mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Opus 4.6
8bde33f4d1
- Delete nessus Application CRD, manifests, and bootstrap script - Vendor envoy-gateway Helm chart (v1.6.3) locally to work around ArgoCD v3.3.3 Docker Hub OCI resolution bug - Re-enable auto-sync for envoy-gateway Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
477 lines
24 KiB
YAML
477 lines
24 KiB
YAML
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.18.0
|
|
name: backends.gateway.envoyproxy.io
|
|
spec:
|
|
group: gateway.envoyproxy.io
|
|
names:
|
|
categories:
|
|
- envoy-gateway
|
|
kind: Backend
|
|
listKind: BackendList
|
|
plural: backends
|
|
shortNames:
|
|
- be
|
|
singular: backend
|
|
scope: Namespaced
|
|
versions:
|
|
- additionalPrinterColumns:
|
|
- jsonPath: .status.conditions[?(@.type=="Accepted")].reason
|
|
name: Status
|
|
type: string
|
|
- jsonPath: .metadata.creationTimestamp
|
|
name: Age
|
|
type: date
|
|
name: v1alpha1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: |-
|
|
Backend allows the user to configure the endpoints of a backend and
|
|
the behavior of the connection from Envoy Proxy to the backend.
|
|
properties:
|
|
apiVersion:
|
|
description: |-
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
may reject unrecognized values.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is a string value representing the REST resource this object represents.
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
Cannot be updated.
|
|
In CamelCase.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: Spec defines the desired state of Backend.
|
|
properties:
|
|
appProtocols:
|
|
description: AppProtocols defines the application protocols to be
|
|
supported when connecting to the backend.
|
|
items:
|
|
description: AppProtocolType defines various backend applications
|
|
protocols supported by Envoy Gateway
|
|
enum:
|
|
- gateway.envoyproxy.io/h2c
|
|
- gateway.envoyproxy.io/ws
|
|
- gateway.envoyproxy.io/wss
|
|
type: string
|
|
type: array
|
|
endpoints:
|
|
description: Endpoints defines the endpoints to be used when connecting
|
|
to the backend.
|
|
items:
|
|
description: |-
|
|
BackendEndpoint describes a backend endpoint, which can be either a fully-qualified domain name, IP address or unix domain socket
|
|
corresponding to Envoy's Address: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/address.proto#config-core-v3-address
|
|
properties:
|
|
fqdn:
|
|
description: FQDN defines a FQDN endpoint
|
|
properties:
|
|
hostname:
|
|
description: Hostname defines the FQDN hostname of the backend
|
|
endpoint.
|
|
maxLength: 253
|
|
minLength: 1
|
|
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
type: string
|
|
port:
|
|
description: Port defines the port of the backend endpoint.
|
|
format: int32
|
|
maximum: 65535
|
|
minimum: 0
|
|
type: integer
|
|
required:
|
|
- hostname
|
|
- port
|
|
type: object
|
|
hostname:
|
|
description: Hostname defines an optional hostname for the backend
|
|
endpoint.
|
|
maxLength: 253
|
|
minLength: 1
|
|
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
type: string
|
|
ip:
|
|
description: IP defines an IP endpoint. Supports both IPv4 and
|
|
IPv6 addresses.
|
|
properties:
|
|
address:
|
|
description: |-
|
|
Address defines the IP address of the backend endpoint.
|
|
Supports both IPv4 and IPv6 addresses.
|
|
maxLength: 45
|
|
minLength: 3
|
|
pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(([0-9a-fA-F]{1,4}:){1,7}[0-9a-fA-F]{1,4}|::|(([0-9a-fA-F]{1,4}:){0,5})?(:[0-9a-fA-F]{1,4}){1,2})$
|
|
type: string
|
|
port:
|
|
description: Port defines the port of the backend endpoint.
|
|
format: int32
|
|
maximum: 65535
|
|
minimum: 0
|
|
type: integer
|
|
required:
|
|
- address
|
|
- port
|
|
type: object
|
|
unix:
|
|
description: Unix defines the unix domain socket endpoint
|
|
properties:
|
|
path:
|
|
description: |-
|
|
Path defines the unix domain socket path of the backend endpoint.
|
|
The path length must not exceed 108 characters.
|
|
type: string
|
|
x-kubernetes-validations:
|
|
- message: unix domain socket path must not exceed 108 characters
|
|
rule: size(self) <= 108
|
|
required:
|
|
- path
|
|
type: object
|
|
zone:
|
|
description: Zone defines the service zone of the backend endpoint.
|
|
type: string
|
|
type: object
|
|
x-kubernetes-validations:
|
|
- message: one of fqdn, ip or unix must be specified
|
|
rule: (has(self.fqdn) || has(self.ip) || has(self.unix))
|
|
- message: only one of fqdn, ip or unix can be specified
|
|
rule: ((has(self.fqdn) && !(has(self.ip) || has(self.unix))) ||
|
|
(has(self.ip) && !(has(self.fqdn) || has(self.unix))) || (has(self.unix)
|
|
&& !(has(self.ip) || has(self.fqdn))))
|
|
maxItems: 64
|
|
minItems: 1
|
|
type: array
|
|
x-kubernetes-validations:
|
|
- message: fqdn addresses cannot be mixed with other address types
|
|
rule: self.all(f, has(f.fqdn)) || !self.exists(f, has(f.fqdn))
|
|
fallback:
|
|
description: |-
|
|
Fallback indicates whether the backend is designated as a fallback.
|
|
It is highly recommended to configure active or passive health checks to ensure that failover can be detected
|
|
when the active backends become unhealthy and to automatically readjust once the primary backends are healthy again.
|
|
The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when
|
|
the health of the active backends falls below 72%.
|
|
type: boolean
|
|
tls:
|
|
description: |-
|
|
TLS defines the TLS settings for the backend.
|
|
If TLS is specified here and a BackendTLSPolicy is also configured for the backend, the final TLS settings will
|
|
be a merge of both configurations. In case of overlapping fields, the values defined in the BackendTLSPolicy will
|
|
take precedence.
|
|
properties:
|
|
alpnProtocols:
|
|
description: |-
|
|
ALPNProtocols supplies the list of ALPN protocols that should be
|
|
exposed by the listener or used by the proxy to connect to the backend.
|
|
Defaults:
|
|
1. HTTPS Routes: h2 and http/1.1 are enabled in listener context.
|
|
2. Other Routes: ALPN is disabled.
|
|
3. Backends: proxy uses the appropriate ALPN options for the backend protocol.
|
|
When an empty list is provided, the ALPN TLS extension is disabled.
|
|
|
|
Defaults to [h2, http/1.1] if not specified.
|
|
|
|
Typical Supported values are:
|
|
- http/1.0
|
|
- http/1.1
|
|
- h2
|
|
items:
|
|
description: ALPNProtocol specifies the protocol to be negotiated
|
|
using ALPN
|
|
type: string
|
|
type: array
|
|
caCertificateRefs:
|
|
description: |-
|
|
CACertificateRefs contains one or more references to Kubernetes objects that
|
|
contain TLS certificates of the Certificate Authorities that can be used
|
|
as a trust anchor to validate the certificates presented by the backend.
|
|
|
|
A single reference to a Kubernetes ConfigMap or a Kubernetes Secret,
|
|
with the CA certificate in a key named `ca.crt` is currently supported.
|
|
|
|
If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
|
|
specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
|
|
not both.
|
|
items:
|
|
description: |-
|
|
LocalObjectReference identifies an API object within the namespace of the
|
|
referrer.
|
|
The API object must be valid in the cluster; the Group and Kind must
|
|
be registered in the cluster for this reference to be valid.
|
|
|
|
References to objects with invalid Group and Kind are not valid, and must
|
|
be rejected by the implementation, with appropriate Conditions set
|
|
on the containing object.
|
|
properties:
|
|
group:
|
|
description: |-
|
|
Group is the group of the referent. For example, "gateway.networking.k8s.io".
|
|
When unspecified or empty string, core API group is inferred.
|
|
maxLength: 253
|
|
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
type: string
|
|
kind:
|
|
description: Kind is kind of the referent. For example "HTTPRoute"
|
|
or "Service".
|
|
maxLength: 63
|
|
minLength: 1
|
|
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
|
type: string
|
|
name:
|
|
description: Name is the name of the referent.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
required:
|
|
- group
|
|
- kind
|
|
- name
|
|
type: object
|
|
maxItems: 8
|
|
type: array
|
|
ciphers:
|
|
description: |-
|
|
Ciphers specifies the set of cipher suites supported when
|
|
negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.
|
|
In non-FIPS Envoy Proxy builds the default cipher list is:
|
|
- [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
|
|
- [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
|
|
- ECDHE-ECDSA-AES256-GCM-SHA384
|
|
- ECDHE-RSA-AES256-GCM-SHA384
|
|
In builds using BoringSSL FIPS the default cipher list is:
|
|
- ECDHE-ECDSA-AES128-GCM-SHA256
|
|
- ECDHE-RSA-AES128-GCM-SHA256
|
|
- ECDHE-ECDSA-AES256-GCM-SHA384
|
|
- ECDHE-RSA-AES256-GCM-SHA384
|
|
items:
|
|
type: string
|
|
type: array
|
|
clientCertificateRef:
|
|
description: |-
|
|
ClientCertificateRef defines the reference to a Kubernetes Secret that contains
|
|
the client certificate and private key for Envoy to use when connecting to
|
|
backend services and external services, such as ExtAuth, ALS, OpenTelemetry, etc.
|
|
This secret should be located within the same namespace as the Envoy proxy resource that references it.
|
|
properties:
|
|
group:
|
|
default: ""
|
|
description: |-
|
|
Group is the group of the referent. For example, "gateway.networking.k8s.io".
|
|
When unspecified or empty string, core API group is inferred.
|
|
maxLength: 253
|
|
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
type: string
|
|
kind:
|
|
default: Secret
|
|
description: Kind is kind of the referent. For example "Secret".
|
|
maxLength: 63
|
|
minLength: 1
|
|
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
|
type: string
|
|
name:
|
|
description: Name is the name of the referent.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
namespace:
|
|
description: |-
|
|
Namespace is the namespace of the referenced object. When unspecified, the local
|
|
namespace is inferred.
|
|
|
|
Note that when a namespace different than the local namespace is specified,
|
|
a ReferenceGrant object is required in the referent namespace to allow that
|
|
namespace's owner to accept the reference. See the ReferenceGrant
|
|
documentation for details.
|
|
|
|
Support: Core
|
|
maxLength: 63
|
|
minLength: 1
|
|
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
|
type: string
|
|
required:
|
|
- name
|
|
type: object
|
|
ecdhCurves:
|
|
description: |-
|
|
ECDHCurves specifies the set of supported ECDH curves.
|
|
In non-FIPS Envoy Proxy builds the default curves are:
|
|
- X25519
|
|
- P-256
|
|
In builds using BoringSSL FIPS the default curve is:
|
|
- P-256
|
|
items:
|
|
type: string
|
|
type: array
|
|
insecureSkipVerify:
|
|
default: false
|
|
description: |-
|
|
InsecureSkipVerify indicates whether the upstream's certificate verification
|
|
should be skipped. Defaults to "false".
|
|
type: boolean
|
|
maxVersion:
|
|
description: |-
|
|
Max specifies the maximal TLS protocol version to allow
|
|
The default is TLS 1.3 if this is not specified.
|
|
enum:
|
|
- Auto
|
|
- "1.0"
|
|
- "1.1"
|
|
- "1.2"
|
|
- "1.3"
|
|
type: string
|
|
minVersion:
|
|
description: |-
|
|
Min specifies the minimal TLS protocol version to allow.
|
|
The default is TLS 1.2 if this is not specified.
|
|
enum:
|
|
- Auto
|
|
- "1.0"
|
|
- "1.1"
|
|
- "1.2"
|
|
- "1.3"
|
|
type: string
|
|
signatureAlgorithms:
|
|
description: |-
|
|
SignatureAlgorithms specifies which signature algorithms the listener should
|
|
support.
|
|
items:
|
|
type: string
|
|
type: array
|
|
sni:
|
|
description: |-
|
|
SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.
|
|
|
|
Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:
|
|
1. Backend resources that do not set SNI, or
|
|
2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them
|
|
|
|
When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence
|
|
over this value.
|
|
maxLength: 253
|
|
minLength: 1
|
|
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
|
type: string
|
|
wellKnownCACertificates:
|
|
description: |-
|
|
WellKnownCACertificates specifies whether system CA certificates may be used in
|
|
the TLS handshake between the gateway and backend pod.
|
|
|
|
If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
|
|
must be specified with at least one entry for a valid configuration. Only one of
|
|
CACertificateRefs or WellKnownCACertificates may be specified, not both.
|
|
enum:
|
|
- System
|
|
type: string
|
|
type: object
|
|
x-kubernetes-validations:
|
|
- message: must not contain both CACertificateRefs and WellKnownCACertificates
|
|
rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs)
|
|
> 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates
|
|
!= "")'
|
|
- message: must not contain either CACertificateRefs or WellKnownCACertificates
|
|
when InsecureSkipVerify is enabled
|
|
rule: '!((has(self.insecureSkipVerify) && self.insecureSkipVerify)
|
|
&& ((has(self.caCertificateRefs) && size(self.caCertificateRefs)
|
|
> 0) || (has(self.wellKnownCACertificates) && self.wellKnownCACertificates
|
|
!= "")))'
|
|
- message: setting ciphers has no effect if the minimum possible TLS
|
|
version is 1.3
|
|
rule: 'has(self.minVersion) && self.minVersion == ''1.3'' ? !has(self.ciphers)
|
|
: true'
|
|
- message: minVersion must be smaller or equal to maxVersion
|
|
rule: 'has(self.minVersion) && has(self.maxVersion) ? {"Auto":0,"1.0":1,"1.1":2,"1.2":3,"1.3":4}[self.minVersion]
|
|
<= {"1.0":1,"1.1":2,"1.2":3,"1.3":4,"Auto":5}[self.maxVersion]
|
|
: !has(self.minVersion) && has(self.maxVersion) ? 3 <= {"1.0":1,"1.1":2,"1.2":3,"1.3":4,"Auto":5}[self.maxVersion]
|
|
: true'
|
|
type:
|
|
default: Endpoints
|
|
description: Type defines the type of the backend. Defaults to "Endpoints"
|
|
enum:
|
|
- Endpoints
|
|
- DynamicResolver
|
|
type: string
|
|
type: object
|
|
x-kubernetes-validations:
|
|
- message: DynamicResolver type cannot have endpoints specified
|
|
rule: self.type != 'DynamicResolver' || !has(self.endpoints)
|
|
status:
|
|
description: Status defines the current status of Backend.
|
|
properties:
|
|
conditions:
|
|
description: Conditions describe the current conditions of the Backend.
|
|
items:
|
|
description: Condition contains details for one aspect of the current
|
|
state of this API Resource.
|
|
properties:
|
|
lastTransitionTime:
|
|
description: |-
|
|
lastTransitionTime is the last time the condition transitioned from one status to another.
|
|
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
|
format: date-time
|
|
type: string
|
|
message:
|
|
description: |-
|
|
message is a human readable message indicating details about the transition.
|
|
This may be an empty string.
|
|
maxLength: 32768
|
|
type: string
|
|
observedGeneration:
|
|
description: |-
|
|
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
|
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
|
with respect to the current state of the instance.
|
|
format: int64
|
|
minimum: 0
|
|
type: integer
|
|
reason:
|
|
description: |-
|
|
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
|
Producers of specific condition types may define expected values and meanings for this field,
|
|
and whether the values are considered a guaranteed API.
|
|
The value should be a CamelCase string.
|
|
This field may not be empty.
|
|
maxLength: 1024
|
|
minLength: 1
|
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
|
type: string
|
|
status:
|
|
description: status of the condition, one of True, False, Unknown.
|
|
enum:
|
|
- "True"
|
|
- "False"
|
|
- Unknown
|
|
type: string
|
|
type:
|
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
|
maxLength: 316
|
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
type: string
|
|
required:
|
|
- lastTransitionTime
|
|
- message
|
|
- reason
|
|
- status
|
|
- type
|
|
type: object
|
|
maxItems: 8
|
|
type: array
|
|
x-kubernetes-list-map-keys:
|
|
- type
|
|
x-kubernetes-list-type: map
|
|
type: object
|
|
required:
|
|
- spec
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|