@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
3
3
kind : CustomResourceDefinition
4
4
metadata :
5
5
annotations :
6
- controller-gen.kubebuilder.io/version : v0.15.0
6
+ controller-gen.kubebuilder.io/version : v0.16.1
7
7
labels :
8
8
gateway.networking.k8s.io/policy : inherited
9
9
name : clientsettingspolicies.gateway.nginx.org
@@ -160,27 +160,22 @@ spec:
160
160
the controller first sees the policy and SHOULD update the entry as
161
161
appropriate when the relevant ancestor is modified.
162
162
163
-
164
163
Note that choosing the relevant ancestor is left to the Policy designers;
165
164
an important part of Policy design is designing the right object level at
166
165
which to namespace this status.
167
166
168
-
169
167
Note also that implementations MUST ONLY populate ancestor status for
170
168
the Ancestor resources they are responsible for. Implementations MUST
171
169
use the ControllerName field to uniquely identify the entries in this list
172
170
that they are responsible for.
173
171
174
-
175
172
Note that to achieve this, the list of PolicyAncestorStatus structs
176
173
MUST be treated as a map with a composite key, made up of the AncestorRef
177
174
and ControllerName fields combined.
178
175
179
-
180
176
A maximum of 16 ancestors will be represented in this list. An empty list
181
177
means the Policy is not relevant for any ancestors.
182
178
183
-
184
179
If this slice is full, implementations MUST NOT add further entries.
185
180
Instead they MUST consider the policy unimplementable and signal that
186
181
on any related resources such as the ancestor that would be referenced
@@ -192,7 +187,6 @@ spec:
192
187
PolicyAncestorStatus describes the status of a route with respect to an
193
188
associated Ancestor.
194
189
195
-
196
190
Ancestors refer to objects that are either the Target of a policy or above it
197
191
in terms of object hierarchy. For example, if a policy targets a Service, the
198
192
Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
@@ -201,28 +195,23 @@ spec:
201
195
SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
202
196
have a _very_ good reason otherwise.
203
197
204
-
205
198
In the context of policy attachment, the Ancestor is used to distinguish which
206
199
resource results in a distinct application of this policy. For example, if a policy
207
200
targets a Service, it may have a distinct result per attached Gateway.
208
201
209
-
210
202
Policies targeting the same resource may have different effects depending on the
211
203
ancestors of those resources. For example, different Gateways targeting the same
212
204
Service may have different capabilities, especially if they have different underlying
213
205
implementations.
214
206
215
-
216
207
For example, in BackendTLSPolicy, the Policy attaches to a Service that is
217
208
used as a backend in a HTTPRoute that is itself attached to a Gateway.
218
209
In this case, the relevant object for status is the Gateway, and that is the
219
210
ancestor object referred to in this status.
220
211
221
-
222
212
Note that a parent is also an ancestor, so for objects where the parent is the
223
213
relevant object for status, this struct SHOULD still be used.
224
214
225
-
226
215
This struct is intended to be used in a slice that's effectively a map,
227
216
with a composite key made up of the AncestorRef and the ControllerName.
228
217
properties :
@@ -239,7 +228,6 @@ spec:
239
228
To set the core API group (such as for a "Service" kind referent),
240
229
Group must be explicitly set to "" (empty string).
241
230
242
-
243
231
Support: Core
244
232
maxLength : 253
245
233
pattern : ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
@@ -249,14 +237,11 @@ spec:
249
237
description : |-
250
238
Kind is kind of the referent.
251
239
252
-
253
240
There are two kinds of parent resources with "Core" support:
254
241
255
-
256
242
* Gateway (Gateway conformance profile)
257
243
* Service (Mesh conformance profile, ClusterIP Services only)
258
244
259
-
260
245
Support for other resources is Implementation-Specific.
261
246
maxLength : 63
262
247
minLength : 1
@@ -266,7 +251,6 @@ spec:
266
251
description : |-
267
252
Name is the name of the referent.
268
253
269
-
270
254
Support: Core
271
255
maxLength : 253
272
256
minLength : 1
@@ -276,28 +260,24 @@ spec:
276
260
Namespace is the namespace of the referent. When unspecified, this refers
277
261
to the local namespace of the Route.
278
262
279
-
280
263
Note that there are specific rules for ParentRefs which cross namespace
281
264
boundaries. Cross-namespace references are only valid if they are explicitly
282
265
allowed by something in the namespace they are referring to. For example:
283
266
Gateway has the AllowedRoutes field, and ReferenceGrant provides a
284
267
generic way to enable any other kind of cross-namespace reference.
285
268
286
-
287
269
<gateway:experimental:description>
288
270
ParentRefs from a Route to a Service in the same namespace are "producer"
289
271
routes, which apply default routing rules to inbound connections from
290
272
any namespace to the Service.
291
273
292
-
293
274
ParentRefs from a Route to a Service in a different namespace are
294
275
"consumer" routes, and these routing rules are only applied to outbound
295
276
connections originating from the same namespace as the Route, for which
296
277
the intended destination of the connections are a Service targeted as a
297
278
ParentRef of the Route.
298
279
</gateway:experimental:description>
299
280
300
-
301
281
Support: Core
302
282
maxLength : 63
303
283
minLength : 1
@@ -308,7 +288,6 @@ spec:
308
288
Port is the network port this Route targets. It can be interpreted
309
289
differently based on the type of parent resource.
310
290
311
-
312
291
When the parent resource is a Gateway, this targets all listeners
313
292
listening on the specified port that also support this kind of Route(and
314
293
select this Route). It's not recommended to set `Port` unless the
@@ -317,19 +296,16 @@ spec:
317
296
and SectionName are specified, the name and port of the selected listener
318
297
must match both specified values.
319
298
320
-
321
299
<gateway:experimental:description>
322
300
When the parent resource is a Service, this targets a specific port in the
323
301
Service spec. When both Port (experimental) and SectionName are specified,
324
302
the name and port of the selected port must match both specified values.
325
303
</gateway:experimental:description>
326
304
327
-
328
305
Implementations MAY choose to support other parent resources.
329
306
Implementations supporting other types of parent resources MUST clearly
330
307
document how/if Port is interpreted.
331
308
332
-
333
309
For the purpose of status, an attachment is considered successful as
334
310
long as the parent resource accepts it partially. For example, Gateway
335
311
listeners can restrict which Routes can attach to them by Route kind,
@@ -338,7 +314,6 @@ spec:
338
314
attached. If no Gateway listeners accept attachment from this Route,
339
315
the Route MUST be considered detached from the Gateway.
340
316
341
-
342
317
Support: Extended
343
318
format : int32
344
319
maximum : 65535
@@ -349,20 +324,17 @@ spec:
349
324
SectionName is the name of a section within the target resource. In the
350
325
following resources, SectionName is interpreted as the following:
351
326
352
-
353
327
* Gateway: Listener name. When both Port (experimental) and SectionName
354
328
are specified, the name and port of the selected listener must match
355
329
both specified values.
356
330
* Service: Port name. When both Port (experimental) and SectionName
357
331
are specified, the name and port of the selected listener must match
358
332
both specified values.
359
333
360
-
361
334
Implementations MAY choose to support attaching Routes to other resources.
362
335
If that is the case, they MUST clearly document how SectionName is
363
336
interpreted.
364
337
365
-
366
338
When unspecified (empty string), this will reference the entire resource.
367
339
For the purpose of status, an attachment is considered successful if at
368
340
least one section in the parent resource accepts it. For example, Gateway
@@ -372,7 +344,6 @@ spec:
372
344
attached. If no Gateway listeners accept attachment from this Route, the
373
345
Route MUST be considered detached from the Gateway.
374
346
375
-
376
347
Support: Core
377
348
maxLength : 253
378
349
minLength : 1
@@ -385,18 +356,8 @@ spec:
385
356
description : Conditions describes the status of the Policy with
386
357
respect to the given Ancestor.
387
358
items :
388
- description : " Condition contains details for one aspect of
389
- the current state of this API Resource.\n ---\n This struct
390
- is intended for direct use as an array at the field path
391
- .status.conditions. For example,\n\n\n\t type FooStatus
392
- struct{\n\t // Represents the observations of a foo's
393
- current state.\n\t // Known .status.conditions.type are:
394
- \" Available\" , \" Progressing\" , and \" Degraded\"\n\t //
395
- +patchMergeKey=type\n\t // +patchStrategy=merge\n\t //
396
- +listType=map\n\t // +listMapKey=type\n\t Conditions
397
- []metav1.Condition `json:\" conditions,omitempty\" patchStrategy:\" merge\"
398
- patchMergeKey:\" type\" protobuf:\" bytes,1,rep,name=conditions\" `\n\n\n\t
399
- \ // other fields\n\t }"
359
+ description : Condition contains details for one aspect of
360
+ the current state of this API Resource.
400
361
properties :
401
362
lastTransitionTime :
402
363
description : |-
@@ -438,12 +399,7 @@ spec:
438
399
- Unknown
439
400
type : string
440
401
type :
441
- description : |-
442
- type of condition in CamelCase or in foo.example.com/CamelCase.
443
- ---
444
- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
445
- useful (see .node.status.conditions), the ability to deconflict is important.
446
- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
402
+ description : type of condition in CamelCase or in foo.example.com/CamelCase.
447
403
maxLength : 316
448
404
pattern : ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
449
405
type : string
@@ -466,15 +422,12 @@ spec:
466
422
controller that wrote this status. This corresponds with the
467
423
controllerName field on GatewayClass.
468
424
469
-
470
425
Example: "example.net/gateway-controller".
471
426
472
-
473
427
The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
474
428
valid Kubernetes names
475
429
(https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
476
430
477
-
478
431
Controllers MUST populate this field when writing status. Controllers should ensure that
479
432
entries to status populated with their ControllerName are cleaned up when they are no
480
433
longer necessary.
0 commit comments