Add source CRD manifests for schemapatch
Signed-off-by: James Munnelly <james@munnelly.eu>
This commit is contained in:
James Munnelly
parent
9d5372c93a
commit
a292400c3a
181
deploy/charts/cert-manager/crds/certificaterequests.yaml
Normal file
181
deploy/charts/cert-manager/crds/certificaterequests.yaml
Normal file
@ -0,0 +1,181 @@
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: certificaterequests.cert-manager.io
|
||||
spec:
|
||||
additionalPrinterColumns:
|
||||
- JSONPath: .status.conditions[?(@.type=="Ready")].status
|
||||
name: Ready
|
||||
type: string
|
||||
- JSONPath: .spec.issuerRef.name
|
||||
name: Issuer
|
||||
priority: 1
|
||||
type: string
|
||||
- JSONPath: .status.conditions[?(@.type=="Ready")].message
|
||||
name: Status
|
||||
priority: 1
|
||||
type: string
|
||||
- JSONPath: .metadata.creationTimestamp
|
||||
description: CreationTimestamp is a timestamp representing the server time when
|
||||
this object was created. It is not guaranteed to be set in happens-before order
|
||||
across separate operations. Clients may not set this value. It is represented
|
||||
in RFC3339 form and is in UTC.
|
||||
name: Age
|
||||
type: date
|
||||
group: cert-manager.io
|
||||
names:
|
||||
kind: CertificateRequest
|
||||
listKind: CertificateRequestList
|
||||
plural: certificaterequests
|
||||
shortNames:
|
||||
- cr
|
||||
- crs
|
||||
singular: certificaterequest
|
||||
scope: Namespaced
|
||||
subresources:
|
||||
status: {}
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
description: CertificateRequest is a type to represent a Certificate Signing
|
||||
Request
|
||||
type: object
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: CertificateRequestSpec defines the desired state of CertificateRequest
|
||||
type: object
|
||||
required:
|
||||
- issuerRef
|
||||
properties:
|
||||
csr:
|
||||
description: Byte slice containing the PEM encoded CertificateSigningRequest
|
||||
type: string
|
||||
format: byte
|
||||
duration:
|
||||
description: Requested certificate default Duration
|
||||
type: string
|
||||
isCA:
|
||||
description: IsCA will mark the resulting certificate as valid for signing.
|
||||
This implies that the 'cert sign' usage is set
|
||||
type: boolean
|
||||
issuerRef:
|
||||
description: IssuerRef is a reference to the issuer for this CertificateRequest. If
|
||||
the 'kind' field is not set, or set to 'Issuer', an Issuer resource
|
||||
with the given name in the same namespace as the CertificateRequest
|
||||
will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer
|
||||
with the provided name will be used. The 'name' field in this stanza
|
||||
is required at all times. The group field refers to the API group
|
||||
of the issuer which defaults to 'cert-manager.io' if empty.
|
||||
type: object
|
||||
required:
|
||||
- name
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
usages:
|
||||
description: Usages is the set of x509 actions that are enabled for
|
||||
a given key. Defaults are ('digital signature', 'key encipherment')
|
||||
if empty
|
||||
type: array
|
||||
items:
|
||||
description: 'KeyUsage specifies valid usage contexts for keys. See:
|
||||
https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12'
|
||||
type: string
|
||||
enum:
|
||||
- signing
|
||||
- digital signature
|
||||
- content commitment
|
||||
- key encipherment
|
||||
- key agreement
|
||||
- data encipherment
|
||||
- cert sign
|
||||
- crl sign
|
||||
- encipher only
|
||||
- decipher only
|
||||
- any
|
||||
- server auth
|
||||
- client auth
|
||||
- code signing
|
||||
- email protection
|
||||
- s/mime
|
||||
- ipsec end system
|
||||
- ipsec tunnel
|
||||
- ipsec user
|
||||
- timestamping
|
||||
- ocsp signing
|
||||
- microsoft sgc
|
||||
- netscape sgc
|
||||
status:
|
||||
description: CertificateStatus defines the observed state of CertificateRequest
|
||||
and resulting signed certificate.
|
||||
type: object
|
||||
properties:
|
||||
ca:
|
||||
description: Byte slice containing the PEM encoded certificate authority
|
||||
of the signed certificate.
|
||||
type: string
|
||||
format: byte
|
||||
certificate:
|
||||
description: Byte slice containing a PEM encoded signed certificate
|
||||
resulting from the given certificate signing request.
|
||||
type: string
|
||||
format: byte
|
||||
conditions:
|
||||
type: array
|
||||
items:
|
||||
description: CertificateRequestCondition contains condition information
|
||||
for a CertificateRequest.
|
||||
type: object
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: LastTransitionTime is the timestamp corresponding
|
||||
to the last status change of this condition.
|
||||
type: string
|
||||
format: date-time
|
||||
message:
|
||||
description: Message is a human readable description of the details
|
||||
of the last transition, complementing reason.
|
||||
type: string
|
||||
reason:
|
||||
description: Reason is a brief machine readable explanation for
|
||||
the condition's last transition.
|
||||
type: string
|
||||
status:
|
||||
description: Status of the condition, one of ('True', 'False',
|
||||
'Unknown').
|
||||
type: string
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type:
|
||||
description: Type of the condition, currently ('Ready').
|
||||
type: string
|
||||
failureTime:
|
||||
description: FailureTime stores the time that this CertificateRequest
|
||||
failed. This is used to influence garbage collection and back-off.
|
||||
type: string
|
||||
format: date-time
|
||||
version: v1alpha2
|
||||
versions:
|
||||
- name: v1alpha2
|
||||
served: true
|
||||
storage: true
|
||||
235
deploy/charts/cert-manager/crds/certificates.yaml
Normal file
235
deploy/charts/cert-manager/crds/certificates.yaml
Normal file
@ -0,0 +1,235 @@
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: certificates.cert-manager.io
|
||||
spec:
|
||||
additionalPrinterColumns:
|
||||
- JSONPath: .status.conditions[?(@.type=="Ready")].status
|
||||
name: Ready
|
||||
type: string
|
||||
- JSONPath: .spec.secretName
|
||||
name: Secret
|
||||
type: string
|
||||
- JSONPath: .spec.issuerRef.name
|
||||
name: Issuer
|
||||
priority: 1
|
||||
type: string
|
||||
- JSONPath: .status.conditions[?(@.type=="Ready")].message
|
||||
name: Status
|
||||
priority: 1
|
||||
type: string
|
||||
- JSONPath: .metadata.creationTimestamp
|
||||
description: CreationTimestamp is a timestamp representing the server time when
|
||||
this object was created. It is not guaranteed to be set in happens-before order
|
||||
across separate operations. Clients may not set this value. It is represented
|
||||
in RFC3339 form and is in UTC.
|
||||
name: Age
|
||||
type: date
|
||||
group: cert-manager.io
|
||||
names:
|
||||
kind: Certificate
|
||||
listKind: CertificateList
|
||||
plural: certificates
|
||||
shortNames:
|
||||
- cert
|
||||
- certs
|
||||
singular: certificate
|
||||
scope: Namespaced
|
||||
subresources:
|
||||
status: {}
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
description: Certificate is a type to represent a Certificate from ACME
|
||||
type: object
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: CertificateSpec defines the desired state of Certificate. A
|
||||
valid Certificate requires at least one of a CommonName, DNSName, or URISAN
|
||||
to be valid.
|
||||
type: object
|
||||
required:
|
||||
- issuerRef
|
||||
- secretName
|
||||
properties:
|
||||
commonName:
|
||||
description: CommonName is a common name to be used on the Certificate.
|
||||
The CommonName should have a length of 64 characters or fewer to avoid
|
||||
generating invalid CSRs.
|
||||
type: string
|
||||
dnsNames:
|
||||
description: DNSNames is a list of subject alt names to be used on the
|
||||
Certificate.
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
duration:
|
||||
description: Certificate default Duration
|
||||
type: string
|
||||
ipAddresses:
|
||||
description: IPAddresses is a list of IP addresses to be used on the
|
||||
Certificate
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
isCA:
|
||||
description: IsCA will mark this Certificate as valid for signing. This
|
||||
implies that the 'cert sign' usage is set
|
||||
type: boolean
|
||||
issuerRef:
|
||||
description: IssuerRef is a reference to the issuer for this certificate.
|
||||
If the 'kind' field is not set, or set to 'Issuer', an Issuer resource
|
||||
with the given name in the same namespace as the Certificate will
|
||||
be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer
|
||||
with the provided name will be used. The 'name' field in this stanza
|
||||
is required at all times.
|
||||
type: object
|
||||
required:
|
||||
- name
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
keyAlgorithm:
|
||||
description: KeyAlgorithm is the private key algorithm of the corresponding
|
||||
private key for this certificate. If provided, allowed values are
|
||||
either "rsa" or "ecdsa" If KeyAlgorithm is specified and KeySize is
|
||||
not provided, key size of 256 will be used for "ecdsa" key algorithm
|
||||
and key size of 2048 will be used for "rsa" key algorithm.
|
||||
type: string
|
||||
enum:
|
||||
- rsa
|
||||
- ecdsa
|
||||
keyEncoding:
|
||||
description: KeyEncoding is the private key cryptography standards (PKCS)
|
||||
for this certificate's private key to be encoded in. If provided,
|
||||
allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8,
|
||||
respectively. If KeyEncoding is not specified, then PKCS#1 will be
|
||||
used by default.
|
||||
type: string
|
||||
enum:
|
||||
- pkcs1
|
||||
- pkcs8
|
||||
keySize:
|
||||
description: KeySize is the key bit size of the corresponding private
|
||||
key for this certificate. If provided, value must be between 2048
|
||||
and 8192 inclusive when KeyAlgorithm is empty or is set to "rsa",
|
||||
and value must be one of (256, 384, 521) when KeyAlgorithm is set
|
||||
to "ecdsa".
|
||||
type: integer
|
||||
organization:
|
||||
description: Organization is the organization to be used on the Certificate
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
renewBefore:
|
||||
description: Certificate renew before expiration duration
|
||||
type: string
|
||||
secretName:
|
||||
description: SecretName is the name of the secret resource to store
|
||||
this secret in
|
||||
type: string
|
||||
uriSANs:
|
||||
description: URISANs is a list of URI Subject Alternative Names to be
|
||||
set on this Certificate.
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
usages:
|
||||
description: Usages is the set of x509 actions that are enabled for
|
||||
a given key. Defaults are ('digital signature', 'key encipherment')
|
||||
if empty
|
||||
type: array
|
||||
items:
|
||||
description: 'KeyUsage specifies valid usage contexts for keys. See:
|
||||
https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12'
|
||||
type: string
|
||||
enum:
|
||||
- signing
|
||||
- digital signature
|
||||
- content commitment
|
||||
- key encipherment
|
||||
- key agreement
|
||||
- data encipherment
|
||||
- cert sign
|
||||
- crl sign
|
||||
- encipher only
|
||||
- decipher only
|
||||
- any
|
||||
- server auth
|
||||
- client auth
|
||||
- code signing
|
||||
- email protection
|
||||
- s/mime
|
||||
- ipsec end system
|
||||
- ipsec tunnel
|
||||
- ipsec user
|
||||
- timestamping
|
||||
- ocsp signing
|
||||
- microsoft sgc
|
||||
- netscape sgc
|
||||
status:
|
||||
description: CertificateStatus defines the observed state of Certificate
|
||||
type: object
|
||||
properties:
|
||||
conditions:
|
||||
type: array
|
||||
items:
|
||||
description: CertificateCondition contains condition information for
|
||||
an Certificate.
|
||||
type: object
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: LastTransitionTime is the timestamp corresponding
|
||||
to the last status change of this condition.
|
||||
type: string
|
||||
format: date-time
|
||||
message:
|
||||
description: Message is a human readable description of the details
|
||||
of the last transition, complementing reason.
|
||||
type: string
|
||||
reason:
|
||||
description: Reason is a brief machine readable explanation for
|
||||
the condition's last transition.
|
||||
type: string
|
||||
status:
|
||||
description: Status of the condition, one of ('True', 'False',
|
||||
'Unknown').
|
||||
type: string
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type:
|
||||
description: Type of the condition, currently ('Ready').
|
||||
type: string
|
||||
lastFailureTime:
|
||||
type: string
|
||||
format: date-time
|
||||
notAfter:
|
||||
description: The expiration time of the certificate stored in the secret
|
||||
named by this resource in spec.secretName.
|
||||
type: string
|
||||
format: date-time
|
||||
version: v1alpha2
|
||||
versions:
|
||||
- name: v1alpha2
|
||||
served: true
|
||||
storage: true
|
||||
1366
deploy/charts/cert-manager/crds/challenges.yaml
Normal file
1366
deploy/charts/cert-manager/crds/challenges.yaml
Normal file
File diff suppressed because it is too large
Load Diff
1655
deploy/charts/cert-manager/crds/clusterissuers.yaml
Normal file
1655
deploy/charts/cert-manager/crds/clusterissuers.yaml
Normal file
File diff suppressed because it is too large
Load Diff
1655
deploy/charts/cert-manager/crds/issuers.yaml
Normal file
1655
deploy/charts/cert-manager/crds/issuers.yaml
Normal file
File diff suppressed because it is too large
Load Diff
200
deploy/charts/cert-manager/crds/orders.yaml
Normal file
200
deploy/charts/cert-manager/crds/orders.yaml
Normal file
@ -0,0 +1,200 @@
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: orders.acme.cert-manager.io
|
||||
spec:
|
||||
additionalPrinterColumns:
|
||||
- JSONPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
- JSONPath: .spec.issuerRef.name
|
||||
name: Issuer
|
||||
priority: 1
|
||||
type: string
|
||||
- JSONPath: .status.reason
|
||||
name: Reason
|
||||
priority: 1
|
||||
type: string
|
||||
- JSONPath: .metadata.creationTimestamp
|
||||
description: CreationTimestamp is a timestamp representing the server time when
|
||||
this object was created. It is not guaranteed to be set in happens-before order
|
||||
across separate operations. Clients may not set this value. It is represented
|
||||
in RFC3339 form and is in UTC.
|
||||
name: Age
|
||||
type: date
|
||||
group: acme.cert-manager.io
|
||||
names:
|
||||
kind: Order
|
||||
listKind: OrderList
|
||||
plural: orders
|
||||
singular: order
|
||||
scope: Namespaced
|
||||
subresources:
|
||||
status: {}
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
description: Order is a type to represent an Order with an ACME server
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
type: object
|
||||
required:
|
||||
- csr
|
||||
- issuerRef
|
||||
properties:
|
||||
commonName:
|
||||
description: CommonName is the common name as specified on the DER encoded
|
||||
CSR. If CommonName is not specified, the first DNSName specified will
|
||||
be used as the CommonName. At least one of CommonName or a DNSNames
|
||||
must be set. This field must match the corresponding field on the
|
||||
DER encoded CSR.
|
||||
type: string
|
||||
csr:
|
||||
description: Certificate signing request bytes in DER encoding. This
|
||||
will be used when finalizing the order. This field must be set on
|
||||
the order.
|
||||
type: string
|
||||
format: byte
|
||||
dnsNames:
|
||||
description: DNSNames is a list of DNS names that should be included
|
||||
as part of the Order validation process. If CommonName is not specified,
|
||||
the first DNSName specified will be used as the CommonName. At least
|
||||
one of CommonName or a DNSNames must be set. This field must match
|
||||
the corresponding field on the DER encoded CSR.
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
issuerRef:
|
||||
description: IssuerRef references a properly configured ACME-type Issuer
|
||||
which should be used to create this Order. If the Issuer does not
|
||||
exist, processing will be retried. If the Issuer is not an 'ACME'
|
||||
Issuer, an error will be returned and the Order will be marked as
|
||||
failed.
|
||||
type: object
|
||||
required:
|
||||
- name
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
status:
|
||||
type: object
|
||||
properties:
|
||||
authorizations:
|
||||
description: Authorizations contains data returned from the ACME server
|
||||
on what authoriations must be completed in order to validate the DNS
|
||||
names specified on the Order.
|
||||
type: array
|
||||
items:
|
||||
description: ACMEAuthorization contains data returned from the ACME
|
||||
server on an authorization that must be completed in order validate
|
||||
a DNS name on an ACME Order resource.
|
||||
type: object
|
||||
required:
|
||||
- url
|
||||
properties:
|
||||
challenges:
|
||||
description: Challenges specifies the challenge types offered
|
||||
by the ACME server. One of these challenge types will be selected
|
||||
when validating the DNS name and an appropriate Challenge resource
|
||||
will be created to perform the ACME challenge process.
|
||||
type: array
|
||||
items:
|
||||
description: Challenge specifies a challenge offered by the
|
||||
ACME server for an Order. An appropriate Challenge resource
|
||||
can be created to perform the ACME challenge process.
|
||||
type: object
|
||||
required:
|
||||
- token
|
||||
- type
|
||||
- url
|
||||
properties:
|
||||
token:
|
||||
description: Token is the token that must be presented for
|
||||
this challenge. This is used to compute the 'key' that
|
||||
must also be presented.
|
||||
type: string
|
||||
type:
|
||||
description: Type is the type of challenge being offered,
|
||||
e.g. http-01, dns-01
|
||||
type: string
|
||||
url:
|
||||
description: URL is the URL of this challenge. It can be
|
||||
used to retrieve additional metadata about the Challenge
|
||||
from the ACME server.
|
||||
type: string
|
||||
identifier:
|
||||
description: Identifier is the DNS name to be validated as part
|
||||
of this authorization
|
||||
type: string
|
||||
url:
|
||||
description: URL is the URL of the Authorization that must be
|
||||
completed
|
||||
type: string
|
||||
wildcard:
|
||||
description: Wildcard will be true if this authorization is for
|
||||
a wildcard DNS name. If this is true, the identifier will be
|
||||
the *non-wildcard* version of the DNS name. For example, if
|
||||
'*.example.com' is the DNS name being validated, this field
|
||||
will be 'true' and the 'identifier' field will be 'example.com'.
|
||||
type: boolean
|
||||
certificate:
|
||||
description: Certificate is a copy of the PEM encoded certificate for
|
||||
this Order. This field will be populated after the order has been
|
||||
successfully finalized with the ACME server, and the order has transitioned
|
||||
to the 'valid' state.
|
||||
type: string
|
||||
format: byte
|
||||
failureTime:
|
||||
description: FailureTime stores the time that this order failed. This
|
||||
is used to influence garbage collection and back-off.
|
||||
type: string
|
||||
format: date-time
|
||||
finalizeURL:
|
||||
description: FinalizeURL of the Order. This is used to obtain certificates
|
||||
for this order once it has been completed.
|
||||
type: string
|
||||
reason:
|
||||
description: Reason optionally provides more information about a why
|
||||
the order is in the current state.
|
||||
type: string
|
||||
state:
|
||||
description: State contains the current state of this Order resource.
|
||||
States 'success' and 'expired' are 'final'
|
||||
type: string
|
||||
enum:
|
||||
- valid
|
||||
- ready
|
||||
- pending
|
||||
- processing
|
||||
- invalid
|
||||
- expired
|
||||
- errored
|
||||
url:
|
||||
description: URL of the Order. This will initially be empty when the
|
||||
resource is first created. The Order controller will populate this
|
||||
field when the Order is first processed. This field will be immutable
|
||||
after it is initially set.
|
||||
type: string
|
||||
version: v1alpha2
|
||||
versions:
|
||||
- name: v1alpha2
|
||||
served: true
|
||||
storage: true
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user