--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.23.0 name: proxies.praxis.io spec: group: praxis.io names: kind: Proxy listKind: ProxyList plural: proxies singular: proxy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.image name: Image type: string - jsonPath: .spec.replicas name: Replicas type: integer - jsonPath: .status.conditions[?(@.type=="Ready")].status name: Ready type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: Proxy owns the Praxis Deployment, Service, config, assets, and listeners. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ProxySpec defines the runtime image, listeners, filter chains, and service for a Praxis proxy. properties: admin: description: admin configures the Praxis admin interface. properties: address: description: address is the admin bind address and port (e.g. "127.0.0.1:19901"). minLength: 1 type: string required: - address type: object filterChains: description: filterChains defines reusable filter chains, referenced by name from listeners. items: description: ProxyFilterChain defines an ordered list of filter and policy uses within a proxy. properties: conditions: description: |- conditions are chain-level request gates inherited by every filter in this chain. Each filter's effective conditions are the chain conditions followed by its own (AND-composed). items: description: |- PraxisRequestCondition gates a filter entry on request properties. Exactly one of when or unless must be set. properties: unless: description: unless skips the entry when the request matches. properties: boundUpstream: description: boundUpstream matches the request's bound logical upstream metadata. properties: applicationProtocol: description: applicationProtocol is the selected cluster's application protocol. type: string applicationProvider: description: applicationProvider is the selected cluster's application provider. type: string type: object grpc: description: grpc matches or excludes gRPC requests. type: boolean headers: additionalProperties: type: string description: headers requires all named request headers to match. type: object headersPresent: description: headersPresent requires all named request headers to be present, regardless of value. items: type: string type: array methods: description: methods matches any listed HTTP method. items: type: string type: array path: description: path is an exact request path match. type: string pathPrefix: description: pathPrefix is a segment-boundary path prefix match. type: string selectedUpstream: description: selectedUpstream matches metadata published by an earlier load balancer. properties: applicationProtocol: description: applicationProtocol is the selected cluster's application protocol. type: string applicationProvider: description: applicationProvider is the selected cluster's application provider. type: string type: object type: object when: description: when runs the entry only when the request matches. properties: boundUpstream: description: boundUpstream matches the request's bound logical upstream metadata. properties: applicationProtocol: description: applicationProtocol is the selected cluster's application protocol. type: string applicationProvider: description: applicationProvider is the selected cluster's application provider. type: string type: object grpc: description: grpc matches or excludes gRPC requests. type: boolean headers: additionalProperties: type: string description: headers requires all named request headers to match. type: object headersPresent: description: headersPresent requires all named request headers to be present, regardless of value. items: type: string type: array methods: description: methods matches any listed HTTP method. items: type: string type: array path: description: path is an exact request path match. type: string pathPrefix: description: pathPrefix is a segment-boundary path prefix match. type: string selectedUpstream: description: selectedUpstream matches metadata published by an earlier load balancer. properties: applicationProtocol: description: applicationProtocol is the selected cluster's application protocol. type: string applicationProvider: description: applicationProvider is the selected cluster's application provider. type: string type: object type: object type: object x-kubernetes-validations: - message: exactly one of when or unless must be set rule: has(self.when) != has(self.unless) type: array filters: description: filters is a non-empty ordered list of filter/policy entries. items: description: |- PraxisFilterEntry is a single use of a filter or policy definition in a chain. Exactly one of ref or inlineFilter must be set. properties: conditions: description: conditions are request gates for this entry. Empty means always eligible. items: description: |- PraxisRequestCondition gates a filter entry on request properties. Exactly one of when or unless must be set. properties: unless: description: unless skips the entry when the request matches. properties: boundUpstream: description: boundUpstream matches the request's bound logical upstream metadata. properties: applicationProtocol: description: applicationProtocol is the selected cluster's application protocol. type: string applicationProvider: description: applicationProvider is the selected cluster's application provider. type: string type: object grpc: description: grpc matches or excludes gRPC requests. type: boolean headers: additionalProperties: type: string description: headers requires all named request headers to match. type: object headersPresent: description: headersPresent requires all named request headers to be present, regardless of value. items: type: string type: array methods: description: methods matches any listed HTTP method. items: type: string type: array path: description: path is an exact request path match. type: string pathPrefix: description: pathPrefix is a segment-boundary path prefix match. type: string selectedUpstream: description: selectedUpstream matches metadata published by an earlier load balancer. properties: applicationProtocol: description: applicationProtocol is the selected cluster's application protocol. type: string applicationProvider: description: applicationProvider is the selected cluster's application provider. type: string type: object type: object when: description: when runs the entry only when the request matches. properties: boundUpstream: description: boundUpstream matches the request's bound logical upstream metadata. properties: applicationProtocol: description: applicationProtocol is the selected cluster's application protocol. type: string applicationProvider: description: applicationProvider is the selected cluster's application provider. type: string type: object grpc: description: grpc matches or excludes gRPC requests. type: boolean headers: additionalProperties: type: string description: headers requires all named request headers to match. type: object headersPresent: description: headersPresent requires all named request headers to be present, regardless of value. items: type: string type: array methods: description: methods matches any listed HTTP method. items: type: string type: array path: description: path is an exact request path match. type: string pathPrefix: description: pathPrefix is a segment-boundary path prefix match. type: string selectedUpstream: description: selectedUpstream matches metadata published by an earlier load balancer. properties: applicationProtocol: description: applicationProtocol is the selected cluster's application protocol. type: string applicationProvider: description: applicationProvider is the selected cluster's application provider. type: string type: object type: object type: object x-kubernetes-validations: - message: exactly one of when or unless must be set rule: has(self.when) != has(self.unless) type: array failureMode: default: closed description: 'failureMode controls runtime behavior on filter errors: closed (default) or open.' enum: - closed - open type: string inlineFilter: description: inlineFilter defines a filter directly without a separate resource. properties: config: description: 'config is filter-specific configuration, flattened beside filter: in native config.' type: object x-kubernetes-preserve-unknown-fields: true type: description: type is the registered Praxis filter name. minLength: 1 type: string required: - type type: object name: description: name is a unique entry name for diagnostics and repeated uses of one definition. minLength: 1 type: string ref: description: ref identifies the filter or policy definition to instantiate. properties: group: description: group is the API group of the referenced resource (e.g. "praxis.io"). minLength: 1 type: string kind: description: kind is the kind of the referenced resource (e.g. "Policy"). minLength: 1 type: string name: description: name is the name of the referenced resource. minLength: 1 type: string namespace: description: |- namespace is the namespace of the referenced resource. Defaults to the namespace of the containing Proxy. type: string version: description: version is the API version of the referenced resource (e.g. "v1alpha1"). type: string required: - group - kind - name type: object responseConditions: description: |- responseConditions are additional response gates. A filter skipped on request cannot run on response. items: description: |- PraxisResponseCondition gates a filter entry on response properties. Exactly one of when or unless must be set. properties: unless: description: unless skips response hooks when the response matches. properties: headers: additionalProperties: type: string description: headers requires all named response headers to match. type: object headersPresent: description: headersPresent requires all named response headers to be present, regardless of value. items: type: string type: array status: description: status matches one of the listed HTTP status codes (100-599). items: format: int32 maximum: 599 minimum: 100 type: integer type: array type: object when: description: when runs response hooks only when the response matches. properties: headers: additionalProperties: type: string description: headers requires all named response headers to match. type: object headersPresent: description: headersPresent requires all named response headers to be present, regardless of value. items: type: string type: array status: description: status matches one of the listed HTTP status codes (100-599). items: format: int32 maximum: 599 minimum: 100 type: integer type: array type: object type: object x-kubernetes-validations: - message: exactly one of when or unless must be set rule: has(self.when) != has(self.unless) type: array required: - name type: object x-kubernetes-validations: - message: exactly one of ref or inlineFilter must be set rule: has(self.ref) != has(self.inlineFilter) minItems: 1 type: array x-kubernetes-list-type: atomic name: description: name is the unique chain name within this proxy. minLength: 1 type: string required: - filters - name type: object type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map image: description: image is the Praxis runtime image, subject to the operator's approved runtime policy. minLength: 1 type: string insecureOptions: description: insecureOptions configures insecure runtime options that relax safety defaults. properties: allowPrivateEndpoints: description: allowPrivateEndpoints permits routing to RFC 1918 addresses. type: boolean allowUnboundedBody: description: allowUnboundedBody disables body size limits. type: boolean type: object listeners: description: listeners is a non-empty list of listeners, keyed by unique name. items: description: PraxisListener defines a single listener on the proxy. properties: bindAddress: default: 0.0.0.0 description: |- bindAddress is the IP the listener binds to in the native config. Defaults to "0.0.0.0". type: string filterChains: description: filterChains references chains from spec.filterChains by name. items: type: string type: array name: description: name is the unique listener and generated Service port name. minLength: 1 type: string port: description: port is the container and Service port. format: int32 maximum: 65535 minimum: 1 type: integer tls: description: tls configures downstream TLS material. properties: certificateRef: description: certificateRef is a same-namespace kubernetes.io/tls Secret. properties: name: minLength: 1 type: string required: - name type: object required: - certificateRef type: object required: - name - port type: object minItems: 1 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map replicas: default: 1 description: replicas is the desired replica count. format: int32 minimum: 1 type: integer secretEnv: description: secretEnv projects authorized same-namespace Secret keys as environment variables. items: description: PraxisSecretEnv projects a Secret key as an environment variable. properties: name: description: name is the environment variable name used by a native filter. minLength: 1 type: string secretRef: description: secretRef identifies the same-namespace Secret and key. properties: key: description: key is the key within the Secret. minLength: 1 type: string name: description: name is the Secret name. minLength: 1 type: string required: - key - name type: object required: - name - secretRef type: object type: array service: description: service configures the Service exposing listener ports. properties: type: default: ClusterIP description: type is the Kubernetes Service type. Ports derive from listeners. enum: - ClusterIP - NodePort - LoadBalancer type: string type: object required: - image - listeners type: object status: description: ProxyStatus reports published and serving revision state. properties: availableFilters: description: availableFilters lists filter types reported by all serving replicas. items: type: string type: array conditions: description: conditions report Accepted, ResolvedRefs, Programmed, and Ready. items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map desiredRevision: description: desiredRevision is a digest of the complete desired config and inputs. type: string listeners: description: listeners reports per-listener results and assembled chain order. items: description: PraxisListenerStatus reports a single listener's status and chain order. properties: chainOrder: description: chainOrder lists attached chain identifiers (namespace/name) in effective pipeline order. items: type: string type: array conditions: description: conditions report Programmed and Ready for this listener. items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map name: description: name is the listener name from spec. type: string required: - name type: object type: array observedGeneration: description: observedGeneration is the latest proxy generation inspected. format: int64 type: integer publishedRevision: description: publishedRevision is the revision successfully written for this proxy. type: string servingReplicas: description: servingReplicas is the number of replicas confirmed to serve desiredRevision. format: int32 type: integer type: object required: - spec type: object served: true storage: true subresources: status: {}