                                        Unconfined - no AppArmor enforcement.
                                    type: string
                                required:
                                - type
                                type: object
                              capabilities:
                                description: |-
                                  The capabilities to add/drop when running containers.
                                  Defaults to the default set of capabilities granted by the container runtime.
                                  Note that this field cannot be set when spec.os.name is windows.
                                properties:
                                  add:
                                    description: Added capabilities
                                    items:
                                      description: Capability represent POSIX capabilities
                                        type
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  drop:
                                    description: Removed capabilities
                                    items:
                                      description: Capability represent POSIX capabilities
                                        type
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                type: object
                              privileged:
                                description: |-
                                  Run container in privileged mode.
                                  Processes in privileged containers are essentially equivalent to root on the host.
                                  Defaults to false.
                                  Note that this field cannot be set when spec.os.name is windows.
                                type: boolean
                              procMount:
                                description: |-
                                  procMount denotes the type of proc mount to use for the containers.
                                  The default value is Default which uses the container runtime defaults for
                                  readonly paths and masked paths.
                                  This requires the ProcMountType feature flag to be enabled.
                                  Note that this field cannot be set when spec.os.name is windows.
                                type: string
                              readOnlyRootFilesystem:
                                description: |-
                                  Whether this container has a read-only root filesystem.
                                  Default is false.
                                  Note that this field cannot be set when spec.os.name is windows.
                                type: boolean
                              runAsGroup:
                                description: |-
                                  The GID to run the entrypoint of the container process.
                                  Uses runtime default if unset.
                                  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  Note that this field cannot be set when spec.os.name is windows.
                                format: int64
                                type: integer
                              runAsNonRoot:
                                description: |-
                                  Indicates that the container must run as a non-root user.
                                  If true, the Kubelet will validate the image at runtime to ensure that it
                                  does not run as UID 0 (root) and fail to start the container if it does.
                                  If unset or false, no such validation will be performed.
                                  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                type: boolean
                              runAsUser:
                                description: |-
                                  The UID to run the entrypoint of the container process.
                                  Defaults to user specified in image metadata if unspecified.
                                  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  Note that this field cannot be set when spec.os.name is windows.
                                format: int64
                                type: integer
                              seLinuxOptions:
                                description: |-
                                  The SELinux context to be applied to the container.
                                  If unspecified, the container runtime will allocate a random SELinux context for each
                                  container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  Note that this field cannot be set when spec.os.name is windows.
                                properties:
                                  level:
                                    description: Level is SELinux level label that
                                      applies to the container.
                                    type: string
                                  role:
                                    description: Role is a SELinux role label that
                                      applies to the container.
                                    type: string
                                  type:
                                    description: Type is a SELinux type label that
                                      applies to the container.
                                    type: string
                                  user:
                                    description: User is a SELinux user label that
                                      applies to the container.
                                    type: string
                                type: object
                              seccompProfile:
                                description: |-
                                  The seccomp options to use by this container. If seccomp options are
                                  provided at both the pod & container level, the container options
                                  override the pod options.
                                  Note that this field cannot be set when spec.os.name is windows.
                                properties:
                                  localhostProfile:
                                    description: |-
                                      localhostProfile indicates a profile defined in a file on the node should be used.
                                      The profile must be preconfigured on the node to work.
                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                      Must be set if type is "Localhost". Must NOT be set for any other type.
                                    type: string
                                  type:
                                    description: |-
                                      type indicates which kind of seccomp profile will be applied.
                                      Valid options are:

                                      Localhost - a profile defined in a file on the node should be used.
                                      RuntimeDefault - the container runtime default profile should be used.
                                      Unconfined - no profile should be applied.
                                    type: string
                                required:
                                - type
                                type: object
                              windowsOptions:
                                description: |-
                                  The Windows specific settings applied to all containers.
                                  If unspecified, the options from the PodSecurityContext will be used.
                                  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  Note that this field cannot be set when spec.os.name is linux.
                                properties:
                                  gmsaCredentialSpec:
                                    description: |-
                                      GMSACredentialSpec is where the GMSA admission webhook
                                      (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
                                      GMSA credential spec named by the GMSACredentialSpecName field.
                                    type: string
                                  gmsaCredentialSpecName:
                                    description: GMSACredentialSpecName is the name
                                      of the GMSA credential spec to use.
                                    type: string
                                  hostProcess:
                                    description: |-
                                      HostProcess determines if a container should be run as a 'Host Process' container.
                                      All of a Pod's containers must have the same effective HostProcess value
                                      (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
                                      In addition, if HostProcess is true then HostNetwork must also be set to true.
                                    type: boolean
                                  runAsUserName:
                                    description: |-
                                      The UserName in Windows to run the entrypoint of the container process.
                                      Defaults to the user specified in image metadata if unspecified.
                                      May also be set in PodSecurityContext. If set in both SecurityContext and
                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
                                    type: string
                                type: object
                            type: object
                        type: object
                      tailscaleInitContainer:
                        description: |-
                          Configuration for the proxy init container that enables forwarding.
                          Not valid to apply to ProxyGroups of type "kube-apiserver".
                        properties:
                          debug:
                            description: |-
                              Configuration for enabling extra debug information in the container.
                              Not recommended for production use.
                            properties:
                              enable:
                                description: |-
                                  Enable tailscaled's HTTP pprof endpoints at <pod-ip>:9001/debug/pprof/
                                  and internal debug metrics endpoint at <pod-ip>:9001/debug/metrics, where
                                  9001 is a container port named "debug". The endpoints and their responses
                                  may change in backwards incompatible ways in the future, and should not
                                  be considered stable.

                                  In 1.78.x and 1.80.x, this setting will default to the value of
                                  .spec.metrics.enable, and requests to the "metrics" port matching the
                                  mux pattern /debug/ will be forwarded to the "debug" port. In 1.82.x,
                                  this setting will default to false, and no requests will be proxied.
                                type: boolean
                            type: object
                          env:
                            description: |-
                              List of environment variables to set in the container.
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables
                              Note that environment variables provided here will take precedence
                              over Tailscale-specific environment variables set by the operator,
                              however running proxies with custom values for Tailscale environment
                              variables (i.e TS_USERSPACE) is not recommended and might break in
                              the future.
                            items:
                              properties:
                                name:
                                  description: Name of the environment variable. Must
                                    be a C_IDENTIFIER.
                                  pattern: ^[-._a-zA-Z][-._a-zA-Z0-9]*$
                                  type: string
                                value:
                                  description: |-
                                    Variable references $(VAR_NAME) are expanded using the previously defined
                                     environment variables in the container and any service environment
                                    variables. If a variable cannot be resolved, the reference in the input
                                    string will be unchanged. Double $$ are reduced to a single $, which
                                    allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
                                    produce the string literal "$(VAR_NAME)". Escaped references will never
                                    be expanded, regardless of whether the variable exists or not. Defaults
                                    to "".
                                  type: string
                              required:
                              - name
                              type: object
                            type: array
                          image:
                            description: |-
                              Container image name. By default images are pulled from docker.io/tailscale,
                              but the official images are also available at ghcr.io/tailscale.

                              For all uses except on ProxyGroups of type "kube-apiserver", this image must
                              be either tailscale/tailscale, or an equivalent mirror of that image.
                              To apply to ProxyGroups of type "kube-apiserver", this image must be
                              tailscale/k8s-proxy or a mirror of that image.

                              For "tailscale/tailscale"-based proxies, specifying image name here will
                              override any proxy image values specified via the Kubernetes operator's
                              Helm chart values or PROXY_IMAGE env var in the operator Deployment.
                              For "tailscale/k8s-proxy"-based proxies, there is currently no way to
                              configure your own default, and this field is the only way to use a
                              custom image.

                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
                            type: string
                          imagePullPolicy:
                            description: |-
                              Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always.
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
                            enum:
                            - Always
                            - Never
                            - IfNotPresent
                            type: string
                          resources:
                            description: |-
                              Container resource requirements.
                              By default Tailscale Kubernetes operator does not apply any resource
                              requirements. The amount of resources required wil depend on the
                              amount of resources the operator needs to parse, usage patterns and
                              cluster size.
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources
                            properties:
                              claims:
                                description: |-
                                  Claims lists the names of resources, defined in spec.resourceClaims,
                                  that are used by this container.

                                  This is an alpha field and requires enabling the
                                  DynamicResourceAllocation feature gate.

                                  This field is immutable. It can only be set for containers.
                                items:
                                  description: ResourceClaim references one entry
                                    in PodSpec.ResourceClaims.
                                  properties:
                                    name:
                                      description: |-
                                        Name must match the name of one entry in pod.spec.resourceClaims of
                                        the Pod where this field is used. It makes that resource available
                                        inside a container.
                                      type: string
                                    request:
                                      description: |-
                                        Request is the name chosen for a request in the referenced claim.
                                        If empty, everything from the claim is made available, otherwise
                                        only the result of this request.
                                      type: string
                                  required:
                                  - name
                                  type: object
                                type: array
                                x-kubernetes-list-map-keys:
                                - name
                                x-kubernetes-list-type: map
                              limits:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: |-
                                  Limits describes the maximum amount of compute resources allowed.
                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                type: object
                              requests:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: |-
                                  Requests describes the minimum amount of compute resources required.
                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                type: object
                            type: object
                          securityContext:
                            description: |-
                              Container security context.
                              Security context specified here will override the security context set by the operator.
                              By default the operator sets the Tailscale container and the Tailscale init container to privileged
                              for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
                              You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
                              installing device plugin in your cluster and configuring the proxies tun device to be created
                              by the device plugin, see  https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
                            properties:
                              allowPrivilegeEscalation:
                                description: |-
                                  AllowPrivilegeEscalation controls whether a process can gain more
                                  privileges than its parent process. This bool directly controls if
                                  the no_new_privs flag will be set on the container process.
                                  AllowPrivilegeEscalation is true always when the container is:
                                  1) run as Privileged
                                  2) has CAP_SYS_ADMIN
                                  Note that this field cannot be set when spec.os.name is windows.
                                type: boolean
                              appArmorProfile:
                                description: |-
                                  appArmorProfile is the AppArmor options to use by this container. If set, this profile
                                  overrides the pod's appArmorProfile.
                                  Note that this field cannot be set when spec.os.name is windows.
                                properties:
                                  localhostProfile:
                                    description: |-
                                      localhostProfile indicates a profile loaded on the node that should be used.
                                      The profile must be preconfigured on the node to work.
                                      Must match the loaded name of the profile.
                                      Must be set if and only if type is "Localhost".
                                    type: string
                                  type:
                                    description: |-
                                      type indicates which kind of AppArmor profile will be applied.
                                      Valid options are:
                                        Localhost - a profile pre-loaded on the node.
                                        RuntimeDefault - the container runtime's default profile.
                                        Unconfined - no AppArmor enforcement.
                                    type: string
                                required:
                                - type
                                type: object
                              capabilities:
                                description: |-
                                  The capabilities to add/drop when running containers.
                                  Defaults to the default set of capabilities granted by the container runtime.
                                  Note that this field cannot be set when spec.os.name is windows.
                                properties:
                                  add:
                                    description: Added capabilities
                                    items:
                                      description: Capability represent POSIX capabilities
                                        type
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  drop:
                                    description: Removed capabilities
                                    items:
                                      description: Capability represent POSIX capabilities
                                        type
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                type: object
                              privileged:
                                description: |-
                                  Run container in privileged mode.
                                  Processes in privileged containers are essentially equivalent to root on the host.
                                  Defaults to false.
                                  Note that this field cannot be set when spec.os.name is windows.
                                type: boolean
                              procMount:
                                description: |-
                                  procMount denotes the type of proc mount to use for the containers.
                                  The default value is Default which uses the container runtime defaults for
                                  readonly paths and masked paths.
                                  This requires the ProcMountType feature flag to be enabled.
                                  Note that this field cannot be set when spec.os.name is windows.
                                type: string
                              readOnlyRootFilesystem:
                                description: |-
                                  Whether this container has a read-only root filesystem.
                                  Default is false.
                                  Note that this field cannot be set when spec.os.name is windows.
                                type: boolean
                              runAsGroup:
                                description: |-
                                  The GID to run the entrypoint of the container process.
                                  Uses runtime default if unset.
                                  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  Note that this field cannot be set when spec.os.name is windows.
                                format: int64
                                type: integer
                              runAsNonRoot:
                                description: |-
                                  Indicates that the container must run as a non-root user.
                                  If true, the Kubelet will validate the image at runtime to ensure that it
                                  does not run as UID 0 (root) and fail to start the container if it does.
                                  If unset or false, no such validation will be performed.
                                  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                type: boolean
                              runAsUser:
                                description: |-
                                  The UID to run the entrypoint of the container process.
                                  Defaults to user specified in image metadata if unspecified.
                                  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  Note that this field cannot be set when spec.os.name is windows.
                                format: int64
                                type: integer
                              seLinuxOptions:
                                description: |-
                                  The SELinux context to be applied to the container.
                                  If unspecified, the container runtime will allocate a random SELinux context for each
                                  container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  Note that this field cannot be set when spec.os.name is windows.
                                properties:
                                  level:
                                    description: Level is SELinux level label that
                                      applies to the container.
                                    type: string
                                  role:
                                    description: Role is a SELinux role label that
                                      applies to the container.
                                    type: string
                                  type:
                                    description: Type is a SELinux type label that
                                      applies to the container.
                                    type: string
                                  user:
                                    description: User is a SELinux user label that
                                      applies to the container.
                                    type: string
                                type: object
                              seccompProfile:
                                description: |-
                                  The seccomp options to use by this container. If seccomp options are
                                  provided at both the pod & container level, the container options
                                  override the pod options.
                                  Note that this field cannot be set when spec.os.name is windows.
                                properties:
                                  localhostProfile:
                                    description: |-
                                      localhostProfile indicates a profile defined in a file on the node should be used.
                                      The profile must be preconfigured on the node to work.
                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                      Must be set if type is "Localhost". Must NOT be set for any other type.
                                    type: string
                                  type:
                                    description: |-
                                      type indicates which kind of seccomp profile will be applied.
                                      Valid options are:

                                      Localhost - a profile defined in a file on the node should be used.
                                      RuntimeDefault - the container runtime default profile should be used.
                                      Unconfined - no profile should be applied.
                                    type: string
                                required:
                                - type
                                type: object
                              windowsOptions:
                                description: |-
                                  The Windows specific settings applied to all containers.
                                  If unspecified, the options from the PodSecurityContext will be used.
                                  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  Note that this field cannot be set when spec.os.name is linux.
                                properties:
                                  gmsaCredentialSpec:
                                    description: |-
                                      GMSACredentialSpec is where the GMSA admission webhook
                                      (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
                                      GMSA credential spec named by the GMSACredentialSpecName field.
                                    type: string
                                  gmsaCredentialSpecName:
                                    description: GMSACredentialSpecName is the name
                                      of the GMSA credential spec to use.
                                    type: string
                                  hostProcess:
                                    description: |-
                                      HostProcess determines if a container should be run as a 'Host Process' container.
                                      All of a Pod's containers must have the same effective HostProcess value
                                      (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
                                      In addition, if HostProcess is true then HostNetwork must also be set to true.
                                    type: boolean
                                  runAsUserName:
                                    description: |-
                                      The UserName in Windows to run the entrypoint of the container process.
                                      Defaults to the user specified in image metadata if unspecified.
                                      May also be set in PodSecurityContext. If set in both SecurityContext and
                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
                                    type: string
                                type: object
                            type: object
                        type: object
                      tolerations:
                        description: |-
                          Proxy Pod's tolerations.
                          By default Tailscale Kubernetes operator does not apply any
                          tolerations.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
                        items:
                          description: |-
                            The pod this Toleration is attached to tolerates any taint that matches
                            the triple <key,value,effect> using the matching operator <operator>.
                          properties:
                            effect:
                              description: |-
                                Effect indicates the taint effect to match. Empty means match all taint effects.
                                When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                              type: string
                            key:
                              description: |-
                                Key is the taint key that the toleration applies to. Empty means match all taint keys.
                                If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                              type: string
                            operator:
                              description: |-
                                Operator represents a key's relationship to the value.
                                Valid operators are Exists and Equal. Defaults to Equal.
                                Exists is equivalent to wildcard for value, so that a pod can
                                tolerate all taints of a particular category.
                              type: string
                            tolerationSeconds:
                              description: |-
                                TolerationSeconds represents the period of time the toleration (which must be
                                of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
                                it is not set, which means tolerate the taint forever (do not evict). Zero and
                                negative values will be treated as 0 (evict immediately) by the system.
                              format: int64
                              type: integer
                            value:
                              description: |-
                                Value is the taint value the toleration matches to.
                                If the operator is Exists, the value should be empty, otherwise just a regular string.
                              type: string
                          type: object
                        type: array
                      topologySpreadConstraints:
                        description: |-
                          Proxy Pod's topology spread constraints.
                          By default Tailscale Kubernetes operator does not apply any topology spread constraints.
                          https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/
                        items:
                          description: TopologySpreadConstraint specifies how to spread
                            matching pods among the given topology.
                          properties:
                            labelSelector:
                              description: |-
                                LabelSelector is used to find matching pods.
                                Pods that match this label selector are counted to determine the number of pods
                                in their corresponding topology domain.
                              properties:
                                matchExpressions:
                                  description: matchExpressions is a list of label
                                    selector requirements. The requirements are ANDed.
                                  items:
                                    description: |-
                                      A label selector requirement is a selector that contains values, a key, and an operator that
                                      relates the key and values.
                                    properties:
                                      key:
                                        description: key is the label key that the
                                          selector applies to.
                                        type: string
                                      operator:
                                        description: |-
                                          operator represents a key's relationship to a set of values.
                                          Valid operators are In, NotIn, Exists and DoesNotExist.
                                        type: string
                                      values:
                                        description: |-
                                          values is an array of string values. If the operator is In or NotIn,
                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                          the values array must be empty. This array is replaced during a strategic
                                          merge patch.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    required:
                                    - key
                                    - operator
                                    type: object
                                  type: array
                                  x-kubernetes-list-type: atomic
                                matchLabels:
                                  additionalProperties:
                                    type: string
                                  description: |-
                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
                                  type: object
                              type: object
                              x-kubernetes-map-type: atomic
                            matchLabelKeys:
                              description: |-
                                MatchLabelKeys is a set of pod label keys to select the pods over which
                                spreading will be calculated. The keys are used to lookup values from the
                                incoming pod labels, those key-value labels are ANDed with labelSelector
                                to select the group of existing pods over which spreading will be calculated
                                for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
                                MatchLabelKeys cannot be set when LabelSelector isn't set.
                                Keys that don't exist in the incoming pod labels will
                                be ignored. A null or empty list means only match against labelSelector.

                                This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                            maxSkew:
                              description: |-
                                MaxSkew describes the degree to which pods may be unevenly distributed.
                                When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference
                                between the number of matching pods in the target topology and the global minimum.
                                The global minimum is the minimum number of matching pods in an eligible domain
                                or zero if the number of eligible domains is less than MinDomains.
                                For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
                                labelSelector spread as 2/2/1:
                                In this case, the global minimum is 1.
                                | zone1 | zone2 | zone3 |
                                |  P P  |  P P  |   P   |
                                - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;
                                scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)
                                violate MaxSkew(1).
                                - if MaxSkew is 2, incoming pod can be scheduled onto any zone.
                                When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence
                                to topologies that satisfy it.
                                It's a required field. Default value is 1 and 0 is not allowed.
                              format: int32
                              type: integer
                            minDomains:
                              description: |-
                                MinDomains indicates a minimum number of eligible domains.
                                When the number of eligible domains with matching topology keys is less than minDomains,
                                Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed.
                                And when the number of eligible domains with matching topology keys equals or greater than minDomains,
                                this value has no effect on scheduling.
                                As a result, when the number of eligible domains is less than minDomains,
                                scheduler won't schedule more than maxSkew Pods to those domains.
                                If value is nil, the constraint behaves as if MinDomains is equal to 1.
                                Valid values are integers greater than 0.
                                When value is not nil, WhenUnsatisfiable must be DoNotSchedule.

                                For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same
                                labelSelector spread as 2/2/2:
                                | zone1 | zone2 | zone3 |
                                |  P P  |  P P  |  P P  |
                                The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0.
                                In this situation, new pod with the same labelSelector cannot be scheduled,
                                because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,
                                it will violate MaxSkew.
                              format: int32
                              type: integer
                            nodeAffinityPolicy:
                              description: |-
                                NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector
                                when calculating pod topology spread skew. Options are:
                                - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.
                                - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.

                                If this value is nil, the behavior is equivalent to the Honor policy.
                                This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                              type: string
                            nodeTaintsPolicy:
                              description: |-
                                NodeTaintsPolicy indicates how we will treat node taints when calculating
                                pod topology spread skew. Options are:
                                - Honor: nodes without taints, along with tainted nodes for which the incoming pod
                                has a toleration, are included.
                                - Ignore: node taints are ignored. All nodes are included.

                                If this value is nil, the behavior is equivalent to the Ignore policy.
                                This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                              type: string
                            topologyKey:
                              description: |-
                                TopologyKey is the key of node labels. Nodes that have a label with this key
                                and identical values are considered to be in the same topology.
                                We consider each <key, value> as a "bucket", and try to put balanced number
                                of pods into each bucket.
                                We define a domain as a particular instance of a topology.
                                Also, we define an eligible domain as a domain whose nodes meet the requirements of
                                nodeAffinityPolicy and nodeTaintsPolicy.
                                e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology.
                                And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology.
                                It's a required field.
                              type: string
                            whenUnsatisfiable:
                              description: |-
                                WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy
                                the spread constraint.
                                - DoNotSchedule (default) tells the scheduler not to schedule it.
                                - ScheduleAnyway tells the scheduler to schedule the pod in any location,
                                  but giving higher precedence to topologies that would help reduce the
                                  skew.
                                A constraint is considered "Unsatisfiable" for an incoming pod
                                if and only if every possible node assignment for that pod would violate
                                "MaxSkew" on some topology.
                                For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
                                labelSelector spread as 3/1/1:
                                | zone1 | zone2 | zone3 |
                                | P P P |   P   |   P   |
                                If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled
                                to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies
                                MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler
                                won't make it *more* imbalanced.
                                It's a required field.
                              type: string
                          required:
                          - maxSkew
                          - topologyKey
                          - whenUnsatisfiable
                          type: object
                        type: array
                    type: object
                type: object
              staticEndpoints:
                description: |-
                  Configuration for 'static endpoints' on proxies in order to facilitate
                  direct connections from other devices on the tailnet.
                  See https://tailscale.com/kb/1445/kubernetes-operator-customization#static-endpoints.
                properties:
                  nodePort:
                    description: The configuration for static endpoints using NodePort
                      Services.
                    properties:
                      ports:
                        description: |-
                          The port ranges from which the operator will select NodePorts for the Services.
                          You must ensure that firewall rules allow UDP ingress traffic for these ports
                          to the node's external IPs.
                          The ports must be in the range of service node ports for the cluster (default `30000-32767`).
                          See https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport.
                        items:
                          properties:
                            endPort:
                              description: |-
                                endPort indicates that the range of ports from port to endPort if set, inclusive,
                                should be used. This field cannot be defined if the port field is not defined.
                                The endPort must be either unset, or equal or greater than port.
                              type: integer
                            port:
                              description: port represents a port selected to be used.
                                This is a required field.
                              type: integer
                          required:
                          - port
                          type: object
                        minItems: 1
                        type: array
                      selector:
                        additionalProperties:
                          type: string
                        description: |-
                          A selector which will be used to select the node's that will have their `ExternalIP`'s advertised
                          by the ProxyGroup as Static Endpoints.
                        type: object
                    required:
                    - ports
                    type: object
                required:
                - nodePort
                type: object
              tailscale:
                description: |-
                  TailscaleConfig contains options to configure the tailscale-specific
                  parameters of proxies.
                properties:
                  acceptRoutes:
                    description: |-
                      AcceptRoutes can be set to true to make the proxy instance accept
                      routes advertized by other nodes on the tailnet, such as subnet
                      routes.
                      This is equivalent of passing --accept-routes flag to a tailscale Linux client.
                      https://tailscale.com/kb/1019/subnets#use-your-subnet-routes-from-other-devices
                      Defaults to false.
                    type: boolean
                type: object
              useLetsEncryptStagingEnvironment:
                description: |-
                  Set UseLetsEncryptStagingEnvironment to true to issue TLS
                  certificates for any HTTPS endpoints exposed to the tailnet from
                  LetsEncrypt's staging environment.
                  https://letsencrypt.org/docs/staging-environment/
                  This setting only affects Tailscale Ingress resources.
                  By default Ingress TLS certificates are issued from LetsEncrypt's
                  production environment.
                  Changing this setting true -> false, will result in any
                  existing certs being re-issued from the production environment.
                  Changing this setting false (default) -> true, when certs have already
                  been provisioned from production environment will NOT result in certs
                  being re-issued from the staging environment before they need to be
                  renewed.
                type: boolean
            type: object
          status:
            description: |-
              Status of the ProxyClass. This is set and managed automatically.
              https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
            properties:
              conditions:
                description: |-
                  List of status conditions to indicate the status of the ProxyClass.
                  Known condition types are `ProxyClassReady`.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.17.0
  name: proxygroups.tailscale.com
spec:
  group: tailscale.com
  names:
    kind: ProxyGroup
    listKind: ProxyGroupList
    plural: proxygroups
    shortNames:
    - pg
    singular: proxygroup
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - description: Status of the deployed ProxyGroup resources.
      jsonPath: .status.conditions[?(@.type == "ProxyGroupReady")].reason
      name: Status
      type: string
    - description: URL of the kube-apiserver proxy advertised by the ProxyGroup devices,
        if any. Only applies to ProxyGroups of type kube-apiserver.
      jsonPath: .status.url
      name: URL
      type: string
    - description: ProxyGroup type.
      jsonPath: .spec.type
      name: Type
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: |-
          ProxyGroup defines a set of Tailscale devices that will act as proxies.
          Depending on spec.Type, it can be a group of egress, ingress, or kube-apiserver
          proxies. In addition to running a highly available set of proxies, ingress
          and egress ProxyGroups also allow for serving many annotated Services from a
          single set of proxies to minimise resource consumption.

          For ingress and egress, use the tailscale.com/proxy-group annotation on a
          Service to specify that the proxy should be implemented by a ProxyGroup
          instead of a single dedicated proxy.

          More info:
          * https://tailscale.com/kb/1438/kubernetes-operator-cluster-egress
          * https://tailscale.com/kb/1439/kubernetes-operator-cluster-ingress

          For kube-apiserver, the ProxyGroup is a standalone resource. Use the
          spec.kubeAPIServer field to configure options specific to the kube-apiserver
          ProxyGroup type.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Spec describes the desired ProxyGroup instances.
            properties:
              hostnamePrefix:
                description: |-
                  HostnamePrefix is the hostname prefix to use for tailnet devices created
                  by the ProxyGroup. Each device will have the integer number from its
                  StatefulSet pod appended to this prefix to form the full hostname.
                  HostnamePrefix can contain lower case letters, numbers and dashes, it
                  must not start with a dash and must be between 1 and 62 characters long.
                pattern: ^[a-z0-9][a-z0-9-]{0,61}$
                type: string
              kubeAPIServer:
                description: |-
                  KubeAPIServer contains configuration specific to the kube-apiserver
                  ProxyGroup type. This field is only used when Type is set to "kube-apiserver".
                properties:
                  hostname:
                    description: |-
                      Hostname is the hostname with which to expose the Kubernetes API server
                      proxies. Must be a valid DNS label no longer than 63 characters. If not
                      specified, the name of the ProxyGroup is used as the hostname. Must be
                      unique across the whole tailnet.
                    pattern: ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$
                    type: string
                  mode:
                    description: |-
                      Mode to run the API server proxy in. Supported modes are auth and noauth.
                      In auth mode, requests from the tailnet proxied over to the Kubernetes
                      API server are additionally impersonated using the sender's tailnet identity.
                      If not specified, defaults to auth mode.
                    enum:
                    - auth
                    - noauth
                    type: string
                type: object
              proxyClass:
                description: |-
                  ProxyClass is the name of the ProxyClass custom resource that contains
                  configuration options that should be applied to the resources created
                  for this ProxyGroup. If unset, and there is no default ProxyClass
                  configured, the operator will create resources with the default
                  configuration.
                type: string
              replicas:
                description: |-
                  Replicas specifies how many replicas to create the StatefulSet with.
                  Defaults to 2.
                format: int32
                minimum: 0
                type: integer
              tags:
                description: |-
                  Tags that the Tailscale devices will be tagged with. Defaults to [tag:k8s].
                  If you specify custom tags here, make sure you also make the operator
                  an owner of these tags.
                  See  https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.
                  Tags cannot be changed once a ProxyGroup device has been created.
                  Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.
                items:
                  pattern: ^tag:[a-zA-Z][a-zA-Z0-9-]*$
                  type: string
                type: array
              type:
                description: |-
                  Type of the ProxyGroup proxies. Supported types are egress, ingress, and kube-apiserver.
                  Type is immutable once a ProxyGroup is created.
                enum:
                - egress
                - ingress
                - kube-apiserver
                type: string
                x-kubernetes-validations:
                - message: ProxyGroup type is immutable
                  rule: self == oldSelf
            required:
            - type
            type: object
          status:
            description: |-
              ProxyGroupStatus describes the status of the ProxyGroup resources. This is
              set and managed by the Tailscale operator.
            properties:
              conditions:
                description: |-
                  List of status conditions to indicate the status of the ProxyGroup
                  resources. Known condition types include `ProxyGroupReady` and
                  `ProxyGroupAvailable`.

                  * `ProxyGroupReady` indicates all ProxyGroup resources are reconciled and
                    all expected conditions are true.
                  * `ProxyGroupAvailable` indicates that at least one proxy is ready to
                    serve traffic.

                  For ProxyGroups of type kube-apiserver, there are two additional conditions:

                  * `KubeAPIServerProxyConfigured` indicates that at least one API server
                    proxy is configured and ready to serve traffic.
                  * `KubeAPIServerProxyValid` indicates that spec.kubeAPIServer config is
                    valid.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
              devices:
                description: List of tailnet devices associated with the ProxyGroup
                  StatefulSet.
                items:
                  properties:
                    hostname:
                      description: |-
                        Hostname is the fully qualified domain name of the device.
                        If MagicDNS is enabled in your tailnet, it is the MagicDNS name of the
                        node.
                      type: string
                    staticEndpoints:
                      description: StaticEndpoints are user configured, 'static' endpoints
                        by which tailnet peers can reach this device.
                      items:
                        type: string
                      type: array
                    tailnetIPs:
                      description: |-
                        TailnetIPs is the set of tailnet IP addresses (both IPv4 and IPv6)
                        assigned to the device.
                      items:
                        type: string
                      type: array
                  required:
                  - hostname
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - hostname
                x-kubernetes-list-type: map
              url:
                description: |-
                  URL of the kube-apiserver proxy advertised by the ProxyGroup devices, if
                  any. Only applies to ProxyGroups of type kube-apiserver.
                type: string
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.17.0
  name: recorders.tailscale.com
spec:
  group: tailscale.com
  names:
    kind: Recorder
    listKind: RecorderList
    plural: recorders
    shortNames:
    - rec
    singular: recorder
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - description: Status of the deployed Recorder resources.
      jsonPath: .status.conditions[?(@.type == "RecorderReady")].reason
      name: Status
      type: string
    - description: URL on which the UI is exposed if enabled.
      jsonPath: .status.devices[?(@.url != "")].url
      name: URL
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: |-
          Recorder defines a tsrecorder device for recording SSH sessions. By default,
          it will store recordings in a local ephemeral volume. If you want to persist
          recordings, you can configure an S3-compatible API for storage.

          More info: https://tailscale.com/kb/1484/kubernetes-operator-deploying-tsrecorder
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Spec describes the desired recorder instance.
            properties:
              enableUI:
                description: |-
                  Set to true to enable the Recorder UI. The UI lists and plays recorded sessions.
                  The UI will be served at <MagicDNS name of the recorder>:443. Defaults to false.
                  Corresponds to --ui tsrecorder flag https://tailscale.com/kb/1246/tailscale-ssh-session-recording#deploy-a-recorder-node.
                  Required if S3 storage is not set up, to ensure that recordings are accessible.
                type: boolean
              statefulSet:
                description: |-
                  Configuration parameters for the Recorder's StatefulSet. The operator
                  deploys a StatefulSet for each Recorder resource.
                properties:
                  annotations:
                    additionalProperties:
                      type: string
                    description: |-
                      Annotations that will be added to the StatefulSet created for the Recorder.
                      Any Annotations specified here will be merged with the default annotations
                      applied to the StatefulSet by the operator.
                      https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set
                    type: object
                  labels:
                    additionalProperties:
                      type: string
                    description: |-
                      Labels that will be added to the StatefulSet created for the Recorder.
                      Any labels specified here will be merged with the default labels applied
                      to the StatefulSet by the operator.
                      https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
                    type: object
                  pod:
                    description: Configuration for pods created by the Recorder's
                      StatefulSet.
                    properties:
                      affinity:
                        description: |-
                          Affinity rules for Recorder Pods. By default, the operator does not
                          apply any affinity rules.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#affinity
                        properties:
                          nodeAffinity:
                            description: Describes node affinity scheduling rules
                              for the pod.
                            properties:
                              preferredDuringSchedulingIgnoredDuringExecution:
                                description: |-
                                  The scheduler will prefer to schedule pods to nodes that satisfy
                                  the affinity expressions specified by this field, but it may choose
                                  a node that violates one or more of the expressions. The node that is
                                  most preferred is the one with the greatest sum of weights, i.e.
                                  for each node that meets all of the scheduling requirements (resource
                                  request, requiredDuringScheduling affinity expressions, etc.),
                                  compute a sum by iterating through the elements of this field and adding
                                  "weight" to the sum if the node matches the corresponding matchExpressions; the
                                  node(s) with the highest sum are the most preferred.
                                items:
                                  description: |-
                                    An empty preferred scheduling term matches all objects with implicit weight 0
                                    (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
                                  properties:
                                    preference:
                                      description: A node selector term, associated
                                        with the corresponding weight.
                                      properties:
                                        matchExpressions:
                                          description: A list of node selector requirements
                                            by node's labels.
                                          items:
                                            description: |-
                                              A node selector requirement is a selector that contains values, a key, and an operator
                                              that relates the key and values.
                                            properties:
                                              key:
                                                description: The label key that the
                                                  selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  Represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                type: string
                                              values:
                                                description: |-
                                                  An array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. If the operator is Gt or Lt, the values
                                                  array must have a single element, which will be interpreted as an integer.
                                                  This array is replaced during a strategic merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchFields:
                                          description: A list of node selector requirements
                                            by node's fields.
                                          items:
                                            description: |-
                                              A node selector requirement is a selector that contains values, a key, and an operator
                                              that relates the key and values.
                                            properties:
                                              key:
                                                description: The label key that the
                                                  selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  Represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                type: string
                                              values:
                                                description: |-
                                                  An array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. If the operator is Gt or Lt, the values
                                                  array must have a single element, which will be interpreted as an integer.
                                                  This array is replaced during a strategic merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    weight:
                                      description: Weight associated with matching
                                        the corresponding nodeSelectorTerm, in the
                                        range 1-100.
                                      format: int32
                                      type: integer
                                  required:
                                  - preference
                                  - weight
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              requiredDuringSchedulingIgnoredDuringExecution:
                                description: |-
                                  If the affinity requirements specified by this field are not met at
                                  scheduling time, the pod will not be scheduled onto the node.
                                  If the affinity requirements specified by this field cease to be met
                                  at some point during pod execution (e.g. due to an update), the system
                                  may or may not try to eventually evict the pod from its node.
                                properties:
                                  nodeSelectorTerms:
                                    description: Required. A list of node selector
                                      terms. The terms are ORed.
                                    items:
                                      description: |-
                                        A null or empty node selector term matches no objects. The requirements of
                                        them are ANDed.
                                        The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
                                      properties:
                                        matchExpressions:
                                          description: A list of node selector requirements
                                            by node's labels.
                                          items:
                                            description: |-
                                              A node selector requirement is a selector that contains values, a key, and an operator
                                              that relates the key and values.
                                            properties:
                                              key:
                                                description: The label key that the
                                                  selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  Represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                type: string
                                              values:
                                                description: |-
                                                  An array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. If the operator is Gt or Lt, the values
                                                  array must have a single element, which will be interpreted as an integer.
                                                  This array is replaced during a strategic merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchFields:
                                          description: A list of node selector requirements
                                            by node's fields.
                                          items:
                                            description: |-
                                              A node selector requirement is a selector that contains values, a key, and an operator
                                              that relates the key and values.
                                            properties:
                                              key:
                                                description: The label key that the
                                                  selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  Represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                                type: string
                                              values:
                                                description: |-
                                                  An array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. If the operator is Gt or Lt, the values
                                                  array must have a single element, which will be interpreted as an integer.
                                                  This array is replaced during a strategic merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                - nodeSelectorTerms
                                type: object
                                x-kubernetes-map-type: atomic
                            type: object
                          podAffinity:
                            description: Describes pod affinity scheduling rules (e.g.
                              co-locate this pod in the same node, zone, etc. as some
                              other pod(s)).
                            properties:
                              preferredDuringSchedulingIgnoredDuringExecution:
                                description: |-
                                  The scheduler will prefer to schedule pods to nodes that satisfy
                                  the affinity expressions specified by this field, but it may choose
                                  a node that violates one or more of the expressions. The node that is
                                  most preferred is the one with the greatest sum of weights, i.e.
                                  for each node that meets all of the scheduling requirements (resource
                                  request, requiredDuringScheduling affinity expressions, etc.),
                                  compute a sum by iterating through the elements of this field and adding
                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                  node(s) with the highest sum are the most preferred.
                                items:
                                  description: The weights of all of the matched WeightedPodAffinityTerm
                                    fields are added per-node to find the most preferred
                                    node(s)
                                  properties:
                                    podAffinityTerm:
                                      description: Required. A pod affinity term,
                                        associated with the corresponding weight.
                                      properties:
                                        labelSelector:
                                          description: |-
                                            A label query over a set of resources, in this case pods.
                                            If it's null, this PodAffinityTerm matches with no Pods.
                                          properties:
                                            matchExpressions:
                                              description: matchExpressions is a list
                                                of label selector requirements. The
                                                requirements are ANDed.
                                              items:
                                                description: |-
                                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                                  relates the key and values.
                                                properties:
                                                  key:
                                                    description: key is the label
                                                      key that the selector applies
                                                      to.
                                                    type: string
                                                  operator:
                                                    description: |-
                                                      operator represents a key's relationship to a set of values.
                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                                    type: string
                                                  values:
                                                    description: |-
                                                      values is an array of string values. If the operator is In or NotIn,
                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                      the values array must be empty. This array is replaced during a strategic
                                                      merge patch.
                                                    items:
                                                      type: string
                                                    type: array
                                                    x-kubernetes-list-type: atomic
                                                required:
                                                - key
                                                - operator
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            matchLabels:
                                              additionalProperties:
                                                type: string
                                              description: |-
                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                                              type: object
                                          type: object
                                          x-kubernetes-map-type: atomic
                                        matchLabelKeys:
                                          description: |-
                                            MatchLabelKeys is a set of pod label keys to select which pods will
                                            be taken into consideration. The keys are used to lookup values from the
                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                            to select the group of existing pods which pods will be taken into consideration
                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                            pod labels will be ignored. The default value is empty.
                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        mismatchLabelKeys:
                                          description: |-
                                            MismatchLabelKeys is a set of pod label keys to select which pods will
                                            be taken into consideration. The keys are used to lookup values from the
                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                            to select the group of existing pods which pods will be taken into consideration
                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                            pod labels will be ignored. The default value is empty.
                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        namespaceSelector:
                                          description: |-
                                            A label query over the set of namespaces that the term applies to.
                                            The term is applied to the union of the namespaces selected by this field
                                            and the ones listed in the namespaces field.
                                            null selector and null or empty namespaces list means "this pod's namespace".
                                            An empty selector ({}) matches all namespaces.
                                          properties:
                                            matchExpressions:
                                              description: matchExpressions is a list
                                                of label selector requirements. The
                                                requirements are ANDed.
                                              items:
                                                description: |-
                                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                                  relates the key and values.
                                                properties:
                                                  key:
                                                    description: key is the label
                                                      key that the selector applies
                                                      to.
                                                    type: string
                                                  operator:
                                                    description: |-
                                                      operator represents a key's relationship to a set of values.
                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                                    type: string
                                                  values:
                                                    description: |-
                                                      values is an array of string values. If the operator is In or NotIn,
                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                      the values array must be empty. This array is replaced during a strategic
                                                      merge patch.
                                                    items:
                                                      type: string
                                                    type: array
                                                    x-kubernetes-list-type: atomic
                                                required:
                                                - key
                                                - operator
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            matchLabels:
                                              additionalProperties:
                                                type: string
                                              description: |-
                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                                              type: object
                                          type: object
                                          x-kubernetes-map-type: atomic
                                        namespaces:
                                          description: |-
                                            namespaces specifies a static list of namespace names that the term applies to.
                                            The term is applied to the union of the namespaces listed in this field
                                            and the ones selected by namespaceSelector.
                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        topologyKey:
                                          description: |-
                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                            whose value of the label with key topologyKey matches that of any node on which any of the
                                            selected pods is running.
                                            Empty topologyKey is not allowed.
                                          type: string
                                      required:
                                      - topologyKey
                                      type: object
                                    weight:
                                      description: |-
                                        weight associated with matching the corresponding podAffinityTerm,
                                        in the range 1-100.
                                      format: int32
                                      type: integer
                                  required:
                                  - podAffinityTerm
                                  - weight
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              requiredDuringSchedulingIgnoredDuringExecution:
                                description: |-
                                  If the affinity requirements specified by this field are not met at
                                  scheduling time, the pod will not be scheduled onto the node.
                                  If the affinity requirements specified by this field cease to be met
                                  at some point during pod execution (e.g. due to a pod label update), the
                                  system may or may not try to eventually evict the pod from its node.
                                  When there are multiple elements, the lists of nodes corresponding to each
                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                items:
                                  description: |-
                                    Defines a set of pods (namely those matching the labelSelector
                                    relative to the given namespace(s)) that this pod should be
                                    co-located (affinity) or not co-located (anti-affinity) with,
                                    where co-located is defined as running on a node whose value of
                                    the label with key <topologyKey> matches that of any node on which
                                    a pod of the set of pods is running
                                  properties:
                                    labelSelector:
                                      description: |-
                                        A label query over a set of resources, in this case pods.
                                        If it's null, this PodAffinityTerm matches with no Pods.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    matchLabelKeys:
                                      description: |-
                                        MatchLabelKeys is a set of pod label keys to select which pods will
                                        be taken into consideration. The keys are used to lookup values from the
                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                        to select the group of existing pods which pods will be taken into consideration
                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    mismatchLabelKeys:
                                      description: |-
                                        MismatchLabelKeys is a set of pod label keys to select which pods will
                                        be taken into consideration. The keys are used to lookup values from the
                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                        to select the group of existing pods which pods will be taken into consideration
                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    namespaceSelector:
                                      description: |-
                                        A label query over the set of namespaces that the term applies to.
                                        The term is applied to the union of the namespaces selected by this field
                                        and the ones listed in the namespaces field.
                                        null selector and null or empty namespaces list means "this pod's namespace".
                                        An empty selector ({}) matches all namespaces.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    namespaces:
                                      description: |-
                                        namespaces specifies a static list of namespace names that the term applies to.
                                        The term is applied to the union of the namespaces listed in this field
                                        and the ones selected by namespaceSelector.
                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    topologyKey:
                                      description: |-
                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                        whose value of the label with key topologyKey matches that of any node on which any of the
                                        selected pods is running.
                                        Empty topologyKey is not allowed.
                                      type: string
                                  required:
                                  - topologyKey
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                          podAntiAffinity:
                            description: Describes pod anti-affinity scheduling rules
                              (e.g. avoid putting this pod in the same node, zone,
                              etc. as some other pod(s)).
                            properties:
                              preferredDuringSchedulingIgnoredDuringExecution:
                                description: |-
                                  The scheduler will prefer to schedule pods to nodes that satisfy
                                  the anti-affinity expressions specified by this field, but it may choose
                                  a node that violates one or more of the expressions. The node that is
                                  most preferred is the one with the greatest sum of weights, i.e.
                                  for each node that meets all of the scheduling requirements (resource
                                  request, requiredDuringScheduling anti-affinity expressions, etc.),
                                  compute a sum by iterating through the elements of this field and adding
                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                  node(s) with the highest sum are the most preferred.
                                items:
                                  description: The weights of all of the matched WeightedPodAffinityTerm
                                    fields are added per-node to find the most preferred
                                    node(s)
                                  properties:
                                    podAffinityTerm:
                                      description: Required. A pod affinity term,
                                        associated with the corresponding weight.
                                      properties:
                                        labelSelector:
                                          description: |-
                                            A label query over a set of resources, in this case pods.
                                            If it's null, this PodAffinityTerm matches with no Pods.
                                          properties:
                                            matchExpressions:
                                              description: matchExpressions is a list
                                                of label selector requirements. The
                                                requirements are ANDed.
                                              items:
                                                description: |-
                                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                                  relates the key and values.
                                                properties:
                                                  key:
                                                    description: key is the label
                                                      key that the selector applies
                                                      to.
                                                    type: string
                                                  operator:
                                                    description: |-
                                                      operator represents a key's relationship to a set of values.
                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                                    type: string
                                                  values:
                                                    description: |-
                                                      values is an array of string values. If the operator is In or NotIn,
                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                      the values array must be empty. This array is replaced during a strategic
                                                      merge patch.
                                                    items:
                                                      type: string
                                                    type: array
                                                    x-kubernetes-list-type: atomic
                                                required:
                                                - key
                                                - operator
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            matchLabels:
                                              additionalProperties:
                                                type: string
                                              description: |-
                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                                              type: object
                                          type: object
                                          x-kubernetes-map-type: atomic
                                        matchLabelKeys:
                                          description: |-
                                            MatchLabelKeys is a set of pod label keys to select which pods will
                                            be taken into consideration. The keys are used to lookup values from the
                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                            to select the group of existing pods which pods will be taken into consideration
                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                            pod labels will be ignored. The default value is empty.
                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        mismatchLabelKeys:
                                          description: |-
                                            MismatchLabelKeys is a set of pod label keys to select which pods will
                                            be taken into consideration. The keys are used to lookup values from the
                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                            to select the group of existing pods which pods will be taken into consideration
                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                            pod labels will be ignored. The default value is empty.
                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        namespaceSelector:
                                          description: |-
                                            A label query over the set of namespaces that the term applies to.
                                            The term is applied to the union of the namespaces selected by this field
                                            and the ones listed in the namespaces field.
                                            null selector and null or empty namespaces list means "this pod's namespace".
                                            An empty selector ({}) matches all namespaces.
                                          properties:
                                            matchExpressions:
                                              description: matchExpressions is a list
                                                of label selector requirements. The
                                                requirements are ANDed.
                                              items:
                                                description: |-
                                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                                  relates the key and values.
                                                properties:
                                                  key:
                                                    description: key is the label
                                                      key that the selector applies
                                                      to.
                                                    type: string
                                                  operator:
                                                    description: |-
                                                      operator represents a key's relationship to a set of values.
                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                                    type: string
                                                  values:
                                                    description: |-
                                                      values is an array of string values. If the operator is In or NotIn,
                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                      the values array must be empty. This array is replaced during a strategic
                                                      merge patch.
                                                    items:
                                                      type: string
                                                    type: array
                                                    x-kubernetes-list-type: atomic
                                                required:
                                                - key
                                                - operator
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            matchLabels:
                                              additionalProperties:
                                                type: string
                                              description: |-
                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                                              type: object
                                          type: object
                                          x-kubernetes-map-type: atomic
                                        namespaces:
                                          description: |-
                                            namespaces specifies a static list of namespace names that the term applies to.
                                            The term is applied to the union of the namespaces listed in this field
                                            and the ones selected by namespaceSelector.
                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        topologyKey:
                                          description: |-
                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                            whose value of the label with key topologyKey matches that of any node on which any of the
                                            selected pods is running.
                                            Empty topologyKey is not allowed.
                                          type: string
                                      required:
                                      - topologyKey
                                      type: object
                                    weight:
                                      description: |-
                                        weight associated with matching the corresponding podAffinityTerm,
                                        in the range 1-100.
                                      format: int32
                                      type: integer
                                  required:
                                  - podAffinityTerm
                                  - weight
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              requiredDuringSchedulingIgnoredDuringExecution:
                                description: |-
                                  If the anti-affinity requirements specified by this field are not met at
                                  scheduling time, the pod will not be scheduled onto the node.
                                  If the anti-affinity requirements specified by this field cease to be met
                                  at some point during pod execution (e.g. due to a pod label update), the
                                  system may or may not try to eventually evict the pod from its node.
                                  When there are multiple elements, the lists of nodes corresponding to each
                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
                                items:
                                  description: |-
                                    Defines a set of pods (namely those matching the labelSelector
                                    relative to the given namespace(s)) that this pod should be
                                    co-located (affinity) or not co-located (anti-affinity) with,
                                    where co-located is defined as running on a node whose value of
                                    the label with key <topologyKey> matches that of any node on which
                                    a pod of the set of pods is running
                                  properties:
                                    labelSelector:
                                      description: |-
                                        A label query over a set of resources, in this case pods.
                                        If it's null, this PodAffinityTerm matches with no Pods.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    matchLabelKeys:
                                      description: |-
                                        MatchLabelKeys is a set of pod label keys to select which pods will
                                        be taken into consideration. The keys are used to lookup values from the
                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                        to select the group of existing pods which pods will be taken into consideration
                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    mismatchLabelKeys:
                                      description: |-
                                        MismatchLabelKeys is a set of pod label keys to select which pods will
                                        be taken into consideration. The keys are used to lookup values from the
                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                        to select the group of existing pods which pods will be taken into consideration
                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                        pod labels will be ignored. The default value is empty.
                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    namespaceSelector:
                                      description: |-
                                        A label query over the set of namespaces that the term applies to.
                                        The term is applied to the union of the namespaces selected by this field
                                        and the ones listed in the namespaces field.
                                        null selector and null or empty namespaces list means "this pod's namespace".
                                        An empty selector ({}) matches all namespaces.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    namespaces:
                                      description: |-
                                        namespaces specifies a static list of namespace names that the term applies to.
                                        The term is applied to the union of the namespaces listed in this field
                                        and the ones selected by namespaceSelector.
                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    topologyKey:
                                      description: |-
                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                        whose value of the label with key topologyKey matches that of any node on which any of the
                                        selected pods is running.
                                        Empty topologyKey is not allowed.
                                      type: string
                                  required:
                                  - topologyKey
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                        type: object
                      annotations:
                        additionalProperties:
                          type: string
                        description: |-
                          Annotations that will be added to Recorder Pods. Any annotations
                          specified here will be merged with the default annotations applied to
                          the Pod by the operator.
                          https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set
                        type: object
                      container:
                        description: Configuration for the Recorder container running
                          tailscale.
                        properties:
                          env:
                            description: |-
                              List of environment variables to set in the container.
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables
                              Note that environment variables provided here will take precedence
                              over Tailscale-specific environment variables set by the operator,
                              however running proxies with custom values for Tailscale environment
                              variables (i.e TS_USERSPACE) is not recommended and might break in
                              the future.
                            items:
                              properties:
                                name:
                                  description: Name of the environment variable. Must
                                    be a C_IDENTIFIER.
                                  pattern: ^[-._a-zA-Z][-._a-zA-Z0-9]*$
                                  type: string
                                value:
                                  description: |-
                                    Variable references $(VAR_NAME) are expanded using the previously defined
                                     environment variables in the container and any service environment
                                    variables. If a variable cannot be resolved, the reference in the input
                                    string will be unchanged. Double $$ are reduced to a single $, which
                                    allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
                                    produce the string literal "$(VAR_NAME)". Escaped references will never
                                    be expanded, regardless of whether the variable exists or not. Defaults
                                    to "".
                                  type: string
                              required:
                              - name
                              type: object
                            type: array
                          image:
                            description: |-
                              Container image name including tag. Defaults to docker.io/tailscale/tsrecorder
                              with the same tag as the operator, but the official images are also
                              available at ghcr.io/tailscale/tsrecorder.
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
                            type: string
                          imagePullPolicy:
                            description: |-
                              Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always.
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
                            enum:
                            - Always
                            - Never
                            - IfNotPresent
                            type: string
                          resources:
                            description: |-
                              Container resource requirements.
                              By default, the operator does not apply any resource requirements. The
                              amount of resources required wil depend on the volume of recordings sent.
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources
                            properties:
                              claims:
                                description: |-
                                  Claims lists the names of resources, defined in spec.resourceClaims,
                                  that are used by this container.

                                  This is an alpha field and requires enabling the
                                  DynamicResourceAllocation feature gate.

                                  This field is immutable. It can only be set for containers.
                                items:
                                  description: ResourceClaim references one entry
                                    in PodSpec.ResourceClaims.
                                  properties:
                                    name:
                                      description: |-
                                        Name must match the name of one entry in pod.spec.resourceClaims of
                                        the Pod where this field is used. It makes that resource available
                                        inside a container.
                                      type: string
                                    request:
                                      description: |-
                                        Request is the name chosen for a request in the referenced claim.
                                        If empty, everything from the claim is made available, otherwise
                                        only the result of this request.
                                      type: string
                                  required:
                                  - name
                                  type: object
                                type: array
                                x-kubernetes-list-map-keys:
                                - name
                                x-kubernetes-list-type: map
                              limits:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: |-
                                  Limits describes the maximum amount of compute resources allowed.
                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                type: object
                              requests:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: |-
                                  Requests describes the minimum amount of compute resources required.
                                  If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                                  otherwise to an implementation-defined value. Requests cannot exceed Limits.
                                  More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                type: object
                            type: object
                          securityContext:
                            description: |-
                              Container security context. By default, the operator does not apply any
                              container security context.
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
                            properties:
                              allowPrivilegeEscalation:
                                description: |-
                                  AllowPrivilegeEscalation controls whether a process can gain more
                                  privileges than its parent process. This bool directly controls if
                                  the no_new_privs flag will be set on the container process.
                                  AllowPrivilegeEscalation is true always when the container is:
                                  1) run as Privileged
                                  2) has CAP_SYS_ADMIN
                                  Note that this field cannot be set when spec.os.name is windows.
                                type: boolean
                              appArmorProfile:
                                description: |-
                                  appArmorProfile is the AppArmor options to use by this container. If set, this profile
                                  overrides the pod's appArmorProfile.
                                  Note that this field cannot be set when spec.os.name is windows.
                                properties:
                                  localhostProfile:
                                    description: |-
                                      localhostProfile indicates a profile loaded on the node that should be used.
                                      The profile must be preconfigured on the node to work.
                                      Must match the loaded name of the profile.
                                      Must be set if and only if type is "Localhost".
                                    type: string
                                  type:
                                    description: |-
                                      type indicates which kind of AppArmor profile will be applied.
                                      Valid options are:
                                        Localhost - a profile pre-loaded on the node.
                                        RuntimeDefault - the container runtime's default profile.
                                        Unconfined - no AppArmor enforcement.
                                    type: string
                                required:
                                - type
                                type: object
                              capabilities:
                                description: |-
                                  The capabilities to add/drop when running containers.
                                  Defaults to the default set of capabilities granted by the container runtime.
                                  Note that this field cannot be set when spec.os.name is windows.
                                properties:
                                  add:
                                    description: Added capabilities
                                    items:
                                      description: Capability represent POSIX capabilities
                                        type
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  drop:
                                    description: Removed capabilities
                                    items:
                                      description: Capability represent POSIX capabilities
                                        type
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                type: object
                              privileged:
                                description: |-
                                  Run container in privileged mode.
                                  Processes in privileged containers are essentially equivalent to root on the host.
                                  Defaults to false.
                                  Note that this field cannot be set when spec.os.name is windows.
                                type: boolean
                              procMount:
                                description: |-
                                  procMount denotes the type of proc mount to use for the containers.
                                  The default value is Default which uses the container runtime defaults for
                                  readonly paths and masked paths.
                                  This requires the ProcMountType feature flag to be enabled.
                                  Note that this field cannot be set when spec.os.name is windows.
                                type: string
                              readOnlyRootFilesystem:
                                description: |-
                                  Whether this container has a read-only root filesystem.
                                  Default is false.
                                  Note that this field cannot be set when spec.os.name is windows.
                                type: boolean
                              runAsGroup:
                                description: |-
                                  The GID to run the entrypoint of the container process.
                                  Uses runtime default if unset.
                                  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  Note that this field cannot be set when spec.os.name is windows.
                                format: int64
                                type: integer
                              runAsNonRoot:
                                description: |-
                                  Indicates that the container must run as a non-root user.
                                  If true, the Kubelet will validate the image at runtime to ensure that it
                                  does not run as UID 0 (root) and fail to start the container if it does.
                                  If unset or false, no such validation will be performed.
                                  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                type: boolean
                              runAsUser:
                                description: |-
                                  The UID to run the entrypoint of the container process.
                                  Defaults to user specified in image metadata if unspecified.
                                  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  Note that this field cannot be set when spec.os.name is windows.
                                format: int64
                                type: integer
                              seLinuxOptions:
                                description: |-
                                  The SELinux context to be applied to the container.
                                  If unspecified, the container runtime will allocate a random SELinux context for each
                                  container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  Note that this field cannot be set when spec.os.name is windows.
                                properties:
                                  level:
                                    description: Level is SELinux level label that
                                      applies to the container.
                                    type: string
                                  role:
                                    description: Role is a SELinux role label that
                                      applies to the container.
                                    type: string
                                  type:
                                    description: Type is a SELinux type label that
                                      applies to the container.
                                    type: string
                                  user:
                                    description: User is a SELinux user label that
                                      applies to the container.
                                    type: string
                                type: object
                              seccompProfile:
                                description: |-
                                  The seccomp options to use by this container. If seccomp options are
                                  provided at both the pod & container level, the container options
                                  override the pod options.
                                  Note that this field cannot be set when spec.os.name is windows.
                                properties:
                                  localhostProfile:
                                    description: |-
                                      localhostProfile indicates a profile defined in a file on the node should be used.
                                      The profile must be preconfigured on the node to work.
                                      Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                      Must be set if type is "Localhost". Must NOT be set for any other type.
                                    type: string
                                  type:
                                    description: |-
                                      type indicates which kind of seccomp profile will be applied.
                                      Valid options are:

                                      Localhost - a profile defined in a file on the node should be used.
                                      RuntimeDefault - the container runtime default profile should be used.
                                      Unconfined - no profile should be applied.
                                    type: string
                                required:
                                - type
                                type: object
                              windowsOptions:
                                description: |-
                                  The Windows specific settings applied to all containers.
                                  If unspecified, the options from the PodSecurityContext will be used.
                                  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  Note that this field cannot be set when spec.os.name is linux.
                                properties:
                                  gmsaCredentialSpec:
                                    description: |-
                                      GMSACredentialSpec is where the GMSA admission webhook
                                      (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
                                      GMSA credential spec named by the GMSACredentialSpecName field.
                                    type: string
                                  gmsaCredentialSpecName:
                                    description: GMSACredentialSpecName is the name
                                      of the GMSA credential spec to use.
                                    type: string
                                  hostProcess:
                                    description: |-
                                      HostProcess determines if a container should be run as a 'Host Process' container.
                                      All of a Pod's containers must have the same effective HostProcess value
                                      (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
                                      In addition, if HostProcess is true then HostNetwork must also be set to true.
                                    type: boolean
                                  runAsUserName:
                                    description: |-
                                      The UserName in Windows to run the entrypoint of the container process.
                                      Defaults to the user specified in image metadata if unspecified.
                                      May also be set in PodSecurityContext. If set in both SecurityContext and
                                      PodSecurityContext, the value specified in SecurityContext takes precedence.
                                    type: string
                                type: object
                            type: object
                        type: object
                      imagePullSecrets:
                        description: |-
                          Image pull Secrets for Recorder Pods.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec
                        items:
                          description: |-
                            LocalObjectReference contains enough information to let you locate the
                            referenced object inside the same namespace.
                          properties:
                            name:
                              default: ""
                              description: |-
                                Name of the referent.
                                This field is effectively required, but due to backwards compatibility is
                                allowed to be empty. Instances of this type with an empty value here are
                                almost certainly wrong.
                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                              type: string
                          type: object
                          x-kubernetes-map-type: atomic
                        type: array
                      labels:
                        additionalProperties:
                          type: string
                        description: |-
                          Labels that will be added to Recorder Pods. Any labels specified here
                          will be merged with the default labels applied to the Pod by the operator.
                          https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
                        type: object
                      nodeSelector:
                        additionalProperties:
                          type: string
                        description: |-
                          Node selector rules for Recorder Pods. By default, the operator does
                          not apply any node selector rules.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
                        type: object
                      securityContext:
                        description: |-
                          Security context for Recorder Pods. By default, the operator does not
                          apply any Pod security context.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-2
                        properties:
                          appArmorProfile:
                            description: |-
                              appArmorProfile is the AppArmor options to use by the containers in this pod.
                              Note that this field cannot be set when spec.os.name is windows.
                            properties:
                              localhostProfile:
                                description: |-
                                  localhostProfile indicates a profile loaded on the node that should be used.
                                  The profile must be preconfigured on the node to work.
                                  Must match the loaded name of the profile.
                                  Must be set if and only if type is "Localhost".
                                type: string
                              type:
                                description: |-
                                  type indicates which kind of AppArmor profile will be applied.
                                  Valid options are:
                                    Localhost - a profile pre-loaded on the node.
                                    RuntimeDefault - the container runtime's default profile.
                                    Unconfined - no AppArmor enforcement.
                                type: string
                            required:
                            - type
                            type: object
                          fsGroup:
                            description: |-
                              A special supplemental group that applies to all containers in a pod.
                              Some volume types allow the Kubelet to change the ownership of that volume
                              to be owned by the pod:

                              1. The owning GID will be the FSGroup
                              2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
                              3. The permission bits are OR'd with rw-rw----

                              If unset, the Kubelet will not modify the ownership and permissions of any volume.
                              Note that this field cannot be set when spec.os.name is windows.
                            format: int64
                            type: integer
                          fsGroupChangePolicy:
                            description: |-
                              fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
                              before being exposed inside Pod. This field will only apply to
                              volume types which support fsGroup based ownership(and permissions).
                              It will have no effect on ephemeral volume types such as: secret, configmaps
                              and emptydir.
                              Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
                              Note that this field cannot be set when spec.os.name is windows.
                            type: string
                          runAsGroup:
                            description: |-
                              The GID to run the entrypoint of the container process.
                              Uses runtime default if unset.
                              May also be set in SecurityContext.  If set in both SecurityContext and
                              PodSecurityContext, the value specified in SecurityContext takes precedence
                              for that container.
                              Note that this field cannot be set when spec.os.name is windows.
                            format: int64
                            type: integer
                          runAsNonRoot:
                            description: |-
                              Indicates that the container must run as a non-root user.
                              If true, the Kubelet will validate the image at runtime to ensure that it
                              does not run as UID 0 (root) and fail to start the container if it does.
                              If unset or false, no such validation will be performed.
                              May also be set in SecurityContext.  If set in both SecurityContext and
                              PodSecurityContext, the value specified in SecurityContext takes precedence.
                            type: boolean
                          runAsUser:
                            description: |-
                              The UID to run the entrypoint of the container process.
                              Defaults to user specified in image metadata if unspecified.
                              May also be set in SecurityContext.  If set in both SecurityContext and
                              PodSecurityContext, the value specified in SecurityContext takes precedence
                              for that container.
                              Note that this field cannot be set when spec.os.name is windows.
                            format: int64
                            type: integer
                          seLinuxChangePolicy:
                            description: |-
                              seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.
                              It has no effect on nodes that do not support SELinux or to volumes does not support SELinux.
                              Valid values are "MountOption" and "Recursive".

                              "Recursive" means relabeling of all files on all Pod volumes by the container runtime.
                              This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.

                              "MountOption" mounts all eligible Pod volumes with `-o context` mount option.
                              This requires all Pods that share the same volume to use the same SELinux label.
                              It is not possible to share the same volume among privileged and unprivileged Pods.
                              Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
                              whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
                              CSIDriver instance. Other volumes are always re-labelled recursively.
                              "MountOption" value is allowed only when SELinuxMount feature gate is enabled.

                              If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
                              If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
                              and "Recursive" for all other volumes.

                              This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.

                              All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.
                              Note that this field cannot be set when spec.os.name is windows.
                            type: string
                          seLinuxOptions:
                            description: |-
                              The SELinux context to be applied to all containers.
                              If unspecified, the container runtime will allocate a random SELinux context for each
                              container.  May also be set in SecurityContext.  If set in
                              both SecurityContext and PodSecurityContext, the value specified in SecurityContext
                              takes precedence for that container.
                              Note that this field cannot be set when spec.os.name is windows.
                            properties:
                              level:
                                description: Level is SELinux level label that applies
                                  to the container.
                                type: string
                              role:
                                description: Role is a SELinux role label that applies
                                  to the container.
                                type: string
                              type:
                                description: Type is a SELinux type label that applies
                                  to the container.
                                type: string
                              user:
                                description: User is a SELinux user label that applies
                                  to the container.
                                type: string
                            type: object
                          seccompProfile:
                            description: |-
                              The seccomp options to use by the containers in this pod.
                              Note that this field cannot be set when spec.os.name is windows.
                            properties:
                              localhostProfile:
                                description: |-
                                  localhostProfile indicates a profile defined in a file on the node should be used.
                                  The profile must be preconfigured on the node to work.
                                  Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                  Must be set if type is "Localhost". Must NOT be set for any other type.
                                type: string
                              type:
                                description: |-
                                  type indicates which kind of seccomp profile will be applied.
                                  Valid options are:

                                  Localhost - a profile defined in a file on the node should be used.
                                  RuntimeDefault - the container runtime default profile should be used.
                                  Unconfined - no profile should be applied.
                                type: string
                            required:
                            - type
                            type: object
                          supplementalGroups:
                            description: |-
                              A list of groups applied to the first process run in each container, in
                              addition to the container's primary GID and fsGroup (if specified).  If
                              the SupplementalGroupsPolicy feature is enabled, the
                              supplementalGroupsPolicy field determines whether these are in addition
                              to or instead of any group memberships defined in the container image.
                              If unspecified, no additional groups are added, though group memberships
                              defined in the container image may still be used, depending on the
                              supplementalGroupsPolicy field.
                              Note that this field cannot be set when spec.os.name is windows.
                            items:
                              format: int64
                              type: integer
                            type: array
                            x-kubernetes-list-type: atomic
                          supplementalGroupsPolicy:
                            description: |-
                              Defines how supplemental groups of the first container processes are calculated.
                              Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
                              (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
                              and the container runtime must implement support for this feature.
                              Note that this field cannot be set when spec.os.name is windows.
                            type: string
                          sysctls:
                            description: |-
                              Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
                              sysctls (by the container runtime) might fail to launch.
                              Note that this field cannot be set when spec.os.name is windows.
                            items:
                              description: Sysctl defines a kernel parameter to be
                                set
                              properties:
                                name:
                                  description: Name of a property to set
                                  type: string
                                value:
                                  description: Value of a property to set
                                  type: string
                              required:
                              - name
                              - value
                              type: object
                            type: array
                            x-kubernetes-list-type: atomic
                          windowsOptions:
                            description: |-
                              The Windows specific settings applied to all containers.
                              If unspecified, the options within a container's SecurityContext will be used.
                              If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
                              Note that this field cannot be set when spec.os.name is linux.
                            properties:
                              gmsaCredentialSpec:
                                description: |-
                                  GMSACredentialSpec is where the GMSA admission webhook
                                  (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
                                  GMSA credential spec named by the GMSACredentialSpecName field.
                                type: string
                              gmsaCredentialSpecName:
                                description: GMSACredentialSpecName is the name of
                                  the GMSA credential spec to use.
                                type: string
                              hostProcess:
                                description: |-
                                  HostProcess determines if a container should be run as a 'Host Process' container.
                                  All of a Pod's containers must have the same effective HostProcess value
                                  (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
                                  In addition, if HostProcess is true then HostNetwork must also be set to true.
                                type: boolean
                              runAsUserName:
                                description: |-
                                  The UserName in Windows to run the entrypoint of the container process.
                                  Defaults to the user specified in image metadata if unspecified.
                                  May also be set in PodSecurityContext. If set in both SecurityContext and
                                  PodSecurityContext, the value specified in SecurityContext takes precedence.
                                type: string
                            type: object
                        type: object
                      serviceAccount:
                        description: |-
                          Config for the ServiceAccount to create for the Recorder's StatefulSet.
                          By default, the operator will create a ServiceAccount with the same
                          name as the Recorder resource.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#service-account
                        properties:
                          annotations:
                            additionalProperties:
                              type: string
                            description: |-
                              Annotations to add to the ServiceAccount.
                              https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set

                              You can use this to add IAM roles to the ServiceAccount (IRSA) instead of
                              providing static S3 credentials in a Secret.
                              https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html

                              For example:
                              eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>
                            type: object
                          name:
                            description: |-
                              Name of the ServiceAccount to create. Defaults to the name of the
                              Recorder resource.
                              https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#service-account
                            maxLength: 253
                            pattern: ^[a-z0-9]([a-z0-9-.]{0,61}[a-z0-9])?$
                            type: string
                        type: object
                      tolerations:
                        description: |-
                          Tolerations for Recorder Pods. By default, the operator does not apply
                          any tolerations.
                          https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
                        items:
                          description: |-
                            The pod this Toleration is attached to tolerates any taint that matches
                            the triple <key,value,effect> using the matching operator <operator>.
                          properties:
                            effect:
                              description: |-
                                Effect indicates the taint effect to match. Empty means match all taint effects.
                                When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                              type: string
                            key:
                              description: |-
                                Key is the taint key that the toleration applies to. Empty means match all taint keys.
                                If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                              type: string
                            operator:
                              description: |-
                                Operator represents a key's relationship to the value.
                                Valid operators are Exists and Equal. Defaults to Equal.
                                Exists is equivalent to wildcard for value, so that a pod can
                                tolerate all taints of a particular category.
                              type: string
                            tolerationSeconds:
                              description: |-
                                TolerationSeconds represents the period of time the toleration (which must be
                                of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
                                it is not set, which means tolerate the taint forever (do not evict). Zero and
                                negative values will be treated as 0 (evict immediately) by the system.
                              format: int64
                              type: integer
                            value:
                              description: |-
                                Value is the taint value the toleration matches to.
                                If the operator is Exists, the value should be empty, otherwise just a regular string.
                              type: string
                          type: object
                        type: array
                    type: object
                type: object
              storage:
                description: |-
                  Configure where to store session recordings. By default, recordings will
                  be stored in a local ephemeral volume, and will not be persisted past the
                  lifetime of a specific pod.
                properties:
                  s3:
                    description: |-
                      Configure an S3-compatible API for storage. Required if the UI is not
                      enabled, to ensure that recordings are accessible.
                    properties:
                      bucket:
                        description: |-
                          Bucket name to write to. The bucket is expected to be used solely for
                          recordings, as there is no stable prefix for written object names.
                        type: string
                      credentials:
                        description: |-
                          Configure environment variable credentials for managing objects in the
                          configured bucket. If not set, tsrecorder will try to acquire credentials
                          first from the file system and then the STS API.
                        properties:
                          secret:
                            description: |-
                              Use a Kubernetes Secret from the operator's namespace as the source of
                              credentials.
                            properties:
                              name:
                                description: |-
                                  The name of a Kubernetes Secret in the operator's namespace that contains
                                  credentials for writing to the configured bucket. Each key-value pair
                                  from the secret's data will be mounted as an environment variable. It
                                  should include keys for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY if
                                  using a static access key.
                                type: string
                            type: object
                        type: object
                      endpoint:
                        description: S3-compatible endpoint, e.g. s3.us-east-1.amazonaws.com.
                        type: string
                    type: object
                type: object
              tags:
                description: |-
                  Tags that the Tailscale device will be tagged with. Defaults to [tag:k8s].
                  If you specify custom tags here, make sure you also make the operator
                  an owner of these tags.
                  See  https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.
                  Tags cannot be changed once a Recorder node has been created.
                  Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.
                items:
                  pattern: ^tag:[a-zA-Z][a-zA-Z0-9-]*$
                  type: string
                type: array
            type: object
          status:
            description: |-
              RecorderStatus describes the status of the recorder. This is set
              and managed by the Tailscale operator.
            properties:
              conditions:
                description: |-
                  List of status conditions to indicate the status of the Recorder.
                  Known condition types are `RecorderReady`.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
              devices:
                description: List of tailnet devices associated with the Recorder
                  StatefulSet.
                items:
                  properties:
                    hostname:
                      description: |-
                        Hostname is the fully qualified domain name of the device.
                        If MagicDNS is enabled in your tailnet, it is the MagicDNS name of the
                        node.
                      type: string
                    tailnetIPs:
                      description: |-
                        TailnetIPs is the set of tailnet IP addresses (both IPv4 and IPv6)
                        assigned to the device.
                      items:
                        type: string
                      type: array
                    url:
                      description: |-
                        URL where the UI is available if enabled for replaying recordings. This
                        will be an HTTPS MagicDNS URL. You must be connected to the same tailnet
                        as the recorder to access it.
                      type: string
                  required:
                  - hostname
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - hostname
                x-kubernetes-list-type: map
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: servicebgpstatuses.metallb.io
spec:
  group: metallb.io
  names:
    kind: ServiceBGPStatus
    listKind: ServiceBGPStatusList
    plural: servicebgpstatuses
    singular: servicebgpstatus
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.node
      name: Node
      type: string
    - jsonPath: .status.serviceName
      name: Service Name
      type: string
    - jsonPath: .status.serviceNamespace
      name: Service Namespace
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: ServiceBGPStatus exposes the BGP peers a service is configured
          to be advertised to, per relevant node.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: ServiceBGPStatusSpec defines the desired state of ServiceBGPStatus.
            type: object
          status:
            description: MetalLBServiceBGPStatus defines the observed state of ServiceBGPStatus.
            properties:
              node:
                description: Node indicates the node announcing the service.
                type: string
                x-kubernetes-validations:
                - message: Value is immutable
                  rule: self == oldSelf
              peers:
                description: |-
                  Peers indicate the BGP peers for which the service is configured to be advertised to.
                  The service being actually advertised to a given peer depends on the session state and is not indicated here.
                items:
                  type: string
                type: array
              serviceName:
                description: ServiceName indicates the service this status represents.
                type: string
                x-kubernetes-validations:
                - message: Value is immutable
                  rule: self == oldSelf
              serviceNamespace:
                description: ServiceNamespace indicates the namespace of the service.
                type: string
                x-kubernetes-validations:
                - message: Value is immutable
                  rule: self == oldSelf
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: servicel2statuses.metallb.io
spec:
  group: metallb.io
  names:
    kind: ServiceL2Status
    listKind: ServiceL2StatusList
    plural: servicel2statuses
    singular: servicel2status
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.node
      name: Allocated Node
      type: string
    - jsonPath: .status.serviceName
      name: Service Name
      type: string
    - jsonPath: .status.serviceNamespace
      name: Service Namespace
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: ServiceL2Status reveals the actual traffic status of loadbalancer
          services in layer2 mode.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: ServiceL2StatusSpec defines the desired state of ServiceL2Status.
            type: object
          status:
            description: MetalLBServiceL2Status defines the observed state of ServiceL2Status.
            properties:
              interfaces:
                description: Interfaces indicates the interfaces that receive the
                  directed traffic
                items:
                  description: InterfaceInfo defines interface info of layer2 announcement.
                  properties:
                    name:
                      description: Name the name of network interface card
                      type: string
                  type: object
                type: array
              node:
                description: Node indicates the node that receives the directed traffic
                type: string
                x-kubernetes-validations:
                - message: Value is immutable
                  rule: self == oldSelf
              serviceName:
                description: ServiceName indicates the service this status represents
                type: string
                x-kubernetes-validations:
                - message: Value is immutable
                  rule: self == oldSelf
              serviceNamespace:
                description: ServiceNamespace indicates the namespace of the service
                type: string
                x-kubernetes-validations:
                - message: Value is immutable
                  rule: self == oldSelf
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: tcpingresses.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: TCPIngress
    listKind: TCPIngressList
    plural: tcpingresses
    singular: tcpingress
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Address of the load balancer
      jsonPath: .status.loadBalancer.ingress[*].ip
      name: Address
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: TCPIngress is the Schema for the tcpingresses API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: Spec is the TCPIngress specification.
            properties:
              rules:
                description: A list of rules used to configure the Ingress.
                items:
                  description: IngressRule represents a rule to apply against incoming
                    requests. Matching is performed based on an (optional) SNI and
                    port.
                  properties:
                    backend:
                      description: Backend defines the referenced service endpoint
                        to which the traffic will be forwarded to.
                      properties:
                        serviceName:
                          description: Specifies the name of the referenced service.
                          minLength: 1
                          type: string
                        servicePort:
                          description: Specifies the port of the referenced service.
                          format: int32
                          maximum: 65535
                          minimum: 1
                          type: integer
                      required:
                      - serviceName
                      - servicePort
                      type: object
                    host:
                      description: Host is the fully qualified domain name of a network
                        host, as defined by RFC 3986. If a Host is not specified,
                        then port-based TCP routing is performed. Kong doesn't care
                        about the content of the TCP stream in this case. If a Host
                        is specified, the protocol must be TLS over TCP. A plain-text
                        TCP request cannot be routed based on Host. It can only be
                        routed based on Port.
                      type: string
                    port:
                      description: Port is the port on which to accept TCP or TLS
                        over TCP sessions and route. It is a required field. If a
                        Host is not specified, the requested are routed based only
                        on Port.
                      format: int32
                      maximum: 65535
                      minimum: 1
                      type: integer
                  required:
                  - backend
                  - port
                  type: object
                type: array
              tls:
                description: TLS configuration. This is similar to the `tls` section
                  in the Ingress resource in networking.v1beta1 group. The mapping
                  of SNIs to TLS cert-key pair defined here will be used for HTTP
                  Ingress rules as well. Once can define the mapping in this resource
                  or the original Ingress resource, both have the same effect.
                items:
                  description: IngressTLS describes the transport layer security.
                  properties:
                    hosts:
                      description: Hosts are a list of hosts included in the TLS certificate.
                        The values in this list must match the name/s used in the
                        tlsSecret. Defaults to the wildcard host setting for the loadbalancer
                        controller fulfilling this Ingress, if left unspecified.
                      items:
                        type: string
                      type: array
                    secretName:
                      description: SecretName is the name of the secret used to terminate
                        SSL traffic.
                      type: string
                  type: object
                type: array
            type: object
          status:
            description: TCPIngressStatus defines the observed state of TCPIngress.
            properties:
              loadBalancer:
                description: LoadBalancer contains the current status of the load-balancer.
                properties:
                  ingress:
                    description: Ingress is a list containing ingress points for the
                      load-balancer. Traffic intended for the service should be sent
                      to these ingress points.
                    items:
                      description: 'LoadBalancerIngress represents the status of a
                        load-balancer ingress point: traffic intended for the service
                        should be sent to an ingress point.'
                      properties:
                        hostname:
                          description: Hostname is set for load-balancer ingress points
                            that are DNS based (typically AWS load-balancers)
                          type: string
                        ip:
                          description: IP is set for load-balancer ingress points
                            that are IP based (typically GCE or OpenStack load-balancers)
                          type: string
                        ports:
                          description: Ports is a list of records of service ports
                            If used, every port defined in the service should have
                            an entry in it
                          items:
                            properties:
                              error:
                                description: 'Error is to record the problem with
                                  the service port The format of the error shall comply
                                  with the following rules: - built-in error values
                                  shall be specified in this file and those shall
                                  use CamelCase names - cloud provider specific error
                                  values must have names that comply with the format
                                  foo.example.com/CamelCase. --- The regex it matches
                                  is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                maxLength: 316
                                pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                                type: string
                              port:
                                description: Port is the port number of the service
                                  port of which status is recorded here
                                format: int32
                                type: integer
                              protocol:
                                default: TCP
                                description: 'Protocol is the protocol of the service
                                  port of which status is recorded here The supported
                                  values are: "TCP", "UDP", "SCTP"'
                                type: string
                            required:
                            - port
                            - protocol
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                      type: object
                    type: array
                type: object
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.13.0
  name: udpingresses.configuration.konghq.com
spec:
  group: configuration.konghq.com
  names:
    categories:
    - kong-ingress-controller
    kind: UDPIngress
    listKind: UDPIngressList
    plural: udpingresses
    singular: udpingress
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Address of the load balancer
      jsonPath: .status.loadBalancer.ingress[*].ip
      name: Address
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: UDPIngress is the Schema for the udpingresses API.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: Spec is the UDPIngress specification.
            properties:
              rules:
                description: A list of rules used to configure the Ingress.
                items:
                  description: UDPIngressRule represents a rule to apply against incoming
                    requests wherein no Host matching is available for request routing,
                    only the port is used to match requests.
                  properties:
                    backend:
                      description: Backend defines the Kubernetes service which accepts
                        traffic from the listening Port defined above.
                      properties:
                        serviceName:
                          description: Specifies the name of the referenced service.
                          minLength: 1
                          type: string
                        servicePort:
                          description: Specifies the port of the referenced service.
                          format: int32
                          maximum: 65535
                          minimum: 1
                          type: integer
                      required:
                      - serviceName
                      - servicePort
                      type: object
                    port:
                      description: Port indicates the port for the Kong proxy to accept
                        incoming traffic on, which will then be routed to the service
                        Backend.
                      format: int32
                      maximum: 65535
                      minimum: 1
                      type: integer
                  required:
                  - backend
                  - port
                  type: object
                type: array
            type: object
          status:
            description: UDPIngressStatus defines the observed state of UDPIngress.
            properties:
              loadBalancer:
                description: LoadBalancer contains the current status of the load-balancer.
                properties:
                  ingress:
                    description: Ingress is a list containing ingress points for the
                      load-balancer. Traffic intended for the service should be sent
                      to these ingress points.
                    items:
                      description: 'LoadBalancerIngress represents the status of a
                        load-balancer ingress point: traffic intended for the service
                        should be sent to an ingress point.'
                      properties:
                        hostname:
                          description: Hostname is set for load-balancer ingress points
                            that are DNS based (typically AWS load-balancers)
                          type: string
                        ip:
                          description: IP is set for load-balancer ingress points
                            that are IP based (typically GCE or OpenStack load-balancers)
                          type: string
                        ports:
                          description: Ports is a list of records of service ports
                            If used, every port defined in the service should have
                            an entry in it
                          items:
                            properties:
                              error:
                                description: 'Error is to record the problem with
                                  the service port The format of the error shall comply
                                  with the following rules: - built-in error values
                                  shall be specified in this file and those shall
                                  use CamelCase names - cloud provider specific error
                                  values must have names that comply with the format
                                  foo.example.com/CamelCase. --- The regex it matches
                                  is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                maxLength: 316
                                pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                                type: string
                              port:
                                description: Port is the port number of the service
                                  port of which status is recorded here
                                format: int32
                                type: integer
                              protocol:
                                default: TCP
                                description: 'Protocol is the protocol of the service
                                  port of which status is recorded here The supported
                                  values are: "TCP", "UDP", "SCTP"'
                                type: string
                            required:
                            - port
                            - protocol
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                      type: object
                    type: array
                type: object
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager
  namespace: cert-manager
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  labels:
    app: cainjector
    app.kubernetes.io/component: cainjector
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cainjector
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-cainjector
  namespace: cert-manager
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  annotations:
    helm.sh/hook: post-install
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    helm.sh/hook-weight: "-5"
  labels:
    app: startupapicheck
    app.kubernetes.io/component: startupapicheck
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: startupapicheck
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-startupapicheck
  namespace: cert-manager
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  labels:
    app: webhook
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: webhook
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-webhook
  namespace: cert-manager
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-controller
  namespace: metallb-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: speaker
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-speaker
  namespace: metallb-system
---
apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana
  namespace: monitoring
---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    helm.sh/hook: test
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  labels:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana-test
  namespace: monitoring
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki
  namespace: monitoring
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: canary
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki-canary
  namespace: monitoring
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: agent-collector
    app.kubernetes.io/instance: otel-collector
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: opentelemetry-collector
    app.kubernetes.io/part-of: opentelemetry-collector
    app.kubernetes.io/version: 0.140.1
    helm.sh/chart: opentelemetry-collector-0.140.1
  name: otel-collector
  namespace: monitoring
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: alertmanager
    app.kubernetes.io/version: v0.29.0
    helm.sh/chart: alertmanager-1.28.0
  name: prometheus-alertmanager
  namespace: monitoring
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: metrics
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/version: 2.17.0
    helm.sh/chart: kube-state-metrics-6.4.1
  name: prometheus-kube-state-metrics
  namespace: monitoring
---
apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: metrics
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: prometheus-node-exporter
    app.kubernetes.io/part-of: prometheus-node-exporter
    app.kubernetes.io/version: 1.10.2
    helm.sh/chart: prometheus-node-exporter-4.49.1
  name: prometheus-prometheus-node-exporter
  namespace: monitoring
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: prometheus-pushgateway
    app.kubernetes.io/version: v1.11.2
    helm.sh/chart: prometheus-pushgateway-3.4.2
  name: prometheus-prometheus-pushgateway
  namespace: monitoring
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: prometheus
    app.kubernetes.io/version: v3.7.3
    helm.sh/chart: prometheus-27.44.1
  name: prometheus-server
  namespace: monitoring
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/instance: tempo
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: tempo
    app.kubernetes.io/version: 2.3.1
    helm.sh/chart: tempo-1.10.1
  name: tempo
  namespace: monitoring
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: edge-controller
  name: edge-controller-sa-local
  namespace: plevion-local
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong
  namespace: plevion-local
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: orchestrator
  name: orchestrator-worker-sa-local
  namespace: plevion-local
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: operator
  namespace: tailscale
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: proxies
  namespace: tailscale
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: cainjector
    app.kubernetes.io/component: cainjector
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cainjector
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-cainjector:leaderelection
  namespace: cert-manager
rules:
- apiGroups:
  - coordination.k8s.io
  resourceNames:
  - cert-manager-cainjector-leader-election
  - cert-manager-cainjector-leader-election-core
  resources:
  - leases
  verbs:
  - get
  - update
  - patch
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    helm.sh/hook: post-install
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    helm.sh/hook-weight: "-5"
  labels:
    app: startupapicheck
    app.kubernetes.io/component: startupapicheck
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: startupapicheck
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-startupapicheck:create-cert
  namespace: cert-manager
rules:
- apiGroups:
  - cert-manager.io
  resources:
  - certificaterequests
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-tokenrequest
  namespace: cert-manager
rules:
- apiGroups:
  - ""
  resourceNames:
  - cert-manager
  resources:
  - serviceaccounts/token
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: webhook
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: webhook
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-webhook:dynamic-serving
  namespace: cert-manager
rules:
- apiGroups:
  - ""
  resourceNames:
  - cert-manager-webhook-ca
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
  - update
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager:leaderelection
  namespace: cert-manager
rules:
- apiGroups:
  - coordination.k8s.io
  resourceNames:
  - cert-manager-controller
  resources:
  - leases
  verbs:
  - get
  - update
  - patch
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-controller
  namespace: metallb-system
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - get
  - list
  - watch
- apiGroups:
  - ""
  resourceNames:
  - metallb-memberlist
  resources:
  - secrets
  verbs:
  - list
- apiGroups:
  - apps
  resourceNames:
  - metallb-controller
  resources:
  - deployments
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - metallb.io
  resources:
  - ipaddresspools
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - metallb.io
  resources:
  - ipaddresspools/status
  verbs:
  - update
- apiGroups:
  - metallb.io
  resources:
  - bgppeers
  verbs:
  - get
  - list
- apiGroups:
  - metallb.io
  resources:
  - bgpadvertisements
  verbs:
  - get
  - list
- apiGroups:
  - metallb.io
  resources:
  - l2advertisements
  verbs:
  - get
  - list
- apiGroups:
  - metallb.io
  resources:
  - communities
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - metallb.io
  resources:
  - bfdprofiles
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-pod-lister
  namespace: metallb-system
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - list
  - get
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - metallb.io
  resources:
  - bfdprofiles
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - metallb.io
  resources:
  - bgppeers
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - metallb.io
  resources:
  - l2advertisements
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - metallb.io
  resources:
  - bgpadvertisements
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - metallb.io
  resources:
  - ipaddresspools
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - metallb.io
  resources:
  - communities
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - metallb.io
  resources:
  - servicebgpstatuses
  - servicebgpstatuses/status
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana
  namespace: monitoring
rules: []
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: edge-controller
  name: edge-controller-stream-manager-local
  namespace: plevion-local
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - create
  - delete
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong
  namespace: plevion-local
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - pods
  - secrets
  - namespaces
  verbs:
  - get
- apiGroups:
  - ""
  resourceNames:
  - kong-ingress-controller-leader-kong-kong
  resources:
  - configmaps
  verbs:
  - get
  - update
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
- apiGroups:
  - ""
  - coordination.k8s.io
  resources:
  - configmaps
  - leases
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: orchestrator
  name: orchestrator-worker-role-local
  namespace: plevion-local
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - get
  - update
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: operator
  namespace: tailscale
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  - serviceaccounts
  - configmaps
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
  - update
- apiGroups:
  - ""
  resources:
  - pods/status
  verbs:
  - update
- apiGroups:
  - apps
  resources:
  - statefulsets
  - deployments
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - deletecollection
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - roles
  - rolebindings
  verbs:
  - get
  - create
  - patch
  - update
  - list
  - watch
  - deletecollection
- apiGroups:
  - monitoring.coreos.com
  resources:
  - servicemonitors
  verbs:
  - get
  - list
  - update
  - create
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: proxies
  namespace: tailscale
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: cainjector
    app.kubernetes.io/component: cainjector
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cainjector
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-cainjector
rules:
- apiGroups:
  - cert-manager.io
  resources:
  - certificates
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - get
  - create
  - update
  - patch
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - validatingwebhookconfigurations
  - mutatingwebhookconfigurations
  verbs:
  - get
  - list
  - watch
  - update
  - patch
- apiGroups:
  - apiregistration.k8s.io
  resources:
  - apiservices
  verbs:
  - get
  - list
  - watch
  - update
  - patch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
  - update
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
    rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
  name: cert-manager-cluster-view
rules:
- apiGroups:
  - cert-manager.io
  resources:
  - clusterissuers
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: cert-manager
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-approve:cert-manager-io
rules:
- apiGroups:
  - cert-manager.io
  resourceNames:
  - issuers.cert-manager.io/*
  - clusterissuers.cert-manager.io/*
  resources:
  - signers
  verbs:
  - approve
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-certificates
rules:
- apiGroups:
  - cert-manager.io
  resources:
  - certificates
  - certificates/status
  - certificaterequests
  - certificaterequests/status
  verbs:
  - update
  - patch
- apiGroups:
  - cert-manager.io
  resources:
  - certificates
  - certificaterequests
  - clusterissuers
  - issuers
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cert-manager.io
  resources:
  - certificates/finalizers
  - certificaterequests/finalizers
  verbs:
  - update
- apiGroups:
  - acme.cert-manager.io
  resources:
  - orders
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
  - patch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: cert-manager
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-certificatesigningrequests
rules:
- apiGroups:
  - certificates.k8s.io
  resources:
  - certificatesigningrequests
  verbs:
  - get
  - list
  - watch
  - update
- apiGroups:
  - certificates.k8s.io
  resources:
  - certificatesigningrequests/status
  verbs:
  - update
  - patch
- apiGroups:
  - certificates.k8s.io
  resourceNames:
  - issuers.cert-manager.io/*
  - clusterissuers.cert-manager.io/*
  resources:
  - signers
  verbs:
  - sign
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-challenges
rules:
- apiGroups:
  - acme.cert-manager.io
  resources:
  - challenges
  - challenges/status
  verbs:
  - update
  - patch
- apiGroups:
  - acme.cert-manager.io
  resources:
  - challenges
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cert-manager.io
  resources:
  - issuers
  - clusterissuers
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - ""
  resources:
  - pods
  - services
  verbs:
  - get
  - list
  - watch
  - create
  - delete
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
  - create
  - delete
  - update
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - httproutes
  verbs:
  - get
  - list
  - watch
  - create
  - delete
  - update
- apiGroups:
  - route.openshift.io
  resources:
  - routes/custom-host
  verbs:
  - create
- apiGroups:
  - acme.cert-manager.io
  resources:
  - challenges/finalizers
  verbs:
  - update
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-clusterissuers
rules:
- apiGroups:
  - cert-manager.io
  resources:
  - clusterissuers
  - clusterissuers/status
  verbs:
  - update
  - patch
- apiGroups:
  - cert-manager.io
  resources:
  - clusterissuers
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-ingress-shim
rules:
- apiGroups:
  - cert-manager.io
  resources:
  - certificates
  - certificaterequests
  verbs:
  - create
  - update
  - delete
- apiGroups:
  - cert-manager.io
  resources:
  - certificates
  - certificaterequests
  - issuers
  - clusterissuers
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses/finalizers
  verbs:
  - update
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - gateways
  - httproutes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - gateways/finalizers
  - httproutes/finalizers
  verbs:
  - update
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-issuers
rules:
- apiGroups:
  - cert-manager.io
  resources:
  - issuers
  - issuers/status
  verbs:
  - update
  - patch
- apiGroups:
  - cert-manager.io
  resources:
  - issuers
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-orders
rules:
- apiGroups:
  - acme.cert-manager.io
  resources:
  - orders
  - orders/status
  verbs:
  - update
  - patch
- apiGroups:
  - acme.cert-manager.io
  resources:
  - orders
  - challenges
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cert-manager.io
  resources:
  - clusterissuers
  - issuers
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - acme.cert-manager.io
  resources:
  - challenges
  verbs:
  - create
  - delete
- apiGroups:
  - acme.cert-manager.io
  resources:
  - orders/finalizers
  verbs:
  - update
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
  name: cert-manager-edit
rules:
- apiGroups:
  - cert-manager.io
  resources:
  - certificates
  - certificaterequests
  - issuers
  verbs:
  - create
  - delete
  - deletecollection
  - patch
  - update
- apiGroups:
  - cert-manager.io
  resources:
  - certificates/status
  verbs:
  - update
- apiGroups:
  - acme.cert-manager.io
  resources:
  - challenges
  - orders
  verbs:
  - create
  - delete
  - deletecollection
  - patch
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-view: "true"
  name: cert-manager-view
rules:
- apiGroups:
  - cert-manager.io
  resources:
  - certificates
  - certificaterequests
  - issuers
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - acme.cert-manager.io
  resources:
  - challenges
  - orders
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: webhook
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: webhook
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-webhook:subjectaccessreviews
rules:
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana-clusterrole
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - secrets
  verbs:
  - get
  - watch
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong
rules:
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongupstreampolicies
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongupstreampolicies/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongconsumergroups
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongconsumergroups/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - ingressclassparameterses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongconsumers
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongconsumers/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongingresses/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongplugins
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongplugins/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - tcpingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - tcpingresses/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - configuration.konghq.com
  resources:
  - udpingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - udpingresses/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - extensions
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  resources:
  - ingresses/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongclusterplugins
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - configuration.konghq.com
  resources:
  - kongclusterplugins/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingressclasses
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki-clusterrole
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - secrets
  verbs:
  - get
  - watch
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb:controller
rules:
- apiGroups:
  - ""
  resources:
  - services
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - list
- apiGroups:
  - ""
  resources:
  - services/status
  verbs:
  - update
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - admissionregistration.k8s.io
  resourceNames:
  - metallb-webhook-configuration
  resources:
  - validatingwebhookconfigurations
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - validatingwebhookconfigurations
  verbs:
  - list
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resourceNames:
  - bfdprofiles.metallb.io
  - bgpadvertisements.metallb.io
  - bgppeers.metallb.io
  - ipaddresspools.metallb.io
  - l2advertisements.metallb.io
  - communities.metallb.io
  - configurationstates.metallb.io
  resources:
  - customresourcedefinitions
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - list
  - watch
- apiGroups:
  - metallb.io
  resources:
  - configurationstates
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - metallb.io
  resources:
  - configurationstates/status
  verbs:
  - get
  - patch
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb:speaker
rules:
- apiGroups:
  - ""
  resources:
  - services
  - endpoints
  - nodes
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - metallb.io
  resources:
  - servicel2statuses
  - servicel2statuses/status
  - configurationstates
  - configurationstates/status
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/component: agent-collector
    app.kubernetes.io/instance: otel-collector
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: opentelemetry-collector
    app.kubernetes.io/part-of: opentelemetry-collector
    app.kubernetes.io/version: 0.140.1
    helm.sh/chart: opentelemetry-collector-0.140.1
  name: otel-collector
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - nodes
  - nodes/stats
  - nodes/proxy
  - services
  - endpoints
  - namespaces
  verbs:
  - get
  - watch
  - list
- apiGroups:
  - apps
  resources:
  - replicasets
  verbs:
  - get
  - watch
  - list
- nonResourceURLs:
  - /metrics
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/component: metrics
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/version: 2.17.0
    helm.sh/chart: kube-state-metrics-6.4.1
  name: prometheus-kube-state-metrics
rules:
- apiGroups:
  - certificates.k8s.io
  resources:
  - certificatesigningrequests
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - list
  - watch
- apiGroups:
  - batch
  resources:
  - cronjobs
  verbs:
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - daemonsets
  verbs:
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - deployments
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - endpoints
  verbs:
  - list
  - watch
- apiGroups:
  - autoscaling
  resources:
  - horizontalpodautoscalers
  verbs:
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - list
  - watch
- apiGroups:
  - batch
  resources:
  - jobs
  verbs:
  - list
  - watch
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - limitranges
  verbs:
  - list
  - watch
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - networkpolicies
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - persistentvolumeclaims
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - persistentvolumes
  verbs:
  - list
  - watch
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - replicasets
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - replicationcontrollers
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - resourcequotas
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - statefulsets
  verbs:
  - list
  - watch
- apiGroups:
  - storage.k8s.io
  resources:
  - storageclasses
  verbs:
  - list
  - watch
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - validatingwebhookconfigurations
  verbs:
  - list
  - watch
- apiGroups:
  - storage.k8s.io
  resources:
  - volumeattachments
  verbs:
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: prometheus
    app.kubernetes.io/version: v3.7.3
    helm.sh/chart: prometheus-27.44.1
  name: prometheus-server
rules:
- apiGroups:
  - ""
  resources:
  - nodes
  - nodes/proxy
  - nodes/metrics
  - services
  - endpoints
  - pods
  - ingresses
  - configmaps
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses/status
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- nonResourceURLs:
  - /metrics
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tailscale-operator
rules:
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - events
  - services
  - services/status
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  - ingresses/status
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingressclasses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - tailscale.com
  resources:
  - connectors
  - connectors/status
  - proxyclasses
  - proxyclasses/status
  - proxygroups
  - proxygroups/status
  verbs:
  - get
  - list
  - watch
  - update
- apiGroups:
  - tailscale.com
  resources:
  - dnsconfigs
  - dnsconfigs/status
  verbs:
  - get
  - list
  - watch
  - update
- apiGroups:
  - tailscale.com
  resources:
  - recorders
  - recorders/status
  verbs:
  - get
  - list
  - watch
  - update
- apiGroups:
  - apiextensions.k8s.io
  resourceNames:
  - servicemonitors.monitoring.coreos.com
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: cainjector
    app.kubernetes.io/component: cainjector
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cainjector
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-cainjector:leaderelection
  namespace: cert-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cert-manager-cainjector:leaderelection
subjects:
- kind: ServiceAccount
  name: cert-manager-cainjector
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    helm.sh/hook: post-install
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    helm.sh/hook-weight: "-5"
  labels:
    app: startupapicheck
    app.kubernetes.io/component: startupapicheck
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: startupapicheck
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-startupapicheck:create-cert
  namespace: cert-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cert-manager-startupapicheck:create-cert
subjects:
- kind: ServiceAccount
  name: cert-manager-startupapicheck
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-tokenrequest
  namespace: cert-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cert-manager-tokenrequest
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: webhook
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: webhook
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-webhook:dynamic-serving
  namespace: cert-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cert-manager-webhook:dynamic-serving
subjects:
- kind: ServiceAccount
  name: cert-manager-webhook
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager:leaderelection
  namespace: cert-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cert-manager:leaderelection
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-controller
  namespace: metallb-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: metallb-controller
subjects:
- kind: ServiceAccount
  name: metallb-controller
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-pod-lister
  namespace: metallb-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: metallb-pod-lister
subjects:
- kind: ServiceAccount
  name: metallb-speaker
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana
  namespace: monitoring
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: grafana
subjects:
- kind: ServiceAccount
  name: grafana
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: edge-controller
  name: edge-controller-stream-manager-local
  namespace: plevion-local
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: edge-controller-stream-manager-local
subjects:
- kind: ServiceAccount
  name: edge-controller-sa-local
  namespace: plevion-local
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong
  namespace: plevion-local
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kong-kong
subjects:
- kind: ServiceAccount
  name: kong-kong
  namespace: plevion-local
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: orchestrator
  name: orchestrator-worker-rolebinding-local
  namespace: plevion-local
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: orchestrator-worker-role-local
subjects:
- kind: ServiceAccount
  name: orchestrator-worker-sa-local
  namespace: plevion-local
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: operator
  namespace: tailscale
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: operator
subjects:
- kind: ServiceAccount
  name: operator
  namespace: tailscale
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: proxies
  namespace: tailscale
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: proxies
subjects:
- kind: ServiceAccount
  name: proxies
  namespace: tailscale
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: cainjector
    app.kubernetes.io/component: cainjector
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cainjector
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-cainjector
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-cainjector
subjects:
- kind: ServiceAccount
  name: cert-manager-cainjector
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: cert-manager
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-approve:cert-manager-io
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-controller-approve:cert-manager-io
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-certificates
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-controller-certificates
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: cert-manager
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-certificatesigningrequests
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-controller-certificatesigningrequests
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-challenges
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-controller-challenges
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-clusterissuers
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-controller-clusterissuers
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-ingress-shim
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-controller-ingress-shim
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-issuers
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-controller-issuers
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-controller-orders
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-controller-orders
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: webhook
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: webhook
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-webhook:subjectaccessreviews
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-webhook:subjectaccessreviews
subjects:
- kind: ServiceAccount
  name: cert-manager-webhook
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana-clusterrolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: grafana-clusterrole
subjects:
- kind: ServiceAccount
  name: grafana
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kong-kong
subjects:
- kind: ServiceAccount
  name: kong-kong
  namespace: plevion-local
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki-clusterrolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: loki-clusterrole
subjects:
- kind: ServiceAccount
  name: loki
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb:controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metallb:controller
subjects:
- kind: ServiceAccount
  name: metallb-controller
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb:speaker
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metallb:speaker
subjects:
- kind: ServiceAccount
  name: metallb-speaker
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/component: agent-collector
    app.kubernetes.io/instance: otel-collector
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: opentelemetry-collector
    app.kubernetes.io/part-of: opentelemetry-collector
    app.kubernetes.io/version: 0.140.1
    helm.sh/chart: opentelemetry-collector-0.140.1
  name: otel-collector-opentelemetry-collector
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: otel-collector
subjects:
- kind: ServiceAccount
  name: otel-collector
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/component: metrics
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/version: 2.17.0
    helm.sh/chart: kube-state-metrics-6.4.1
  name: prometheus-kube-state-metrics
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: prometheus-kube-state-metrics
subjects:
- kind: ServiceAccount
  name: prometheus-kube-state-metrics
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: prometheus
    app.kubernetes.io/version: v3.7.3
    helm.sh/chart: prometheus-27.44.1
  name: prometheus-server
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: prometheus-server
subjects:
- kind: ServiceAccount
  name: prometheus-server
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tailscale-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tailscale-operator
subjects:
- kind: ServiceAccount
  name: operator
  namespace: tailscale
---
apiVersion: v1
data:
  excludel2.yaml: |
    announcedInterfacesToExclude:
    - ^docker.*
    - ^cbr.*
    - ^dummy.*
    - ^virbr.*
    - ^lxcbr.*
    - ^veth.*
    - ^lo$
    - ^cali.*
    - ^tunl.*
    - ^flannel.*
    - ^kube-ipvs.*
    - ^cni.*
    - ^nodelocaldns.*
    - ^lxc.*
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-excludel2
  namespace: metallb-system
---
apiVersion: v1
data:
  daemons: |
    # This file tells the frr package which daemons to start.
    #
    # Sample configurations for these daemons can be found in
    # /usr/share/doc/frr/examples/.
    #
    # ATTENTION:
    #
    # When activating a daemon for the first time, a config file, even if it is
    # empty, has to be present *and* be owned by the user and group "frr", else
    # the daemon will not be started by /etc/init.d/frr. The permissions should
    # be u=rw,g=r,o=.
    # When using "vtysh" such a config file is also needed. It should be owned by
    # group "frrvty" and set to ug=rw,o= though. Check /etc/pam.d/frr, too.
    #
    # The watchfrr and zebra daemons are always started.
    #
    bgpd=yes
    ospfd=no
    ospf6d=no
    ripd=no
    ripngd=no
    isisd=no
    pimd=no
    ldpd=no
    nhrpd=no
    eigrpd=no
    babeld=no
    sharpd=no
    pbrd=no
    bfdd=yes
    fabricd=no
    vrrpd=no

    #
    # If this option is set the /etc/init.d/frr script automatically loads
    # the config via "vtysh -b" when the servers are started.
    # Check /etc/pam.d/frr if you intend to use "vtysh"!
    #
    vtysh_enable=yes
    zebra_options="  -A 127.0.0.1 -s 90000000 --limit-fds 100000"
    bgpd_options="   -A 127.0.0.1 -p 0 --limit-fds 100000"
    ospfd_options="  -A 127.0.0.1"
    ospf6d_options=" -A ::1"
    ripd_options="   -A 127.0.0.1"
    ripngd_options=" -A ::1"
    isisd_options="  -A 127.0.0.1"
    pimd_options="   -A 127.0.0.1"
    ldpd_options="   -A 127.0.0.1"
    nhrpd_options="  -A 127.0.0.1"
    eigrpd_options=" -A 127.0.0.1"
    babeld_options=" -A 127.0.0.1"
    sharpd_options=" -A 127.0.0.1"
    pbrd_options="   -A 127.0.0.1"
    staticd_options="-A 127.0.0.1 --limit-fds 100000"
    bfdd_options="   -A 127.0.0.1 --limit-fds 100000"
    fabricd_options="-A 127.0.0.1"
    vrrpd_options="  -A 127.0.0.1"

    # configuration profile
    #
    #frr_profile="traditional"
    #frr_profile="datacenter"

    #
    # This is the maximum number of FD's that will be available.
    # Upon startup this is read by the control files and ulimit
    # is called. Uncomment and use a reasonable value for your
    # setup if you are expecting a large number of peers in
    # say BGP.
    #MAX_FDS=1024

    # The list of daemons to watch is automatically generated by the init script.
    #watchfrr_options=""

    # for debugging purposes, you can specify a "wrap" command to start instead
    # of starting the daemon directly, e.g. to use valgrind on ospfd:
    #   ospfd_wrap="/usr/bin/valgrind"
    # or you can use "all_wrap" for all daemons, e.g. to use perf record:
    #   all_wrap="/usr/bin/perf record --call-graph -"
    # the normal daemon command is added to this at the end.
  frr.conf: |
    ! This file gets overriden the first time the speaker renders a config.
    ! So anything configured here is only temporary.
    frr version 8.0
    frr defaults traditional
    hostname Router
    line vty
    log file /etc/frr/frr.log informational
  vtysh.conf: |
    service integrated-vtysh-config
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: speaker
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-frr-startup
  namespace: metallb-system
---
apiVersion: v1
data:
  datasources.yaml: |
    apiVersion: 1
    datasources:
    - access: proxy
      isDefault: true
      jsonData:
        timeInterval: 15s
      name: Prometheus
      type: prometheus
      uid: prometheus
      url: http://prometheus-server.monitoring.svc.cluster.local
    - access: proxy
      jsonData:
        nodeGraph:
          enabled: true
        search:
          hide: false
        serviceMap:
          datasourceUid: prometheus
      name: Tempo
      type: tempo
      uid: tempo
      url: http://tempo.monitoring.svc.cluster.local:3100
    - access: proxy
      jsonData:
        derivedFields:
        - datasourceUid: tempo
          matcherRegex: trace_id=(\w+)
          name: TraceID
          url: $${__value.raw}
          urlDisplayLabel: Ver Traza (Tempo)
        maxLines: 1000
      name: Loki
      type: loki
      uid: loki
      url: http://loki.monitoring.svc.cluster.local:3100
  grafana.ini: |
    [analytics]
    check_for_updates = true
    [grafana_net]
    url = https://grafana.net
    [log]
    mode = console
    [paths]
    data = /var/lib/grafana/
    logs = /var/log/grafana
    plugins = /var/lib/grafana/plugins
    provisioning = /etc/grafana/provisioning
    [server]
    domain = ''
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana
  namespace: monitoring
---
apiVersion: v1
data:
  provider.yaml: |-
    apiVersion: 1
    providers:
      - name: 'sidecarProvider'
        orgId: 1
        folder: ''
        folderUid: ''
        type: file
        disableDeletion: false
        allowUiUpdates: false
        updateIntervalSeconds: 30
        options:
          foldersFromFilesStructure: false
          path: /tmp/dashboards
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana-config-dashboards
  namespace: monitoring
---
apiVersion: v1
data:
  run.sh: |-
    @test "Test Health" {
      url="http://grafana/api/health"

      code=$(wget --server-response --spider --timeout 90 --tries 10 ${url} 2>&1 | awk '/^  HTTP/{print $2}')
      [ "$code" == "200" ]
    }
kind: ConfigMap
metadata:
  annotations:
    helm.sh/hook: test
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  labels:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana-test
  namespace: monitoring
---
apiVersion: v1
data:
  config.yaml: |2

    auth_enabled: false
    bloom_build:
      builder:
        planner_address: ""
      enabled: false
    bloom_gateway:
      client:
        addresses: ""
      enabled: false
    chunk_store_config:
      chunk_cache_config:
        background:
          writeback_buffer: 500000
          writeback_goroutines: 1
          writeback_size_limit: 500MB
        default_validity: 0s
        memcached:
          batch_size: 4
          parallelism: 5
        memcached_client:
          addresses: dnssrvnoa+_memcached-client._tcp.loki-chunks-cache.monitoring.svc
          consistent_hash: true
          max_idle_conns: 72
          timeout: 2000ms
    common:
      compactor_grpc_address: 'loki.default.svc.cluster.local:9095'
      path_prefix: /var/loki
      replication_factor: 1
      ring:
        kvstore:
          store: inmemory
      storage:
        filesystem:
          chunks_directory: /var/loki/chunks
          rules_directory: /var/loki/rules
    frontend:
      scheduler_address: ""
      tail_proxy_url: ""
    frontend_worker:
      scheduler_address: ""
    index_gateway:
      mode: simple
    limits_config:
      max_cache_freshness_per_query: 10m
      query_timeout: 300s
      reject_old_samples: true
      reject_old_samples_max_age: 168h
      split_queries_by_interval: 15m
      volume_enabled: true
    memberlist:
      join_members:
      - loki-memberlist
    pattern_ingester:
      enabled: false
    query_range:
      align_queries_with_step: true
      cache_results: true
      results_cache:
        cache:
          background:
            writeback_buffer: 500000
            writeback_goroutines: 1
            writeback_size_limit: 500MB
          default_validity: 12h
          memcached_client:
            addresses: dnssrvnoa+_memcached-client._tcp.loki-results-cache.monitoring.svc
            consistent_hash: true
            timeout: 500ms
            update_interval: 1m
    ruler:
      storage:
        type: local
      wal:
        dir: /var/loki/ruler-wal
    runtime_config:
      file: /etc/loki/runtime-config/runtime-config.yaml
    schema_config:
      configs:
      - from: "2024-01-01"
        index:
          period: 24h
          prefix: index_
        object_store: filesystem
        schema: v13
        store: tsdb
    server:
      grpc_listen_port: 9095
      http_listen_port: 3100
      http_server_read_timeout: 600s
      http_server_write_timeout: 600s
    storage_config:
      bloom_shipper:
        working_directory: /var/loki/data/bloomshipper
      boltdb_shipper:
        index_gateway_client:
          server_address: ""
      hedging:
        at: 250ms
        max_per_second: 20
        up_to: 3
      tsdb_shipper:
        index_gateway_client:
          server_address: ""
      use_thanos_objstore: false
    tracing:
      enabled: false
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki
  namespace: monitoring
---
apiVersion: v1
data:
  runtime-config.yaml: |
    {}
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki-runtime
  namespace: monitoring
---
apiVersion: v1
data:
  relay: |
    exporters:
      debug: {}
      loki:
        endpoint: http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push
      otlp/tempo:
        endpoint: tempo.monitoring.svc.cluster.local:4317
        tls:
          insecure: true
      prometheus:
        endpoint: 0.0.0.0:8889
        resource_to_telemetry_conversion:
          enabled: true
    extensions:
      health_check:
        endpoint: ${env:MY_POD_IP}:13133
    processors:
      batch:
        send_batch_size: 1024
        timeout: 1s
      k8sattributes:
        auth_type: serviceAccount
        extract:
          metadata:
          - k8s.pod.name
          - k8s.pod.uid
          - k8s.deployment.name
          - k8s.namespace.name
          - k8s.node.name
        passthrough: false
        pod_association:
        - sources:
          - from: resource_attribute
            name: k8s.pod.ip
        - sources:
          - from: resource_attribute
            name: k8s.pod.uid
        - sources:
          - from: connection
      memory_limiter:
        check_interval: 1s
        limit_mib: 400
        limit_percentage: 80
        spike_limit_mib: 100
        spike_limit_percentage: 25
      transform:
        error_mode: ignore
        log_statements:
        - context: log
          statements:
          - set(attributes["pod"], resource.attributes["k8s.pod.name"])
          - set(attributes["namespace"], resource.attributes["k8s.namespace.name"])
          - set(attributes["container"], resource.attributes["k8s.container.name"])
          - set(attributes["loki.attribute.labels"], "pod, namespace, container")
    receivers:
      filelog:
        exclude:
        - /var/log/pods/monitoring_otel-collector*/*/*.log
        - /var/log/pods/monitoring_loki*/*/*.log
        include:
        - /var/log/pods/*/*/*.log
        include_file_name: false
        include_file_path: true
        operators:
        - id: get-format
          routes:
          - expr: body matches "^\\{"
            output: parser-docker
          - expr: body matches "^[^ ]+Z "
            output: parser-containerd
          - expr: body matches "^[^ ]+ "
            output: parser-crio
          type: router
        - id: parser-docker
          output: extract_metadata_from_filepath
          timestamp:
            layout: "2006-01-02T15:04:05.999999999Z"
            layout_type: gotime
            parse_from: body.time
          type: json_parser
        - id: parser-crio
          output: extract_metadata_from_filepath
          regex: ^(?P<time>[^ Z]+) (?P<stream>stdout|stderr) (?P<logtag>[^ ]*) ?(?P<log>.*)$
          timestamp:
            layout: 2006-01-02T15:04:05.000000000Z07:00
            layout_type: gotime
            parse_from: body.time
          type: regex_parser
        - id: parser-containerd
          output: extract_metadata_from_filepath
          regex: ^(?P<time>[^ ^Z]+Z) (?P<stream>stdout|stderr) (?P<logtag>[^ ]*) ?(?P<log>.*)$
          timestamp:
            layout: "2006-01-02T15:04:05.999999999Z"
            layout_type: gotime
            parse_from: body.time
          type: regex_parser
        - id: extract_metadata_from_filepath
          parse_from: attributes["log.file.path"]
          regex: ^.*\/(?P<namespace>[^_]+)_(?P<pod_name>[^_]+)_(?P<uid>[a-f0-9\-]+)\/(?P<container_name>[^\._]+)\/(?P<restart_count>\d+)\.log$
          type: regex_parser
        - from: attributes.namespace
          to: resource["k8s.namespace.name"]
          type: move
        - from: attributes.pod_name
          to: resource["k8s.pod.name"]
          type: move
        - from: attributes.uid
          to: resource["k8s.pod.uid"]
          type: move
        - from: attributes.container_name
          to: resource["k8s.container.name"]
          type: move
        start_at: end
      hostmetrics:
        collection_interval: 30s
        scrapers:
          cpu: null
          filesystem: null
          load: null
          memory: null
          network: null
      jaeger:
        protocols:
          grpc:
            endpoint: ${env:MY_POD_IP}:14250
          thrift_compact:
            endpoint: ${env:MY_POD_IP}:6831
          thrift_http:
            endpoint: ${env:MY_POD_IP}:14268
      kubeletstats:
        auth_type: serviceAccount
        collection_interval: 20s
        endpoint: ${env:K8S_NODE_NAME}:10250
        insecure_skip_verify: true
        metric_groups:
        - node
        - pod
      otlp:
        protocols:
          grpc:
            endpoint: 0.0.0.0:4317
          http:
            endpoint: 0.0.0.0:4318
      prometheus:
        config:
          scrape_configs:
          - job_name: opentelemetry-collector
            scrape_interval: 10s
            static_configs:
            - targets:
              - ${env:MY_POD_IP}:8888
      zipkin:
        endpoint: ${env:MY_POD_IP}:9411
    service:
      extensions:
      - health_check
      pipelines:
        logs:
          exporters:
          - loki
          processors:
          - k8sattributes
          - transform
          - batch
          receivers:
          - filelog
        metrics:
          exporters:
          - prometheus
          processors:
          - k8sattributes
          - batch
          receivers:
          - otlp
          - kubeletstats
          - hostmetrics
        traces:
          exporters:
          - otlp/tempo
          processors:
          - k8sattributes
          - batch
          receivers:
          - otlp
      telemetry:
        metrics:
          readers:
          - pull:
              exporter:
                prometheus:
                  host: 0.0.0.0
                  port: 8887
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: agent-collector
    app.kubernetes.io/instance: otel-collector
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: opentelemetry-collector
    app.kubernetes.io/part-of: opentelemetry-collector
    app.kubernetes.io/version: 0.140.1
    helm.sh/chart: opentelemetry-collector-0.140.1
  name: otel-collector-opentelemetry-collector-agent
  namespace: monitoring
---
apiVersion: v1
data:
  alertmanager.yml: |
    global: {}
    receivers:
    - name: default-receiver
    route:
      group_interval: 5m
      group_wait: 10s
      receiver: default-receiver
      repeat_interval: 3h
    templates:
    - /etc/alertmanager/*.tmpl
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: alertmanager
    app.kubernetes.io/version: v0.29.0
    helm.sh/chart: alertmanager-1.28.0
  name: prometheus-alertmanager
  namespace: monitoring
---
apiVersion: v1
data:
  alerting_rules.yml: |
    {}
  alerts: |
    {}
  allow-snippet-annotations: "false"
  prometheus.yml: |
    global:
      evaluation_interval: 15s
      scrape_interval: 15s
      scrape_timeout: 10s
    rule_files:
    - /etc/config/recording_rules.yml
    - /etc/config/alerting_rules.yml
    - /etc/config/rules
    - /etc/config/alerts
    scrape_configs:
    - job_name: prometheus
      static_configs:
      - targets:
        - localhost:9090
    - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      job_name: kubernetes-apiservers
      kubernetes_sd_configs:
      - role: endpoints
      relabel_configs:
      - action: keep
        regex: default;kubernetes;https
        source_labels:
        - __meta_kubernetes_namespace
        - __meta_kubernetes_service_name
        - __meta_kubernetes_endpoint_port_name
      scheme: https
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      job_name: kubernetes-nodes
      kubernetes_sd_configs:
      - role: node
      relabel_configs:
      - action: labelmap
        regex: __meta_kubernetes_node_label_(.+)
      - replacement: kubernetes.default.svc:443
        target_label: __address__
      - regex: (.+)
        replacement: /api/v1/nodes/$1/proxy/metrics
        source_labels:
        - __meta_kubernetes_node_name
        target_label: __metrics_path__
      scheme: https
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      job_name: kubernetes-nodes-cadvisor
      kubernetes_sd_configs:
      - role: node
      relabel_configs:
      - action: labelmap
        regex: __meta_kubernetes_node_label_(.+)
      - replacement: kubernetes.default.svc:443
        target_label: __address__
      - regex: (.+)
        replacement: /api/v1/nodes/$1/proxy/metrics/cadvisor
        source_labels:
        - __meta_kubernetes_node_name
        target_label: __metrics_path__
      scheme: https
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    - honor_labels: true
      job_name: kubernetes-service-endpoints
      kubernetes_sd_configs:
      - role: endpoints
      relabel_configs:
      - action: keep
        regex: true
        source_labels:
        - __meta_kubernetes_service_annotation_prometheus_io_scrape
      - action: drop
        regex: true
        source_labels:
        - __meta_kubernetes_service_annotation_prometheus_io_scrape_slow
      - action: replace
        regex: (https?)
        source_labels:
        - __meta_kubernetes_service_annotation_prometheus_io_scheme
        target_label: __scheme__
      - action: replace
        regex: (.+)
        source_labels:
        - __meta_kubernetes_service_annotation_prometheus_io_path
        target_label: __metrics_path__
      - action: replace
        regex: (.+?)(?::\d+)?;(\d+)
        replacement: $1:$2
        source_labels:
        - __address__
        - __meta_kubernetes_service_annotation_prometheus_io_port
        target_label: __address__
      - action: labelmap
        regex: __meta_kubernetes_service_annotation_prometheus_io_param_(.+)
        replacement: __param_$1
      - action: labelmap
        regex: __meta_kubernetes_service_label_(.+)
      - action: replace
        source_labels:
        - __meta_kubernetes_namespace
        target_label: namespace
      - action: replace
        source_labels:
        - __meta_kubernetes_service_name
        target_label: service
      - action: replace
        source_labels:
        - __meta_kubernetes_pod_node_name
        target_label: node
    - honor_labels: true
      job_name: kubernetes-service-endpoints-slow
      kubernetes_sd_configs:
      - role: endpoints
      relabel_configs:
      - action: keep
        regex: true
        source_labels:
        - __meta_kubernetes_service_annotation_prometheus_io_scrape_slow
      - action: replace
        regex: (https?)
        source_labels:
        - __meta_kubernetes_service_annotation_prometheus_io_scheme
        target_label: __scheme__
      - action: replace
        regex: (.+)
        source_labels:
        - __meta_kubernetes_service_annotation_prometheus_io_path
        target_label: __metrics_path__
      - action: replace
        regex: (.+?)(?::\d+)?;(\d+)
        replacement: $1:$2
        source_labels:
        - __address__
        - __meta_kubernetes_service_annotation_prometheus_io_port
        target_label: __address__
      - action: labelmap
        regex: __meta_kubernetes_service_annotation_prometheus_io_param_(.+)
        replacement: __param_$1
      - action: labelmap
        regex: __meta_kubernetes_service_label_(.+)
      - action: replace
        source_labels:
        - __meta_kubernetes_namespace
        target_label: namespace
      - action: replace
        source_labels:
        - __meta_kubernetes_service_name
        target_label: service
      - action: replace
        source_labels:
        - __meta_kubernetes_pod_node_name
        target_label: node
      scrape_interval: 5m
      scrape_timeout: 30s
    - honor_labels: true
      job_name: prometheus-pushgateway
      kubernetes_sd_configs:
      - role: service
      relabel_configs:
      - action: keep
        regex: pushgateway
        source_labels:
        - __meta_kubernetes_service_annotation_prometheus_io_probe
    - honor_labels: true
      job_name: kubernetes-services
      kubernetes_sd_configs:
      - role: service
      metrics_path: /probe
      params:
        module:
        - http_2xx
      relabel_configs:
      - action: keep
        regex: true
        source_labels:
        - __meta_kubernetes_service_annotation_prometheus_io_probe
      - source_labels:
        - __address__
        target_label: __param_target
      - replacement: blackbox
        target_label: __address__
      - source_labels:
        - __param_target
        target_label: instance
      - action: labelmap
        regex: __meta_kubernetes_service_label_(.+)
      - source_labels:
        - __meta_kubernetes_namespace
        target_label: namespace
      - source_labels:
        - __meta_kubernetes_service_name
        target_label: service
    - honor_labels: true
      job_name: kubernetes-pods
      kubernetes_sd_configs:
      - role: pod
      relabel_configs:
      - action: keep
        regex: true
        source_labels:
        - __meta_kubernetes_pod_annotation_prometheus_io_scrape
      - action: drop
        regex: true
        source_labels:
        - __meta_kubernetes_pod_annotation_prometheus_io_scrape_slow
      - action: replace
        regex: (https?)
        source_labels:
        - __meta_kubernetes_pod_annotation_prometheus_io_scheme
        target_label: __scheme__
      - action: replace
        regex: (.+)
        source_labels:
        - __meta_kubernetes_pod_annotation_prometheus_io_path
        target_label: __metrics_path__
      - action: replace
        regex: (\d+);(([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4})
        replacement: '[$2]:$1'
        source_labels:
        - __meta_kubernetes_pod_annotation_prometheus_io_port
        - __meta_kubernetes_pod_ip
        target_label: __address__
      - action: replace
        regex: (\d+);((([0-9]+?)(\.|$)){4})
        replacement: $2:$1
        source_labels:
        - __meta_kubernetes_pod_annotation_prometheus_io_port
        - __meta_kubernetes_pod_ip
        target_label: __address__
      - action: labelmap
        regex: __meta_kubernetes_pod_annotation_prometheus_io_param_(.+)
        replacement: __param_$1
      - action: labelmap
        regex: __meta_kubernetes_pod_label_(.+)
      - action: replace
        source_labels:
        - __meta_kubernetes_namespace
        target_label: namespace
      - action: replace
        source_labels:
        - __meta_kubernetes_pod_name
        target_label: pod
      - action: drop
        regex: Pending|Succeeded|Failed|Completed
        source_labels:
        - __meta_kubernetes_pod_phase
      - action: replace
        source_labels:
        - __meta_kubernetes_pod_node_name
        target_label: node
    - honor_labels: true
      job_name: kubernetes-pods-slow
      kubernetes_sd_configs:
      - role: pod
      relabel_configs:
      - action: keep
        regex: true
        source_labels:
        - __meta_kubernetes_pod_annotation_prometheus_io_scrape_slow
      - action: replace
        regex: (https?)
        source_labels:
        - __meta_kubernetes_pod_annotation_prometheus_io_scheme
        target_label: __scheme__
      - action: replace
        regex: (.+)
        source_labels:
        - __meta_kubernetes_pod_annotation_prometheus_io_path
        target_label: __metrics_path__
      - action: replace
        regex: (\d+);(([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4})
        replacement: '[$2]:$1'
        source_labels:
        - __meta_kubernetes_pod_annotation_prometheus_io_port
        - __meta_kubernetes_pod_ip
        target_label: __address__
      - action: replace
        regex: (\d+);((([0-9]+?)(\.|$)){4})
        replacement: $2:$1
        source_labels:
        - __meta_kubernetes_pod_annotation_prometheus_io_port
        - __meta_kubernetes_pod_ip
        target_label: __address__
      - action: labelmap
        regex: __meta_kubernetes_pod_annotation_prometheus_io_param_(.+)
        replacement: __param_$1
      - action: labelmap
        regex: __meta_kubernetes_pod_label_(.+)
      - action: replace
        source_labels:
        - __meta_kubernetes_namespace
        target_label: namespace
      - action: replace
        source_labels:
        - __meta_kubernetes_pod_name
        target_label: pod
      - action: drop
        regex: Pending|Succeeded|Failed|Completed
        source_labels:
        - __meta_kubernetes_pod_phase
      - action: replace
        source_labels:
        - __meta_kubernetes_pod_node_name
        target_label: node
      scrape_interval: 5m
      scrape_timeout: 30s
    # 1. Job to read metrics from the OTEL Collector itself
    # (This includes metrics from your Django apps that OTEL processed)
    - job_name: 'otel-collector'
      kubernetes_sd_configs:
        - role: pod

      # Filter only the pods that belong to the collector
      relabel_configs:
        - source_labels: [__meta_kubernetes_pod_label_app_kubernetes_io_instance]
          action: keep
          regex: otel-collector
        - source_labels: [__meta_kubernetes_pod_container_port_number]
          action: keep
          regex: '8889'  # <--- MUST MATCH THE PORT WE CHOSE

    alerting:
      alertmanagers:
      - kubernetes_sd_configs:
          - role: pod
        tls_config:
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
        relabel_configs:
        - source_labels: [__meta_kubernetes_namespace]
          regex: default
          action: keep
        - source_labels: [__meta_kubernetes_pod_label_app_kubernetes_io_instance]
          regex: prometheus
          action: keep
        - source_labels: [__meta_kubernetes_pod_label_app_kubernetes_io_name]
          regex: alertmanager
          action: keep
        - source_labels: [__meta_kubernetes_pod_container_port_number]
          regex: "9093"
          action: keep
  recording_rules.yml: |
    {}
  rules: |
    {}
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: prometheus
    app.kubernetes.io/version: v3.7.3
    helm.sh/chart: prometheus-27.44.1
  name: prometheus-server
  namespace: monitoring
---
apiVersion: v1
data:
  overrides.yaml: |
    overrides:
      {}
  tempo.yaml: |
    multitenancy_enabled: false
    usage_report:
      reporting_enabled: true
    compactor:
      compaction:
        block_retention: 24h
    distributor:
      receivers:
            jaeger:
              protocols:
                grpc:
                  endpoint: 0.0.0.0:14250
                thrift_binary:
                  endpoint: 0.0.0.0:6832
                thrift_compact:
                  endpoint: 0.0.0.0:6831
                thrift_http:
                  endpoint: 0.0.0.0:14268
            opencensus: null
            otlp:
              protocols:
                grpc:
                  endpoint: 0.0.0.0:4317
                http:
                  endpoint: 0.0.0.0:4318
    ingester:
          {}
    server:
          http_listen_port: 3100
    storage:
          trace:
            backend: local
            local:
              path: /var/tempo/traces
            wal:
              path: /var/tempo/wal
    querier:
          {}
    query_frontend:
          {}
    overrides:
          per_tenant_override_config: /conf/overrides.yaml
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/instance: tempo
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: tempo
    app.kubernetes.io/version: 2.3.1
    helm.sh/chart: tempo-1.10.1
  name: tempo
  namespace: monitoring
---
apiVersion: v1
data:
  authmtx.yml: |
    server:
      port: 8080
      read_timeout: 5s
      write_timeout: 10s

    upstream:
      base_url: "http://api.local.plevion.com"
      auth_path: "/public/v1/sink/"
      timeout: 5s

    logging:
      level: "debug"
kind: ConfigMap
metadata:
  labels:
    app: mediamtx
  name: authmtx-config-local-dm99t88c4b
  namespace: plevion-local
---
apiVersion: v1
data:
  mediamtx.yml: |
    api: yes
    apiAddress: :9997

    authMethod: http
    authHTTPAddress: http://localhost:8080/auth

    webrtcIPsFromInterfaces: yes
    webrtcLocalUDPAddress: :8189
    webrtcAdditionalHosts:
      - "192.168.0.240"

    pathDefaults:
      # $MTX_PATH -> live/{installation_id}/{stream_id}
      # $MTX_QUERY -> URL-escaped publisher query string (MediaMTX calls url.QueryEscape
      #   on the raw query, so "jwt=eyJ..." becomes "jwt%3DeyJ..."). Pass it as a named
      #   param so authmtx can decode it correctly.
      # MediaMTX exec()s the command directly (no shell); use absolute path.
      runOnReady: >-
        /usr/bin/wget --post-data="" -q -O /dev/null
        "http://localhost:8080/notify/ready?path=$MTX_PATH&query=$MTX_QUERY&source_type=$MTX_SOURCE_TYPE"
      runOnNotReady: >-
        /usr/bin/wget --post-data="" -q -O /dev/null
        "http://localhost:8080/notify/stop?path=$MTX_PATH"

    paths:
      all_others:

    srt: yes
    srtAddress: :8890

    hls: yes
    hlsVariant: lowLatency
    # 100ms, not the 1s default -- a maintainer-cited "most important parameter"
    # for LL-HLS latency; MediaMTX's own docs discourage hlsPartDuration below
    # 200ms (Apple's own guidance: sub-200ms parts destabilize hls.js playback),
    # so segment duration is the remaining lever.
    hlsSegmentDuration: 100ms
    hlsPartDuration: 200ms

    readTimeout: 3600s
    writeTimeout: 3600s
    writeQueueSize: 1024
kind: ConfigMap
metadata:
  labels:
    app: mediamtx
  name: mediamtx-config-local-gk79kkc942
  namespace: plevion-local
---
apiVersion: v1
data:
  init.sql: |
    CREATE DATABASE orchestrator;
    CREATE DATABASE auth;
    CREATE DATABASE sink;
kind: ConfigMap
metadata:
  labels:
    app: postgres
  name: postgres-init-scripts-local
  namespace: plevion-local
---
apiVersion: v1
data:
  rabbitmq.conf: |
    # Force memory limit to 400Mi to prevent OOMKills in Kubernetes
    vm_memory_high_watermark.absolute = 400Mi
    # Load definitions (policies, queues, exchanges) from JSON file
    management.load_definitions = /etc/rabbitmq/definitions.json
kind: ConfigMap
metadata:
  labels:
    app: rabbitmq
  name: rabbitmq-config-local
  namespace: plevion-local
---
apiVersion: v1
data:
  definitions.json: |
    {
      "users": [
        {
          "name": "user",
          "password_hash": "fJxFDyRRW+jITJP7Fy0o9pFfUutRuwr+sX6kV93O38y23GbO",
          "hashing_algorithm": "rabbit_password_hashing_sha256",
          "tags": "administrator"
        }
      ],
      "vhosts": [
        {
          "name": "/"
        }
      ],
      "permissions": [
        {
          "user": "user",
          "vhost": "/",
          "configure": ".*",
          "write": ".*",
          "read": ".*"
        }
      ],
      "policies": [
        {
          "name": "celery_ev_limit",
          "pattern": "^celeryev\\.",
          "definition": {
            "max-length": 10000
          },
          "apply-to": "queues",
          "vhost": "/"
        }
      ]
    }
kind: ConfigMap
metadata:
  labels:
    app: rabbitmq
  name: rabbitmq-definitions-local-t4gcbb6kdb
  namespace: plevion-local
---
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-webhook-cert
  namespace: metallb-system
---
apiVersion: v1
data:
  admin-password: YWRtaW4=
  admin-user: YWRtaW4=
  ldap-toml: ""
kind: Secret
metadata:
  labels:
    app.kubernetes.io/component: admin-secret
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana
  namespace: monitoring
type: Opaque
---
apiVersion: v1
data:
  BACKEND_URL: aHR0cDovL2tvbmcta29uZy1wcm94eS9wdWJsaWMvdjE=
  COMPANY_ID: N2YyYzBkYjMtYjE2ZS00NTlkLTljY2ItNDZiOTM5ZmExNWU2
  OTEL_SERVICE_NAME: cGxldmlvbi1hZG1pbg==
  SERVICE_TOKEN: MTBjYzBhNzA0MDhhMzAxMjZlZjcwMDg5NTdkMjg3YTE5MmU4ODYyZA==
  TAILSCALE_AUTH_KEY: |
    dHNrZXktYXV0aC1rMlI3Q3ZmY3c3MTFDTlRSTC1GUWNGNFJySFhiMmRScXk3Y1h0SmIyMz
    JhZDJjNExnbQ==
kind: Secret
metadata:
  name: admin-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  CSRF_TRUSTED_ORIGINS: aHR0cHM6Ly9hdXRoLmxvY2FsLnBsZXZpb24uY29t
  DB_HOST: cG9zdGdyZXMtbG9jYWw=
  DB_NAME: YXV0aA==
  DB_PASSWORD: cGFzc3dvcmQ=
  DB_PORT: NTQzMg==
  DB_USER: cG9zdGdyZXM=
  DJANGO_SETTINGS_MODULE: c2V0dGluZ3MuZG9ja2Vy
  LOGIN_URL: L2F1dGgvYWRtaW4vbG9naW4v
  ORCHESTRATOR_SERVICE_TOKEN: OTU2NTY0NzRmNTNkN2EzMDc0ZmMzNDA2YzY4M2U0MGJjNDMzNzE1ZQ==
  OTEL_PYTHON_INSTRUMENTATION_REDIS_CAPTURE_ARGS: dHJ1ZQ==
  OTEL_PYTHON_LOG_CORRELATION: dHJ1ZQ==
  OTEL_SDK_DISABLED: dHJ1ZQ==
  OTEL_SERVICE_NAME: YXV0aA==
  PYTHONPATH: L2FwcC9zcmM=
  PYTHONWARNINGS: |
    aWdub3JlOnBrZ19yZXNvdXJjZXMgaXMgZGVwcmVjYXRlZCBhcyBhbiBBUEk6VXNlcldhcm
    5pbmc=
  RABBITMQ_DEFAULT_PASS: MXEydzNl
  RABBITMQ_DEFAULT_USER: dXNlcg==
  RABBITMQ_HOST: cmFiYml0bXEtbG9jYWw=
  RABBITMQ_PORT: NTY3Mg==
  REDIS_HOST: cmVkaXMtbG9jYWw=
  REDIS_PASSWORD: MXEydzNl
  REDIS_PORT: NjM3OQ==
  SERVICE_TOKEN: YjUwOTA2YzM4NGQzOWIyNTVlYjUzYzVmYTgyMjJiZmRlMmRiNTU4ZQ==
  SWAGGER_UI_URL: L2F1dGgvc2NoZW1hL3N3YWdnZXItdWkv
  TAILSCALE_AUTH_KEY: |
    dHNrZXktYXV0aC1rZ2tKQURLcFF5MTFDTlRSTC1Bc0dVcjZaNnRhQ3ViNFp6blRISmJDRD
    FERHdQUVlmWEQ=
  UI_ADMIN_SERVICE_TOKEN: MTBjYzBhNzA0MDhhMzAxMjZlZjcwMDg5NTdkMjg3YTE5MmU4ODYyZA==
kind: Secret
metadata:
  name: auth-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  DB_HOST: cG9zdGdyZXMtbG9jYWw=
  DB_NAME: ZWRnZV9jb250cm9sbGVy
  DB_PASSWORD: cGFzc3dvcmQ=
  DB_PORT: NTQzMg==
  DB_USER: cG9zdGdyZXM=
  DJANGO_SETTINGS_MODULE: c2V0dGluZ3Muazhz
  PYTHONPATH: L2FwcC9zcmM=
  RABBITMQ_DEFAULT_PASS: MXEydzNl
  RABBITMQ_DEFAULT_USER: dXNlcg==
  RABBITMQ_HOST: cmFiYml0bXEtbG9jYWw=
  RABBITMQ_PORT: NTY3Mg==
  REDIS_HOST: cmVkaXMtbG9jYWw=
  REDIS_PASSWORD: MXEydzNl
  REDIS_PORT: NjM3OQ==
  SECRET_KEY: ZGphbmdvLWluc2VjdXJlLWVkZ2UtY29udHJvbGxlci1sb2NhbC1jaGFuZ2UtbWU=
  STREAM_RECORDING_HOST_PATH: |
    L2hvbWUvanBhdWwvRXNjcml0b3Jpby9wbGV2aW9uL2VkZ2UtY29udHJvbGxlci9zcmMvYX
    Bwcy9zdHJlYW1zL3ZpZGVvX2V4YW1wbGVz
kind: Secret
metadata:
  name: edge-controller-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  .dockerconfigjson: |
    ewogICAgImF1dGhzIjogewogICAgICAgICJnaGNyLmlvIjogewogICAgICAgICAgICAidX
    Nlcm5hbWUiOiAiam9uYXRyaW9zIiwKICAgICAgICAgICAgInBhc3N3b3JkIjogImdocF9u
    THZsQWF3aHdCMmR2bUM0YzBzWkxKV290Nk40dTMwc1lXbG0iLAogICAgICAgICAgICAiYX
    V0aCI6ICJhbTl1WVhSeWFXOXpPbWRvY0Y5dVRIWnNRV0YzYUhkQ01tUjJiVU0wWXpCeldr
    eEtWMjkwTms0MGRUTXdjMWxYYkcwPSIKICAgICAgICB9CiAgICB9Cn0K
kind: Secret
metadata:
  name: ghcr-registry-secret
  namespace: plevion-local
type: kubernetes.io/dockerconfigjson
---
apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURJekNDQWd1Z0F3SUJBZ0lRQVBEemNzQXF0UmJCRExFaDVtaFQ3VEFOQmdrcWhraUc5dzBCQVFzRkFEQWMKTVJvd0dBWURWUVFERXhGcmIyNW5MV0ZrYldsemMybHZiaTFqWVRBZUZ3MHlOakE0TURFd09ETXpNREZhRncwegpOakEzTWprd09ETXpNREZhTUJ3eEdqQVlCZ05WQkFNVEVXdHZibWN0WVdSdGFYTnphVzl1TFdOaE1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQW96dlFIVVZCeFFOMEkwRUI3QnE0Ylo5T2VmT1QKV1FlNVZKWFEyeVlWaVlpTU03ZWp2K2xjZnRNWERUS1JrQW5PQ1ZYRjVlTWFHdlBhZGcyZG9LZzNNS05QTFNKVgpIaTRybTltbVJ6QzZxZkI0T1lHbWtOdHNBZDdITUsrMENoOWxDcEpSaWE0Ly82YTR2NTNpNWY4SHA0dG45T24zCmdDb0MyZHpVOG1QcEJXbVlXUUZic3FleHhxTkdqcW1JVVNlOGRTMWFaY3NiWWJnakRlQmJaVUlmbXVkdmFxM20KTmsvRW84cUMxTjlTTTNqMGRPK0Y1RjlNTmd2R1VYOHhXS1lUeWZGcXg3US80dGwxaHBSOG9rSXl3QVlxcTNrVAphQ1owSzZVYVN5UFQzNDBBeXZwamVrTmtKTVZIQjgyY21aUXRyQUVMQ3JtS2dXMS9wYzJ6VllBalh3SURBUUFCCm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUYKQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPQkJZRUZPNFZ0allwbUZUNUhNSEFSRjk2RE1OSApqT3RKTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBeTlMYm94K2E4d0tSVGJ1MUliQ1I2Uk1Oc1I2NTFZNjhICmd0UUQ1a3hUS2VPVm53dXFTejEya2g0V3IzMExYVmE3b2pQWklDLytXRGpicW5YWTJJbW9uRkdldHRPTVl1SU8KZnd3Q3o4SURsT0FBTnRRWFBMRDYzV2RrTUJDU0RtSFNLbWJuMDF2RHJzMTFtU2tUMWZaOVI3eU9tOEhSNU0vSQpGSGNlSUlXM2oyd1N3Qmx6S3VtYnMyM0VhUUpKWE9HQmRzNGVHdktMbjZ2aEVqMnBrU09SbFh1TVNIcWRPOUs5CkxlYVZJVHpIWDVlUkEzSzY3MFVMS3RKbzVIdnpWczJ3Y3NpcmZob2YzUlcyM3BLdFc0UUVBc3A4VEVGM045NWgKVTdKa2dEZHY1NENySVgrNEZBdHkxSGtNNldKbzRiSEVqd1FpYmhHREQ5OThmVEtkYThkVQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBb3p2UUhVVkJ4UU4wSTBFQjdCcTRiWjlPZWZPVFdRZTVWSlhRMnlZVmlZaU1NN2VqCnYrbGNmdE1YRFRLUmtBbk9DVlhGNWVNYUd2UGFkZzJkb0tnM01LTlBMU0pWSGk0cm05bW1SekM2cWZCNE9ZR20Ka050c0FkN0hNSyswQ2g5bENwSlJpYTQvLzZhNHY1M2k1ZjhIcDR0bjlPbjNnQ29DMmR6VThtUHBCV21ZV1FGYgpzcWV4eHFOR2pxbUlVU2U4ZFMxYVpjc2JZYmdqRGVCYlpVSWZtdWR2YXEzbU5rL0VvOHFDMU45U00zajBkTytGCjVGOU1OZ3ZHVVg4eFdLWVR5ZkZxeDdRLzR0bDFocFI4b2tJeXdBWXFxM2tUYUNaMEs2VWFTeVBUMzQwQXl2cGoKZWtOa0pNVkhCODJjbVpRdHJBRUxDcm1LZ1cxL3BjMnpWWUFqWHdJREFRQUJBb0lCQUM0NEJ1YnF6OE1WaGNKZgpxMGdyanJIM2JCU0t1OXQzSE9wTzIwclovem9va0M0cW5ySjl4SU5paU1IallpVHJLY3dwM2JXSWRzRlA3N2tDCmhQSFMvNEdGbENzZThBUHlKY1hrdkRpbkd3dDRPOHBvby8yYkszdGlGWHQ3SEpyTEplUjI1cUI1MXNRdjlGckoKUFZCTFJHTVR6WFVpOUVIMVkwWkZ5WVB5ZHkzaE12OXpnd1RXSXBodXFWc2FteldGVzAzdVQySFVVZnU0UU9ZTApFTHJZYlhoNklodzFoUllHUHprMnZvcXlhWXpCNjRVazQzTUhjWEFFb2VsZVJZN2pmVzhadzc2ZkJLN2hROHNDCk1OeDk4OTZzNWtycGhRcGFUZVhObnhxdDdRWENRUWg0NEVvbm5FTEFxQnhjR0JiOFpOY245TDNJSWsydXplMTIKSEV3UmJoa0NnWUVBMHlkN01telE1L2ppNk5WTEpBTW85aGpMeFphSEtrbGt4U0JuYTd2bVFIWDhoU3I3clZERApKa21Tb0ZieWFKVlYxdmwvYW42TEsyblpHU1JyZEVXMFROQUxvTWJCd1Zyb1RqNDVyNHp6WjdTSXJjSnZ4YnVmCmlWUEdxN2ljem0rL3ZoRUZNVmN3bXllNW1BbmRHeE44UlFxcmR1ZElNWmd3dDlEVUxQc0gyK2NDZ1lFQXhlYmcKR0lpb0NSeDhvNWE2YlBCajlIZ1RFTXZ1VWtIemI5U1NXQmJoZkZBbTVjWTNYOVBhQ1dGSi9yWTU4Y01Cc1BVVwo5dnd5UndGaEltei9PYkgrbFFWS1JiRFBydm5lSHJEbjJhWUtoU1d0ZUVjTXZUd1N6eXJsNTFDc1Y3MUdVRjRDCnU1T0h5MmVUeENzS3JWWjkxWEpVQnk4NEdBMllNa0ZXNWNGUVRja0NnWUVBbnBISHN0YUZDNitjdDcxMThGVnYKTFdEeHBqQ2swTnpORUR5RmJpSnRoM3NUWis0ZmtzaFR4U3o3TCs0Ym5PNkl5Q2dWeDZQQVg1bmRyMFBxYmlicQpmOFM4OXNCTVFTaER6SDV1VTZkR0kxc3dTVXo3STBNRFM5M2VGSmRQS3JoQkJqdEI2d3ZQTkxWZ2F3ejlQcGdqCmVyWElqa0todEp6VitUU2FJaTFpZVlFQ2dZQWFmZVovd2tOa1BOaitlUjNwbVdCNENGN2MvNytlYVUreUo2MlQKZHpTbUZJQ3dmNUZJRmE3NVZIbTRUQ0tEbDR3eGFRMnk4RjIyblp1b0pSa2hXdzl1V1cvdzFsTm00L0gwLzg5NQpsajJRUjFQcVp2QndvSXNRQ25rT053RnJHVjVCUWVSeHdiVUs2SW1pVi9TczhZZ1V1Nkk5OS9jMVdSU0huYkdKClBoQ0c2UUtCZ1FEQzdvaWpFbC9jM09YdVVTaEdCR2tDaHlQRVBUNDgxdFNMVkFYNXA3SmtmeURPV2p0V3YrN08KWHZ5aWFXQkZIN1dHWUJoODVYelhHVVdQc0pvcFA4TmRuMzNYaWpaMldIdGlrV2dLbTJud0VPVTVMNjJwV3AwSgo5eHQ5dGplTTdzUmtRcnIvY0ZKSkRGSFc3WXd5M1ZSbjNjVDN1YjFjN1BHdEJaZ2FpQ0hlNUE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-validation-webhook-ca-keypair
  namespace: plevion-local
type: kubernetes.io/tls
---
apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURhakNDQWxLZ0F3SUJBZ0lRVkdFSjlwSDcwUGhqaWxQeWRuNFk5REFOQmdrcWhraUc5dzBCQVFzRkFEQWMKTVJvd0dBWURWUVFERXhGcmIyNW5MV0ZrYldsemMybHZiaTFqWVRBZUZ3MHlOakE0TURFd09ETXpNREZhRncwegpOakEzTWprd09ETXpNREZhTURBeExqQXNCZ05WQkFNVEpXdHZibWN0YTI5dVp5MTJZV3hwWkdGMGFXOXVMWGRsClltaHZiMnN1YTI5dVp5NXpkbU13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRREwKVllkRy9jY0d2VjFDK2wrSkd6RkNYc0tJME1JeFl1ckdPekR3VHFnekxGd3lldzR0aXJTWks1VDFFcW05TENubQpKTTF3ajdrdHgvbnFDaVY4Q3ZnanIyUXpiOCtqRGFBYzFlbGNzWkNlejVSdEpMWkpIaWNVRkNHQ3BDZHdLaVczCkQ3N09WKzZ4OTNaSnVBblVmTy83UXd6ZUxzM3ZKRmRibXZpRm51ZWxVSUlMUnRMUjVuNzVOQjcxQmt4V3Y5cUsKbE5qa2VHTWcyaVdpQVA3dnA4SDRHanVnWkV2NnkrUk9UTFFBNDBCQktkcjhHTWRtK3ZON0xlMHRVOHFXc1lkRgpRa0I5ekhoaCswbzRCQnZyNDNvM3pic29xMmlqcFFpS1prcC9xTTJ4RnJHVkVxM3g1RXQ5YmM5WHNKRldZTGtTCkpydncwNzMvNDBNNzRLekd4YlZ2QWdNQkFBR2pnWk13Z1pBd0RnWURWUjBQQVFIL0JBUURBZ1dnTUIwR0ExVWQKSlFRV01CUUdDQ3NHQVFVRkJ3TUJCZ2dyQmdFRkJRY0RBakFNQmdOVkhSTUJBZjhFQWpBQU1COEdBMVVkSXdRWQpNQmFBRk80VnRqWXBtRlQ1SE1IQVJGOTZETU5Iak90Sk1EQUdBMVVkRVFRcE1DZUNKV3R2Ym1jdGEyOXVaeTEyCllXeHBaR0YwYVc5dUxYZGxZbWh2YjJzdWEyOXVaeTV6ZG1Nd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFDSU0KRVl6eGYzeDU0N3Fmb1VlcUNuVmlFdmQ1K0F1K214c1BwWGd1N2U3UWo0SkdtNU1kTjBQc3hzbWRzM05EZDNGUwpLY1ZBdWNDM09WVjZMemc4MytlYkJEcGFtSkl5Q3NZaFJuZm1DQmhHR1V2UTk3NngxWWdkUmM4WWdqeStqd1lqCloxOTV4QmhQUzJvOUphd3NqNFhWYUhrY1lUL2ZKdStxVjd3SG1UM2VQdlo0bXdmRkNxUzNwQXlIZ0pQa2NXMlIKZzB4T0R1Skdqa0U3U3lQS1RacU5haXpmdlJOUW53TzJ5NzhjK2NkalpVNUtmOUN1SHRseFd2NlFtVFVnNlEzSwpEcWtOY3pYajhBYzUzdFkvWnNFbGtzNy9Td1pBbitXYmhDZkFNNnA3TWsxUUJkOStWNk1vSHdqK3RiK3FGTDM5CmkxNjNSMk1DZENNRHEydlNjWWs9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBeTFXSFJ2M0hCcjFkUXZwZmlSc3hRbDdDaU5EQ01XTHF4anN3OEU2b015eGNNbnNPCkxZcTBtU3VVOVJLcHZTd3A1aVROY0krNUxjZjU2Z29sZkFyNEk2OWtNMi9Qb3cyZ0hOWHBYTEdRbnMrVWJTUzIKU1I0bkZCUWhncVFuY0NvbHR3Kyt6bGZ1c2ZkMlNiZ0oxSHp2KzBNTTNpN043eVJYVzVyNGhaN25wVkNDQzBiUwowZVorK1RRZTlRWk1Wci9haXBUWTVIaGpJTm9sb2dEKzc2ZkIrQm83b0dSTCtzdmtUa3kwQU9OQVFTbmEvQmpIClp2cnpleTN0TFZQS2xyR0hSVUpBZmN4NFlmdEtPQVFiNitONk44MjdLS3RvbzZVSWltWktmNmpOc1JheGxSS3QKOGVSTGZXM1BWN0NSVm1DNUVpYTc4Tk85LytORE8rQ3N4c1cxYndJREFRQUJBb0lCQUQ0N3NyaEJNeG0yZXFWbAowVGk3Q0dRYWNhc0RUZlJrcEp2QWdSV0QxWW80RVEzb1NPb2FjblVRK0RuY0dQU0w0RlVPdll3dWlReGdrUGFYClhXcXVSczFSUUxkWGlQTU1XQTJMVVMzc01PblNlY2kvL0VTN3hGVXFaaWxBaWN1VU1zL3BNMHFmY2pDcEgxeW4KeGVaeHlOZWI2WVBWU25WZnA1Y2pndDRPeVRKNHVtTnFxczFlSXRERUd6cmRRSkMwMHJPalBzUnhtUUZiMHNacwpUeTB4aEZOZTBycnpiU3lJS2J2ZXdmTU1mZUdLV3RPSHdZMFpIVnp0enBRVUMwV0dSSFdTQjdvbUpXK0t3SndPCm1IR3M2VjFIa2dSSUpXTlVhbHM5c2ZYVnV4L29lRkczWCtSRnNWVURzcU95d3VjSXZnWWptczJmSi9LaHkvYzkKL0JxSUtkMENnWUVBNng2Rlh3bTFHZjlWaUpWV1kzUDg0WGFCS2IxRHJHZlNxYkxrVlpTc2tSd2h6REQxOEE0UApFTHpaUHZObEV3RUtTakt1RGlaWkpIRXlmSDRnajhvdWhmV203M2R4MTVKK0E2WCs3ZnlBZGxGdVhQRHlEc2xzClB5M29sZytyNHM4Tko1QmgvSGVTdzBOM3QyZjA3aGRoVjY3dUYrVlBQSFJOalBtdGxSTHBKTHNDZ1lFQTNXUmQKNEFqV0x3WHJIdEhob0ttUkw5elkzTDB1aCtqc1g5OUZ2S2NMVkRuZXNST2FDQVlFSW13QlpLZTN2TDlFdE9aMQpFUlpHNjM0b21jei8xN3Z4L3ZJUUYxUXg5WFovenA5MDZxV1lTVDVRaFhJVVNnb3Z1cVRaTEJ6VWthQWQ2eEF6CkhSV1p6a2pSRVNrcWpvZEwxMENaMHFoaVU2UUF5SG9QK21MekFOMENnWUJtcndlMGYvcldCY3VIUVNGZmdmSjUKVFZZUHNwYnhuczVFU3RxcC9hcDRIWDh0UEZ6TW9IYzM2aUkrK2ZHMG9RbXJhZ0xXTHkxVFd4U2ZoajRXVGtpUApQTC9SYWFzUWFPd2NEODBNaHZCYnZDaWs4cDNrazFkeEtFMmg2K28zdmhHU3E5My9jd0Zud2ZsdzRqZjRHOEhwCmwzNW9kVDlydWFkODREWk5HdHN6clFLQmdRRFNIYXAyc1F4T0RxanFWRGwyV05pQmUzR2FkallPS1VNRmJvcnEKRkFQTmlTclFGcEZ1b2Y4VWlEcitRNnMvQ0t4MW4rOWxLeVpkNUJzMmRQZ3YwS0ZJM0lYbkRqSm9DM0liTVAwdQpvY0VaYW5uVFhNVGl6QzRtVHNRS2VNWkorNVBKZjFOemZBZkFYeDJFMHZRZjEwcGtYVnhnTVEwNDRvTVh3YmtlCll3RE1SUUtCZ1FEaWsxZlNpbmFNVW1JTDVseDBrTDRlTkNONkZ2OVFoR3dEcjJQbC9GSklKVVAxanJkTHJhWm0KR1l5NjQ2OEV6VUw4TXQzSCtUNEtlZXdrS3lqNkRneWVaR1NzdkNCbHU1K28xVkR6RzdteTUzUzR0MEhKcVZsZwp3aFFUMnRYWFVHZ05FT0pmczVXMFVzcXpuWTBRYzliQ1QrMWp2aUtxNlI5QzJGOW9BSnBWWlE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-validation-webhook-keypair
  namespace: plevion-local
type: kubernetes.io/tls
---
apiVersion: v1
data: {}
kind: Secret
metadata:
  name: kong-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  BACKEND_URL: aHR0cDovL2tvbmcta29uZy1wcm94eS9wdWJsaWMvdjE=
  COMPANY_ID: N2YyYzBkYjMtYjE2ZS00NTlkLTljY2ItNDZiOTM5ZmExNWU2
  OTEL_SERVICE_NAME: cGxldmlvbi1sYW5kaW5n
  SERVICE_TOKEN: MTBjYzBhNzA0MDhhMzAxMjZlZjcwMDg5NTdkMjg3YTE5MmU4ODYyZA==
kind: Secret
metadata:
  name: landing-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  MINIO_DEFAULT_BUCKETS: cGxldmlvbg==
  MINIO_ROOT_PASSWORD: cGxldmlvbjEyMw==
  MINIO_ROOT_USER: cGxldmlvbg==
kind: Secret
metadata:
  name: minio-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  API_HOST: aHR0cDovL2FwaS5sb2NhbC5wbGV2aW9uLmNvbQ==
  CELERY_WORKER_HEARTBEAT_INTERVAL: MTA=
  CSRF_TRUSTED_ORIGINS: aHR0cHM6Ly9vcmNoZXN0cmF0b3IubG9jYWwucGxldmlvbi5jb20=
  DB_HOST: cG9zdGdyZXMtbG9jYWw=
  DB_NAME: b3JjaGVzdHJhdG9y
  DB_PASSWORD: cGFzc3dvcmQ=
  DB_PORT: NTQzMg==
  DB_USER: cG9zdGdyZXM=
  DJANGO_SETTINGS_MODULE: c2V0dGluZ3MuZG9ja2Vy
  LOGIN_URL: L29yY2hlc3RyYXRvci9hZG1pbi9sb2dpbi8=
  MEDIA_MTX_RTSP_URL: cnRzcDovL21lZGlhbXR4LWxvY2FsLnBsZXZpb24tbG9jYWw6ODU1NC8=
  MEDIA_MTX_SRT_URL: c3J0Oi8vbWVkaWFtdHgtbG9jYWwucGxldmlvbi1sb2NhbDo4ODkw
  MEDIA_MTX_URL: aHR0cDovL21lZGlhbXR4LWxvY2FsLnBsZXZpb24tbG9jYWw6ODg4OQ==
  OTEL_PYTHON_INSTRUMENTATION_REDIS_CAPTURE_ARGS: dHJ1ZQ==
  OTEL_PYTHON_LOG_CORRELATION: dHJ1ZQ==
  OTEL_SDK_DISABLED: dHJ1ZQ==
  OTEL_SERVICE_NAME: b3JjaGVzdHJhdG9y
  PYTHONPATH: L2FwcC9zcmM=
  RABBITMQ_DEFAULT_PASS: MXEydzNl
  RABBITMQ_DEFAULT_USER: dXNlcg==
  RABBITMQ_HOST: cmFiYml0bXEtbG9jYWw=
  RABBITMQ_PORT: NTY3Mg==
  REDIS_HOST: cmVkaXMtbG9jYWw=
  REDIS_PASSWORD: MXEydzNl
  REDIS_PORT: NjM3OQ==
  SERVICE_TOKEN: OTU2NTY0NzRmNTNkN2EzMDc0ZmMzNDA2YzY4M2U0MGJjNDMzNzE1ZQ==
  SWAGGER_UI_URL: L29yY2hlc3RyYXRvci9zY2hlbWEvc3dhZ2dlci11aS8=
  TAILSCALE_AUTH_KEY: |
    dHNrZXktYXV0aC1rdFg1ekVQc2c1MTFDTlRSTC1iRGNlTFJRajR6TFpDVTNYblE2cXlMOW
    ZSMXBvOWVZYw==
kind: Secret
metadata:
  name: orchestrator-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  POSTGRES_DB: cGxldmlvbg==
  POSTGRES_PASSWORD: cGFzc3dvcmQ=
  POSTGRES_USER: cG9zdGdyZXM=
kind: Secret
metadata:
  name: postgres-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  RABBITMQ_DEFAULT_PASS: MXEydzNl
  RABBITMQ_DEFAULT_USER: dXNlcg==
kind: Secret
metadata:
  name: rabbitmq-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  REDIS_PASSWORD: MXEydzNl
kind: Secret
metadata:
  name: redis-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  API_HOST: aHR0cDovL2FwaS5sb2NhbC5wbGV2aW9uLmNvbQ==
  AUTH_JWT_KEY: |
    ZGphbmdvLWluc2VjdXJlLSU4Jil2YSpnMHRAYyFycjV1XjMpemlsa2pvc3F2biZzbzZ6LT
    krI2ZwMiRAa21pcGgl
  AUTH_ROOT_ACCOUNT_ID: MTZiZGZjZTctMDU0Ny00ZWE4LWI0MzEtMmVmYjg5MmJiYmQ1
  AUTH_ROOT_USER_ID: YzQ5MjM5YzItYWNlYS00ZmM0LTgxN2UtYzU2MmY2N2U3NDdj
  AUTH_ROOT_USER_USERNAME: cm9vdEBwbGV2aW9uLmNvbQ==
  DB_HOST: cG9zdGdyZXMtbG9jYWw=
  DB_NAME: c2luaw==
  DB_PASSWORD: cGFzc3dvcmQ=
  DB_PORT: NTQzMg==
  DB_USER: cG9zdGdyZXM=
  DJANGO_SETTINGS_MODULE: c2V0dGluZ3MucHJvZHVjdGlvbg==
  MEDIAMTX_HLS_URL: aHR0cDovL21lZGlhbXR4LWxvY2FsLnBsZXZpb24tbG9jYWw6ODg4OA==
  MEDIAMTX_RTSP_URL: cnRzcDovL21lZGlhbXR4LWxvY2FsLnBsZXZpb24tbG9jYWw6ODU1NA==
  OTEL_PYTHON_LOG_CORRELATION: dHJ1ZQ==
  OTEL_SDK_DISABLED: dHJ1ZQ==
  OTEL_SERVICE_NAME: c2luaw==
  RABBITMQ_DEFAULT_PASS: MXEydzNl
  RABBITMQ_DEFAULT_USER: dXNlcg==
  RABBITMQ_HOST: cmFiYml0bXEtbG9jYWw=
  RABBITMQ_PORT: NTY3Mg==
  REDIS_HOST: cmVkaXMtbG9jYWw=
  REDIS_PASSWORD: MXEydzNl
  REDIS_PORT: NjM3OQ==
  SECRET_KEY: ZGphbmdvLWluc2VjdXJlLWNoYW5nZS1tZS1pbi1wcm9kdWN0aW9u
  SERVICE_TOKEN: YTNmOGMyZTFiMGQ3NDU5NmFmMTJlM2M3MDkxZDg1YmY0ZTYyMDk3OA==
  STORAGE_BUCKET: cGxldmlvbg==
  STORAGE_ENDPOINT: aHR0cDovL21pbmlvLWxvY2FsLnBsZXZpb24tbG9jYWw6OTAwMA==
  STORAGE_KEY: cGxldmlvbg==
  STORAGE_PUBLIC_BASE_URL: aHR0cDovL2FwaS5sb2NhbC5wbGV2aW9uLmNvbS9wbGV2aW9u
  STORAGE_SECRET: cGxldmlvbjEyMw==
kind: Secret
metadata:
  name: sink-secrets
  namespace: plevion-local
type: Opaque
---
apiVersion: v1
data:
  client_id: a3dBRW1aNVhTMjExQ05UUkw=
  client_secret: |
    dHNrZXktY2xpZW50LWt3QUVtWjVYUzIxMUNOVFJMLXN0dkRHbmFpd2hMaHVYR3l2RVBLaU
    xSQUZWUWh5WVRM
kind: Secret
metadata:
  name: operator-oauth
  namespace: tailscale
type: Opaque
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager
  namespace: cert-manager
spec:
  ports:
  - name: tcp-prometheus-servicemonitor
    port: 9402
    protocol: TCP
    targetPort: http-metrics
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/name: cert-manager
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: cainjector
    app.kubernetes.io/component: cainjector
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cainjector
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-cainjector
  namespace: cert-manager
spec:
  ports:
  - name: http-metrics
    port: 9402
    protocol: TCP
  selector:
    app.kubernetes.io/component: cainjector
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/name: cainjector
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: webhook
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: webhook
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-webhook
  namespace: cert-manager
spec:
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: https
  - name: metrics
    port: 9402
    protocol: TCP
    targetPort: http-metrics
  selector:
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/name: webhook
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-webhook-service
  namespace: metallb-system
spec:
  ports:
  - port: 443
    targetPort: 9443
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/name: metallb
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana
  namespace: monitoring
spec:
  ports:
  - name: service
    port: 80
    protocol: TCP
    targetPort: grafana
  selector:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki
  namespace: monitoring
spec:
  ports:
  - name: http-metrics
    port: 3100
    protocol: TCP
    targetPort: http-metrics
  - name: grpc
    port: 9095
    protocol: TCP
    targetPort: grpc
  selector:
    app.kubernetes.io/component: single-binary
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: canary
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki-canary
  namespace: monitoring
spec:
  ports:
  - name: http-metrics
    port: 3500
    protocol: TCP
    targetPort: http-metrics
  selector:
    app.kubernetes.io/component: canary
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: memcached-chunks-cache
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki-chunks-cache
  namespace: monitoring
spec:
  clusterIP: None
  ports:
  - name: memcached-client
    port: 11211
    targetPort: client
  - name: http-metrics
    port: 9150
    targetPort: http-metrics
  selector:
    app.kubernetes.io/component: memcached-chunks-cache
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
    prometheus.io/service-monitor: "false"
    variant: headless
  name: loki-headless
  namespace: monitoring
spec:
  clusterIP: None
  ports:
  - name: http-metrics
    port: 3100
    protocol: TCP
    targetPort: http-metrics
  selector:
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki-memberlist
  namespace: monitoring
spec:
  clusterIP: None
  ports:
  - name: tcp
    port: 7946
    protocol: TCP
    targetPort: http-memberlist
  selector:
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/part-of: memberlist
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: memcached-results-cache
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki-results-cache
  namespace: monitoring
spec:
  clusterIP: None
  ports:
  - name: memcached-client
    port: 11211
    targetPort: client
  - name: http-metrics
    port: 9150
    targetPort: http-metrics
  selector:
    app.kubernetes.io/component: memcached-results-cache
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: alertmanager
    app.kubernetes.io/version: v0.29.0
    helm.sh/chart: alertmanager-1.28.0
  name: prometheus-alertmanager
  namespace: monitoring
spec:
  ports:
  - name: http
    port: 9093
    protocol: TCP
    targetPort: http
  selector:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/name: alertmanager
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: alertmanager
    app.kubernetes.io/version: v0.29.0
    helm.sh/chart: alertmanager-1.28.0
  name: prometheus-alertmanager-headless
  namespace: monitoring
spec:
  clusterIP: None
  ports:
  - name: http
    port: 9093
    protocol: TCP
    targetPort: http
  selector:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/name: alertmanager
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    prometheus.io/scrape: "true"
  labels:
    app.kubernetes.io/component: metrics
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/version: 2.17.0
    helm.sh/chart: kube-state-metrics-6.4.1
  name: prometheus-kube-state-metrics
  namespace: monitoring
spec:
  ports:
  - name: http
    port: 8080
    protocol: TCP
    targetPort: http
  selector:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/name: kube-state-metrics
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    prometheus.io/scrape: "true"
  labels:
    app.kubernetes.io/component: metrics
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: prometheus-node-exporter
    app.kubernetes.io/part-of: prometheus-node-exporter
    app.kubernetes.io/version: 1.10.2
    helm.sh/chart: prometheus-node-exporter-4.49.1
  name: prometheus-prometheus-node-exporter
  namespace: monitoring
spec:
  ports:
  - name: metrics
    port: 9100
    protocol: TCP
    targetPort: 9100
  selector:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/name: prometheus-node-exporter
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    prometheus.io/probe: pushgateway
  labels:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: prometheus-pushgateway
    app.kubernetes.io/version: v1.11.2
    helm.sh/chart: prometheus-pushgateway-3.4.2
  name: prometheus-prometheus-pushgateway
  namespace: monitoring
spec:
  ports:
  - name: http
    port: 9091
    protocol: TCP
    targetPort: 9091
  selector:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/name: prometheus-pushgateway
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: prometheus
    app.kubernetes.io/version: v3.7.3
    helm.sh/chart: prometheus-27.44.1
  name: prometheus-server
  namespace: monitoring
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 9090
  selector:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/name: prometheus
  sessionAffinity: None
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: tempo
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: tempo
    app.kubernetes.io/version: 2.3.1
    helm.sh/chart: tempo-1.10.1
  name: tempo
  namespace: monitoring
spec:
  ports:
  - name: tempo-prom-metrics
    port: 3100
    targetPort: 3100
  - name: tempo-jaeger-thrift-compact
    port: 6831
    protocol: UDP
    targetPort: 6831
  - name: tempo-jaeger-thrift-binary
    port: 6832
    protocol: UDP
    targetPort: 6832
  - name: tempo-jaeger-thrift-http
    port: 14268
    protocol: TCP
    targetPort: 14268
  - name: grpc-tempo-jaeger
    port: 14250
    protocol: TCP
    targetPort: 14250
  - name: tempo-zipkin
    port: 9411
    protocol: TCP
    targetPort: 9411
  - name: tempo-otlp-legacy
    port: 55680
    protocol: TCP
    targetPort: 55680
  - name: tempo-otlp-http-legacy
    port: 55681
    protocol: TCP
    targetPort: 4318
  - name: grpc-tempo-otlp
    port: 4317
    protocol: TCP
    targetPort: 4317
  - name: tempo-otlp-http
    port: 4318
    protocol: TCP
    targetPort: 4318
  - name: tempo-opencensus
    port: 55678
    protocol: TCP
    targetPort: 55678
  selector:
    app.kubernetes.io/instance: tempo
    app.kubernetes.io/name: tempo
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: auth
  name: auth-events-gateway-local
  namespace: plevion-local
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    component: events-gateway
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: auth
  name: auth-local
  namespace: plevion-local
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    app: auth
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: frontend-admin
  name: frontend-admin-local
  namespace: plevion-local
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 3000
  selector:
    app: frontend-admin
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: frontend-landing
  name: frontend-landing-local
  namespace: plevion-local
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 3000
  selector:
    app: frontend-landing
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-admin
  namespace: plevion-local
spec:
  ports:
  - name: kong-admin
    port: 8001
    protocol: TCP
    targetPort: 8001
  - name: kong-admin-tls
    port: 8444
    protocol: TCP
    targetPort: 8444
  publishNotReadyAddresses: true
  selector:
    app.kubernetes.io/component: app
    app.kubernetes.io/instance: kong
    app.kubernetes.io/name: kong
  type: NodePort
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-manager
  namespace: plevion-local
spec:
  ports:
  - name: kong-manager
    port: 8002
    protocol: TCP
    targetPort: 8002
  - name: kong-manager-tls
    port: 8445
    protocol: TCP
    targetPort: 8445
  selector:
    app.kubernetes.io/component: app
    app.kubernetes.io/instance: kong
    app.kubernetes.io/name: kong
  type: NodePort
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    enable-metrics: "true"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-proxy
  namespace: plevion-local
spec:
  ports:
  - name: stream-udp
    port: 8189
    protocol: UDP
    targetPort: 8189
  - name: proxy
    port: 80
    protocol: TCP
    targetPort: 8000
  - name: proxy-ssl
    port: 443
    protocol: TCP
    targetPort: 8443
  selector:
    app.kubernetes.io/component: app
    app.kubernetes.io/instance: kong
    app.kubernetes.io/name: kong
  type: LoadBalancer
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-validation-webhook
  namespace: plevion-local
spec:
  ports:
  - name: webhook
    port: 443
    protocol: TCP
    targetPort: webhook
  selector:
    app.kubernetes.io/component: app
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: mediamtx
  name: mediamtx-local
  namespace: plevion-local
spec:
  ports:
  - name: rtsp
    nodePort: 30554
    port: 8554
    protocol: TCP
    targetPort: 8554
  - name: http-api
    nodePort: 30888
    port: 8888
    protocol: TCP
    targetPort: 8888
  - name: webrtc
    nodePort: 30889
    port: 8889
    protocol: TCP
    targetPort: 8889
  - name: srt
    nodePort: 30890
    port: 8890
    protocol: UDP
    targetPort: 8890
  - name: udp-stream
    nodePort: 30189
    port: 8189
    protocol: UDP
    targetPort: 8189
  selector:
    app: mediamtx
  type: NodePort
---
apiVersion: v1
kind: Service
metadata:
  name: minio-local
  namespace: plevion-local
spec:
  ports:
  - name: api
    port: 9000
    targetPort: 9000
  - name: console
    port: 9001
    targetPort: 9001
  selector:
    app: minio
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: orchestrator
  name: orchestrator-local
  namespace: plevion-local
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    app: orchestrator
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: postgres
  name: postgres-local
  namespace: plevion-local
spec:
  ports:
  - port: 5432
  selector:
    app: postgres
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    tailscale.com/expose: "true"
    tailscale.com/hostname: rabbitmq
    tailscale.com/tags: tag:k8s-services
  labels:
    app: rabbitmq
  name: rabbitmq-local
  namespace: plevion-local
spec:
  ports:
  - name: amqp
    port: 5672
    targetPort: 5672
  - name: management
    port: 15672
    targetPort: 15672
  selector:
    app: rabbitmq
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    tailscale.com/expose: "true"
    tailscale.com/hostname: redis
    tailscale.com/tags: tag:k8s-services
  labels:
    app: redis
  name: redis-local
  namespace: plevion-local
spec:
  ports:
  - port: 6379
    targetPort: 6379
  selector:
    app: redis
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: sink
  name: sink-broadcast-gateway-local
  namespace: plevion-local
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    component: broadcast-gateway
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: sink
  name: sink-local
  namespace: plevion-local
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    app: sink
  type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: cert-manager
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager
  namespace: cert-manager
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: cert-manager
      app.kubernetes.io/name: cert-manager
  template:
    metadata:
      annotations:
        prometheus.io/path: /metrics
        prometheus.io/port: "9402"
        prometheus.io/scrape: "true"
      labels:
        app: cert-manager
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: cert-manager
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: cert-manager
        app.kubernetes.io/version: v1.19.2
        helm.sh/chart: cert-manager-v1.19.2
    spec:
      containers:
      - args:
        - --v=2
        - --cluster-resource-namespace=$(POD_NAMESPACE)
        - --leader-election-namespace=kube-system
        - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.19.2
        - --max-concurrent-challenges=60
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: quay.io/jetstack/cert-manager-controller:v1.19.2
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 8
          httpGet:
            path: /livez
            port: http-healthz
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 15
        name: cert-manager-controller
        ports:
        - containerPort: 9402
          name: http-metrics
          protocol: TCP
        - containerPort: 9403
          name: http-healthz
          protocol: TCP
        resources:
          limits:
            cpu: 100m
            memory: 128Mi
          requests:
            cpu: 10m
            memory: 32Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
      enableServiceLinks: false
      nodeSelector:
        kubernetes.io/os: linux
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: cert-manager
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: cainjector
    app.kubernetes.io/component: cainjector
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cainjector
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-cainjector
  namespace: cert-manager
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: cainjector
      app.kubernetes.io/instance: cert-manager
      app.kubernetes.io/name: cainjector
  template:
    metadata:
      annotations:
        prometheus.io/path: /metrics
        prometheus.io/port: "9402"
        prometheus.io/scrape: "true"
      labels:
        app: cainjector
        app.kubernetes.io/component: cainjector
        app.kubernetes.io/instance: cert-manager
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: cainjector
        app.kubernetes.io/version: v1.19.2
        helm.sh/chart: cert-manager-v1.19.2
    spec:
      containers:
      - args:
        - --v=2
        - --leader-election-namespace=kube-system
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: quay.io/jetstack/cert-manager-cainjector:v1.19.2
        imagePullPolicy: IfNotPresent
        name: cert-manager-cainjector
        ports:
        - containerPort: 9402
          name: http-metrics
          protocol: TCP
        resources:
          limits:
            cpu: 50m
            memory: 64Mi
          requests:
            cpu: 10m
            memory: 32Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
      enableServiceLinks: false
      nodeSelector:
        kubernetes.io/os: linux
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: cert-manager-cainjector
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: webhook
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: webhook
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-webhook
  namespace: cert-manager
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: webhook
      app.kubernetes.io/instance: cert-manager
      app.kubernetes.io/name: webhook
  template:
    metadata:
      annotations:
        prometheus.io/path: /metrics
        prometheus.io/port: "9402"
        prometheus.io/scrape: "true"
      labels:
        app: webhook
        app.kubernetes.io/component: webhook
        app.kubernetes.io/instance: cert-manager
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: webhook
        app.kubernetes.io/version: v1.19.2
        helm.sh/chart: cert-manager-v1.19.2
    spec:
      containers:
      - args:
        - --v=2
        - --secure-port=10250
        - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
        - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca
        - --dynamic-serving-dns-names=cert-manager-webhook
        - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE)
        - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: quay.io/jetstack/cert-manager-webhook:v1.19.2
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /livez
            port: healthcheck
            scheme: HTTP
          initialDelaySeconds: 60
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: cert-manager-webhook
        ports:
        - containerPort: 10250
          name: https
          protocol: TCP
        - containerPort: 6080
          name: healthcheck
          protocol: TCP
        - containerPort: 9402
          name: http-metrics
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: healthcheck
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 5
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          limits:
            cpu: 50m
            memory: 64Mi
          requests:
            cpu: 10m
            memory: 32Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
      enableServiceLinks: false
      nodeSelector:
        kubernetes.io/os: linux
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: cert-manager-webhook
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-controller
  namespace: metallb-system
spec:
  selector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: metallb
      app.kubernetes.io/name: metallb
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: metallb
        app.kubernetes.io/name: metallb
    spec:
      containers:
      - args:
        - --port=7472
        - --log-level=info
        - --webhook-mode=enabled
        - --tls-min-version=VersionTLS12
        env:
        - name: METALLB_ML_SECRET_NAME
          value: metallb-memberlist
        - name: METALLB_DEPLOYMENT
          value: metallb-controller
        - name: METALLB_BGP_TYPE
          value: frr
        image: quay.io/metallb/controller:v0.15.3
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /metrics
            port: monitoring
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: controller
        ports:
        - containerPort: 7472
          name: monitoring
        - containerPort: 9443
          name: webhook-server
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /metrics
            port: monitoring
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /tmp/k8s-webhook-server/serving-certs
          name: cert
          readOnly: true
      nodeSelector:
        kubernetes.io/os: linux
      securityContext:
        fsGroup: 65534
        runAsNonRoot: true
        runAsUser: 65534
      serviceAccountName: metallb-controller
      terminationGracePeriodSeconds: 0
      volumes:
      - name: cert
        secret:
          defaultMode: 420
          secretName: metallb-webhook-cert
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana
  namespace: monitoring
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/instance: grafana
      app.kubernetes.io/name: grafana
  strategy:
    type: RollingUpdate
  template:
    metadata:
      annotations:
        checksum/config: 70178dcb1c3607ac8ed8d39e59c483d3d431f2ffff95714f9f6728a5c07f1a40
        checksum/sc-dashboard-provider-config: e70bf6a851099d385178a76de9757bb0bef8299da6d8443602590e44f05fdf24
        checksum/secret: bed677784356b2af7fb0d87455db21f077853059b594101a4f6532bfbd962a7f
        kubectl.kubernetes.io/default-container: grafana
      labels:
        app.kubernetes.io/instance: grafana
        app.kubernetes.io/name: grafana
        app.kubernetes.io/version: 12.3.0
        helm.sh/chart: grafana-10.1.5
    spec:
      automountServiceAccountToken: true
      containers:
      - env:
        - name: METHOD
          value: WATCH
        - name: LABEL
          value: grafana_dashboard
        - name: FOLDER
          value: /tmp/dashboards
        - name: RESOURCE
          value: both
        - name: NAMESPACE
          value: monitoring
        - name: REQ_USERNAME
          valueFrom:
            secretKeyRef:
              key: admin-user
              name: grafana
        - name: REQ_PASSWORD
          valueFrom:
            secretKeyRef:
              key: admin-password
              name: grafana
        - name: REQ_URL
          value: http://localhost:3000/api/admin/provisioning/dashboards/reload
        - name: REQ_METHOD
          value: POST
        image: quay.io/kiwigrid/k8s-sidecar:1.30.10
        imagePullPolicy: IfNotPresent
        name: grafana-sc-dashboard
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /tmp/dashboards
          name: sc-dashboard-volume
      - env:
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: GF_SECURITY_ADMIN_USER
          valueFrom:
            secretKeyRef:
              key: admin-user
              name: grafana
        - name: GF_SECURITY_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              key: admin-password
              name: grafana
        - name: GF_PATHS_DATA
          value: /var/lib/grafana/
        - name: GF_PATHS_LOGS
          value: /var/log/grafana
        - name: GF_PATHS_PLUGINS
          value: /var/lib/grafana/plugins
        - name: GF_PATHS_PROVISIONING
          value: /etc/grafana/provisioning
        image: docker.io/grafana/grafana:12.3.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 10
          httpGet:
            path: /api/health
            port: 3000
          initialDelaySeconds: 60
          timeoutSeconds: 30
        name: grafana
        ports:
        - containerPort: 3000
          name: grafana
          protocol: TCP
        - containerPort: 9094
          name: gossip-tcp
          protocol: TCP
        - containerPort: 9094
          name: gossip-udp
          protocol: UDP
        - containerPort: 6060
          name: profiling
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /api/health
            port: 3000
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /etc/grafana/grafana.ini
          name: config
          subPath: grafana.ini
        - mountPath: /var/lib/grafana
          name: storage
        - mountPath: /etc/grafana/provisioning/datasources/datasources.yaml
          name: config
          subPath: datasources.yaml
        - mountPath: /tmp/dashboards
          name: sc-dashboard-volume
        - mountPath: /etc/grafana/provisioning/dashboards/sc-dashboardproviders.yaml
          name: sc-dashboard-provider
          subPath: provider.yaml
      enableServiceLinks: true
      securityContext:
        fsGroup: 472
        runAsGroup: 472
        runAsNonRoot: true
        runAsUser: 472
      serviceAccountName: grafana
      shareProcessNamespace: false
      volumes:
      - configMap:
          name: grafana
        name: config
      - emptyDir: {}
        name: storage
      - emptyDir: {}
        name: sc-dashboard-volume
      - configMap:
          name: grafana-config-dashboards
        name: sc-dashboard-provider
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: metrics
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/version: 2.17.0
    helm.sh/chart: kube-state-metrics-6.4.1
  name: prometheus-kube-state-metrics
  namespace: monitoring
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/instance: prometheus
      app.kubernetes.io/name: kube-state-metrics
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/component: metrics
        app.kubernetes.io/instance: prometheus
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: kube-state-metrics
        app.kubernetes.io/part-of: kube-state-metrics
        app.kubernetes.io/version: 2.17.0
        helm.sh/chart: kube-state-metrics-6.4.1
    spec:
      automountServiceAccountToken: true
      containers:
      - args:
        - --port=8080
        - --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpoints,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            httpHeaders: null
            path: /livez
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        name: kube-state-metrics
        ports:
        - containerPort: 8080
          name: http
        readinessProbe:
          failureThreshold: 3
          httpGet:
            httpHeaders: null
            path: /readyz
            port: 8081
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
      dnsPolicy: ClusterFirst
      hostNetwork: false
      securityContext:
        fsGroup: 65534
        runAsGroup: 65534
        runAsNonRoot: true
        runAsUser: 65534
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: prometheus-kube-state-metrics
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: prometheus-pushgateway
    app.kubernetes.io/version: v1.11.2
    helm.sh/chart: prometheus-pushgateway-3.4.2
  name: prometheus-prometheus-pushgateway
  namespace: monitoring
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: prometheus
      app.kubernetes.io/name: prometheus-pushgateway
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: prometheus
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: prometheus-pushgateway
        app.kubernetes.io/version: v1.11.2
        helm.sh/chart: prometheus-pushgateway-3.4.2
    spec:
      automountServiceAccountToken: true
      containers:
      - image: quay.io/prometheus/pushgateway:v1.11.2
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /-/healthy
            port: 9091
          initialDelaySeconds: 10
          timeoutSeconds: 10
        name: pushgateway
        ports:
        - containerPort: 9091
          name: metrics
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /-/ready
            port: 9091
          initialDelaySeconds: 10
          timeoutSeconds: 10
        volumeMounts:
        - mountPath: /data
          name: storage-volume
          subPath: ""
      securityContext:
        fsGroup: 65534
        runAsNonRoot: true
        runAsUser: 65534
      serviceAccountName: prometheus-prometheus-pushgateway
      volumes:
      - emptyDir: {}
        name: storage-volume
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: prometheus
    app.kubernetes.io/version: v3.7.3
    helm.sh/chart: prometheus-27.44.1
  name: prometheus-server
  namespace: monitoring
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/component: server
      app.kubernetes.io/instance: prometheus
      app.kubernetes.io/name: prometheus
  strategy:
    rollingUpdate: null
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/component: server
        app.kubernetes.io/instance: prometheus
        app.kubernetes.io/name: prometheus
        app.kubernetes.io/part-of: prometheus
        app.kubernetes.io/version: v3.7.3
        helm.sh/chart: prometheus-27.44.1
    spec:
      containers:
      - args:
        - --watched-dir=/etc/config
        - --listen-address=0.0.0.0:8080
        - --reload-url=http://127.0.0.1:9090/-/reload
        image: quay.io/prometheus-operator/prometheus-config-reloader:v0.86.2
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /healthz
            port: metrics
            scheme: HTTP
          initialDelaySeconds: 2
          periodSeconds: 10
        name: prometheus-server-configmap-reload
        ports:
        - containerPort: 8080
          name: metrics
        readinessProbe:
          httpGet:
            path: /healthz
            port: metrics
            scheme: HTTP
          periodSeconds: 10
        volumeMounts:
        - mountPath: /etc/config
          name: config-volume
          readOnly: true
      - args:
        - --storage.tsdb.retention.time=15d
        - --config.file=/etc/config/prometheus.yml
        - --storage.tsdb.path=/data
        - --web.console.libraries=/etc/prometheus/console_libraries
        - --web.console.templates=/etc/prometheus/consoles
        - --web.enable-lifecycle
        image: quay.io/prometheus/prometheus:v3.7.3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /-/healthy
            port: 9090
            scheme: HTTP
          initialDelaySeconds: 30
          periodSeconds: 15
          successThreshold: 1
          timeoutSeconds: 10
        name: prometheus-server
        ports:
        - containerPort: 9090
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /-/ready
            port: 9090
            scheme: HTTP
          initialDelaySeconds: 30
          periodSeconds: 5
          successThreshold: 1
          timeoutSeconds: 4
        volumeMounts:
        - mountPath: /etc/config
          name: config-volume
        - mountPath: /data
          name: storage-volume
          subPath: ""
      dnsPolicy: ClusterFirst
      enableServiceLinks: true
      securityContext:
        fsGroup: 65534
        runAsGroup: 65534
        runAsNonRoot: true
        runAsUser: 65534
      serviceAccountName: prometheus-server
      terminationGracePeriodSeconds: 300
      volumes:
      - configMap:
          name: prometheus-server
        name: config-volume
      - emptyDir: {}
        name: storage-volume
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: auth
    component: events-gateway
  name: auth-events-gateway-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      component: events-gateway
  template:
    metadata:
      labels:
        component: events-gateway
    spec:
      containers:
      - args:
        - --timeout
        - "120"
        - --threads
        - "2"
        - --workers
        - "3"
        - --bind
        - 0.0.0.0:8080
        - --access-logfile
        - '-'
        - --limit-request-field_size
        - "16384"
        - --worker-class
        - uvicorn.workers.UvicornWorker
        - settings.asgi
        command:
        - opentelemetry-instrument
        - gunicorn
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        envFrom:
        - secretRef:
            name: auth-secrets
        image: ghcr.io/plevion-dev/auth:v0.0.71-4800ec9
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /_healthz/
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 30
        name: auth-events-gateway
        ports:
        - containerPort: 8080
          name: http
        resources:
          limits:
            memory: 512Mi
          requests:
            cpu: 100m
            memory: 128Mi
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: auth-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: auth-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: auth-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: auth
  name: auth-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: auth
  template:
    metadata:
      labels:
        app: auth
    spec:
      containers:
      - args:
        - --reload
        - --timeout
        - "120"
        - --threads
        - "2"
        - --workers
        - "3"
        - --bind
        - 0.0.0.0:8080
        - --access-logfile
        - '-'
        - --limit-request-field_size
        - "16384"
        - settings.wsgi
        command:
        - opentelemetry-instrument
        - gunicorn
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        envFrom:
        - secretRef:
            name: auth-secrets
        image: ghcr.io/plevion-dev/auth:v0.0.71-4800ec9
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
            path: /_healthz/
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 30
        name: auth
        ports:
        - containerPort: 8080
          name: http
        resources:
          limits:
            memory: 512Mi
          requests:
            cpu: 100m
            memory: 128Mi
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - args:
        - |
          python src/manage.py migrate && \
          python src/manage.py fixturing
        command:
        - /bin/sh
        - -c
        envFrom:
        - secretRef:
            name: auth-secrets
        image: ghcr.io/plevion-dev/auth:v0.0.71-4800ec9
        imagePullPolicy: IfNotPresent
        name: run-migrations
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: auth-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: auth-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: auth-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: edge-controller
  name: edge-controller-worker-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: edge-controller-worker
  template:
    metadata:
      labels:
        app: edge-controller-worker
        component: worker
    spec:
      containers:
      - args:
        - -A
        - settings
        - worker
        - -l
        - info
        - -E
        - -I
        - apps.common.worker.heartbeat
        - --hostname
        - $(CONTROLLER_ID)@%h
        - --concurrency
        - "1"
        command:
        - celery
        env:
        - name: CONTROLLER_ID
          value: b7289a9f-bd55-4e0f-87f2-3168b59f576c
        - name: CONTAINER_BACKEND
          value: kubernetes
        - name: K8S_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: K8S_IMAGE_PULL_SECRET
          value: ghcr-registry-secret
        - name: STREAM_AUTH_URL
          value: http://api.local.plevion.com/public/v1/orchestrator/controllers/{0}/auth/
        - name: STREAM_CONTAINER_IMAGE
          value: ghcr.io/plevion-dev/edge-controller:latest
        - name: STREAM_DEVICE_MOUNT
          value: /dev/video0:/dev/video0,/dev/snd:/dev/snd
        - name: STREAM_DEVICE_INDEX
          value: "0"
        - name: XDG_RUNTIME_DIR
          value: /run/user/1000
        - name: PULSE_SERVER
          value: unix:/run/user/1000/pulse/native
        envFrom:
        - secretRef:
            name: edge-controller-secrets
        image: ghcr.io/plevion-dev/edge-controller:latest
        imagePullPolicy: Always
        livenessProbe:
          exec:
            command:
            - sh
            - -c
            - if [ $(($(date +%s) - $(stat -c %Y /tmp/worker_heartbeat))) -lt 60 ];
              then exit 0; else exit 1; fi
          failureThreshold: 3
          initialDelaySeconds: 30
          periodSeconds: 60
        name: worker
        resources:
          limits:
            cpu: "1"
            memory: 512Mi
          requests:
            cpu: 200m
            memory: 256Mi
        workingDir: /app/src
      hostAliases:
      - hostnames:
        - api.local.plevion.com
        ip: 10.152.183.32
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: edge-controller-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: edge-controller-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
      serviceAccountName: edge-controller-sa-local
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: frontend-admin
  name: frontend-admin-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: frontend-admin
  template:
    metadata:
      labels:
        app: frontend-admin
    spec:
      containers:
      - env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        envFrom:
        - secretRef:
            name: admin-secrets
        image: ghcr.io/plevion-dev/frontend-admin:latest
        name: frontend-admin
        ports:
        - containerPort: 3000
        resources:
          limits:
            cpu: 500m
            memory: 512Mi
          requests:
            cpu: 250m
            memory: 256Mi
      imagePullSecrets:
      - name: ghcr-registry-secret
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: frontend-landing
  name: frontend-landing-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: frontend-landing
  template:
    metadata:
      labels:
        app: frontend-landing
    spec:
      containers:
      - env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        envFrom:
        - secretRef:
            name: landing-secrets
        image: ghcr.io/plevion-dev/frontend-landing:latest
        name: frontend-landing
        ports:
        - containerPort: 3000
        resources:
          limits:
            cpu: 500m
            memory: 512Mi
          requests:
            cpu: 250m
            memory: 256Mi
      imagePullSecrets:
      - name: ghcr-registry-secret
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: app
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: app
      app.kubernetes.io/instance: kong
      app.kubernetes.io/name: kong
  template:
    metadata:
      annotations:
        kuma.io/gateway: enabled
        kuma.io/service-account-token-volume: kong-kong-token
        traffic.sidecar.istio.io/includeInboundPorts: ""
      labels:
        app: kong-kong
        app.kubernetes.io/component: app
        app.kubernetes.io/instance: kong
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: kong
        app.kubernetes.io/version: "3.5"
        helm.sh/chart: kong-2.36.0
        version: "3.5"
    spec:
      automountServiceAccountToken: false
      containers:
      - env:
        - name: KONG_ADMIN_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_ADMIN_ERROR_LOG
          value: /dev/stderr
        - name: KONG_ADMIN_GUI_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_ADMIN_GUI_ERROR_LOG
          value: /dev/stderr
        - name: KONG_ADMIN_LISTEN
          value: 0.0.0.0:8001, [::]:8001, 0.0.0.0:8444 http2 ssl, [::]:8444 http2
            ssl
        - name: KONG_CLUSTER_LISTEN
          value: "off"
        - name: KONG_DATABASE
          value: "off"
        - name: KONG_KIC
          value: "on"
        - name: KONG_LUA_PACKAGE_PATH
          value: /opt/?.lua;/opt/?/init.lua;;
        - name: KONG_NGINX_WORKER_PROCESSES
          value: "2"
        - name: KONG_PORTAL_API_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_PORTAL_API_ERROR_LOG
          value: /dev/stderr
        - name: KONG_PORT_MAPS
          value: 80:8000, 443:8443
        - name: KONG_PREFIX
          value: /kong_prefix/
        - name: KONG_PROXY_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_PROXY_ERROR_LOG
          value: /dev/stderr
        - name: KONG_PROXY_LISTEN
          value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2
            ssl
        - name: KONG_PROXY_STREAM_ACCESS_LOG
          value: /dev/stdout basic
        - name: KONG_PROXY_STREAM_ERROR_LOG
          value: /dev/stderr
        - name: KONG_ROUTER_FLAVOR
          value: traditional
        - name: KONG_STATUS_ACCESS_LOG
          value: "off"
        - name: KONG_STATUS_ERROR_LOG
          value: /dev/stderr
        - name: KONG_STATUS_LISTEN
          value: 0.0.0.0:8100, [::]:8100
        - name: KONG_STREAM_LISTEN
          value: "off"
        - name: KONG_NGINX_DAEMON
          value: "off"
        envFrom:
        - secretRef:
            name: kong-secrets
        image: ghcr.io/plevion-dev/kong:latest
        imagePullPolicy: IfNotPresent
        lifecycle:
          preStop:
            exec:
              command:
              - kong
              - quit
              - --wait=15
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /status
            port: status
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        name: proxy
        ports:
        - containerPort: 8001
          name: admin
          protocol: TCP
        - containerPort: 8444
          name: admin-tls
          protocol: TCP
        - containerPort: 8000
          name: proxy
          protocol: TCP
        - containerPort: 8443
          name: proxy-tls
          protocol: TCP
        - containerPort: 8100
          name: status
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /status/ready
            port: status
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        resources:
          limits:
            cpu: 2000m
            memory: 2Gi
          requests:
            cpu: 500m
            memory: 512Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /kong_prefix/
          name: kong-kong-prefix-dir
        - mountPath: /tmp
          name: kong-kong-tmp
      - env:
        - name: CONTROLLER_KONG_ADMIN_SVC
          value: plevion-local/kong-kong-admin
        - name: CONTROLLER_PUBLISH_SERVICE
          value: plevion-local/kong-kong-proxy
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CONTROLLER_ADMISSION_WEBHOOK_LISTEN
          value: 0.0.0.0:8080
        - name: CONTROLLER_ELECTION_ID
          value: kong-ingress-controller-leader-kong
        - name: CONTROLLER_INGRESS_CLASS
          value: kong
        - name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY
          value: "true"
        - name: CONTROLLER_KONG_ADMIN_URL
          value: https://localhost:8444
        image: kong/kubernetes-ingress-controller:3.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 18
          httpGet:
            path: /readyz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        name: ingress-controller
        ports:
        - containerPort: 8080
          name: webhook
          protocol: TCP
        - containerPort: 10255
          name: cmetrics
          protocol: TCP
        - containerPort: 10254
          name: status
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /readyz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /admission-webhook
          name: webhook-cert
          readOnly: true
        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          name: kong-kong-token
          readOnly: true
      hostNetwork: false
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - rm
        - -vrf
        - $KONG_PREFIX/pids
        env:
        - name: KONG_ADMIN_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_ADMIN_ERROR_LOG
          value: /dev/stderr
        - name: KONG_ADMIN_GUI_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_ADMIN_GUI_ERROR_LOG
          value: /dev/stderr
        - name: KONG_ADMIN_LISTEN
          value: 0.0.0.0:8001, [::]:8001, 0.0.0.0:8444 http2 ssl, [::]:8444 http2
            ssl
        - name: KONG_CLUSTER_LISTEN
          value: "off"
        - name: KONG_DATABASE
          value: "off"
        - name: KONG_KIC
          value: "on"
        - name: KONG_LUA_PACKAGE_PATH
          value: /opt/?.lua;/opt/?/init.lua;;
        - name: KONG_NGINX_WORKER_PROCESSES
          value: "2"
        - name: KONG_PORTAL_API_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_PORTAL_API_ERROR_LOG
          value: /dev/stderr
        - name: KONG_PORT_MAPS
          value: 80:8000, 443:8443
        - name: KONG_PREFIX
          value: /kong_prefix/
        - name: KONG_PROXY_ACCESS_LOG
          value: /dev/stdout
        - name: KONG_PROXY_ERROR_LOG
          value: /dev/stderr
        - name: KONG_PROXY_LISTEN
          value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2
            ssl
        - name: KONG_PROXY_STREAM_ACCESS_LOG
          value: /dev/stdout basic
        - name: KONG_PROXY_STREAM_ERROR_LOG
          value: /dev/stderr
        - name: KONG_ROUTER_FLAVOR
          value: traditional
        - name: KONG_STATUS_ACCESS_LOG
          value: "off"
        - name: KONG_STATUS_ERROR_LOG
          value: /dev/stderr
        - name: KONG_STATUS_LISTEN
          value: 0.0.0.0:8100, [::]:8100
        - name: KONG_STREAM_LISTEN
          value: "off"
        image: ghcr.io/plevion-dev/kong:latest
        imagePullPolicy: IfNotPresent
        name: clear-stale-pid
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /kong_prefix/
          name: kong-kong-prefix-dir
        - mountPath: /tmp
          name: kong-kong-tmp
      securityContext: {}
      serviceAccountName: kong-kong
      terminationGracePeriodSeconds: 30
      volumes:
      - emptyDir:
          sizeLimit: 256Mi
        name: kong-kong-prefix-dir
      - emptyDir:
          sizeLimit: 1Gi
        name: kong-kong-tmp
      - name: kong-kong-token
        projected:
          sources:
          - serviceAccountToken:
              expirationSeconds: 3607
              path: token
          - configMap:
              items:
              - key: ca.crt
                path: ca.crt
              name: kube-root-ca.crt
          - downwardAPI:
              items:
              - fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
                path: namespace
      - name: webhook-cert
        secret:
          secretName: kong-kong-validation-webhook-keypair
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: mediamtx
  name: mediamtx-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mediamtx
  template:
    metadata:
      labels:
        app: mediamtx
    spec:
      containers:
      - image: ghcr.io/plevion-dev/authmtx:latest
        imagePullPolicy: Always
        name: authmtx
        ports:
        - containerPort: 8080
          name: authmtx-http
        volumeMounts:
        - mountPath: /authmtx.yml
          name: authmtx-config
          subPath: authmtx.yml
      - image: ghcr.io/plevion-dev/mediamtx:latest
        imagePullPolicy: Always
        name: mediamtx
        ports:
        - containerPort: 8554
        - containerPort: 1935
        - containerPort: 8888
        - containerPort: 8889
        - containerPort: 8189
          protocol: UDP
        volumeMounts:
        - mountPath: /mediamtx.yml
          name: config
          subPath: mediamtx.yml
      imagePullSecrets:
      - name: ghcr-registry-secret
      volumes:
      - configMap:
          name: mediamtx-config-local-gk79kkc942
        name: config
      - configMap:
          name: authmtx-config-local-dm99t88c4b
        name: authmtx-config
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: minio-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: minio
  template:
    metadata:
      labels:
        app: minio
    spec:
      containers:
      - args:
        - server
        - /data
        - --console-address
        - :9001
        envFrom:
        - secretRef:
            name: minio-secrets
        image: minio/minio:RELEASE.2025-04-22T22-12-26Z
        livenessProbe:
          httpGet:
            path: /minio/health/live
            port: 9000
          initialDelaySeconds: 10
          periodSeconds: 30
        name: minio
        ports:
        - containerPort: 9000
          name: api
        - containerPort: 9001
          name: console
        volumeMounts:
        - mountPath: /data
          name: data
      volumes:
      - emptyDir: {}
        name: data
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: orchestrator
  name: orchestrator-cqrs-worker-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: orchestrator-cqrs-worker
  template:
    metadata:
      labels:
        app: orchestrator-cqrs-worker
        component: cqrs-worker
    spec:
      containers:
      - args:
        - python
        - manage.py
        - cqrs_consume
        command:
        - opentelemetry-instrument
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: orchestrator-cqrs-worker
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: ghcr.io/plevion-dev/orchestrator:v0.0.81-bfa5a93
        imagePullPolicy: IfNotPresent
        name: cqrs-worker
        resources:
          limits:
            cpu: 500m
            memory: 512Mi
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: orchestrator
  name: orchestrator-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: orchestrator
  template:
    metadata:
      labels:
        app: orchestrator
    spec:
      containers:
      - args:
        - --reload
        - --timeout
        - "120"
        - --threads
        - "2"
        - --workers
        - "3"
        - --bind
        - 0.0.0.0:8080
        - --access-logfile
        - '-'
        - --limit-request-field_size
        - "16384"
        - settings.wsgi
        command:
        - opentelemetry-instrument
        - gunicorn
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: MEDIA_MTX_RTSP_URL
          value: rtsp://mediamtx-local.plevion-local:8554/
        - name: MEDIA_MTX_SRT_URL
          value: srt://mediamtx-local.plevion-local:8890
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: ghcr.io/plevion-dev/orchestrator:v0.0.81-bfa5a93
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
            path: /_healthz/
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 30
        name: orchestrator
        ports:
        - containerPort: 8080
          name: http
        resources:
          limits:
            cpu: 500m
            memory: 512Mi
          requests:
            cpu: 100m
            memory: 128Mi
      hostAliases:
      - hostnames:
        - api.local.plevion.com
        ip: 10.152.183.32
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - args:
        - |
          python src/manage.py migrate && \
          python src/manage.py fixturing
        command:
        - /bin/sh
        - -c
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: ghcr.io/plevion-dev/orchestrator:v0.0.81-bfa5a93
        imagePullPolicy: IfNotPresent
        name: run-migrations
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: orchestrator
  name: orchestrator-monitor-controllers-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: orchestrator-monitor-controllers
  template:
    metadata:
      labels:
        app: orchestrator-monitor-controllers
        component: monitor
    spec:
      containers:
      - args:
        - python
        - manage.py
        - monitor_controllers
        command:
        - opentelemetry-instrument
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: orchestrator-monitor-controllers
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: ghcr.io/plevion-dev/orchestrator:v0.0.81-bfa5a93
        imagePullPolicy: Always
        name: monitor
        resources:
          limits:
            cpu: 500m
            memory: 512Mi
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-redis
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: orchestrator
  name: orchestrator-worker-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: orchestrator-worker
  template:
    metadata:
      labels:
        app: orchestrator-worker
        component: worker
    spec:
      containers:
      - args:
        - -A
        - settings
        - worker
        - -E
        - -l
        - info
        - -I
        - apps.common.worker.heartbeat
        - --hostname
        - orchestrator-worker@%h
        command:
        - opentelemetry-instrument
        - celery
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: orchestrator-worker
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: ghcr.io/plevion-dev/orchestrator:v0.0.81-bfa5a93
        imagePullPolicy: Always
        livenessProbe:
          exec:
            command:
            - /bin/sh
            - -c
            - if [ $(($(date +%s) - $(stat -c %Y /tmp/worker_heartbeat))) -lt 60 ];
              then exit 0; else exit 1; fi
          initialDelaySeconds: 30
          periodSeconds: 60
          timeoutSeconds: 5
        name: worker
        resources:
          limits:
            cpu: 1000m
            memory: 2Gi
          requests:
            cpu: 250m
            memory: 512Mi
        volumeMounts:
        - mountPath: /var/lib/tailscale
          name: tailscale-state
        workingDir: /app/src
      - env:
        - name: TS_AUTHKEY
          valueFrom:
            secretKeyRef:
              key: TAILSCALE_AUTH_KEY
              name: orchestrator-secrets
        - name: TS_HOSTNAME
          value: orchestrator-worker
        - name: TS_USERSPACE
          value: "false"
        - name: TS_STATE_DIR
          value: /var/lib/tailscale
        - name: TS_ACCEPT_DNS
          value: "true"
        image: tailscale/tailscale:latest
        imagePullPolicy: Always
        name: tailscaled
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
        volumeMounts:
        - mountPath: /var/lib/tailscale
          name: tailscale-state
      dnsConfig:
        nameservers:
        - 100.100.100.100
        - 8.8.8.8
        searches:
        - default.svc.cluster.local
        - svc.cluster.local
        - cluster.local
      hostAliases:
      - hostnames:
        - api.local.plevion.com
        ip: 10.152.183.32
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: orchestrator-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
      serviceAccountName: orchestrator-worker-sa-local
      volumes:
      - emptyDir: {}
        name: tailscale-state
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: postgres
  name: postgres-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
      - envFrom:
        - secretRef:
            name: postgres-secrets
        image: postgres:15
        livenessProbe:
          exec:
            command:
            - pg_isready
            - -U
            - postgres
          initialDelaySeconds: 10
          periodSeconds: 30
        name: postgres
        ports:
        - containerPort: 5432
        volumeMounts:
        - mountPath: /docker-entrypoint-initdb.d
          name: init-scripts
      volumes:
      - configMap:
          name: postgres-init-scripts-local
        name: init-scripts
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: rabbitmq
  name: rabbitmq-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: rabbitmq
  template:
    metadata:
      labels:
        app: rabbitmq
    spec:
      containers:
      - envFrom:
        - secretRef:
            name: rabbitmq-secrets
        image: rabbitmq:3-management
        livenessProbe:
          exec:
            command:
            - rabbitmq-diagnostics
            - ping
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 10
        name: rabbitmq
        ports:
        - containerPort: 5672
        - containerPort: 15672
        resources:
          limits:
            cpu: 500m
            memory: 512Mi
          requests:
            cpu: 100m
            memory: 256Mi
        volumeMounts:
        - mountPath: /etc/rabbitmq/rabbitmq.conf
          name: config-volume
          subPath: rabbitmq.conf
        - mountPath: /etc/rabbitmq/definitions.json
          name: definitions-volume
          subPath: definitions.json
      volumes:
      - configMap:
          name: rabbitmq-config-local
        name: config-volume
      - configMap:
          name: rabbitmq-definitions-local-t4gcbb6kdb
        name: definitions-volume
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: redis
  name: redis-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
    spec:
      containers:
      - args:
        - --requirepass
        - $(REDIS_PASSWORD)
        envFrom:
        - secretRef:
            name: redis-secrets
        image: redis:latest
        livenessProbe:
          exec:
            command:
            - redis-cli
            - ping
          initialDelaySeconds: 10
          periodSeconds: 30
        name: redis
        ports:
        - containerPort: 6379
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sink
    component: broadcast-gateway
  name: sink-broadcast-gateway-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      component: broadcast-gateway
  template:
    metadata:
      labels:
        component: broadcast-gateway
    spec:
      containers:
      - args:
        - --timeout
        - "120"
        - --workers
        - "2"
        - --worker-class
        - uvicorn.workers.UvicornWorker
        - --bind
        - 0.0.0.0:8080
        - --access-logfile
        - '-'
        - --error-logfile
        - '-'
        - --limit-request-field_size
        - "16384"
        - --pythonpath
        - /app/src
        - settings.asgi
        command:
        - gunicorn
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink:v0.0.187-c9d5825
        imagePullPolicy: Always
        name: sink-broadcast-gateway
        ports:
        - containerPort: 8080
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sink
  name: sink-capturer-worker-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      component: sink-capturer-worker
  template:
    metadata:
      labels:
        component: sink-capturer-worker
    spec:
      containers:
      - args:
        - -A
        - settings
        - worker
        - -E
        - -l
        - info
        - --hostname
        - sink-capturer-worker@%h
        - -Q
        - capturer
        - -I
        - apps.common.worker.heartbeat
        - --pool=threads
        - --concurrency=16
        command:
        - opentelemetry-instrument
        - celery
        env:
        - name: MY_POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: sink-capturer-worker
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink-capturer:v0.0.187-c9d5825
        imagePullPolicy: Always
        livenessProbe:
          exec:
            command:
            - /bin/sh
            - -c
            - if [ $(($(date +%s) - $(stat -c %Y /tmp/worker_heartbeat))) -lt 60 ];
              then exit 0; else exit 1; fi
          initialDelaySeconds: 30
          periodSeconds: 60
          timeoutSeconds: 5
        name: sink-capturer-worker
        resources:
          limits:
            cpu: "4"
            memory: 4Gi
          requests:
            cpu: 500m
            memory: 2Gi
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sink
  name: sink-cqrs-worker-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sink-cqrs-worker
  template:
    metadata:
      labels:
        app: sink-cqrs-worker
        component: cqrs-worker
    spec:
      containers:
      - command:
        - uv
        - run
        - python
        - manage.py
        - cqrs_consume
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: sink-cqrs-worker
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink:v0.0.187-c9d5825
        imagePullPolicy: Always
        name: cqrs-worker
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sink
  name: sink-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sink
  template:
    metadata:
      labels:
        app: sink
    spec:
      containers:
      - args:
        - --timeout
        - "120"
        - --workers
        - "4"
        - --bind
        - 0.0.0.0:8080
        - --access-logfile
        - '-'
        - --error-logfile
        - '-'
        - --limit-request-field_size
        - "16384"
        - --pythonpath
        - /app/src
        - settings.wsgi
        command:
        - opentelemetry-instrument
        - gunicorn
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: sink
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink:v0.0.187-c9d5825
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
            path: /_healthz/
            port: 8080
          initialDelaySeconds: 20
          periodSeconds: 30
        name: sink
        ports:
        - containerPort: 8080
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - args:
        - |
          uv run python src/manage.py migrate && \
          uv run python src/manage.py fixturing
        command:
        - /bin/sh
        - -c
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink:v0.0.187-c9d5825
        imagePullPolicy: IfNotPresent
        name: run-migrations
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
      - command:
        - uv
        - run
        - python
        - manage.py
        - migrate
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink:v0.0.187-c9d5825
        imagePullPolicy: IfNotPresent
        name: migrate
        workingDir: /app/src
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sink
    component: worker
  name: sink-worker-local
  namespace: plevion-local
spec:
  replicas: 1
  selector:
    matchLabels:
      component: sink-worker
  template:
    metadata:
      labels:
        component: sink-worker
    spec:
      containers:
      - args:
        - -A
        - settings
        - worker
        - -E
        - -l
        - info
        - --hostname
        - sink-worker@%h
        - -I
        - apps.common.worker.heartbeat
        - --concurrency=4
        command:
        - opentelemetry-instrument
        - celery
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://$(HOST_IP):4317
        - name: OTEL_SERVICE_NAME
          value: sink-worker
        envFrom:
        - secretRef:
            name: sink-secrets
        image: ghcr.io/plevion-dev/sink:v0.0.187-c9d5825
        imagePullPolicy: Always
        livenessProbe:
          exec:
            command:
            - /bin/sh
            - -c
            - if [ $(($(date +%s) - $(stat -c %Y /tmp/worker_heartbeat))) -lt 60 ];
              then exit 0; else exit 1; fi
          initialDelaySeconds: 30
          periodSeconds: 60
          timeoutSeconds: 5
        name: sink-worker
        resources:
          limits:
            cpu: "6"
            memory: 6Gi
          requests:
            cpu: 500m
            memory: 1Gi
        workingDir: /app/src
      imagePullSecrets:
      - name: ghcr-registry-secret
      initContainers:
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $DB_HOST 5432; do echo "Waiting for Postgres..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-postgres
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $REDIS_HOST 6379; do echo "Waiting for Redis..."; sleep
          2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-redis
      - command:
        - sh
        - -c
        - until nc -z -v -w30 $RABBITMQ_HOST 5672; do echo "Waiting for RabbitMQ...";
          sleep 2; done
        envFrom:
        - secretRef:
            name: sink-secrets
        image: busybox:1.36
        name: wait-for-rabbitmq
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: operator
  namespace: tailscale
spec:
  replicas: 1
  selector:
    matchLabels:
      app: operator
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: operator
    spec:
      containers:
      - env:
        - name: OPERATOR_INITIAL_TAGS
          value: tag:k8s-operator
        - name: OPERATOR_HOSTNAME
          value: tailscale-operator
        - name: OPERATOR_SECRET
          value: operator
        - name: OPERATOR_LOGGING
          value: info
        - name: OPERATOR_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: OPERATOR_LOGIN_SERVER
          value: null
        - name: OPERATOR_INGRESS_CLASS_NAME
          value: tailscale
        - name: CLIENT_ID_FILE
          value: /oauth/client_id
        - name: CLIENT_SECRET_FILE
          value: /oauth/client_secret
        - name: PROXY_IMAGE
          value: tailscale/tailscale:v1.90.9
        - name: PROXY_TAGS
          value: tag:k8s
        - name: APISERVER_PROXY
          value: "false"
        - name: PROXY_FIREWALL_MODE
          value: auto
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_UID
          valueFrom:
            fieldRef:
              fieldPath: metadata.uid
        image: tailscale/k8s-operator:v1.90.9
        imagePullPolicy: Always
        name: operator
        volumeMounts:
        - mountPath: /oauth
          name: oauth
          readOnly: true
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: operator
      volumes:
      - name: oauth
        secret:
          secretName: operator-oauth
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app.kubernetes.io/component: single-binary
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/part-of: memberlist
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki
  namespace: monitoring
spec:
  podManagementPolicy: Parallel
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/component: single-binary
      app.kubernetes.io/instance: loki
      app.kubernetes.io/name: loki
  serviceName: loki-headless
  template:
    metadata:
      annotations:
        checksum/config: a839eccb39e88556569baa308b23e65201c6697d686965e80adf8db9ef12e108
        kubectl.kubernetes.io/default-container: loki
      labels:
        app.kubernetes.io/component: single-binary
        app.kubernetes.io/instance: loki
        app.kubernetes.io/name: loki
        app.kubernetes.io/part-of: memberlist
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/component: single-binary
                app.kubernetes.io/instance: loki
                app.kubernetes.io/name: loki
            topologyKey: kubernetes.io/hostname
      automountServiceAccountToken: true
      containers:
      - args:
        - -config.file=/etc/loki/config/config.yaml
        - -target=all
        image: docker.io/grafana/loki:3.5.5
        imagePullPolicy: IfNotPresent
        name: loki
        ports:
        - containerPort: 3100
          name: http-metrics
          protocol: TCP
        - containerPort: 9095
          name: grpc
          protocol: TCP
        - containerPort: 7946
          name: http-memberlist
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /ready
            port: http-metrics
          initialDelaySeconds: 30
          timeoutSeconds: 1
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: false
        volumeMounts:
        - mountPath: /tmp
          name: tmp
        - mountPath: /etc/loki/config
          name: config
        - mountPath: /etc/loki/runtime-config
          name: runtime-config
        - mountPath: /rules
          name: sc-rules-volume
        - mountPath: /var/loki
          name: loki-storage
      - env:
        - name: METHOD
          value: WATCH
        - name: LABEL
          value: loki_rule
        - name: FOLDER
          value: /rules
        - name: RESOURCE
          value: both
        - name: WATCH_SERVER_TIMEOUT
          value: "60"
        - name: WATCH_CLIENT_TIMEOUT
          value: "60"
        - name: LOG_LEVEL
          value: INFO
        image: docker.io/kiwigrid/k8s-sidecar:1.30.10
        imagePullPolicy: IfNotPresent
        name: loki-sc-rules
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /rules
          name: sc-rules-volume
      enableServiceLinks: true
      securityContext:
        fsGroup: 10001
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
      serviceAccountName: loki
      terminationGracePeriodSeconds: 30
      volumes:
      - emptyDir: {}
        name: tmp
      - configMap:
          items:
          - key: config.yaml
            path: config.yaml
          name: loki
        name: config
      - configMap:
          name: loki-runtime
        name: runtime-config
      - emptyDir: {}
        name: sc-rules-volume
      - emptyDir: {}
        name: loki-storage
  updateStrategy:
    rollingUpdate:
      partition: 0
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app.kubernetes.io/component: memcached-chunks-cache
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
    name: memcached-chunks-cache
  name: loki-chunks-cache
  namespace: monitoring
spec:
  podManagementPolicy: Parallel
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: memcached-chunks-cache
      app.kubernetes.io/instance: loki
      app.kubernetes.io/name: loki
      name: memcached-chunks-cache
  serviceName: loki-chunks-cache
  template:
    metadata:
      annotations: null
      labels:
        app.kubernetes.io/component: memcached-chunks-cache
        app.kubernetes.io/instance: loki
        app.kubernetes.io/name: loki
        name: memcached-chunks-cache
    spec:
      affinity: {}
      containers:
      - args:
        - -m 8192
        - --extended=modern,track_sizes
        - -I 5m
        - -c 16384
        - -v
        - -u 11211
        env: null
        envFrom: null
        image: memcached:1.6.39-alpine
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          initialDelaySeconds: 30
          periodSeconds: 10
          tcpSocket:
            port: client
          timeoutSeconds: 5
        name: memcached
        ports:
        - containerPort: 11211
          name: client
        readinessProbe:
          failureThreshold: 6
          initialDelaySeconds: 5
          periodSeconds: 5
          tcpSocket:
            port: client
          timeoutSeconds: 3
        resources:
          limits:
            memory: 9830Mi
          requests:
            cpu: 500m
            memory: 9830Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
      - args:
        - --memcached.address=localhost:11211
        - --web.listen-address=0.0.0.0:9150
        image: prom/memcached-exporter:v0.15.3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /metrics
            port: http-metrics
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
        name: exporter
        ports:
        - containerPort: 9150
          name: http-metrics
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /metrics
            port: http-metrics
          initialDelaySeconds: 5
          periodSeconds: 5
          timeoutSeconds: 3
        resources:
          limits: {}
          requests: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
      initContainers: []
      nodeSelector: {}
      securityContext:
        fsGroup: 11211
        runAsGroup: 11211
        runAsNonRoot: true
        runAsUser: 11211
      serviceAccountName: loki
      terminationGracePeriodSeconds: 60
      tolerations: []
      topologySpreadConstraints: []
  updateStrategy:
    type: RollingUpdate
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app.kubernetes.io/component: memcached-results-cache
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
    name: memcached-results-cache
  name: loki-results-cache
  namespace: monitoring
spec:
  podManagementPolicy: Parallel
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: memcached-results-cache
      app.kubernetes.io/instance: loki
      app.kubernetes.io/name: loki
      name: memcached-results-cache
  serviceName: loki-results-cache
  template:
    metadata:
      annotations: null
      labels:
        app.kubernetes.io/component: memcached-results-cache
        app.kubernetes.io/instance: loki
        app.kubernetes.io/name: loki
        name: memcached-results-cache
    spec:
      affinity: {}
      containers:
      - args:
        - -m 1024
        - --extended=modern,track_sizes
        - -I 5m
        - -c 16384
        - -v
        - -u 11211
        env: null
        envFrom: null
        image: memcached:1.6.39-alpine
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          initialDelaySeconds: 30
          periodSeconds: 10
          tcpSocket:
            port: client
          timeoutSeconds: 5
        name: memcached
        ports:
        - containerPort: 11211
          name: client
        readinessProbe:
          failureThreshold: 6
          initialDelaySeconds: 5
          periodSeconds: 5
          tcpSocket:
            port: client
          timeoutSeconds: 3
        resources:
          limits:
            memory: 1229Mi
          requests:
            cpu: 500m
            memory: 1229Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
      - args:
        - --memcached.address=localhost:11211
        - --web.listen-address=0.0.0.0:9150
        image: prom/memcached-exporter:v0.15.3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /metrics
            port: http-metrics
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
        name: exporter
        ports:
        - containerPort: 9150
          name: http-metrics
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /metrics
            port: http-metrics
          initialDelaySeconds: 5
          periodSeconds: 5
          timeoutSeconds: 3
        resources:
          limits: {}
          requests: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
      initContainers: []
      nodeSelector: {}
      securityContext:
        fsGroup: 11211
        runAsGroup: 11211
        runAsNonRoot: true
        runAsUser: 11211
      serviceAccountName: loki
      terminationGracePeriodSeconds: 60
      tolerations: []
      topologySpreadConstraints: []
  updateStrategy:
    type: RollingUpdate
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: alertmanager
    app.kubernetes.io/version: v0.29.0
    helm.sh/chart: alertmanager-1.28.0
  name: prometheus-alertmanager
  namespace: monitoring
spec:
  minReadySeconds: 0
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/instance: prometheus
      app.kubernetes.io/name: alertmanager
  serviceName: prometheus-alertmanager-headless
  template:
    metadata:
      annotations:
        checksum/config: 879531dec27e1be8d996ecc9acea44f68b5c7f562942a687b90474651c8b6536
      labels:
        app.kubernetes.io/instance: prometheus
        app.kubernetes.io/name: alertmanager
    spec:
      automountServiceAccountToken: true
      containers:
      - args:
        - --storage.path=/alertmanager
        - --config.file=/etc/alertmanager/alertmanager.yml
        env:
        - name: POD_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        image: quay.io/prometheus/alertmanager:v0.29.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /
            port: http
        name: alertmanager
        ports:
        - containerPort: 9093
          name: http
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /
            port: http
        resources: {}
        securityContext:
          runAsGroup: 65534
          runAsNonRoot: true
          runAsUser: 65534
        volumeMounts:
        - mountPath: /etc/alertmanager
          name: config
        - mountPath: /alertmanager
          name: storage
      securityContext:
        fsGroup: 65534
        runAsGroup: 65534
        runAsNonRoot: true
        runAsUser: 65534
      serviceAccountName: prometheus-alertmanager
      volumes:
      - configMap:
          name: prometheus-alertmanager
        name: config
  volumeClaimTemplates:
  - metadata:
      name: storage
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 2Gi
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app.kubernetes.io/instance: tempo
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: tempo
    app.kubernetes.io/version: 2.3.1
    helm.sh/chart: tempo-1.10.1
  name: tempo
  namespace: monitoring
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: tempo
      app.kubernetes.io/name: tempo
  serviceName: tempo-headless
  template:
    metadata:
      annotations:
        checksum/config: e6cd15a6f9408a1d5abbc42b452caeeca5f707f26b7a436642a31f4c6f63a80f
      labels:
        app.kubernetes.io/instance: tempo
        app.kubernetes.io/name: tempo
    spec:
      automountServiceAccountToken: true
      containers:
      - args:
        - -config.file=/conf/tempo.yaml
        - -mem-ballast-size-mbs=1024
        env: null
        image: grafana/tempo:2.3.1
        imagePullPolicy: IfNotPresent
        name: tempo
        ports:
        - containerPort: 3100
          name: prom-metrics
        - containerPort: 6831
          name: jaeger-thrift-c
          protocol: UDP
        - containerPort: 6832
          name: jaeger-thrift-b
          protocol: UDP
        - containerPort: 14268
          name: jaeger-thrift-h
        - containerPort: 14250
          name: jaeger-grpc
        - containerPort: 9411
          name: zipkin
        - containerPort: 55680
          name: otlp-legacy
        - containerPort: 4317
          name: otlp-grpc
        - containerPort: 55681
          name: otlp-httplegacy
        - containerPort: 4318
          name: otlp-http
        - containerPort: 55678
          name: opencensus
        resources: {}
        volumeMounts:
        - mountPath: /conf
          name: tempo-conf
      serviceAccountName: tempo
      volumes:
      - configMap:
          name: tempo
        name: tempo-conf
  updateStrategy:
    type: RollingUpdate
---
apiVersion: batch/v1
kind: CronJob
metadata:
  labels:
    app: orchestrator
  name: orchestrator-check-components-updates-local
  namespace: plevion-local
spec:
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - args:
            - manage.py
            - check_components_updates
            command:
            - python
            envFrom:
            - secretRef:
                name: orchestrator-secrets
            image: ghcr.io/plevion-dev/orchestrator:v0.0.81-bfa5a93
            imagePullPolicy: IfNotPresent
            name: check-components-updates
            resources:
              limits:
                cpu: 100m
                memory: 128Mi
            workingDir: /app/src
          imagePullSecrets:
          - name: ghcr-registry-secret
          restartPolicy: OnFailure
  schedule: 0 0,12 * * *
---
apiVersion: batch/v1
kind: CronJob
metadata:
  labels:
    app: orchestrator
  name: orchestrator-reap-connections-local
  namespace: plevion-local
spec:
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - args:
            - manage.py
            - reap_connections
            command:
            - python
            envFrom:
            - secretRef:
                name: orchestrator-secrets
            image: ghcr.io/plevion-dev/orchestrator:v0.0.81-bfa5a93
            imagePullPolicy: Always
            name: reaper
            resources:
              limits:
                cpu: 100m
                memory: 128Mi
            workingDir: /app/src
          imagePullSecrets:
          - name: ghcr-registry-secret
          restartPolicy: OnFailure
  schedule: '* * * * *'
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app.kubernetes.io/component: speaker
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-speaker
  namespace: metallb-system
spec:
  selector:
    matchLabels:
      app.kubernetes.io/component: speaker
      app.kubernetes.io/instance: metallb
      app.kubernetes.io/name: metallb
  template:
    metadata:
      labels:
        app.kubernetes.io/component: speaker
        app.kubernetes.io/instance: metallb
        app.kubernetes.io/name: metallb
    spec:
      containers:
      - args:
        - --port=7472
        - --log-level=info
        env:
        - name: METALLB_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: METALLB_HOST
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: METALLB_ML_BIND_ADDR
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: METALLB_ML_LABELS
          value: app.kubernetes.io/name=metallb,app.kubernetes.io/component=speaker
        - name: METALLB_ML_BIND_PORT
          value: "7946"
        - name: METALLB_ML_SECRET_KEY_PATH
          value: /etc/ml_secret_key
        - name: FRR_CONFIG_FILE
          value: /etc/frr_reloader/frr.conf
        - name: FRR_RELOADER_PID_FILE
          value: /etc/frr_reloader/reloader.pid
        - name: METALLB_BGP_TYPE
          value: frr
        - name: METALLB_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: quay.io/metallb/speaker:v0.15.3
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /metrics
            port: monitoring
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: speaker
        ports:
        - containerPort: 7472
          name: monitoring
        - containerPort: 7946
          name: memberlist-tcp
          protocol: TCP
        - containerPort: 7946
          name: memberlist-udp
          protocol: UDP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /metrics
            port: monitoring
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_RAW
            drop:
            - ALL
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /etc/ml_secret_key
          name: memberlist
        - mountPath: /etc/frr_reloader
          name: reloader
        - mountPath: /etc/metallb
          name: metallb-excludel2
      - command:
        - /bin/sh
        - -c
        - |
          /sbin/tini -- /usr/lib/frr/docker-start &
          attempts=0
          until [[ -f /etc/frr/frr.log || $attempts -eq 60 ]]; do
            sleep 1
            attempts=$(( $attempts + 1 ))
          done
          tail -f /etc/frr/frr.log
        env:
        - name: TINI_SUBREAPER
          value: "true"
        image: quay.io/frrouting/frr:10.4.1
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: livez
            port: 7473
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: frr
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_ADMIN
            - NET_RAW
            - SYS_ADMIN
            - NET_BIND_SERVICE
          readOnlyRootFilesystem: true
        startupProbe:
          failureThreshold: 30
          httpGet:
            path: /livez
            port: 7473
          periodSeconds: 5
        volumeMounts:
        - mountPath: /var/run/frr
          name: frr-sockets
        - mountPath: /etc/frr
          name: frr-conf
        - mountPath: /var/tmp/frr
          name: frr-tmp
        - mountPath: /var/lib/frr
          name: frr-lib
      - command:
        - /etc/frr_reloader/frr-reloader.sh
        image: quay.io/frrouting/frr:10.4.1
        name: reloader
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /var/run/frr
          name: frr-sockets
        - mountPath: /etc/frr
          name: frr-conf
        - mountPath: /etc/frr_reloader
          name: reloader
        - mountPath: /var/log/frr
          name: frr-log
      - args:
        - --metrics-port=7473
        command:
        - /etc/frr_metrics/frr-metrics
        env:
        - name: VTYSH_HISTFILE
          value: /dev/null
        image: quay.io/frrouting/frr:10.4.1
        name: frr-metrics
        ports:
        - containerPort: 7473
          name: frrmetrics
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /var/run/frr
          name: frr-sockets
        - mountPath: /etc/frr
          name: frr-conf
        - mountPath: /etc/frr_metrics
          name: metrics
      hostNetwork: true
      initContainers:
      - command:
        - /bin/sh
        - -c
        - cp -rLf /tmp/frr/* /etc/frr/
        image: quay.io/frrouting/frr:10.4.1
        name: cp-frr-files
        securityContext:
          runAsGroup: 101
          runAsUser: 100
        volumeMounts:
        - mountPath: /tmp/frr
          name: frr-startup
        - mountPath: /etc/frr
          name: frr-conf
      - command:
        - /cp-tool
        - /frr-reloader.sh
        - /etc/frr_reloader/frr-reloader.sh
        image: quay.io/metallb/speaker:v0.15.3
        name: cp-reloader
        volumeMounts:
        - mountPath: /etc/frr_reloader
          name: reloader
      - command:
        - /cp-tool
        - /frr-metrics
        - /etc/frr_metrics/frr-metrics
        image: quay.io/metallb/speaker:v0.15.3
        name: cp-metrics
        volumeMounts:
        - mountPath: /etc/frr_metrics
          name: metrics
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: metallb-speaker
      shareProcessNamespace: true
      terminationGracePeriodSeconds: 0
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
        operator: Exists
      - effect: NoSchedule
        key: node-role.kubernetes.io/control-plane
        operator: Exists
      volumes:
      - name: memberlist
        secret:
          defaultMode: 420
          secretName: metallb-memberlist
      - configMap:
          defaultMode: 256
          name: metallb-excludel2
        name: metallb-excludel2
      - emptyDir: {}
        name: frr-sockets
      - configMap:
          name: metallb-frr-startup
        name: frr-startup
      - emptyDir: {}
        name: frr-conf
      - emptyDir: {}
        name: reloader
      - emptyDir: {}
        name: metrics
      - emptyDir: {}
        name: frr-tmp
      - emptyDir: {}
        name: frr-lib
      - emptyDir: {}
        name: frr-log
  updateStrategy:
    type: RollingUpdate
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app.kubernetes.io/component: canary
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki-canary
  namespace: monitoring
spec:
  selector:
    matchLabels:
      app.kubernetes.io/component: canary
      app.kubernetes.io/instance: loki
      app.kubernetes.io/name: loki
  template:
    metadata:
      labels:
        app.kubernetes.io/component: canary
        app.kubernetes.io/instance: loki
        app.kubernetes.io/name: loki
    spec:
      containers:
      - args:
        - -addr=loki.monitoring.svc.cluster.local.:3100
        - -labelname=pod
        - -labelvalue=$(POD_NAME)
        - -push=true
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: docker.io/grafana/loki-canary:3.5.7
        imagePullPolicy: IfNotPresent
        name: loki-canary
        ports:
        - containerPort: 3500
          name: http-metrics
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /metrics
            port: http-metrics
          initialDelaySeconds: 15
          timeoutSeconds: 1
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: false
        volumeMounts: null
      securityContext:
        fsGroup: 10001
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
      serviceAccountName: loki-canary
      volumes: null
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app.kubernetes.io/component: agent-collector
    app.kubernetes.io/instance: otel-collector
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: opentelemetry-collector
    app.kubernetes.io/part-of: opentelemetry-collector
    app.kubernetes.io/version: 0.140.1
    helm.sh/chart: opentelemetry-collector-0.140.1
  name: otel-collector-opentelemetry-collector-agent
  namespace: monitoring
spec:
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/instance: otel-collector
      app.kubernetes.io/name: opentelemetry-collector
      component: agent-collector
  template:
    metadata:
      annotations:
        checksum/config: 9fdc9b12bb59412d8d92731bafaf1e2aff0e2493b76271419213b8a8a9839ba5
      labels:
        app.kubernetes.io/instance: otel-collector
        app.kubernetes.io/name: opentelemetry-collector
        component: agent-collector
    spec:
      automountServiceAccountToken: true
      containers:
      - args:
        - --config=/conf/relay.yaml
        env:
        - name: MY_POD_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: GOMEMLIMIT
          value: 409MiB
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        image: ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector-contrib:0.105.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /
            port: 13133
        name: opentelemetry-collector
        ports:
        - containerPort: 6831
          hostPort: 6831
          name: jaeger-compact
          protocol: UDP
        - containerPort: 14250
          hostPort: 14250
          name: jaeger-grpc
          protocol: TCP
        - containerPort: 14268
          hostPort: 14268
          name: jaeger-thrift
          protocol: TCP
        - containerPort: 4317
          hostPort: 4317
          name: otlp
          protocol: TCP
        - containerPort: 4318
          hostPort: 4318
          name: otlp-http
          protocol: TCP
        - containerPort: 8889
          name: prometheus
          protocol: null
        - containerPort: 9411
          hostPort: 9411
          name: zipkin
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /
            port: 13133
        resources:
          limits:
            cpu: 250m
            memory: 512Mi
          requests:
            cpu: 100m
            memory: 200Mi
        securityContext: {}
        volumeMounts:
        - mountPath: /conf
          name: opentelemetry-collector-configmap
        - mountPath: /var/log/pods
          name: varlogpods
          readOnly: true
      hostNetwork: false
      securityContext: {}
      serviceAccountName: otel-collector
      volumes:
      - configMap:
          items:
          - key: relay
            path: relay.yaml
          name: otel-collector-opentelemetry-collector-agent
        name: opentelemetry-collector-configmap
      - hostPath:
          path: /var/log/pods
        name: varlogpods
  updateStrategy:
    type: RollingUpdate
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app.kubernetes.io/component: metrics
    app.kubernetes.io/instance: prometheus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: prometheus-node-exporter
    app.kubernetes.io/part-of: prometheus-node-exporter
    app.kubernetes.io/version: 1.10.2
    helm.sh/chart: prometheus-node-exporter-4.49.1
  name: prometheus-prometheus-node-exporter
  namespace: monitoring
spec:
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/instance: prometheus
      app.kubernetes.io/name: prometheus-node-exporter
  template:
    metadata:
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
      labels:
        app.kubernetes.io/component: metrics
        app.kubernetes.io/instance: prometheus
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: prometheus-node-exporter
        app.kubernetes.io/part-of: prometheus-node-exporter
        app.kubernetes.io/version: 1.10.2
        helm.sh/chart: prometheus-node-exporter-4.49.1
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: eks.amazonaws.com/compute-type
                operator: NotIn
                values:
                - fargate
              - key: type
                operator: NotIn
                values:
                - virtual-kubelet
      automountServiceAccountToken: false
      containers:
      - args:
        - --path.procfs=/host/proc
        - --path.sysfs=/host/sys
        - --path.rootfs=/host/root
        - --path.udev.data=/host/root/run/udev/data
        - --web.listen-address=[$(HOST_IP)]:9100
        env:
        - name: HOST_IP
          value: 0.0.0.0
        image: quay.io/prometheus/node-exporter:v1.10.2
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            httpHeaders: null
            path: /
            port: metrics
            scheme: HTTP
          initialDelaySeconds: 0
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: node-exporter
        ports:
        - containerPort: 9100
          name: metrics
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            httpHeaders: null
            path: /
            port: metrics
            scheme: HTTP
          initialDelaySeconds: 0
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /host/proc
          name: proc
          readOnly: true
        - mountPath: /host/sys
          name: sys
          readOnly: true
        - mountPath: /host/root
          mountPropagation: HostToContainer
          name: root
          readOnly: true
      hostIPC: false
      hostNetwork: true
      hostPID: true
      nodeSelector:
        kubernetes.io/os: linux
      securityContext:
        fsGroup: 65534
        runAsGroup: 65534
        runAsNonRoot: true
        runAsUser: 65534
      serviceAccountName: prometheus-prometheus-node-exporter
      tolerations:
      - effect: NoSchedule
        operator: Exists
      volumes:
      - hostPath:
          path: /proc
        name: proc
      - hostPath:
          path: /sys
        name: sys
      - hostPath:
          path: /
        name: root
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
---
apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    helm.sh/hook: post-install
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    helm.sh/hook-weight: "1"
  labels:
    app: startupapicheck
    app.kubernetes.io/component: startupapicheck
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: startupapicheck
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-startupapicheck
  namespace: cert-manager
spec:
  backoffLimit: 4
  template:
    metadata:
      labels:
        app: startupapicheck
        app.kubernetes.io/component: startupapicheck
        app.kubernetes.io/instance: cert-manager
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: startupapicheck
        app.kubernetes.io/version: v1.19.2
        helm.sh/chart: cert-manager-v1.19.2
    spec:
      containers:
      - args:
        - check
        - api
        - --wait=1m
        - -v
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: quay.io/jetstack/cert-manager-startupapicheck:v1.19.2
        imagePullPolicy: IfNotPresent
        name: cert-manager-startupapicheck
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
      enableServiceLinks: false
      nodeSelector:
        kubernetes.io/os: linux
      restartPolicy: OnFailure
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: cert-manager-startupapicheck
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: selfsigned-ca
  namespace: cert-manager
spec:
  commonName: plevion-local-ca
  isCA: true
  issuerRef:
    group: cert-manager.io
    kind: ClusterIssuer
    name: selfsigned-issuer
  privateKey:
    algorithm: ECDSA
    size: 256
  secretName: selfsigned-ca
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-ca-issuer
  namespace: cert-manager
spec:
  ca:
    secretName: selfsigned-ca
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
  namespace: cert-manager
spec:
  selfSigned: {}
---
apiVersion: configuration.konghq.com/v1
config:
  auth_url: http://auth-local.plevion-local/public/v1/auth/authentication/check/
kind: KongClusterPlugin
metadata:
  annotations:
    kubernetes.io/ingress.class: kong
  name: auth-config
  namespace: plevion-local
plugin: plevion-auth
---
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: local-pool
  namespace: metallb-system
spec:
  addresses:
  - 192.168.0.240-192.168.0.250
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
  name: local-advertisement
  namespace: metallb-system
spec:
  ipAddressPools:
  - local-pool
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/plugins: auth-config
    konghq.com/protocols: http,https
    konghq.com/strip-path: "false"
  labels:
    app: auth
  name: auth-gateway-events-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: api.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: auth-events-gateway-local
            port:
              number: 80
        path: /public/v1/auth/events/authentication/
        pathType: Exact
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-ca-issuer
    konghq.com/protocols: https
    konghq.com/strip-path: "false"
  labels:
    app: auth
  name: auth-ingress-admin-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: auth.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: auth-local
            port:
              number: 80
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - auth.local.plevion.com
    secretName: auth-admin-tls
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-ca-issuer
    konghq.com/plugins: auth-config
    konghq.com/protocols: http,https
    konghq.com/strip-path: "false"
  labels:
    app: auth
  name: auth-ingress-api-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: api.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: auth-local
            port:
              number: 80
        path: /public/v1/auth
        pathType: Prefix
  - host: auth.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: auth-local
            port:
              number: 80
        path: /public/v1/auth
        pathType: Prefix
  tls:
  - hosts:
    - api.local.plevion.com
    - auth.local.plevion.com
    secretName: auth-api-tls
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/strip-path: "false"
  labels:
    app: auth
  name: auth-ingress-authorizer-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - http:
      paths:
      - backend:
          service:
            name: auth-local
            port:
              number: 80
        path: /public/v1/auth/authentication/check/
        pathType: Exact
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/strip-path: "false"
  labels:
    app: auth
  name: auth-ingress-static-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - http:
      paths:
      - backend:
          service:
            name: auth-local
            port:
              number: 80
        path: /static
        pathType: Prefix
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/preserve-host: "true"
    konghq.com/strip-path: "false"
  labels:
    app: frontend-admin
  name: frontend-admin-ingress-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - http:
      paths:
      - backend:
          service:
            name: frontend-admin-local
            port:
              number: 80
        path: /admin
        pathType: Prefix
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-ca-issuer
    konghq.com/preserve-host: "true"
    konghq.com/protocols: https
    konghq.com/strip-path: "false"
  labels:
    app: frontend-landing
  name: frontend-landing-ingress-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: plevion.com
    http:
      paths:
      - backend:
          service:
            name: frontend-landing-local
            port:
              number: 80
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - plevion.com
    secretName: frontend-landing-tls
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/preserve-host: "true"
    konghq.com/strip-path: "false"
  name: minio-public-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: api.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: minio-local
            port:
              number: 9000
        path: /plevion/
        pathType: Prefix
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-ca-issuer
    konghq.com/protocols: https
    konghq.com/strip-path: "false"
  labels:
    app: orchestrator
  name: orchestrator-ingress-admin-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: orchestrator.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: orchestrator-local
            port:
              number: 80
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - orchestrator.local.plevion.com
    secretName: orchestrator-admin-tls
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-ca-issuer
    konghq.com/plugins: auth-config
    konghq.com/protocols: http,https
    konghq.com/strip-path: "false"
  labels:
    app: orchestrator
  name: orchestrator-ingress-api-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: api.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: orchestrator-local
            port:
              number: 80
        path: /public/v1/orchestrator
        pathType: Prefix
  - host: orchestrator.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: orchestrator-local
            port:
              number: 80
        path: /public/v1/orchestrator
        pathType: Prefix
  tls:
  - hosts:
    - api.local.plevion.com
    - orchestrator.local.plevion.com
    secretName: orchestrator-api-tls
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/strip-path: "false"
  labels:
    app: orchestrator
  name: orchestrator-ingress-static-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - http:
      paths:
      - backend:
          service:
            name: orchestrator-local
            port:
              number: 80
        path: /static
        pathType: Prefix
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/plugins: auth-config
    konghq.com/protocols: http,https
    konghq.com/regex-priority: "100"
    konghq.com/strip-path: "false"
  labels:
    app: sink
  name: sink-gateway-broadcast-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: api.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: sink-broadcast-gateway-local
            port:
              number: 80
        path: /public/v1/sink/events/compositions/
        pathType: ImplementationSpecific
      - backend:
          service:
            name: sink-broadcast-gateway-local
            port:
              number: 80
        path: /public/v1/sink/events/
        pathType: ImplementationSpecific
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-ca-issuer
    konghq.com/plugins: auth-config
    konghq.com/protocols: http,https
    konghq.com/strip-path: "false"
  labels:
    app: sink
  name: sink-ingress-api-local
  namespace: plevion-local
spec:
  ingressClassName: kong
  rules:
  - host: api.local.plevion.com
    http:
      paths:
      - backend:
          service:
            name: sink-local
            port:
              number: 80
        path: /public/v1/sink/
        pathType: Prefix
  tls:
  - hosts:
    - api.local.plevion.com
    secretName: sink-api-tls
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong
spec:
  controller: ingress-controllers.konghq.com/kong
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: tailscale
spec:
  controller: tailscale.com/ts-ingress
---
apiVersion: v1
kind: Pod
metadata:
  annotations:
    helm.sh/hook: test
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  labels:
    app.kubernetes.io/instance: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/version: 12.3.0
    helm.sh/chart: grafana-10.1.5
  name: grafana-test
  namespace: monitoring
spec:
  containers:
  - command:
    - /opt/bats/bin/bats
    - -t
    - /tests/run.sh
    image: docker.io/bats/bats:v1.4.1
    imagePullPolicy: IfNotPresent
    name: grafana-test
    volumeMounts:
    - mountPath: /tests
      name: tests
      readOnly: true
  restartPolicy: Never
  serviceAccountName: grafana-test
  volumes:
  - configMap:
      name: grafana-test
    name: tests
---
apiVersion: v1
kind: Pod
metadata:
  annotations:
    helm.sh/hook: test
  labels:
    app.kubernetes.io/component: helm-test
    app.kubernetes.io/instance: loki
    app.kubernetes.io/name: loki
    app.kubernetes.io/version: 3.5.5
    helm.sh/chart: loki-6.44.0
  name: loki-helm-test
  namespace: monitoring
spec:
  containers:
  - args:
    - -test.v
    env:
    - name: CANARY_SERVICE_ADDRESS
      value: http://loki-canary:3500/metrics
    - name: CANARY_PROMETHEUS_ADDRESS
      value: ""
    - name: CANARY_TEST_TIMEOUT
      value: 1m
    image: docker.io/grafana/loki-helm-test:latest
    name: loki-helm-test
  restartPolicy: Never
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca
  labels:
    app: webhook
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: webhook
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-webhook
webhooks:
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: cert-manager-webhook
      namespace: cert-manager
      path: /mutate
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: webhook.cert-manager.io
  rules:
  - apiGroups:
    - cert-manager.io
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - certificaterequests
  sideEffects: None
  timeoutSeconds: 30
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  labels:
    app.kubernetes.io/instance: kong
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kong
    app.kubernetes.io/version: "3.5"
    helm.sh/chart: kong-2.36.0
  name: kong-kong-validations
  namespace: kong
webhooks:
- admissionReviewVersions:
  - v1beta1
  clientConfig:
    caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURJekNDQWd1Z0F3SUJBZ0lRQVBEemNzQXF0UmJCRExFaDVtaFQ3VEFOQmdrcWhraUc5dzBCQVFzRkFEQWMKTVJvd0dBWURWUVFERXhGcmIyNW5MV0ZrYldsemMybHZiaTFqWVRBZUZ3MHlOakE0TURFd09ETXpNREZhRncwegpOakEzTWprd09ETXpNREZhTUJ3eEdqQVlCZ05WQkFNVEVXdHZibWN0WVdSdGFYTnphVzl1TFdOaE1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQW96dlFIVVZCeFFOMEkwRUI3QnE0Ylo5T2VmT1QKV1FlNVZKWFEyeVlWaVlpTU03ZWp2K2xjZnRNWERUS1JrQW5PQ1ZYRjVlTWFHdlBhZGcyZG9LZzNNS05QTFNKVgpIaTRybTltbVJ6QzZxZkI0T1lHbWtOdHNBZDdITUsrMENoOWxDcEpSaWE0Ly82YTR2NTNpNWY4SHA0dG45T24zCmdDb0MyZHpVOG1QcEJXbVlXUUZic3FleHhxTkdqcW1JVVNlOGRTMWFaY3NiWWJnakRlQmJaVUlmbXVkdmFxM20KTmsvRW84cUMxTjlTTTNqMGRPK0Y1RjlNTmd2R1VYOHhXS1lUeWZGcXg3US80dGwxaHBSOG9rSXl3QVlxcTNrVAphQ1owSzZVYVN5UFQzNDBBeXZwamVrTmtKTVZIQjgyY21aUXRyQUVMQ3JtS2dXMS9wYzJ6VllBalh3SURBUUFCCm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUYKQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPQkJZRUZPNFZ0allwbUZUNUhNSEFSRjk2RE1OSApqT3RKTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBeTlMYm94K2E4d0tSVGJ1MUliQ1I2Uk1Oc1I2NTFZNjhICmd0UUQ1a3hUS2VPVm53dXFTejEya2g0V3IzMExYVmE3b2pQWklDLytXRGpicW5YWTJJbW9uRkdldHRPTVl1SU8KZnd3Q3o4SURsT0FBTnRRWFBMRDYzV2RrTUJDU0RtSFNLbWJuMDF2RHJzMTFtU2tUMWZaOVI3eU9tOEhSNU0vSQpGSGNlSUlXM2oyd1N3Qmx6S3VtYnMyM0VhUUpKWE9HQmRzNGVHdktMbjZ2aEVqMnBrU09SbFh1TVNIcWRPOUs5CkxlYVZJVHpIWDVlUkEzSzY3MFVMS3RKbzVIdnpWczJ3Y3NpcmZob2YzUlcyM3BLdFc0UUVBc3A4VEVGM045NWgKVTdKa2dEZHY1NENySVgrNEZBdHkxSGtNNldKbzRiSEVqd1FpYmhHREQ5OThmVEtkYThkVQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
    service:
      name: kong-kong-validation-webhook
      namespace: plevion-local
  failurePolicy: Ignore
  name: validations.kong.konghq.com
  objectSelector:
    matchExpressions:
    - key: owner
      operator: NotIn
      values:
      - helm
  rules:
  - apiGroups:
    - configuration.konghq.com
    apiVersions:
    - '*'
    operations:
    - CREATE
    - UPDATE
    resources:
    - kongconsumers
    - kongplugins
    - kongclusterplugins
    - kongingresses
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - secrets
    - services
  - apiGroups:
    - networking.k8s.io
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - ingresses
  - apiGroups:
    - gateway.networking.k8s.io
    apiVersions:
    - v1alpha2
    - v1beta1
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - gateways
    - httproutes
  sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca
  labels:
    app: webhook
    app.kubernetes.io/component: webhook
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: webhook
    app.kubernetes.io/version: v1.19.2
    helm.sh/chart: cert-manager-v1.19.2
  name: cert-manager-webhook
webhooks:
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: cert-manager-webhook
      namespace: cert-manager
      path: /validate
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: webhook.cert-manager.io
  namespaceSelector:
    matchExpressions:
    - key: cert-manager.io/disable-validation
      operator: NotIn
      values:
      - "true"
  rules:
  - apiGroups:
    - cert-manager.io
    - acme.cert-manager.io
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - '*/*'
  sideEffects: None
  timeoutSeconds: 30
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  labels:
    app.kubernetes.io/instance: metallb
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: metallb
    app.kubernetes.io/version: v0.15.3
    helm.sh/chart: metallb-0.15.3
  name: metallb-webhook-configuration
webhooks:
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: metallb-system
      path: /validate-metallb-io-v1beta2-bgppeer
  failurePolicy: Fail
  name: bgppeervalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta2
    operations:
    - CREATE
    - UPDATE
    resources:
    - bgppeers
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: metallb-system
      path: /validate-metallb-io-v1beta1-ipaddresspool
  failurePolicy: Fail
  name: ipaddresspoolvalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - ipaddresspools
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: metallb-system
      path: /validate-metallb-io-v1beta1-bgpadvertisement
  failurePolicy: Fail
  name: bgpadvertisementvalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - bgpadvertisements
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: metallb-system
      path: /validate-metallb-io-v1beta1-community
  failurePolicy: Fail
  name: communityvalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - communities
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: metallb-system
      path: /validate-metallb-io-v1beta1-bfdprofile
  failurePolicy: Fail
  name: bfdprofilevalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - DELETE
    resources:
    - bfdprofiles
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: metallb-webhook-service
      namespace: metallb-system
      path: /validate-metallb-io-v1beta1-l2advertisement
  failurePolicy: Fail
  name: l2advertisementvalidationwebhook.metallb.io
  rules:
  - apiGroups:
    - metallb.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - l2advertisements
  sideEffects: None
