vcluster.yaml configuration reference
Create a virtual cluster with a config file​
Pre-v0.20.0 values.yaml
files are not equivalent to vcluster.yaml
with v0.20.0. If you are moving from vCluster 0.19.x to 0.20+, see the conversion guide for how to automatically convert your existing values.yaml
configuration file to the new vcluster.yaml
format.
Configure your vCluster installation in a vcluster.yaml
configuration file. Then deploy your changes.
- vCluster CLI
- Helm
- Terraform
- Argo CD
- Cluster API
To keep the same version of your vCluster, your CLI needs to be the same version as your virtual cluster.
vcluster create --upgrade <VCLUSTER_NAME> -n <VCLUSTER_NAMESPACE> -f vcluster.yaml
Replace:
<VCLUSTER_NAME>
with the name of the vCluster instance to update.<VCLUSTER_NAMESPACE>
with the namespace where the vCluster instance is deployed.
helm upgrade --install <VCLUSTER_NAME> vcluster \
--values vcluster.yaml \
--repo https://charts.loft.sh \
--namespace <VCLUSTER_NAMESPACE> \
--repository-config=''
Replace:
<VCLUSTER_NAME>
with the name of the vCluster instance to update.<VCLUSTER_NAMESPACE>
with the namespace where the vCluster instance is deployed.
Generate a new plan with your updated
vcluster.yaml
.terraform plan
Verify that the provider can access your cluster and that the proposed changes are correct.
Apply your new changes.
terraform apply
The steps assume that you have the terraform file that you initially deployed your terraform resource from.
Commit and push your updated
vcluster.yaml
to your configured ArgoCD repository.Synchronize your ArgoCD repository with your configured cluster.
Learn more about Cluster API Provider for vCluster.
Install the vCluster provider.
clusterctl init --infrastructure vcluster:v0.2.0
Export environment variables to be used by the cluster API provider to create an updated manifest. The manifest will be applied to your Kubernetes cluster, which will update your vCluster with the updated configuration options.
# Replace <VCLUSTER_NAME> and <VCLUSTER_NAMESPACE> with values of the vCluster that you are updating
export CLUSTER_NAME=<VCLUSTER_NAME>
export CLUSTER_NAMESPACE=<VCLUSTER_NAMESPACE>
# Since the vcluster.yaml has changed, you'll need to re-export it to the updated vcluster.yaml
export VCLUSTER_YAML=$(awk '{printf "%s\\n", $0}' vcluster.yaml)Replace:
<VCLUSTER_NAME>
with the name of the vCluster instance to update.<VCLUSTER_NAMESPACE>
with the namespace where the vCluster instance is deployed.
Regenerate the manifest and apply the updated manifest.
clusterctl generate cluster ${CLUSTER_NAME} \
--infrastructure vcluster \
--target-namespace ${CLUSTER_NAMESPACE} \
| kubectl apply -f -Kubernetes VersionThe Kubernetes version for the vCluster is not set at the CAPI provider command. It is configured the
vcluster.yaml
file based on your Kubernetes distribution.Wait for vCluster to be updated by watching for the vCluster custom resource to report a
ready
status.kubectl wait --for=condition=ready vcluster -n $CLUSTER_NAMESPACE $CLUSTER_NAME --timeout=300s
Config reference​
exportKubeConfig
required object pro​
ExportKubeConfig describes how vCluster should export the vCluster kubeConfig file.
exportKubeConfig
required object pro​context
required string pro​
Context is the name of the context within the generated kubeconfig to use.
context
required string pro​server
required string pro​
Override the default https://localhost:8443 and specify a custom hostname for the generated kubeconfig.
server
required string pro​secret
required object pro​
Declare in which host cluster secret vCluster should store the generated virtual cluster kubeconfig.
If this is not defined, vCluster create it with vc-NAME
. If you specify another name,
vCluster creates the config in this other secret.
secret
required object pro​vc-NAME
. If you specify another name,
vCluster creates the config in this other secret.name
required string pro​
Name is the name of the secret where the kubeconfig should get stored.
name
required string pro​namespace
required string pro​
Namespace where vCluster should store the kubeconfig secret. If this is not equal to the namespace
where you deployed vCluster, you need to make sure vCluster has access to this other namespace.
namespace
required string pro​integrations
required object pro​
Integrations holds config for vCluster integrations with other operators or tools running on the host cluster
integrations
required object pro​metricsServer
required object pro​
MetricsServer reuses the metrics server from the host cluster within the vCluster.
metricsServer
required object pro​enabled
required boolean false pro​
Enabled signals the metrics server integration should be enabled.
enabled
required boolean false pro​apiService
required object pro​
APIService holds information about where to find the metrics-server service. Defaults to metrics-server/kube-system.
apiService
required object pro​service
required object pro​
Service is a reference to the service for the API server.
service
required object pro​nodes
required boolean true pro​
Nodes defines if metrics-server nodes api should get proxied from host to virtual cluster.
nodes
required boolean true pro​pods
required boolean true pro​
Pods defines if metrics-server pods api should get proxied from host to virtual cluster.
pods
required boolean true pro​kubeVirt
required object pro​
KubeVirt reuses a host kubevirt and makes certain CRDs from it available inside the vCluster
kubeVirt
required object pro​enabled
required boolean false pro​
Enabled signals if the integration should be enabled
enabled
required boolean false pro​apiService
required object pro​
APIService holds information about where to find the virt-api service. Defaults to virt-api/kubevirt.
apiService
required object pro​service
required object pro​
Service is a reference to the service for the API server.
service
required object pro​webhook
required object pro​
Webhook holds configuration for enabling the webhook within the vCluster
webhook
required object pro​enabled
required boolean true pro​
Enabled defines if this option should be enabled.
enabled
required boolean true pro​sync
required object pro​
Sync holds configuration on what resources to sync
sync
required object pro​dataVolumes
required object pro​
If DataVolumes should get synced
dataVolumes
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​virtualMachineInstanceMigrations
required object pro​
If VirtualMachineInstanceMigrations should get synced
virtualMachineInstanceMigrations
required object pro​enabled
required boolean true pro​
Enabled defines if this option should be enabled.
enabled
required boolean true pro​virtualMachineInstances
required object pro​
If VirtualMachineInstances should get synced
virtualMachineInstances
required object pro​enabled
required boolean true pro​
Enabled defines if this option should be enabled.
enabled
required boolean true pro​virtualMachines
required object pro​
If VirtualMachines should get synced
virtualMachines
required object pro​enabled
required boolean true pro​
Enabled defines if this option should be enabled.
enabled
required boolean true pro​sync
required object pro​
Sync describes how to sync resources from the virtual cluster to host cluster and back.
sync
required object pro​toHost
required object pro​
Configure resources to sync from the virtual cluster to the host cluster.
toHost
required object pro​pods
required object pro​
Pods defines if pods created within the virtual cluster should get synced to the host cluster.
pods
required object pro​enabled
required boolean true pro​
Enabled defines if pod syncing should be enabled.
enabled
required boolean true pro​translateImage
required object {} pro​
TranslateImage maps an image to another image that should be used instead. For example this can be used to rewrite
a certain image that is used within the virtual cluster to be another image on the host cluster
translateImage
required object {} pro​enforceTolerations
required string[] [] pro​
EnforceTolerations will add the specified tolerations to all pods synced by the virtual cluster.
enforceTolerations
required string[] [] pro​useSecretsForSATokens
required boolean false pro​
UseSecretsForSATokens will use secrets to save the generated service account tokens by virtual cluster instead of using a
pod annotation.
useSecretsForSATokens
required boolean false pro​rewriteHosts
required object pro​
RewriteHosts is a special option needed to rewrite statefulset containers to allow the correct FQDN. virtual cluster will add
a small container to each stateful set pod that will initially rewrite the /etc/hosts file to match the FQDN expected by
the virtual cluster.
rewriteHosts
required object pro​enabled
required boolean true pro​
Enabled specifies if rewriting stateful set pods should be enabled.
enabled
required boolean true pro​initContainer
required object pro​
InitContainer holds extra options for the init container used by vCluster to rewrite the FQDN for stateful set pods.
initContainer
required object pro​translate
required object[] pro​
Translate the patch according to the given patches.
translate
required object[] pro​path
required string pro​
Path is the path within the patch to target. If the path is not found within the patch, the patch is not applied.
path
required string pro​expression
required object pro​
Expression transforms the value according to the given JavaScript expression.
expression
required object pro​reference
required object pro​
Reference rewrites the value value according to the name.
reference
required object pro​apiVersion
required string pro​
APIVersion is the apiVersion of the referenced object.
apiVersion
required string pro​kind
required string pro​
Kind is the kind of the referenced object.
kind
required string pro​namePath
required string pro​
NamePath is the optional path to the reference name within the object. If omitted namePath equals to the
translate patch path.
namePath
required string pro​namespacePath
required string pro​
NamespacePath is the optional path to the reference namespace within the object. If omitted namespacePath equals to the
metadata.namespace path of the object.
namespacePath
required string pro​secrets
required object pro​
Secrets defines if secrets created within the virtual cluster should get synced to the host cluster.
secrets
required object pro​enabled
required boolean true pro​
Enabled defines if this option should be enabled.
enabled
required boolean true pro​all
required boolean false pro​
All defines if all resources of that type should get synced or only the necessary ones that are needed.
all
required boolean false pro​translate
required object[] pro​
Translate the patch according to the given patches.
translate
required object[] pro​path
required string pro​
Path is the path within the patch to target. If the path is not found within the patch, the patch is not applied.
path
required string pro​expression
required object pro​
Expression transforms the value according to the given JavaScript expression.
expression
required object pro​reference
required object pro​
Reference rewrites the value value according to the name.
reference
required object pro​apiVersion
required string pro​
APIVersion is the apiVersion of the referenced object.
apiVersion
required string pro​kind
required string pro​
Kind is the kind of the referenced object.
kind
required string pro​namePath
required string pro​
NamePath is the optional path to the reference name within the object. If omitted namePath equals to the
translate patch path.
namePath
required string pro​namespacePath
required string pro​
NamespacePath is the optional path to the reference namespace within the object. If omitted namespacePath equals to the
metadata.namespace path of the object.
namespacePath
required string pro​configMaps
required object pro​
ConfigMaps defines if config maps created within the virtual cluster should get synced to the host cluster.
configMaps
required object pro​enabled
required boolean true pro​
Enabled defines if this option should be enabled.
enabled
required boolean true pro​all
required boolean false pro​
All defines if all resources of that type should get synced or only the necessary ones that are needed.
all
required boolean false pro​translate
required object[] pro​
Translate the patch according to the given patches.
translate
required object[] pro​path
required string pro​
Path is the path within the patch to target. If the path is not found within the patch, the patch is not applied.
path
required string pro​expression
required object pro​
Expression transforms the value according to the given JavaScript expression.
expression
required object pro​reference
required object pro​
Reference rewrites the value value according to the name.
reference
required object pro​apiVersion
required string pro​
APIVersion is the apiVersion of the referenced object.
apiVersion
required string pro​kind
required string pro​
Kind is the kind of the referenced object.
kind
required string pro​namePath
required string pro​
NamePath is the optional path to the reference name within the object. If omitted namePath equals to the
translate patch path.
namePath
required string pro​namespacePath
required string pro​
NamespacePath is the optional path to the reference namespace within the object. If omitted namespacePath equals to the
metadata.namespace path of the object.
namespacePath
required string pro​ingresses
required object pro​
Ingresses defines if ingresses created within the virtual cluster should get synced to the host cluster.
ingresses
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​translate
required object[] pro​
Translate the patch according to the given patches.
translate
required object[] pro​path
required string pro​
Path is the path within the patch to target. If the path is not found within the patch, the patch is not applied.
path
required string pro​expression
required object pro​
Expression transforms the value according to the given JavaScript expression.
expression
required object pro​reference
required object pro​
Reference rewrites the value value according to the name.
reference
required object pro​apiVersion
required string pro​
APIVersion is the apiVersion of the referenced object.
apiVersion
required string pro​kind
required string pro​
Kind is the kind of the referenced object.
kind
required string pro​namePath
required string pro​
NamePath is the optional path to the reference name within the object. If omitted namePath equals to the
translate patch path.
namePath
required string pro​namespacePath
required string pro​
NamespacePath is the optional path to the reference namespace within the object. If omitted namespacePath equals to the
metadata.namespace path of the object.
namespacePath
required string pro​services
required object pro​
Services defines if services created within the virtual cluster should get synced to the host cluster.
services
required object pro​enabled
required boolean true pro​
Enabled defines if this option should be enabled.
enabled
required boolean true pro​translate
required object[] pro​
Translate the patch according to the given patches.
translate
required object[] pro​path
required string pro​
Path is the path within the patch to target. If the path is not found within the patch, the patch is not applied.
path
required string pro​expression
required object pro​
Expression transforms the value according to the given JavaScript expression.
expression
required object pro​reference
required object pro​
Reference rewrites the value value according to the name.
reference
required object pro​apiVersion
required string pro​
APIVersion is the apiVersion of the referenced object.
apiVersion
required string pro​kind
required string pro​
Kind is the kind of the referenced object.
kind
required string pro​namePath
required string pro​
NamePath is the optional path to the reference name within the object. If omitted namePath equals to the
translate patch path.
namePath
required string pro​namespacePath
required string pro​
NamespacePath is the optional path to the reference namespace within the object. If omitted namespacePath equals to the
metadata.namespace path of the object.
namespacePath
required string pro​endpoints
required object pro​
Endpoints defines if endpoints created within the virtual cluster should get synced to the host cluster.
endpoints
required object pro​enabled
required boolean true pro​
Enabled defines if this option should be enabled.
enabled
required boolean true pro​networkPolicies
required object pro​
NetworkPolicies defines if network policies created within the virtual cluster should get synced to the host cluster.
networkPolicies
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​persistentVolumeClaims
required object pro​
PersistentVolumeClaims defines if persistent volume claims created within the virtual cluster should get synced to the host cluster.
persistentVolumeClaims
required object pro​enabled
required boolean true pro​
Enabled defines if this option should be enabled.
enabled
required boolean true pro​translate
required object[] pro​
Translate the patch according to the given patches.
translate
required object[] pro​path
required string pro​
Path is the path within the patch to target. If the path is not found within the patch, the patch is not applied.
path
required string pro​expression
required object pro​
Expression transforms the value according to the given JavaScript expression.
expression
required object pro​reference
required object pro​
Reference rewrites the value value according to the name.
reference
required object pro​apiVersion
required string pro​
APIVersion is the apiVersion of the referenced object.
apiVersion
required string pro​kind
required string pro​
Kind is the kind of the referenced object.
kind
required string pro​namePath
required string pro​
NamePath is the optional path to the reference name within the object. If omitted namePath equals to the
translate patch path.
namePath
required string pro​namespacePath
required string pro​
NamespacePath is the optional path to the reference namespace within the object. If omitted namespacePath equals to the
metadata.namespace path of the object.
namespacePath
required string pro​persistentVolumes
required object pro​
PersistentVolumes defines if persistent volumes created within the virtual cluster should get synced to the host cluster.
persistentVolumes
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​volumeSnapshots
required object pro​
VolumeSnapshots defines if volume snapshots created within the virtual cluster should get synced to the host cluster.
volumeSnapshots
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​storageClasses
required object pro​
StorageClasses defines if storage classes created within the virtual cluster should get synced to the host cluster.
storageClasses
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​serviceAccounts
required object pro​
ServiceAccounts defines if service accounts created within the virtual cluster should get synced to the host cluster.
serviceAccounts
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​podDisruptionBudgets
required object pro​
PodDisruptionBudgets defines if pod disruption budgets created within the virtual cluster should get synced to the host cluster.
podDisruptionBudgets
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​priorityClasses
required object pro​
PriorityClasses defines if priority classes created within the virtual cluster should get synced to the host cluster.
priorityClasses
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​customResourceDefinitions
required object pro​
CustomResourceDefinitions defines what custom resource definitions should get synced from the virtual cluster to the host cluster.
customResourceDefinitions
required object pro​fromHost
required object pro​
Configure what resources vCluster should sync from the host cluster to the virtual cluster.
fromHost
required object pro​nodes
required object pro​
Nodes defines if nodes should get synced from the host cluster to the virtual cluster, but not back.
nodes
required object pro​enabled
required boolean false pro​
Enabled specifies if syncing real nodes should be enabled. If this is disabled, vCluster will create fake nodes instead.
enabled
required boolean false pro​syncBackChanges
required boolean false pro​
SyncBackChanges enables syncing labels and taints from the virtual cluster to the host cluster. If this is enabled someone within the virtual cluster will be able to change the labels and taints of the host cluster node.
syncBackChanges
required boolean false pro​clearImageStatus
required boolean false pro​
ClearImageStatus will erase the image status when syncing a node. This allows to hide images that are pulled by the node.
clearImageStatus
required boolean false pro​selector
required object pro​
Selector can be used to define more granular what nodes should get synced from the host cluster to the virtual cluster.
selector
required object pro​all
required boolean false pro​
All specifies if all nodes should get synced by vCluster from the host to the virtual cluster or only the ones where pods are assigned to.
all
required boolean false pro​labels
required object {} pro​
Labels are the node labels used to sync nodes from host cluster to virtual cluster. This will also set the node selector when syncing a pod from virtual cluster to host cluster to the same value.
labels
required object {} pro​events
required object pro​
Events defines if events should get synced from the host cluster to the virtual cluster, but not back.
events
required object pro​enabled
required boolean true pro​
Enabled defines if this option should be enabled.
enabled
required boolean true pro​ingressClasses
required object pro​
IngressClasses defines if ingress classes should get synced from the host cluster to the virtual cluster, but not back.
ingressClasses
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​runtimeClasses
required object pro​
RuntimeClasses defines if runtime classes should get synced from the host cluster to the virtual cluster, but not back.
runtimeClasses
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​priorityClasses
required object pro​
PriorityClasses defines if priority classes classes should get synced from the host cluster to the virtual cluster, but not back.
priorityClasses
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​storageClasses
required object pro​
StorageClasses defines if storage classes should get synced from the host cluster to the virtual cluster, but not back. If auto, is automatically enabled when the virtual scheduler is enabled.
storageClasses
required object pro​enabled
required string|boolean auto pro​
Enabled defines if this option should be enabled.
enabled
required string|boolean auto pro​csiNodes
required object pro​
CSINodes defines if csi nodes should get synced from the host cluster to the virtual cluster, but not back. If auto, is automatically enabled when the virtual scheduler is enabled.
csiNodes
required object pro​enabled
required string|boolean auto pro​
Enabled defines if this option should be enabled.
enabled
required string|boolean auto pro​csiDrivers
required object pro​
CSIDrivers defines if csi drivers should get synced from the host cluster to the virtual cluster, but not back. If auto, is automatically enabled when the virtual scheduler is enabled.
csiDrivers
required object pro​enabled
required string|boolean auto pro​
Enabled defines if this option should be enabled.
enabled
required string|boolean auto pro​csiStorageCapacities
required object pro​
CSIStorageCapacities defines if csi storage capacities should get synced from the host cluster to the virtual cluster, but not back. If auto, is automatically enabled when the virtual scheduler is enabled.
csiStorageCapacities
required object pro​enabled
required string|boolean auto pro​
Enabled defines if this option should be enabled.
enabled
required string|boolean auto pro​customResourceDefinitions
required object pro​
CustomResourceDefinitions defines what custom resource definitions should get synced read-only to the virtual cluster from the host cluster.
customResourceDefinitions
required object pro​networking
required object pro​
Networking options related to the virtual cluster.
networking
required object pro​replicateServices
required object pro​
ReplicateServices allows replicating services from the host within the virtual cluster or the other way around.
replicateServices
required object pro​toHost
required object[] pro​
ToHost defines the services that should get synced from virtual cluster to the host cluster. If services are
synced to a different namespace than the virtual cluster is in, additional permissions for the other namespace
are required.
toHost
required object[] pro​fromHost
required object[] pro​
FromHost defines the services that should get synced from the host to the virtual cluster.
fromHost
required object[] pro​resolveDNS
required object[] pro​
ResolveDNS allows to define extra DNS rules. This only works if embedded coredns is configured.
resolveDNS
required object[] pro​hostname
required string pro​
Hostname is the hostname within the vCluster that should be resolved from.
hostname
required string pro​service
required string pro​
Service is the virtual cluster service that should be resolved from.
service
required string pro​namespace
required string pro​
Namespace is the virtual cluster namespace that should be resolved from.
namespace
required string pro​target
required object pro​
Target is the DNS target that should get mapped to
target
required object pro​hostname
required string pro​
Hostname to use as a DNS target
hostname
required string pro​ip
required string pro​
IP to use as a DNS target
ip
required string pro​hostService
required string pro​
HostService to target, format is hostNamespace/hostService
hostService
required string pro​hostNamespace
required string pro​
HostNamespace to target
hostNamespace
required string pro​vClusterService
required string pro​
VClusterService format is hostNamespace/vClusterName/vClusterNamespace/vClusterService
vClusterService
required string pro​advanced
required object pro​
Advanced holds advanced network options.
advanced
required object pro​clusterDomain
required string cluster.local pro​
ClusterDomain is the Kubernetes cluster domain to use within the virtual cluster.
clusterDomain
required string cluster.local pro​fallbackHostCluster
required boolean false pro​
FallbackHostCluster allows to fallback dns to the host cluster. This is useful if you want to reach host services without
any other modification. You will need to provide a namespace for the service, e.g. my-other-service.my-other-namespace
fallbackHostCluster
required boolean false pro​proxyKubelets
required object pro​
ProxyKubelets allows rewriting certain metrics and stats from the Kubelet to "fake" this for applications such as
prometheus or other node exporters.
proxyKubelets
required object pro​byHostname
required boolean true pro​
ByHostname will add a special vCluster hostname to the nodes where the node can be reached at. This doesn't work
for all applications, e.g. Prometheus requires a node IP.
byHostname
required boolean true pro​byIP
required boolean true pro​
ByIP will create a separate service in the host cluster for every node that will point to virtual cluster and will be used to
route traffic.
byIP
required boolean true pro​policies
required object pro​
Policies to enforce for the virtual cluster deployment as well as within the virtual cluster.
policies
required object pro​networkPolicy
required object pro​
NetworkPolicy specifies network policy options.
networkPolicy
required object pro​enabled
required boolean false pro​
Enabled defines if the network policy should be deployed by vCluster.
enabled
required boolean false pro​fallbackDns
required string 8.8.8.8 pro​
fallbackDns
required string 8.8.8.8 pro​outgoingConnections
required object pro​
outgoingConnections
required object pro​ipBlock
required object pro​
IPBlock describes a particular CIDR (Ex. "192.168.1.0/24","2001:db8::/64") that is allowed
to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs
that should not be included within this rule.
ipBlock
required object pro​cidr
required string 0.0.0.0/0 pro​
cidr is a string representing the IPBlock
Valid examples are "192.168.1.0/24" or "2001:db8::/64"
cidr
required string 0.0.0.0/0 pro​except
required string[] [100.64.0.0/10 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16] pro​
except is a slice of CIDRs that should not be included within an IPBlock
Valid examples are "192.168.1.0/24" or "2001:db8::/64"
Except values will be rejected if they are outside the cidr range
except
required string[] [100.64.0.0/10 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16] pro​platform
required boolean true pro​
Platform enables egress access towards loft platform
platform
required boolean true pro​annotations
required object {} pro​
Annotations are extra annotations for this resource.
annotations
required object {} pro​labels
required object {} pro​
Labels are extra labels for this resource.
labels
required object {} pro​podSecurityStandard
required string pro​
PodSecurityStandard that can be enforced can be one of: empty (""), baseline, restricted or privileged
podSecurityStandard
required string pro​resourceQuota
required object pro​
ResourceQuota specifies resource quota options.
resourceQuota
required object pro​enabled
required boolean false pro​
Enabled defines if the resource quota should be enabled.
enabled
required boolean false pro​quota
required object map[count/configmaps:100 count/endpoints:40 count/persistentvolumeclaims:20 count/pods:20 count/secrets:100 count/services:20 limits.cpu:20 limits.ephemeral-storage:160Gi limits.memory:40Gi requests.cpu:10 requests.ephemeral-storage:60Gi requests.memory:20Gi requests.storage:100Gi services.loadbalancers:1 services.nodeports:0] pro​
Quota are the quota options
quota
required object map[count/configmaps:100 count/endpoints:40 count/persistentvolumeclaims:20 count/pods:20 count/secrets:100 count/services:20 limits.cpu:20 limits.ephemeral-storage:160Gi limits.memory:40Gi requests.cpu:10 requests.ephemeral-storage:60Gi requests.memory:20Gi requests.storage:100Gi services.loadbalancers:1 services.nodeports:0] pro​scopeSelector
required object map[matchExpressions:[]] pro​
ScopeSelector is the resource quota scope selector
scopeSelector
required object map[matchExpressions:[]] pro​scopes
required string[] [] pro​
Scopes are the resource quota scopes
scopes
required string[] [] pro​annotations
required object {} pro​
Annotations are extra annotations for this resource.
annotations
required object {} pro​labels
required object {} pro​
Labels are extra labels for this resource.
labels
required object {} pro​limitRange
required object pro​
LimitRange specifies limit range options.
limitRange
required object pro​enabled
required boolean false pro​
Enabled defines if the limit range should be deployed by vCluster.
enabled
required boolean false pro​default
required object map[cpu:1 ephemeral-storage:8Gi memory:512Mi] pro​
Default are the default limits for the limit range
default
required object map[cpu:1 ephemeral-storage:8Gi memory:512Mi] pro​defaultRequest
required object map[cpu:100m ephemeral-storage:3Gi memory:128Mi] pro​
DefaultRequest are the default request options for the limit range
defaultRequest
required object map[cpu:100m ephemeral-storage:3Gi memory:128Mi] pro​annotations
required object {} pro​
Annotations are extra annotations for this resource.
annotations
required object {} pro​labels
required object {} pro​
Labels are extra labels for this resource.
labels
required object {} pro​centralAdmission
required object pro​
CentralAdmission defines what validating or mutating webhooks should be enforced within the virtual cluster.
centralAdmission
required object pro​validatingWebhooks
required object[] pro​
ValidatingWebhooks are validating webhooks that should be enforced in the virtual cluster
validatingWebhooks
required object[] pro​kind
required string pro​
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
kind
required string pro​apiVersion
required string pro​
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
apiVersion
required string pro​metadata
required object pro​
Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
metadata
required object pro​name
required string pro​
Name must be unique within a namespace. Is required when creating resources, although
some resources may allow a client to request the generation of an appropriate name
automatically. Name is primarily intended for creation idempotence and configuration
definition.
name
required string pro​labels
required object pro​
Map of string keys and values that can be used to organize and categorize
(scope and select) objects. May match selectors of replication controllers
and services.
labels
required object pro​annotations
required object pro​
Annotations is an unstructured key value map stored with a resource that may be
set by external tools to store and retrieve arbitrary metadata.
annotations
required object pro​webhooks
required object[] pro​
Webhooks is a list of webhooks and the affected resources and operations.
webhooks
required object[] pro​name
required string pro​
The name of the admission webhook.
Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
"imagepolicy" is the name of the webhook, and kubernetes.io is the name
of the organization.
name
required string pro​clientConfig
required object pro​
ClientConfig defines how to communicate with the hook.
clientConfig
required object pro​url
required string pro​
URL gives the location of the webhook, in standard URL form
(scheme://host:port/path
). Exactly one of url
or service
must be specified.
url
required string pro​scheme://host:port/path
). Exactly one of url
or service
must be specified.service
required object pro​
Service is a reference to the service for this webhook. Either
service
or url
must be specified.
If the webhook is running within the cluster, then you should use service
.
service
required object pro​service
or url
must be specified.service
.namespace
required string pro​
Namespace is the namespace of the service.
namespace
required string pro​name
required string pro​
Name is the name of the service.
name
required string pro​path
required string pro​
Path is an optional URL path which will be sent in any request to
this service.
path
required string pro​port
required integer pro​
If specified, the port on the service that hosting webhook.
Default to 443 for backward compatibility.
port
should be a valid port number (1-65535, inclusive).
port
required integer pro​port
should be a valid port number (1-65535, inclusive).caBundle
required string pro​
CABundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
If unspecified, system trust roots on the apiserver are used.
caBundle
required string pro​rules
required object[] pro​
Rules describes what operations on what resources/subresources the webhook cares about.
The webhook cares about an operation if it matches any Rule.
rules
required object[] pro​failurePolicy
required string pro​
FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
allowed values are Ignore or Fail. Defaults to Fail.
failurePolicy
required string pro​matchPolicy
required string pro​
matchPolicy defines how the "rules" list is used to match incoming requests.
Allowed values are "Exact" or "Equivalent".
matchPolicy
required string pro​namespaceSelector
required object pro​
NamespaceSelector decides whether to run the webhook on an object based
on whether the namespace for that object matches the selector. If the
object itself is a namespace, the matching is performed on
object.metadata.labels. If the object is another cluster scoped resource,
it never skips the webhook.
namespaceSelector
required object pro​objectSelector
required object pro​
ObjectSelector decides whether to run the webhook based on if the
object has matching labels. objectSelector is evaluated against both
the oldObject and newObject that would be sent to the webhook, and
is considered to match if either object matches the selector.
objectSelector
required object pro​sideEffects
required string pro​
SideEffects states whether this webhook has side effects.
sideEffects
required string pro​timeoutSeconds
required integer pro​
TimeoutSeconds specifies the timeout for this webhook.
timeoutSeconds
required integer pro​admissionReviewVersions
required string[] pro​
AdmissionReviewVersions is an ordered list of preferred AdmissionReview
versions the Webhook expects.
admissionReviewVersions
required string[] pro​AdmissionReview
versions the Webhook expects.matchConditions
required object[] pro​
MatchConditions is a list of conditions that must be met for a request to be sent to this
webhook. Match conditions filter requests that have already been matched by the rules,
namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
There are a maximum of 64 match conditions allowed.
matchConditions
required object[] pro​mutatingWebhooks
required object[] pro​
MutatingWebhooks are mutating webhooks that should be enforced in the virtual cluster
mutatingWebhooks
required object[] pro​kind
required string pro​
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
kind
required string pro​apiVersion
required string pro​
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
apiVersion
required string pro​metadata
required object pro​
Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
metadata
required object pro​name
required string pro​
Name must be unique within a namespace. Is required when creating resources, although
some resources may allow a client to request the generation of an appropriate name
automatically. Name is primarily intended for creation idempotence and configuration
definition.
name
required string pro​labels
required object pro​
Map of string keys and values that can be used to organize and categorize
(scope and select) objects. May match selectors of replication controllers
and services.
labels
required object pro​annotations
required object pro​
Annotations is an unstructured key value map stored with a resource that may be
set by external tools to store and retrieve arbitrary metadata.
annotations
required object pro​webhooks
required object[] pro​
Webhooks is a list of webhooks and the affected resources and operations.
webhooks
required object[] pro​reinvocationPolicy
required string pro​
reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation.
Allowed values are "Never" and "IfNeeded".
reinvocationPolicy
required string pro​name
required string pro​
The name of the admission webhook.
Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
"imagepolicy" is the name of the webhook, and kubernetes.io is the name
of the organization.
name
required string pro​clientConfig
required object pro​
ClientConfig defines how to communicate with the hook.
clientConfig
required object pro​url
required string pro​
URL gives the location of the webhook, in standard URL form
(scheme://host:port/path
). Exactly one of url
or service
must be specified.
url
required string pro​scheme://host:port/path
). Exactly one of url
or service
must be specified.service
required object pro​
Service is a reference to the service for this webhook. Either
service
or url
must be specified.
If the webhook is running within the cluster, then you should use service
.
service
required object pro​service
or url
must be specified.service
.namespace
required string pro​
Namespace is the namespace of the service.
namespace
required string pro​name
required string pro​
Name is the name of the service.
name
required string pro​path
required string pro​
Path is an optional URL path which will be sent in any request to
this service.
path
required string pro​port
required integer pro​
If specified, the port on the service that hosting webhook.
Default to 443 for backward compatibility.
port
should be a valid port number (1-65535, inclusive).
port
required integer pro​port
should be a valid port number (1-65535, inclusive).caBundle
required string pro​
CABundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
If unspecified, system trust roots on the apiserver are used.
caBundle
required string pro​rules
required object[] pro​
Rules describes what operations on what resources/subresources the webhook cares about.
The webhook cares about an operation if it matches any Rule.
rules
required object[] pro​failurePolicy
required string pro​
FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
allowed values are Ignore or Fail. Defaults to Fail.
failurePolicy
required string pro​matchPolicy
required string pro​
matchPolicy defines how the "rules" list is used to match incoming requests.
Allowed values are "Exact" or "Equivalent".
matchPolicy
required string pro​namespaceSelector
required object pro​
NamespaceSelector decides whether to run the webhook on an object based
on whether the namespace for that object matches the selector. If the
object itself is a namespace, the matching is performed on
object.metadata.labels. If the object is another cluster scoped resource,
it never skips the webhook.
namespaceSelector
required object pro​objectSelector
required object pro​
ObjectSelector decides whether to run the webhook based on if the
object has matching labels. objectSelector is evaluated against both
the oldObject and newObject that would be sent to the webhook, and
is considered to match if either object matches the selector.
objectSelector
required object pro​sideEffects
required string pro​
SideEffects states whether this webhook has side effects.
sideEffects
required string pro​timeoutSeconds
required integer pro​
TimeoutSeconds specifies the timeout for this webhook.
timeoutSeconds
required integer pro​admissionReviewVersions
required string[] pro​
AdmissionReviewVersions is an ordered list of preferred AdmissionReview
versions the Webhook expects.
admissionReviewVersions
required string[] pro​AdmissionReview
versions the Webhook expects.matchConditions
required object[] pro​
MatchConditions is a list of conditions that must be met for a request to be sent to this
webhook. Match conditions filter requests that have already been matched by the rules,
namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
There are a maximum of 64 match conditions allowed.
matchConditions
required object[] pro​controlPlane
required object pro​
Configure vCluster's control plane components and deployment.
controlPlane
required object pro​distro
required object pro​
Distro holds virtual cluster related distro options. A distro cannot be changed after vCluster is deployed.
distro
required object pro​k8s
required object pro​
K8S holds K8s relevant configuration.
k8s
required object pro​enabled
required boolean false pro​
Enabled specifies if the K8s distro should be enabled. Only one distro can be enabled at the same time.
enabled
required boolean false pro​version
required string pro​
Version specifies k8s components (scheduler, kube-controller-manager & apiserver) version.
It is a shortcut for controlPlane.distro.k8s.apiServer.image.tag,
controlPlane.distro.k8s.controllerManager.image.tag and
controlPlane.distro.k8s.scheduler.image.tag
If e.g. controlPlane.distro.k8s.version is set to v1.30.1 and
controlPlane.distro.k8s.scheduler.image.tag
(or controlPlane.distro.k8s.controllerManager.image.tag or controlPlane.distro.k8s.apiServer.image.tag)
is set to v1.31.0,
value from controlPlane.distro.k8s.(controlPlane-component).image.tag will be used
(where (controlPlane-component is apiServer, controllerManager and scheduler).
version
required string pro​apiServer
required object pro​
APIServer holds configuration specific to starting the api server.
apiServer
required object pro​enabled
required boolean true pro​
Enabled signals this container should be enabled.
enabled
required boolean true pro​image
required object pro​
Image is the distro image
image
required object pro​registry
required string registry.k8s.io pro​
Registry is the registry of the container image, e.g. my-registry.com or ghcr.io. This setting can be globally
overridden via the controlPlane.advanced.defaultImageRegistry option. Empty means docker hub.
registry
required string registry.k8s.io pro​repository
required string kube-apiserver pro​
Repository is the repository of the container image, e.g. my-repo/my-image
repository
required string kube-apiserver pro​tag
required string v1.30.2 pro​
Tag is the tag of the container image, e.g. latest
tag
required string v1.30.2 pro​imagePullPolicy
required string pro​
ImagePullPolicy is the pull policy for the distro image
imagePullPolicy
required string pro​command
required string[] [] pro​
Command is the command to start the distro binary. This will override the existing command.
command
required string[] [] pro​extraArgs
required string[] [] pro​
ExtraArgs are additional arguments to pass to the distro binary.
extraArgs
required string[] [] pro​controllerManager
required object pro​
ControllerManager holds configuration specific to starting the controller manager.
controllerManager
required object pro​enabled
required boolean true pro​
Enabled signals this container should be enabled.
enabled
required boolean true pro​image
required object pro​
Image is the distro image
image
required object pro​registry
required string registry.k8s.io pro​
Registry is the registry of the container image, e.g. my-registry.com or ghcr.io. This setting can be globally
overridden via the controlPlane.advanced.defaultImageRegistry option. Empty means docker hub.
registry
required string registry.k8s.io pro​repository
required string kube-controller-manager pro​
Repository is the repository of the container image, e.g. my-repo/my-image
repository
required string kube-controller-manager pro​tag
required string v1.30.2 pro​
Tag is the tag of the container image, e.g. latest
tag
required string v1.30.2 pro​imagePullPolicy
required string pro​
ImagePullPolicy is the pull policy for the distro image
imagePullPolicy
required string pro​command
required string[] [] pro​
Command is the command to start the distro binary. This will override the existing command.
command
required string[] [] pro​extraArgs
required string[] [] pro​
ExtraArgs are additional arguments to pass to the distro binary.
extraArgs
required string[] [] pro​scheduler
required object pro​
Scheduler holds configuration specific to starting the scheduler. Enable this via controlPlane.advanced.virtualScheduler.enabled
scheduler
required object pro​image
required object pro​
Image is the distro image
image
required object pro​registry
required string registry.k8s.io pro​
Registry is the registry of the container image, e.g. my-registry.com or ghcr.io. This setting can be globally
overridden via the controlPlane.advanced.defaultImageRegistry option. Empty means docker hub.
registry
required string registry.k8s.io pro​repository
required string kube-scheduler pro​
Repository is the repository of the container image, e.g. my-repo/my-image
repository
required string kube-scheduler pro​tag
required string v1.30.2 pro​
Tag is the tag of the container image, e.g. latest
tag
required string v1.30.2 pro​imagePullPolicy
required string pro​
ImagePullPolicy is the pull policy for the distro image
imagePullPolicy
required string pro​command
required string[] [] pro​
Command is the command to start the distro binary. This will override the existing command.
command
required string[] [] pro​extraArgs
required string[] [] pro​
ExtraArgs are additional arguments to pass to the distro binary.
extraArgs
required string[] [] pro​env
required object[] [] pro​
Env are extra environment variables to use for the main container and NOT the init container.
env
required object[] [] pro​resources
required object map[limits:map[cpu:100m memory:256Mi] requests:map[cpu:40m memory:64Mi]] pro​
Resources for the distro init container
resources
required object map[limits:map[cpu:100m memory:256Mi] requests:map[cpu:40m memory:64Mi]] pro​securityContext
required object {} pro​
Security options can be used for the distro init container
securityContext
required object {} pro​k3s
required object pro​
K3S holds K3s relevant configuration.
k3s
required object pro​enabled
required boolean false pro​
Enabled specifies if the K3s distro should be enabled. Only one distro can be enabled at the same time.
enabled
required boolean false pro​token
required string pro​
Token is the K3s token to use. If empty, vCluster will choose one.
token
required string pro​env
required object[] pro​
Env are extra environment variables to use for the main container and NOT the init container.
env
required object[] pro​resources
required object map[limits:map[cpu:100m memory:256Mi] requests:map[cpu:40m memory:64Mi]] pro​
Resources for the distro init container
resources
required object map[limits:map[cpu:100m memory:256Mi] requests:map[cpu:40m memory:64Mi]] pro​securityContext
required object {} pro​
Security options can be used for the distro init container
securityContext
required object {} pro​image
required object pro​
Image is the distro image
image
required object pro​registry
required string pro​
Registry is the registry of the container image, e.g. my-registry.com or ghcr.io. This setting can be globally
overridden via the controlPlane.advanced.defaultImageRegistry option. Empty means docker hub.
registry
required string pro​repository
required string rancher/k3s pro​
Repository is the repository of the container image, e.g. my-repo/my-image
repository
required string rancher/k3s pro​tag
required string v1.30.2-k3s1 pro​
Tag is the tag of the container image, e.g. latest
tag
required string v1.30.2-k3s1 pro​imagePullPolicy
required string pro​
ImagePullPolicy is the pull policy for the distro image
imagePullPolicy
required string pro​command
required string[] [] pro​
Command is the command to start the distro binary. This will override the existing command.
command
required string[] [] pro​extraArgs
required string[] [] pro​
ExtraArgs are additional arguments to pass to the distro binary.
extraArgs
required string[] [] pro​k0s
required object pro​
K0S holds k0s relevant configuration.
k0s
required object pro​enabled
required boolean false pro​
Enabled specifies if the k0s distro should be enabled. Only one distro can be enabled at the same time.
enabled
required boolean false pro​config
required string pro​
Config allows you to override the k0s config passed to the k0s binary.
config
required string pro​env
required object[] pro​
Env are extra environment variables to use for the main container and NOT the init container.
env
required object[] pro​resources
required object map[limits:map[cpu:100m memory:256Mi] requests:map[cpu:40m memory:64Mi]] pro​
Resources for the distro init container
resources
required object map[limits:map[cpu:100m memory:256Mi] requests:map[cpu:40m memory:64Mi]] pro​securityContext
required object {} pro​
Security options can be used for the distro init container
securityContext
required object {} pro​image
required object pro​
Image is the distro image
image
required object pro​registry
required string pro​
Registry is the registry of the container image, e.g. my-registry.com or ghcr.io. This setting can be globally
overridden via the controlPlane.advanced.defaultImageRegistry option. Empty means docker hub.
registry
required string pro​repository
required string k0sproject/k0s pro​
Repository is the repository of the container image, e.g. my-repo/my-image
repository
required string k0sproject/k0s pro​tag
required string v1.30.2-k0s.0 pro​
Tag is the tag of the container image, e.g. latest
tag
required string v1.30.2-k0s.0 pro​imagePullPolicy
required string pro​
ImagePullPolicy is the pull policy for the distro image
imagePullPolicy
required string pro​command
required string[] [] pro​
Command is the command to start the distro binary. This will override the existing command.
command
required string[] [] pro​extraArgs
required string[] [] pro​
ExtraArgs are additional arguments to pass to the distro binary.
extraArgs
required string[] [] pro​backingStore
required object pro​
BackingStore defines which backing store to use for virtual cluster. If not defined will use embedded database as a default backing store.
backingStore
required object pro​etcd
required object pro​
Etcd defines that etcd should be used as the backend for the virtual cluster
etcd
required object pro​embedded
required object pro​
Embedded defines to use embedded etcd as a storage backend for the virtual cluster
embedded
required object pro​deploy
required object pro​
Deploy defines to use an external etcd that is deployed by the helm chart
deploy
required object pro​enabled
required boolean false pro​
Enabled defines that an external etcd should be deployed.
enabled
required boolean false pro​statefulSet
required object pro​
StatefulSet holds options for the external etcd statefulSet.
statefulSet
required object pro​enabled
required boolean true pro​
Enabled defines if the statefulSet should be deployed
enabled
required boolean true pro​enableServiceLinks
required boolean true pro​
EnableServiceLinks for the StatefulSet pod
enableServiceLinks
required boolean true pro​image
required object pro​
Image is the image to use for the external etcd statefulSet
image
required object pro​registry
required string registry.k8s.io pro​
Registry is the registry of the container image, e.g. my-registry.com or ghcr.io. This setting can be globally
overridden via the controlPlane.advanced.defaultImageRegistry option. Empty means docker hub.
registry
required string registry.k8s.io pro​repository
required string etcd pro​
Repository is the repository of the container image, e.g. my-repo/my-image
repository
required string etcd pro​tag
required string 3.5.13-0 pro​
Tag is the tag of the container image, e.g. latest
tag
required string 3.5.13-0 pro​imagePullPolicy
required string pro​
ImagePullPolicy is the pull policy for the external etcd image
imagePullPolicy
required string pro​env
required object[] [] pro​
Env are extra environment variables
env
required object[] [] pro​extraArgs
required string[] [] pro​
ExtraArgs are appended to the etcd command.
extraArgs
required string[] [] pro​resources
required object pro​
Resources the etcd can consume
resources
required object pro​pods
required object pro​
Pods defines extra metadata for the etcd pods.
pods
required object pro​highAvailability
required object pro​
HighAvailability are high availability options
highAvailability
required object pro​replicas
required integer 1 pro​
Replicas are the amount of pods to use.
replicas
required integer 1 pro​scheduling
required object pro​
Scheduling options for the etcd pods.
scheduling
required object pro​nodeSelector
required object {} pro​
NodeSelector is the node selector to apply to the pod.
nodeSelector
required object {} pro​affinity
required object {} pro​
Affinity is the affinity to apply to the pod.
affinity
required object {} pro​tolerations
required object[] [] pro​
Tolerations are the tolerations to apply to the pod.
tolerations
required object[] [] pro​priorityClassName
required string pro​
PriorityClassName is the priority class name for the the pod.
priorityClassName
required string pro​podManagementPolicy
required string Parallel pro​
PodManagementPolicy is the statefulSet pod management policy.
podManagementPolicy
required string Parallel pro​topologySpreadConstraints
required object[] [] pro​
TopologySpreadConstraints are the topology spread constraints for the pod.
topologySpreadConstraints
required object[] [] pro​security
required object pro​
Security options for the etcd pods.
security
required object pro​persistence
required object pro​
Persistence options for the etcd pods.
persistence
required object pro​volumeClaim
required object pro​
VolumeClaim can be used to configure the persistent volume claim.
volumeClaim
required object pro​enabled
required boolean true pro​
Enabled enables deploying a persistent volume claim.
enabled
required boolean true pro​accessModes
required string[] [ReadWriteOnce] pro​
AccessModes are the persistent volume claim access modes.
accessModes
required string[] [ReadWriteOnce] pro​retentionPolicy
required string Retain pro​
RetentionPolicy is the persistent volume claim retention policy.
retentionPolicy
required string Retain pro​size
required string 5Gi pro​
Size is the persistent volume claim storage size.
size
required string 5Gi pro​storageClass
required string pro​
StorageClass is the persistent volume claim storage class.
storageClass
required string pro​volumeClaimTemplates
required object[] [] pro​
VolumeClaimTemplates defines the volumeClaimTemplates for the statefulSet
volumeClaimTemplates
required object[] [] pro​addVolumes
required object[] [] pro​
AddVolumes defines extra volumes for the pod
addVolumes
required object[] [] pro​addVolumeMounts
required object[] pro​
AddVolumeMounts defines extra volume mounts for the container
addVolumeMounts
required object[] pro​name
required string pro​
This must match the Name of a Volume.
name
required string pro​readOnly
required boolean pro​
Mounted read-only if true, read-write otherwise (false or unspecified).
Defaults to false.
readOnly
required boolean pro​mountPath
required string pro​
Path within the container at which the volume should be mounted. Must
not contain ':'.
mountPath
required string pro​subPath
required string pro​
Path within the volume from which the container's volume should be mounted.
Defaults to "" (volume's root).
subPath
required string pro​mountPropagation
required string pro​
mountPropagation determines how mounts are propagated from the host
to container and the other way around.
When not set, MountPropagationNone is used.
This field is beta in 1.10.
mountPropagation
required string pro​subPathExpr
required string pro​
Expanded path within the volume from which the container's volume should be mounted.
Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
Defaults to "" (volume's root).
SubPathExpr and SubPath are mutually exclusive.
subPathExpr
required string pro​annotations
required object {} pro​
Annotations are extra annotations for this resource.
annotations
required object {} pro​labels
required object {} pro​
Labels are extra labels for this resource.
labels
required object {} pro​service
required object pro​
Service holds options for the external etcd service.
service
required object pro​headlessService
required object pro​
HeadlessService holds options for the external etcd headless service.
headlessService
required object pro​database
required object pro​
Database defines that a database backend should be used as the backend for the virtual cluster. This uses a project called kine under the hood which is a shim for bridging Kubernetes and relational databases.
database
required object pro​embedded
required object pro​
Embedded defines that an embedded database (sqlite) should be used as the backend for the virtual cluster
embedded
required object pro​enabled
required boolean false pro​
Enabled defines if the database should be used.
enabled
required boolean false pro​dataSource
required string pro​
DataSource is the kine dataSource to use for the database. This depends on the database format.
This is optional for the embedded database. Examples:
- mysql: mysql://username:password@tcp(hostname:3306)/k3s
- postgres: postgres://username:password@hostname:5432/k3s
dataSource
required string pro​keyFile
required string pro​
KeyFile is the key file to use for the database. This is optional.
keyFile
required string pro​certFile
required string pro​
CertFile is the cert file to use for the database. This is optional.
certFile
required string pro​caFile
required string pro​
CaFile is the ca file to use for the database. This is optional.
caFile
required string pro​external
required object pro​
External defines that an external database should be used as the backend for the virtual cluster
external
required object pro​enabled
required boolean false pro​
Enabled defines if the database should be used.
enabled
required boolean false pro​dataSource
required string pro​
DataSource is the kine dataSource to use for the database. This depends on the database format.
This is optional for the embedded database. Examples:
- mysql: mysql://username:password@tcp(hostname:3306)/k3s
- postgres: postgres://username:password@hostname:5432/k3s
dataSource
required string pro​keyFile
required string pro​
KeyFile is the key file to use for the database. This is optional.
keyFile
required string pro​certFile
required string pro​
CertFile is the cert file to use for the database. This is optional.
certFile
required string pro​caFile
required string pro​
CaFile is the ca file to use for the database. This is optional.
caFile
required string pro​coredns
required object pro​
CoreDNS defines everything related to the coredns that is deployed and used within the vCluster.
coredns
required object pro​enabled
required boolean true pro​
Enabled defines if coredns is enabled
enabled
required boolean true pro​embedded
required boolean false pro​
Embedded defines if vCluster will start the embedded coredns service within the control-plane and not as a separate deployment. This is a PRO feature.
embedded
required boolean false pro​service
required object pro​
Service holds extra options for the coredns service deployed within the virtual cluster
service
required object pro​deployment
required object pro​
Deployment holds extra options for the coredns deployment deployed within the virtual cluster
deployment
required object pro​image
required string pro​
Image is the coredns image to use
image
required string pro​replicas
required integer 1 pro​
Replicas is the amount of coredns pods to run.
replicas
required integer 1 pro​nodeSelector
required object {} pro​
NodeSelector is the node selector to use for coredns.
nodeSelector
required object {} pro​resources
required object pro​
Resources are the desired resources for coredns.
resources
required object pro​pods
required object pro​
Pods is additional metadata for the coredns pods.
pods
required object pro​annotations
required object {} pro​
Annotations are extra annotations for this resource.
annotations
required object {} pro​labels
required object {} pro​
Labels are extra labels for this resource.
labels
required object {} pro​topologySpreadConstraints
required object[] [map[labelSelector:map[matchLabels:map[k8s-app:kube-dns]] maxSkew:1 topologyKey:kubernetes.io/hostname whenUnsatisfiable:DoNotSchedule]] pro​
TopologySpreadConstraints are the topology spread constraints for the CoreDNS pod.
topologySpreadConstraints
required object[] [map[labelSelector:map[matchLabels:map[k8s-app:kube-dns]] maxSkew:1 topologyKey:kubernetes.io/hostname whenUnsatisfiable:DoNotSchedule]] pro​overwriteConfig
required string pro​
OverwriteConfig can be used to overwrite the coredns config
overwriteConfig
required string pro​overwriteManifests
required string pro​
OverwriteManifests can be used to overwrite the coredns manifests used to deploy coredns
overwriteManifests
required string pro​priorityClassName
required string pro​
PriorityClassName specifies the priority class name for the CoreDNS pods.
priorityClassName
required string pro​proxy
required object pro​
Proxy defines options for the virtual cluster control plane proxy that is used to do authentication and intercept requests.
proxy
required object pro​bindAddress
required string 0.0.0.0 pro​
BindAddress under which vCluster will expose the proxy.
bindAddress
required string 0.0.0.0 pro​port
required integer 8443 pro​
Port under which vCluster will expose the proxy. Changing port is currently not supported.
port
required integer 8443 pro​extraSANs
required string[] [] pro​
ExtraSANs are extra hostnames to sign the vCluster proxy certificate for.
extraSANs
required string[] [] pro​hostPathMapper
required object pro​
HostPathMapper defines if vCluster should rewrite host paths.
hostPathMapper
required object pro​ingress
required object pro​
Ingress defines options for vCluster ingress deployed by Helm.
ingress
required object pro​enabled
required boolean false pro​
Enabled defines if the control plane ingress should be enabled
enabled
required boolean false pro​host
required string my-host.com pro​
Host is the host where vCluster will be reachable
host
required string my-host.com pro​pathType
required string ImplementationSpecific pro​
PathType is the path type of the ingress
pathType
required string ImplementationSpecific pro​spec
required object map[tls:[]] pro​
Spec allows you to configure extra ingress options.
spec
required object map[tls:[]] pro​annotations
required object map[nginx.ingress.kubernetes.io/backend-protocol:HTTPS nginx.ingress.kubernetes.io/ssl-passthrough:true nginx.ingress.kubernetes.io/ssl-redirect:true] pro​
Annotations are extra annotations for this resource.
annotations
required object map[nginx.ingress.kubernetes.io/backend-protocol:HTTPS nginx.ingress.kubernetes.io/ssl-passthrough:true nginx.ingress.kubernetes.io/ssl-redirect:true] pro​labels
required object {} pro​
Labels are extra labels for this resource.
labels
required object {} pro​service
required object pro​
Service defines options for vCluster service deployed by Helm.
service
required object pro​enabled
required boolean true pro​
Enabled defines if the control plane service should be enabled
enabled
required boolean true pro​spec
required object map[type:ClusterIP] pro​
Spec allows you to configure extra service options.
spec
required object map[type:ClusterIP] pro​kubeletNodePort
required integer 0 pro​
KubeletNodePort is the node port where the fake kubelet is exposed. Defaults to 0.
kubeletNodePort
required integer 0 pro​httpsNodePort
required integer 0 pro​
HTTPSNodePort is the node port where https is exposed. Defaults to 0.
httpsNodePort
required integer 0 pro​annotations
required object {} pro​
Annotations are extra annotations for this resource.
annotations
required object {} pro​labels
required object {} pro​
Labels are extra labels for this resource.
labels
required object {} pro​statefulSet
required object pro​
StatefulSet defines options for vCluster statefulSet deployed by Helm.
statefulSet
required object pro​highAvailability
required object pro​
HighAvailability holds options related to high availability.
highAvailability
required object pro​replicas
required integer 1 pro​
Replicas is the amount of replicas to use for the statefulSet.
replicas
required integer 1 pro​leaseDuration
required integer 60 pro​
LeaseDuration is the time to lease for the leader.
leaseDuration
required integer 60 pro​renewDeadline
required integer 40 pro​
RenewDeadline is the deadline to renew a lease for the leader.
renewDeadline
required integer 40 pro​retryPeriod
required integer 15 pro​
RetryPeriod is the time until a replica will retry to get a lease.
retryPeriod
required integer 15 pro​resources
required object pro​
Resources are the resource requests and limits for the statefulSet container.
resources
required object pro​scheduling
required object pro​
Scheduling holds options related to scheduling.
scheduling
required object pro​nodeSelector
required object {} pro​
NodeSelector is the node selector to apply to the pod.
nodeSelector
required object {} pro​affinity
required object {} pro​
Affinity is the affinity to apply to the pod.
affinity
required object {} pro​tolerations
required object[] [] pro​
Tolerations are the tolerations to apply to the pod.
tolerations
required object[] [] pro​priorityClassName
required string pro​
PriorityClassName is the priority class name for the the pod.
priorityClassName
required string pro​podManagementPolicy
required string Parallel pro​
PodManagementPolicy is the statefulSet pod management policy.
podManagementPolicy
required string Parallel pro​topologySpreadConstraints
required object[] [] pro​
TopologySpreadConstraints are the topology spread constraints for the pod.
topologySpreadConstraints
required object[] [] pro​security
required object pro​
Security defines pod or container security context.
security
required object pro​podSecurityContext
required object {} pro​
PodSecurityContext specifies security context options on the pod level.
podSecurityContext
required object {} pro​containerSecurityContext
required object map[allowPrivilegeEscalation:false runAsGroup:0 runAsUser:0] pro​
ContainerSecurityContext specifies security context options on the container level.
containerSecurityContext
required object map[allowPrivilegeEscalation:false runAsGroup:0 runAsUser:0] pro​probes
required object pro​
Probes enables or disables the main container probes.
probes
required object pro​livenessProbe
required object pro​
LivenessProbe specifies if the liveness probe for the container should be enabled
livenessProbe
required object pro​enabled
required boolean true pro​
Enabled defines if this option should be enabled.
enabled
required boolean true pro​persistence
required object pro​
Persistence defines options around persistence for the statefulSet.
persistence
required object pro​volumeClaim
required object pro​
VolumeClaim can be used to configure the persistent volume claim.
volumeClaim
required object pro​enabled
required string|boolean auto pro​
Enabled enables deploying a persistent volume claim. If auto, vCluster will automatically determine
based on the chosen distro and other options if this is required.
enabled
required string|boolean auto pro​accessModes
required string[] [ReadWriteOnce] pro​
AccessModes are the persistent volume claim access modes.
accessModes
required string[] [ReadWriteOnce] pro​retentionPolicy
required string Retain pro​
RetentionPolicy is the persistent volume claim retention policy.
retentionPolicy
required string Retain pro​size
required string 5Gi pro​
Size is the persistent volume claim storage size.
size
required string 5Gi pro​storageClass
required string pro​
StorageClass is the persistent volume claim storage class.
storageClass
required string pro​volumeClaimTemplates
required object[] [] pro​
VolumeClaimTemplates defines the volumeClaimTemplates for the statefulSet
volumeClaimTemplates
required object[] [] pro​dataVolume
required object[] [] pro​
Allows you to override the dataVolume. Only works correctly if volumeClaim.enabled=false.
dataVolume
required object[] [] pro​binariesVolume
required object[] [map[emptyDir:map[] name:binaries]] pro​
BinariesVolume defines a binaries volume that is used to retrieve
distro specific executables to be run by the syncer controller.
This volume doesn't need to be persistent.
binariesVolume
required object[] [map[emptyDir:map[] name:binaries]] pro​addVolumes
required object[] [] pro​
AddVolumes defines extra volumes for the pod
addVolumes
required object[] [] pro​addVolumeMounts
required object[] pro​
AddVolumeMounts defines extra volume mounts for the container
addVolumeMounts
required object[] pro​name
required string pro​
This must match the Name of a Volume.
name
required string pro​readOnly
required boolean pro​
Mounted read-only if true, read-write otherwise (false or unspecified).
Defaults to false.
readOnly
required boolean pro​mountPath
required string pro​
Path within the container at which the volume should be mounted. Must
not contain ':'.
mountPath
required string pro​subPath
required string pro​
Path within the volume from which the container's volume should be mounted.
Defaults to "" (volume's root).
subPath
required string pro​mountPropagation
required string pro​
mountPropagation determines how mounts are propagated from the host
to container and the other way around.
When not set, MountPropagationNone is used.
This field is beta in 1.10.
mountPropagation
required string pro​subPathExpr
required string pro​
Expanded path within the volume from which the container's volume should be mounted.
Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
Defaults to "" (volume's root).
SubPathExpr and SubPath are mutually exclusive.
subPathExpr
required string pro​enableServiceLinks
required boolean true pro​
EnableServiceLinks for the StatefulSet pod
enableServiceLinks
required boolean true pro​annotations
required object {} pro​
Annotations are extra annotations for this resource.
annotations
required object {} pro​labels
required object {} pro​
Labels are extra labels for this resource.
labels
required object {} pro​pods
required object pro​
Additional labels or annotations for the statefulSet pods.
pods
required object pro​image
required object pro​
Image is the image for the controlPlane statefulSet container
image
required object pro​registry
required string ghcr.io pro​
Configure the registry of the container image, e.g. my-registry.com or ghcr.io
It defaults to ghcr.io and can be overriding either by using this field or controlPlane.advanced.defaultImageRegistry
registry
required string ghcr.io pro​repository
required string loft-sh/vcluster-pro pro​
Configure the repository of the container image, e.g. my-repo/my-image.
It defaults to the vCluster pro repository that includes the optional pro modules that are turned off by default.
If you still want to use the pure OSS build, use 'loft-sh/vcluster-oss' instead.
repository
required string loft-sh/vcluster-pro pro​tag
required string pro​
Tag is the tag of the container image, e.g. latest
tag
required string pro​imagePullPolicy
required string pro​
ImagePullPolicy is the policy how to pull the image.
imagePullPolicy
required string pro​workingDir
required string pro​
WorkingDir specifies in what folder the main process should get started.
workingDir
required string pro​command
required string[] [] pro​
Command allows you to override the main command.
command
required string[] [] pro​args
required string[] [] pro​
Args allows you to override the main arguments.
args
required string[] [] pro​env
required object[] [] pro​
Env are additional environment variables for the statefulSet container.
env
required object[] [] pro​serviceMonitor
required object pro​
ServiceMonitor can be used to automatically create a service monitor for vCluster deployment itself.
serviceMonitor
required object pro​advanced
required object pro​
Advanced holds additional configuration for the vCluster control plane.
advanced
required object pro​defaultImageRegistry
required string pro​
DefaultImageRegistry will be used as a prefix for all internal images deployed by vCluster or Helm. This makes it easy to
upload all required vCluster images to a single private repository and set this value. Workload images are not affected by this.
defaultImageRegistry
required string pro​virtualScheduler
required object pro​
VirtualScheduler defines if a scheduler should be used within the virtual cluster or the scheduling decision for workloads will be made by the host cluster.
virtualScheduler
required object pro​enabled
required boolean false pro​
Enabled defines if this option should be enabled.
enabled
required boolean false pro​serviceAccount
required object pro​
ServiceAccount specifies options for the vCluster control plane service account.
serviceAccount
required object pro​enabled
required boolean true pro​
Enabled specifies if the service account should get deployed.
enabled
required boolean true pro​name
required string pro​
Name specifies what name to use for the service account.
name
required string pro​imagePullSecrets
required object[] pro​
ImagePullSecrets defines extra image pull secrets for the service account.
imagePullSecrets
required object[] pro​name
required string pro​
Name of the image pull secret to use.
name
required string pro​annotations
required object {} pro​
Annotations are extra annotations for this resource.
annotations
required object {} pro​labels
required object {} pro​
Labels are extra labels for this resource.
labels
required object {} pro​workloadServiceAccount
required object pro​
WorkloadServiceAccount specifies options for the service account that will be used for the workloads that run within the virtual cluster.
workloadServiceAccount
required object pro​enabled
required boolean true pro​
Enabled specifies if the service account for the workloads should get deployed.
enabled
required boolean true pro​name
required string pro​
Name specifies what name to use for the service account for the virtual cluster workloads.
name
required string pro​imagePullSecrets
required object[] pro​
ImagePullSecrets defines extra image pull secrets for the workload service account.
imagePullSecrets
required object[] pro​name
required string pro​
Name of the image pull secret to use.
name
required string pro​annotations
required object {} pro​
Annotations are extra annotations for this resource.
annotations
required object {} pro​labels
required object {} pro​
Labels are extra labels for this resource.
labels
required object {} pro​headlessService
required object pro​
HeadlessService specifies options for the headless service used for the vCluster StatefulSet.
headlessService
required object pro​rbac
required object pro​
RBAC options for the virtual cluster.
rbac
required object pro​role
required object pro​
Role holds virtual cluster role configuration
role
required object pro​clusterRole
required object pro​
ClusterRole holds virtual cluster cluster role configuration
clusterRole
required object pro​enabled
required string|boolean auto pro​
Enabled defines if the cluster role should be enabled or disabled. If auto, vCluster automatically determines whether the virtual cluster requires a cluster role.
enabled
required string|boolean auto pro​extraRules
required object[] [] pro​
ExtraRules will add rules to the cluster role.
extraRules
required object[] [] pro​overwriteRules
required object[] [] pro​
OverwriteRules will overwrite the cluster role rules completely.
overwriteRules
required object[] [] pro​plugins
required object {} pro​
Define which vCluster plugins to load.
plugins
required object {} pro​experimental
required object pro​
Experimental features for vCluster. Configuration here might change, so be careful with this.
experimental
required object pro​deploy
required object pro​
Deploy allows you to configure manifests and Helm charts to deploy within the virtual cluster.
deploy
required object pro​host
required object pro​
Host defines what manifests to deploy into the host cluster
host
required object pro​manifests
required string pro​
Manifests are raw Kubernetes manifests that should get applied within the virtual cluster.
manifests
required string pro​manifestsTemplate
required string pro​
ManifestsTemplate is a Kubernetes manifest template that will be rendered with vCluster values before applying it within the virtual cluster.
manifestsTemplate
required string pro​vcluster
required object pro​
VCluster defines what manifests and charts to deploy into the vCluster
vcluster
required object pro​manifests
required string pro​
Manifests are raw Kubernetes manifests that should get applied within the virtual cluster.
manifests
required string pro​manifestsTemplate
required string pro​
ManifestsTemplate is a Kubernetes manifest template that will be rendered with vCluster values before applying it within the virtual cluster.
manifestsTemplate
required string pro​helm
required object[] pro​
Helm are Helm charts that should get deployed into the virtual cluster
helm
required object[] pro​chart
required object pro​
Chart defines what chart should get deployed.
chart
required object pro​release
required object pro​
Release defines what release should get deployed.
release
required object pro​values
required string pro​
Values defines what values should get used.
values
required string pro​timeout
required string pro​
Timeout defines the timeout for Helm
timeout
required string pro​bundle
required string pro​
Bundle allows to compress the Helm chart and specify this instead of an online chart
bundle
required string pro​syncSettings
required object pro​
SyncSettings are advanced settings for the syncer controller.
syncSettings
required object pro​disableSync
required boolean false pro​
DisableSync will not sync any resources and disable most control plane functionality.
disableSync
required boolean false pro​rewriteKubernetesService
required boolean false pro​
RewriteKubernetesService will rewrite the Kubernetes service to point to the vCluster service if disableSync is enabled
rewriteKubernetesService
required boolean false pro​targetNamespace
required string pro​
TargetNamespace is the namespace where the workloads should get synced to.
targetNamespace
required string pro​setOwner
required boolean true pro​
SetOwner specifies if vCluster should set an owner reference on the synced objects to the vCluster service. This allows for easy garbage collection.
setOwner
required boolean true pro​hostMetricsBindAddress
required string pro​
HostMetricsBindAddress is the bind address for the local manager
hostMetricsBindAddress
required string pro​virtualMetricsBindAddress
required string pro​
VirtualMetricsBindAddress is the bind address for the virtual manager
virtualMetricsBindAddress
required string pro​genericSync
required object pro​
GenericSync holds options to generically sync resources from virtual cluster to host.
genericSync
required object pro​version
required string pro​
Version is the config version
version
required string pro​export
required object[] pro​
Exports syncs a resource from the virtual cluster to the host
export
required object[] pro​apiVersion
required string pro​
APIVersion of the object to sync
apiVersion
required string pro​kind
required string pro​
Kind of the object to sync
kind
required string pro​optional
required boolean pro​
optional
required boolean pro​replaceOnConflict
required boolean pro​
ReplaceWhenInvalid determines if the controller should try to recreate the object
if there is a problem applying
replaceOnConflict
required boolean pro​patches
required object[] pro​
Patches are the patches to apply on the virtual cluster objects
when syncing them from the host cluster
patches
required object[] pro​op
required string pro​
Operation is the type of the patch
op
required string pro​fromPath
required string pro​
FromPath is the path from the other object
fromPath
required string pro​path
required string pro​
Path is the path of the patch
path
required string pro​namePath
required string pro​
NamePath is the path to the name of a child resource within Path
namePath
required string pro​namespacePath
required string pro​
NamespacePath is path to the namespace of a child resource within Path
namespacePath
required string pro​value
required object pro​
Value is the new value to be set to the path
value
required object pro​regex
required string pro​
Regex - is regular expresion used to identify the Name,
and optionally Namespace, parts of the field value that
will be replaced with the rewritten Name and/or Namespace
regex
required string pro​conditions
required object[] pro​
Conditions are conditions that must be true for
the patch to get executed
conditions
required object[] pro​path
required string pro​
Path is the path within the object to select
path
required string pro​subPath
required string pro​
SubPath is the path below the selected object to select
subPath
required string pro​equal
required object pro​
Equal is the value the path should be equal to
equal
required object pro​notEqual
required object pro​
NotEqual is the value the path should not be equal to
notEqual
required object pro​empty
required boolean pro​
Empty means that the path value should be empty or unset
empty
required boolean pro​ignore
required boolean pro​
Ignore determines if the path should be ignored if handled as a reverse patch
ignore
required boolean pro​reversePatches
required object[] pro​
ReversePatches are the patches to apply to host cluster objects
after it has been synced to the virtual cluster
reversePatches
required object[] pro​op
required string pro​
Operation is the type of the patch
op
required string pro​fromPath
required string pro​
FromPath is the path from the other object
fromPath
required string pro​path
required string pro​
Path is the path of the patch
path
required string pro​namePath
required string pro​
NamePath is the path to the name of a child resource within Path
namePath
required string pro​namespacePath
required string pro​
NamespacePath is path to the namespace of a child resource within Path
namespacePath
required string pro​value
required object pro​
Value is the new value to be set to the path
value
required object pro​regex
required string pro​
Regex - is regular expresion used to identify the Name,
and optionally Namespace, parts of the field value that
will be replaced with the rewritten Name and/or Namespace
regex
required string pro​conditions
required object[] pro​
Conditions are conditions that must be true for
the patch to get executed
conditions
required object[] pro​path
required string pro​
Path is the path within the object to select
path
required string pro​subPath
required string pro​
SubPath is the path below the selected object to select
subPath
required string pro​equal
required object pro​
Equal is the value the path should be equal to
equal
required object pro​notEqual
required object pro​
NotEqual is the value the path should not be equal to
notEqual
required object pro​empty
required boolean pro​
Empty means that the path value should be empty or unset
empty
required boolean pro​ignore
required boolean pro​
Ignore determines if the path should be ignored if handled as a reverse patch
ignore
required boolean pro​import
required object[] pro​
Imports syncs a resource from the host cluster to virtual cluster
import
required object[] pro​apiVersion
required string pro​
APIVersion of the object to sync
apiVersion
required string pro​kind
required string pro​
Kind of the object to sync
kind
required string pro​optional
required boolean pro​
optional
required boolean pro​replaceOnConflict
required boolean pro​
ReplaceWhenInvalid determines if the controller should try to recreate the object
if there is a problem applying
replaceOnConflict
required boolean pro​patches
required object[] pro​
Patches are the patches to apply on the virtual cluster objects
when syncing them from the host cluster
patches
required object[] pro​op
required string pro​
Operation is the type of the patch
op
required string pro​fromPath
required string pro​
FromPath is the path from the other object
fromPath
required string pro​path
required string pro​
Path is the path of the patch
path
required string pro​namePath
required string pro​
NamePath is the path to the name of a child resource within Path
namePath
required string pro​namespacePath
required string pro​
NamespacePath is path to the namespace of a child resource within Path
namespacePath
required string pro​value
required object pro​
Value is the new value to be set to the path
value
required object pro​regex
required string pro​
Regex - is regular expresion used to identify the Name,
and optionally Namespace, parts of the field value that
will be replaced with the rewritten Name and/or Namespace
regex
required string pro​conditions
required object[] pro​
Conditions are conditions that must be true for
the patch to get executed
conditions
required object[] pro​path
required string pro​
Path is the path within the object to select
path
required string pro​subPath
required string pro​
SubPath is the path below the selected object to select
subPath
required string pro​equal
required object pro​
Equal is the value the path should be equal to
equal
required object pro​notEqual
required object pro​
NotEqual is the value the path should not be equal to
notEqual
required object pro​empty
required boolean pro​
Empty means that the path value should be empty or unset
empty
required boolean pro​ignore
required boolean pro​
Ignore determines if the path should be ignored if handled as a reverse patch
ignore
required boolean pro​reversePatches
required object[] pro​
ReversePatches are the patches to apply to host cluster objects
after it has been synced to the virtual cluster
reversePatches
required object[] pro​op
required string pro​
Operation is the type of the patch
op
required string pro​fromPath
required string pro​
FromPath is the path from the other object
fromPath
required string pro​path
required string pro​
Path is the path of the patch
path
required string pro​namePath
required string pro​
NamePath is the path to the name of a child resource within Path
namePath
required string pro​namespacePath
required string pro​
NamespacePath is path to the namespace of a child resource within Path
namespacePath
required string pro​value
required object pro​
Value is the new value to be set to the path
value
required object pro​regex
required string pro​
Regex - is regular expresion used to identify the Name,
and optionally Namespace, parts of the field value that
will be replaced with the rewritten Name and/or Namespace
regex
required string pro​conditions
required object[] pro​
Conditions are conditions that must be true for
the patch to get executed
conditions
required object[] pro​path
required string pro​
Path is the path within the object to select
path
required string pro​subPath
required string pro​
SubPath is the path below the selected object to select
subPath
required string pro​equal
required object pro​
Equal is the value the path should be equal to
equal
required object pro​notEqual
required object pro​
NotEqual is the value the path should not be equal to
notEqual
required object pro​empty
required boolean pro​
Empty means that the path value should be empty or unset
empty
required boolean pro​ignore
required boolean pro​
Ignore determines if the path should be ignored if handled as a reverse patch
ignore
required boolean pro​hooks
required object pro​
Hooks are hooks that can be used to inject custom patches before syncing
hooks
required object pro​hostToVirtual
required object[] pro​
HostToVirtual is a hook that is executed before syncing from the host to the virtual cluster
hostToVirtual
required object[] pro​apiVersion
required string pro​
APIVersion of the object to sync
apiVersion
required string pro​kind
required string pro​
Kind of the object to sync
kind
required string pro​verbs
required string[] pro​
Verbs are the verbs that the hook should mutate
verbs
required string[] pro​patches
required object[] pro​
Patches are the patches to apply on the object to be synced
patches
required object[] pro​op
required string pro​
Operation is the type of the patch
op
required string pro​fromPath
required string pro​
FromPath is the path from the other object
fromPath
required string pro​path
required string pro​
Path is the path of the patch
path
required string pro​namePath
required string pro​
NamePath is the path to the name of a child resource within Path
namePath
required string pro​namespacePath
required string pro​
NamespacePath is path to the namespace of a child resource within Path
namespacePath
required string pro​value
required object pro​
Value is the new value to be set to the path
value
required object pro​regex
required string pro​
Regex - is regular expresion used to identify the Name,
and optionally Namespace, parts of the field value that
will be replaced with the rewritten Name and/or Namespace
regex
required string pro​conditions
required object[] pro​
Conditions are conditions that must be true for
the patch to get executed
conditions
required object[] pro​path
required string pro​
Path is the path within the object to select
path
required string pro​subPath
required string pro​
SubPath is the path below the selected object to select
subPath
required string pro​equal
required object pro​
Equal is the value the path should be equal to
equal
required object pro​notEqual
required object pro​
NotEqual is the value the path should not be equal to
notEqual
required object pro​empty
required boolean pro​
Empty means that the path value should be empty or unset
empty
required boolean pro​ignore
required boolean pro​
Ignore determines if the path should be ignored if handled as a reverse patch
ignore
required boolean pro​virtualToHost
required object[] pro​
VirtualToHost is a hook that is executed before syncing from the virtual to the host cluster
virtualToHost
required object[] pro​apiVersion
required string pro​
APIVersion of the object to sync
apiVersion
required string pro​kind
required string pro​
Kind of the object to sync
kind
required string pro​verbs
required string[] pro​
Verbs are the verbs that the hook should mutate
verbs
required string[] pro​patches
required object[] pro​
Patches are the patches to apply on the object to be synced
patches
required object[] pro​op
required string pro​
Operation is the type of the patch
op
required string pro​fromPath
required string pro​
FromPath is the path from the other object
fromPath
required string pro​path
required string pro​
Path is the path of the patch
path
required string pro​namePath
required string pro​
NamePath is the path to the name of a child resource within Path
namePath
required string pro​namespacePath
required string pro​
NamespacePath is path to the namespace of a child resource within Path
namespacePath
required string pro​value
required object pro​
Value is the new value to be set to the path
value
required object pro​regex
required string pro​
Regex - is regular expresion used to identify the Name,
and optionally Namespace, parts of the field value that
will be replaced with the rewritten Name and/or Namespace
regex
required string pro​conditions
required object[] pro​
Conditions are conditions that must be true for
the patch to get executed
conditions
required object[] pro​path
required string pro​
Path is the path within the object to select
path
required string pro​subPath
required string pro​
SubPath is the path below the selected object to select
subPath
required string pro​equal
required object pro​
Equal is the value the path should be equal to
equal
required object pro​notEqual
required object pro​
NotEqual is the value the path should not be equal to
notEqual
required object pro​empty
required boolean pro​
Empty means that the path value should be empty or unset
empty
required boolean pro​ignore
required boolean pro​
Ignore determines if the path should be ignored if handled as a reverse patch
ignore
required boolean pro​multiNamespaceMode
required object pro​
MultiNamespaceMode tells virtual cluster to sync to multiple namespaces instead of a single one. This will map each virtual cluster namespace to a single namespace in the host cluster.
multiNamespaceMode
required object pro​isolatedControlPlane
required object pro​
IsolatedControlPlane is a feature to run the vCluster control plane in a different Kubernetes cluster than the workloads themselves.
isolatedControlPlane
required object pro​enabled
required boolean pro​
Enabled specifies if the isolated control plane feature should be enabled.
enabled
required boolean pro​headless
required boolean false pro​
Headless states that Helm should deploy the vCluster in headless mode for the isolated control plane.
headless
required boolean false pro​kubeConfig
required string pro​
KubeConfig is the path where to find the remote workload cluster kubeconfig.
kubeConfig
required string pro​namespace
required string pro​
Namespace is the namespace where to sync the workloads into.
namespace
required string pro​service
required string pro​
Service is the vCluster service in the remote cluster.
service
required string pro​virtualClusterKubeConfig
required object pro​
VirtualClusterKubeConfig allows you to override distro specifics and specify where vCluster will find the required certificates and vCluster config.
virtualClusterKubeConfig
required object pro​kubeConfig
required string pro​
KubeConfig is the virtual cluster kubeconfig path.
kubeConfig
required string pro​serverCAKey
required string pro​
ServerCAKey is the server ca key path.
serverCAKey
required string pro​serverCACert
required string pro​
ServerCAKey is the server ca cert path.
serverCACert
required string pro​clientCACert
required string pro​
ServerCAKey is the client ca cert path.
clientCACert
required string pro​requestHeaderCACert
required string pro​
RequestHeaderCACert is the request header ca cert path.
requestHeaderCACert
required string pro​denyProxyRequests
required object[] pro​
DenyProxyRequests denies certain requests in the vCluster proxy.
denyProxyRequests
required object[] pro​name
required string pro​
The name of the check.
name
required string pro​namespaces
required string[] pro​
Namespace describe a list of namespaces that will be affected by the check.
An empty list means that all namespaces will be affected.
In case of ClusterScoped rules, only the Namespace resource is affected.
namespaces
required string[] pro​rules
required object[] pro​
Rules describes on which verbs and on what resources/subresources the webhook is enforced.
The webhook is enforced if it matches any Rule.
The version of the request must match the rule version exactly. Equivalent matching is not supported.
rules
required object[] pro​apiGroups
required string[] pro​
APIGroups is the API groups the resources belong to. '*' is all groups.
apiGroups
required string[] pro​apiVersions
required string[] pro​
APIVersions is the API versions the resources belong to. '*' is all versions.
apiVersions
required string[] pro​resources
required string[] pro​
Resources is a list of resources this rule applies to.
resources
required string[] pro​scope
required string pro​
Scope specifies the scope of this rule.
scope
required string pro​operations
required string[] pro​
Verb is the kube verb associated with the request for API requests, not the http verb. This includes things like list and watch.
For non-resource requests, this is the lowercase http verb.
If '*' is present, the length of the slice must be one.
operations
required string[] pro​excludedUsers
required string[] pro​
ExcludedUsers describe a list of users for which the checks will be skipped.
Impersonation attempts on these users will still be subjected to the checks.
excludedUsers
required string[] pro​external
required object pro​
External holds external tool configuration
external
required object pro​platform
required object pro​
Platform holds configuration for vCluster platform
platform
required object pro​apiKey
required object pro​
APIKey defines where to find the platform access key and host. By default, vCluster will search in the following locations in this precedence:
- platform.api.accessKey
- environment variable called LICENSE
- secret specified under external.platform.apiKey.secretName
- secret called "vcluster-platform-api-key" in the vCluster namespace
apiKey
required object pro​secretName
required string pro​
SecretName is the name of the secret where the platform access key is stored. This defaults to vcluster-platform-api-key if undefined.
secretName
required string pro​namespace
required string pro​
Namespace defines the namespace where the access key secret should be retrieved from. If this is not equal to the namespace
where the vCluster instance is deployed, you need to make sure vCluster has access to this other namespace.
namespace
required string pro​createRBAC
required boolean pro​
CreateRBAC will automatically create the necessary RBAC roles and role bindings to allow vCluster to read the secret specified
in the above namespace, if specified.
This defaults to true.
createRBAC
required boolean pro​autoSleep
required object pro​
AutoSleep holds configuration for automatic sleep and wakeup
autoSleep
required object pro​afterInactivity
required integer pro​
AfterInactivity specifies after how many seconds of inactivity the virtual cluster should sleep
afterInactivity
required integer pro​schedule
required string pro​
Schedule specifies scheduled virtual cluster sleep in Cron format, see https://en.wikipedia.org/wiki/Cron.
Note: timezone defined in the schedule string will be ignored. Use ".Timezone" field instead.
schedule
required string pro​timezone
required string pro​
Timezone specifies time zone used for scheduled virtual cluster operations. Defaults to UTC.
Accepts the same format as time.LoadLocation() in Go (https://pkg.go.dev/time#LoadLocation).
The value should be a location name corresponding to a file in the IANA Time Zone database, such as "America/New_York".
timezone
required string pro​autoWakeup
required object pro​
AutoSleep holds configuration for automatic wakeup
autoWakeup
required object pro​schedule
required string pro​
Schedule specifies scheduled wakeup from sleep in Cron format, see https://en.wikipedia.org/wiki/Cron.
Note: timezone defined in the schedule string will be ignored. The timezone for the autoSleep schedule will be
used
schedule
required string pro​telemetry
required object pro​
Configuration related to telemetry gathered about vCluster usage.
telemetry
required object pro​