v1beta1

package
v0.1.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 31, 2026 License: AGPL-3.0 Imports: 5 Imported by: 0

Documentation

Overview

Package v1beta1 contains API Schema definitions for the extensions v1beta1 API group

Package v1beta1 contains API Schema definitions for the extensions.agents v1beta1 API group. +kubebuilder:object:generate=true +groupName=extensions.agents.x-k8s.io

Index

Constants

View Source 
const (
	// ClaimExpiredReason is the reason used in conditions/events when a claim expires.
	ClaimExpiredReason = "ClaimExpired"

	// AssignedSandboxNameAnnotation is the annotation key applied to the claim to identify the adopted Sandbox Name.
	AssignedSandboxNameAnnotation = "agents.x-k8s.io/sandbox-name"

	// WarmPoolRefField is the field used for indexing SandboxClaims by their warm pool reference name.
	WarmPoolRefField = ".spec.warmPoolRef.name"

	// ShutdownPolicyDelete deletes the SandboxClaim (and cascadingly the Sandbox) when expired.
	ShutdownPolicyDelete ShutdownPolicy = "Delete"

	// ShutdownPolicyDeleteForeground deletes the SandboxClaim when expired using foreground
	// cascade deletion. The claim remains in the API (with a deletionTimestamp) until its
	// underlying Sandbox and Pod are fully terminated. This allows external systems to observe
	// shutdown progress by checking whether the claim still exists.
	ShutdownPolicyDeleteForeground ShutdownPolicy = "DeleteForeground"

	// ShutdownPolicyRetain keeps the SandboxClaim when expired (Status will show Expired).
	// The underlying SandboxClaim resources (Sandbox, Pod, Service) are deleted to save resources,
	// but the SandboxClaim object itself remains.
	ShutdownPolicyRetain ShutdownPolicy = "Retain"
)
View Source 
const (
	// SandboxIDLabel is the label key applied to the Pod to identify the owning Claim UID.
	// The SandboxClaim controller injects this label into the Pod
	// System-injected labels/annotations shouldn't be touched.
	SandboxIDLabel = "agents.x-k8s.io/claim-uid"

	// NetworkPolicyManagementManaged means the controller will ensure a shared NetworkPolicy exists.
	// This shared NetworkPolicy will be a user provide one or a default controller created policy.
	// This is the default behavior if the field is omitted.
	NetworkPolicyManagementManaged NetworkPolicyManagement = "Managed"

	// NetworkPolicyManagementUnmanaged means the controller will skip NetworkPolicy
	// creation entirely, allowing external systems (like Cilium) to manage networking.
	NetworkPolicyManagementUnmanaged NetworkPolicyManagement = "Unmanaged"

	// EnvVarsInjectionPolicyAllowed allows a SandboxClaim to inject new environment variables, but not override existing ones.
	EnvVarsInjectionPolicyAllowed EnvVarsInjectionPolicy = "Allowed"

	// EnvVarsInjectionPolicyOverrides allows a SandboxClaim to inject new and override existing environment variables.
	EnvVarsInjectionPolicyOverrides EnvVarsInjectionPolicy = "Overrides"

	// EnvVarsInjectionPolicyDisallowed prevents a SandboxClaim from injecting any environment variables.
	EnvVarsInjectionPolicyDisallowed EnvVarsInjectionPolicy = "Disallowed"

	// VolumeClaimTemplatesPolicyDisallowed prevents a SandboxClaim from specifying any volume claim templates.
	VolumeClaimTemplatesPolicyDisallowed VolumeClaimTemplatesPolicy = "Disallowed"

	// VolumeClaimTemplatesPolicyAllowed allows a SandboxClaim to inject new volume claim templates, but not override existing ones.
	VolumeClaimTemplatesPolicyAllowed VolumeClaimTemplatesPolicy = "Allowed"

	// VolumeClaimTemplatesPolicyOverrides allows a SandboxClaim to inject new and override existing volume claim templates.
	VolumeClaimTemplatesPolicyOverrides VolumeClaimTemplatesPolicy = "Overrides"
)

Variables

View Source 
var (
	// GroupVersion is group version used to register these objects.
	GroupVersion = schema.GroupVersion{Group: "extensions.agents.x-k8s.io", Version: "v1beta1"}
	// SchemeGroupVersion is group version used to register these objects.
	SchemeGroupVersion = GroupVersion

	// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
	SchemeBuilder = runtime.NewSchemeBuilder(func(scheme *runtime.Scheme) error {
		metav1.AddToGroupVersion(scheme, GroupVersion)
		return nil
	})

	// AddToScheme adds the types in this group-version to the given scheme.
	AddToScheme = SchemeBuilder.AddToScheme
)

Functions

func Resource 

func Resource(resource string) schema.GroupResource

Resource takes an unqualified resource and returns a Group qualified GroupResource.

Types

type EnvVar 

type EnvVar struct {
	// name of the environment variable.
	// +required
	Name string `json:"name"`

	// value of the environment variable.
	// +required
	Value string `json:"value"`

	// containerName specifies the target container for the environment variable.
	// If not specified, it defaults to the first container defined in the template.
	// +optional
	ContainerName string `json:"containerName,omitempty"`
}

EnvVar represents a custom environment variable key-value pair.

func (*EnvVar) DeepCopy 

func (in *EnvVar) DeepCopy() *EnvVar

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvVar.

func (*EnvVar) DeepCopyInto 

func (in *EnvVar) DeepCopyInto(out *EnvVar)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EnvVarsInjectionPolicy 

type EnvVarsInjectionPolicy string

EnvVarsInjectionPolicy defines whether a SandboxClaim is allowed to inject or override environment variables.

type InventoryEntry 

type InventoryEntry struct {
	// name is the sandbox "<namespace>/<name>"; an unqualified name means the
	// default namespace.
	Name string `json:"name"`
	// id is the owning node's sandboxd claim id ("sb_..."), the handle its
	// sandbox-release verb needs. The aggregated apiserver surfaces it on the
	// synthesized Sandbox so Delete can release exactly this node-local microVM
	// (releasing by k8s name would target the wrong claim). Empty until the
	// node publishes it.
	// +optional
	ID string `json:"id,omitempty"`
	// phase is the node-reported sandbox phase (e.g. Running).
	Phase string `json:"phase"`
	// claimRef is the "<namespace>/<name>" of the SandboxClaim the sandbox is
	// bound to, if any.
	// +optional
	ClaimRef string `json:"claimRef,omitempty"`
	// addr is the sandbox "host:port" address, if published.
	// +optional
	Address string `json:"addr,omitempty"`
	// deadline is the node-granted lease expiry, if published.
	// +optional
	Deadline *metav1.Time `json:"deadline,omitempty"`
}

InventoryEntry is one live sandbox as summarized by its owning node.

func (*InventoryEntry) DeepCopy 

func (in *InventoryEntry) DeepCopy() *InventoryEntry

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InventoryEntry.

func (*InventoryEntry) DeepCopyInto 

func (in *InventoryEntry) DeepCopyInto(out *InventoryEntry)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type Lifecycle 

type Lifecycle struct {
	// shutdownTime is the absolute time when the SandboxClaim expires.
	// This time governs the lifecycle of the claim. It is not propagated to the
	// underlying Sandbox. Instead, the SandboxClaim controller enforces this
	// expiration by deleting the Sandbox resources when the time is reached.
	// If this field is omitted or set to nil, the SandboxClaim itself won't expire.
	// This implies unsetting a Sandbox's ShutdownTime via SandboxClaim isn't supported.
	// +kubebuilder:validation:Format="date-time"
	// +optional
	ShutdownTime *metav1.Time `json:"shutdownTime,omitempty"`

	// ttlSecondsAfterFinished limits how long a finished claim is retained.
	// The timer starts from the mirrored Finished condition's LastTransitionTime.
	// +kubebuilder:validation:Minimum=0
	// +optional
	TTLSecondsAfterFinished *int32 `json:"ttlSecondsAfterFinished,omitempty"`

	// shutdownPolicy determines the behavior when the SandboxClaim expires.
	// +kubebuilder:default=Retain
	// +optional
	ShutdownPolicy ShutdownPolicy `json:"shutdownPolicy,omitempty"`
}

Lifecycle defines the lifecycle management for the SandboxClaim.

func (*Lifecycle) DeepCopy 

func (in *Lifecycle) DeepCopy() *Lifecycle

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Lifecycle.

func (*Lifecycle) DeepCopyInto 

func (in *Lifecycle) DeepCopyInto(out *Lifecycle)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type NetworkPolicyManagement 

type NetworkPolicyManagement string

NetworkPolicyManagement defines whether the controller automatically generates and manages a shared NetworkPolicy for this template.

type NetworkPolicySpec 

type NetworkPolicySpec struct {
	// ingress is a list of ingress rules to be applied to the sandbox.
	// Traffic is allowed to the sandbox if it matches at least one rule.
	// If this list is empty, all ingress traffic is blocked (Default Deny).
	// +optional
	Ingress []networkingv1.NetworkPolicyIngressRule `json:"ingress,omitempty"`

	// egress is a list of egress rules to be applied to the sandbox.
	// Traffic is allowed out of the sandbox if it matches at least one rule.
	// If this list is empty, all egress traffic is blocked (Default Deny).
	// +optional
	Egress []networkingv1.NetworkPolicyEgressRule `json:"egress,omitempty"`
}

NetworkPolicySpec defines the desired state of the NetworkPolicy.

func (*NetworkPolicySpec) DeepCopy 

func (in *NetworkPolicySpec) DeepCopy() *NetworkPolicySpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkPolicySpec.

func (*NetworkPolicySpec) DeepCopyInto 

func (in *NetworkPolicySpec) DeepCopyInto(out *NetworkPolicySpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type NodeInventory 

type NodeInventory struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// node is the owning node name; it matches metadata.name.
	Node string `json:"node"`
	// entries summarizes the node's live sandboxes.
	// +optional
	Entries []InventoryEntry `json:"entries,omitempty"`
	// address is the node's sandboxd advertise address ("host:port"); the
	// aggregated apiserver routes a claim to this node's sandboxd through it.
	// +optional
	Address string `json:"address,omitempty"`
	// pools is the node's per-pool warm capacity, used to pick a node that
	// already holds a warm microVM for a requested (template, net, size).
	// +optional
	Pools []PoolCapacity `json:"pools,omitempty"`
}

NodeInventory is the single O(nodes) etcd object per node: the durable summary of that node's live sandboxes, server-side-applied on a slow cadence and scatter-gathered by the aggregated sandbox-apiserver. It is deliberately spec-less (pure reported summary, no desired state) and cluster-scoped with metadata.name equal to the node name. It lives in this CRD extensions group — NOT in the aggregated agents.x-k8s.io group, whose entire v1beta1 the APIService hands to the aggregated server (which serves only `sandboxes`).

func (*NodeInventory) DeepCopy 

func (in *NodeInventory) DeepCopy() *NodeInventory

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeInventory.

func (*NodeInventory) DeepCopyInto 

func (in *NodeInventory) DeepCopyInto(out *NodeInventory)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*NodeInventory) DeepCopyObject 

func (in *NodeInventory) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type NodeInventoryList 

type NodeInventoryList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NodeInventory `json:"items"`
}

NodeInventoryList contains a list of NodeInventory.

func (*NodeInventoryList) DeepCopy 

func (in *NodeInventoryList) DeepCopy() *NodeInventoryList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeInventoryList.

func (*NodeInventoryList) DeepCopyInto 

func (in *NodeInventoryList) DeepCopyInto(out *NodeInventoryList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*NodeInventoryList) DeepCopyObject 

func (in *NodeInventoryList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type PoolCapacity 

type PoolCapacity struct {
	// template is the pool's base image (the sandbox template).
	Template string `json:"template"`
	// net is the pool's network shape (e.g. "none", "egress").
	// +optional
	Net string `json:"net,omitempty"`
	// size is the pool's VM size class (e.g. "small").
	// +optional
	Size string `json:"size,omitempty"`
	// warm is the number of ready-to-claim warm microVMs currently in the pool.
	Warm int `json:"warm"`
	// target is the pool's desired warm depth.
	Target int `json:"target"`
}

PoolCapacity is one sandboxd warm pool's capacity as reported by its owning node's GET /v1/info: the pool key plus its warm/target counts. The aggregated apiserver reads it to pick a node that already holds a warm microVM for a requested (template, net, size).

func (*PoolCapacity) DeepCopy 

func (in *PoolCapacity) DeepCopy() *PoolCapacity

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PoolCapacity.

func (*PoolCapacity) DeepCopyInto 

func (in *PoolCapacity) DeepCopyInto(out *PoolCapacity)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SandboxClaim 

type SandboxClaim struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of Sandbox
	// +required
	Spec SandboxClaimSpec `json:"spec"`

	// status defines the observed state of Sandbox
	// +optional
	Status SandboxClaimStatus `json:"status,omitempty,omitzero"`
}

+genclient +kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:resource:scope=Namespaced,shortName=sandboxclaim +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status" +kubebuilder:printcolumn:name="Sandbox",type="string",JSONPath=".status.sandbox.name" +kubebuilder:printcolumn:name="Reason",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].reason" +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp" +kubebuilder:storageversion +kubebuilder:conversion:strategy=Webhook SandboxClaim is the Schema for the sandbox Claim API.

func (*SandboxClaim) DeepCopy 

func (in *SandboxClaim) DeepCopy() *SandboxClaim

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxClaim.

func (*SandboxClaim) DeepCopyInto 

func (in *SandboxClaim) DeepCopyInto(out *SandboxClaim)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*SandboxClaim) DeepCopyObject 

func (in *SandboxClaim) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*SandboxClaim) Hub 

func (*SandboxClaim) Hub()

Hub marks SandboxClaim as a conversion Hub.

type SandboxClaimList 

type SandboxClaimList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []SandboxClaim `json:"items"`
}

+kubebuilder:object:root=true SandboxList contains a list of Sandbox.

func (*SandboxClaimList) DeepCopy 

func (in *SandboxClaimList) DeepCopy() *SandboxClaimList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxClaimList.

func (*SandboxClaimList) DeepCopyInto 

func (in *SandboxClaimList) DeepCopyInto(out *SandboxClaimList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*SandboxClaimList) DeepCopyObject 

func (in *SandboxClaimList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type SandboxClaimSpec 

type SandboxClaimSpec struct {
	// warmPoolRef targets the specific pre-warmed infrastructure pool to check out from.
	// +required
	WarmPoolRef SandboxWarmPoolRef `json:"warmPoolRef"`

	// lifecycle defines when and how the SandboxClaim should be shut down.
	// +optional
	Lifecycle *Lifecycle `json:"lifecycle,omitempty"`

	// additionalPodMetadata defines the labels and annotations to be propagated to the Sandbox Pod.
	// Label values are limited to 63 characters and must match Kubernetes label value patterns.
	// +optional
	AdditionalPodMetadata sandboxv1beta1.PodMetadata `json:"additionalPodMetadata,omitempty"`

	// env is a list of environment variables to inject into the sandbox.
	// Please note adding this field means the Sandbox will always be cold-started from the
	// template of the warmpool.
	// +listType=atomic
	// +optional
	Env []EnvVar `json:"env,omitempty"`

	// volumeClaimTemplates is a list of persistent volume claims to be created for the sandbox.
	// Specifying this field forces a cold start because warm pool pods will not have these volumes.
	// +optional
	// +listType=atomic
	VolumeClaimTemplates []sandboxv1beta1.PersistentVolumeClaimTemplate `json:"volumeClaimTemplates,omitempty"`
}

SandboxClaimSpec defines the desired state of Sandbox.

func (*SandboxClaimSpec) DeepCopy 

func (in *SandboxClaimSpec) DeepCopy() *SandboxClaimSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxClaimSpec.

func (*SandboxClaimSpec) DeepCopyInto 

func (in *SandboxClaimSpec) DeepCopyInto(out *SandboxClaimSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SandboxClaimStatus 

type SandboxClaimStatus struct {
	// conditions represent the latest available observations of a Sandbox's current state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// sandbox defines the state of Sandbox
	// +optional
	SandboxStatus SandboxStatus `json:"sandbox,omitempty"`
}

SandboxClaimStatus defines the observed state of Sandbox.

func (*SandboxClaimStatus) DeepCopy 

func (in *SandboxClaimStatus) DeepCopy() *SandboxClaimStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxClaimStatus.

func (*SandboxClaimStatus) DeepCopyInto 

func (in *SandboxClaimStatus) DeepCopyInto(out *SandboxClaimStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SandboxStatus 

type SandboxStatus struct {
	// name is the name of the Sandbox created from this claim
	// +optional
	Name string `json:"name,omitempty"`

	// podIPs are the IP addresses of the underlying pod.
	// A pod may have multiple IPs in dual-stack clusters.
	// +optional
	PodIPs []string `json:"podIPs,omitempty"`
}

func (*SandboxStatus) DeepCopy 

func (in *SandboxStatus) DeepCopy() *SandboxStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxStatus.

func (*SandboxStatus) DeepCopyInto 

func (in *SandboxStatus) DeepCopyInto(out *SandboxStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SandboxTemplate 

type SandboxTemplate struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of Sandbox
	// +required
	Spec SandboxTemplateSpec `json:"spec"`
}

+genclient +kubebuilder:object:root=true +kubebuilder:resource:scope=Namespaced,shortName=sandboxtemplate +kubebuilder:storageversion +kubebuilder:conversion:strategy=Webhook SandboxTemplate is the Schema for the sandbox template API.

func (*SandboxTemplate) DeepCopy 

func (in *SandboxTemplate) DeepCopy() *SandboxTemplate

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxTemplate.

func (*SandboxTemplate) DeepCopyInto 

func (in *SandboxTemplate) DeepCopyInto(out *SandboxTemplate)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*SandboxTemplate) DeepCopyObject 

func (in *SandboxTemplate) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*SandboxTemplate) Hub 

func (*SandboxTemplate) Hub()

Hub marks SandboxTemplate as a conversion Hub.

type SandboxTemplateList 

type SandboxTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []SandboxTemplate `json:"items"`
}

+kubebuilder:object:root=true SandboxTemplateList contains a list of Sandbox.

func (*SandboxTemplateList) DeepCopy 

func (in *SandboxTemplateList) DeepCopy() *SandboxTemplateList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxTemplateList.

func (*SandboxTemplateList) DeepCopyInto 

func (in *SandboxTemplateList) DeepCopyInto(out *SandboxTemplateList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*SandboxTemplateList) DeepCopyObject 

func (in *SandboxTemplateList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type SandboxTemplateRef 

type SandboxTemplateRef struct {
	// name of the SandboxTemplate
	// +required
	Name string `json:"name"`
}

SandboxTemplateRef references a SandboxTemplate.

func (*SandboxTemplateRef) DeepCopy 

func (in *SandboxTemplateRef) DeepCopy() *SandboxTemplateRef

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxTemplateRef.

func (*SandboxTemplateRef) DeepCopyInto 

func (in *SandboxTemplateRef) DeepCopyInto(out *SandboxTemplateRef)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SandboxTemplateSpec 

type SandboxTemplateSpec struct {
	// SandboxBlueprint defines the workload configuration shared with SandboxSpec.
	// NOTE: Once a field is added here, it is promoted to both Sandbox and SandboxTemplate.
	// Since moving fields out is breaking, if unsure whether a new field should be shared,
	// define it in SandboxTemplateSpec (or SandboxSpec) first and promote it here later.
	sandboxv1beta1.SandboxBlueprint `json:",inline"`

	// networkPolicy defines the network policy to be applied to the sandboxes
	// created from this template. A single shared NetworkPolicy is created per Template.
	// Behavior is dictated by the NetworkPolicyManagement field:
	// - If Management is "Unmanaged": This field is completely ignored.
	// - If Management is "Managed" (default) and this field is omitted (nil): The controller
	//   automatically applies a strict Secure Default policy:
	//     * Ingress: Allow traffic only from the Sandbox Router.
	//     * Egress: Allow Public Internet only. Blocks internal IPs (RFC1918), Metadata Server, etc.
	// - If Management is "Managed" and this field is provided: The controller applies your custom rules.
	// Update Behavior:
	// Because the NetworkPolicy is shared at the template level, any updates to these rules
	// will be applied to the single shared policy object. The underlying Kubernetes CNI will then
	// dynamically enforce the updated rules across all existing and future sandboxes
	// referencing this template.
	// NOTE: This is a restricted subset of the standard Kubernetes NetworkPolicySpec.
	// Fields like 'PodSelector' and 'PolicyTypes' are intentionally excluded because
	// they are managed by the controller to ensure strict isolation and default-deny posture.
	// WARNING: This policy enforces a strict "Default Deny" ingress posture.
	// If your Pod uses sidecars (e.g., Istio proxy, monitoring agents) that listen
	// on their own ports, the NetworkPolicy will BLOCK traffic to them by default.
	// You MUST explicitly allow traffic to these sidecar ports using 'Ingress',
	// otherwise the sidecars may fail health checks.
	// +optional
	NetworkPolicy *NetworkPolicySpec `json:"networkPolicy,omitempty"`

	// networkPolicyManagement defines whether the controller manages the NetworkPolicy.
	// Valid values are "Managed" (default) or "Unmanaged".
	// +kubebuilder:validation:Enum=Managed;Unmanaged
	// +kubebuilder:default=Managed
	// +optional
	NetworkPolicyManagement NetworkPolicyManagement `json:"networkPolicyManagement,omitempty"`

	// envVarsInjectionPolicy allows a SandboxClaim to inject or override environment variables defined in the template.
	// If set to Disallowed, the SandboxClaim will be rejected if it specifies any environment variables.
	// +kubebuilder:validation:Enum=Allowed;Overrides;Disallowed
	// +kubebuilder:default=Disallowed
	// +optional
	EnvVarsInjectionPolicy EnvVarsInjectionPolicy `json:"envVarsInjectionPolicy,omitempty"`

	// volumeClaimTemplatesPolicy allows a SandboxClaim to inject or override volume claim templates defined in the template.
	// If set to Disallowed, the SandboxClaim will be rejected if it specifies any volume claim templates.
	// +kubebuilder:validation:Enum=Disallowed;Allowed;Overrides
	// +kubebuilder:default=Disallowed
	// +optional
	VolumeClaimTemplatesPolicy VolumeClaimTemplatesPolicy `json:"volumeClaimTemplatesPolicy,omitempty"`
}

SandboxTemplateSpec defines the desired state of Sandbox.

func (*SandboxTemplateSpec) DeepCopy 

func (in *SandboxTemplateSpec) DeepCopy() *SandboxTemplateSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxTemplateSpec.

func (*SandboxTemplateSpec) DeepCopyInto 

func (in *SandboxTemplateSpec) DeepCopyInto(out *SandboxTemplateSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SandboxWarmPool 

type SandboxWarmPool struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec defines the desired state of SandboxWarmPool
	// +required
	Spec SandboxWarmPoolSpec `json:"spec"`

	// status defines the observed state of SandboxWarmPool
	// +optional
	Status SandboxWarmPoolStatus `json:"status,omitempty"`
}

+genclient +kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:subresource:scale:specpath=.spec.replicas,statuspath=.status.replicas,selectorpath=.status.selector +kubebuilder:resource:scope=Namespaced,shortName=swp +kubebuilder:printcolumn:name="Ready",type="integer",JSONPath=".status.readyReplicas" +kubebuilder:printcolumn:name="Desired",type="integer",JSONPath=".spec.replicas" +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp" +kubebuilder:storageversion +kubebuilder:conversion:strategy=Webhook SandboxWarmPool is the Schema for the sandboxwarmpools API.

func (*SandboxWarmPool) DeepCopy 

func (in *SandboxWarmPool) DeepCopy() *SandboxWarmPool

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxWarmPool.

func (*SandboxWarmPool) DeepCopyInto 

func (in *SandboxWarmPool) DeepCopyInto(out *SandboxWarmPool)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*SandboxWarmPool) DeepCopyObject 

func (in *SandboxWarmPool) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*SandboxWarmPool) Hub 

func (*SandboxWarmPool) Hub()

Hub marks SandboxWarmPool as a conversion Hub.

type SandboxWarmPoolList 

type SandboxWarmPoolList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []SandboxWarmPool `json:"items"`
}

+kubebuilder:object:root=true SandboxWarmPoolList contains a list of SandboxWarmPool.

func (*SandboxWarmPoolList) DeepCopy 

func (in *SandboxWarmPoolList) DeepCopy() *SandboxWarmPoolList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxWarmPoolList.

func (*SandboxWarmPoolList) DeepCopyInto 

func (in *SandboxWarmPoolList) DeepCopyInto(out *SandboxWarmPoolList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*SandboxWarmPoolList) DeepCopyObject 

func (in *SandboxWarmPoolList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type SandboxWarmPoolRef 

type SandboxWarmPoolRef struct {
	// name of the SandboxWarmPool
	// +required
	Name string `json:"name"`
}

SandboxWarmPoolRef references a SandboxWarmPool.

func (*SandboxWarmPoolRef) DeepCopy 

func (in *SandboxWarmPoolRef) DeepCopy() *SandboxWarmPoolRef

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxWarmPoolRef.

func (*SandboxWarmPoolRef) DeepCopyInto 

func (in *SandboxWarmPoolRef) DeepCopyInto(out *SandboxWarmPoolRef)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SandboxWarmPoolSpec 

type SandboxWarmPoolSpec struct {
	// replicas is the desired number of sandboxes in the pool.
	// This field is controlled by an HPA if specified.
	// +optional
	// +kubebuilder:default=1
	// +kubebuilder:validation:Minimum=0
	Replicas *int32 `json:"replicas,omitempty"`

	// sandboxTemplateRef - name of the SandboxTemplate to be used for creating a Sandbox
	// Warning: Any change to the json tag "sandboxTemplateRef" must be synchronized with the TemplateRefField constant.
	// +required
	TemplateRef SandboxTemplateRef `json:"sandboxTemplateRef,omitempty"`

	// updateStrategy - strategy for updating the SandboxWarmPool pods based on sandboxTemplateRef name change or underlying template changes
	// +optional
	UpdateStrategy *SandboxWarmPoolUpdateStrategy `json:"updateStrategy,omitempty"`
}

SandboxWarmPoolSpec defines the desired state of SandboxWarmPool.

func (*SandboxWarmPoolSpec) DeepCopy 

func (in *SandboxWarmPoolSpec) DeepCopy() *SandboxWarmPoolSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxWarmPoolSpec.

func (*SandboxWarmPoolSpec) DeepCopyInto 

func (in *SandboxWarmPoolSpec) DeepCopyInto(out *SandboxWarmPoolSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SandboxWarmPoolStatus 

type SandboxWarmPoolStatus struct {
	// replicas is the total number of sandboxes in the pool.
	// +optional
	Replicas int32 `json:"replicas,omitempty"`

	// readyReplicas is the total number of sandboxes in the pool that are in a ready state.
	// +optional
	ReadyReplicas int32 `json:"readyReplicas,omitempty"`

	// selector is the label selector used to find the pods in the pool.
	// +optional
	Selector string `json:"selector,omitempty"`
}

SandboxWarmPoolStatus defines the observed state of SandboxWarmPool.

func (*SandboxWarmPoolStatus) DeepCopy 

func (in *SandboxWarmPoolStatus) DeepCopy() *SandboxWarmPoolStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxWarmPoolStatus.

func (*SandboxWarmPoolStatus) DeepCopyInto 

func (in *SandboxWarmPoolStatus) DeepCopyInto(out *SandboxWarmPoolStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SandboxWarmPoolUpdateStrategy 

type SandboxWarmPoolUpdateStrategy struct {
	// type indicates the type of the SandboxWarmPoolUpdateStrategy.
	// Default is OnReplenish.
	// +kubebuilder:default=OnReplenish
	// +optional
	Type SandboxWarmPoolUpdateStrategyType `json:"type,omitempty"`
}

SandboxWarmPoolUpdateStrategy defines the update strategy for the SandboxWarmPool.

func (*SandboxWarmPoolUpdateStrategy) DeepCopy 

func (in *SandboxWarmPoolUpdateStrategy) DeepCopy() *SandboxWarmPoolUpdateStrategy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SandboxWarmPoolUpdateStrategy.

func (*SandboxWarmPoolUpdateStrategy) DeepCopyInto 

func (in *SandboxWarmPoolUpdateStrategy) DeepCopyInto(out *SandboxWarmPoolUpdateStrategy)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SandboxWarmPoolUpdateStrategyType 

type SandboxWarmPoolUpdateStrategyType string

SandboxWarmPoolUpdateStrategyType is a string enumeration type that enumerates all possible update strategies for the SandboxWarmPool controller. +kubebuilder:validation:Enum=Recreate;OnReplenish 

const (
	// TemplateRefField is the field used for indexing SandboxWarmPools by their template reference name.
	// Warning: This path must exactly match the JSON tag path of SandboxWarmPoolSpec.TemplateRef.Name.
	// If the JSON tags are changed, this constant must be updated to avoid indexer failures.
	TemplateRefField = ".spec.sandboxTemplateRef.name"

	// RecreateSandboxWarmPoolUpdateStrategyType indicates that stale sandboxes are deleted immediately to ensure the pool only contains fresh sandboxes.
	// Note: This applies to changes in the template's SandboxBlueprint only. Changes to annotations, labels, or template-level policies do not trigger recreate.
	RecreateSandboxWarmPoolUpdateStrategyType SandboxWarmPoolUpdateStrategyType = "Recreate"
	// OnReplenishSandboxWarmPoolUpdateStrategyType indicates that stale sandboxes are only replaced when they are manually deleted or when these stale sandboxes are adopted by sandboxclaims and hence replaced by fresh sandboxes.
	OnReplenishSandboxWarmPoolUpdateStrategyType SandboxWarmPoolUpdateStrategyType = "OnReplenish"
)

type ShutdownPolicy 

type ShutdownPolicy string

ShutdownPolicy describes the policy for shutting down the underlying Sandbox when the SandboxClaim expires. +kubebuilder:validation:Enum=Delete;DeleteForeground;Retain

type VolumeClaimTemplatesPolicy 

type VolumeClaimTemplatesPolicy string

VolumeClaimTemplatesPolicy defines whether a SandboxClaim is allowed to inject or override volume claim templates.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.