k8s_crds_helm_controller/
helmcharts.rs

1// WARNING: generated by kopium - manual changes will be overwritten
2// kopium command: kopium -f helmcharts.yml --schema=derived --docs -b --derive=Default --derive=PartialEq --smart-derive-elision
3// kopium version: 0.21.2
4
5#[allow(unused_imports)]
6mod prelude {
7    pub use k8s_openapi::apimachinery::pkg::util::intstr::IntOrString;
8    pub use kube_derive::CustomResource;
9    #[cfg(feature = "schemars")]
10    pub use schemars::JsonSchema;
11    pub use serde::{Deserialize, Serialize};
12    pub use std::collections::BTreeMap;
13    #[cfg(feature = "builder")]
14    pub use typed_builder::TypedBuilder;
15}
16use self::prelude::*;
17
18/// HelmChartSpec represents the user-configurable details for installation and upgrade of a Helm chart release.
19#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
20#[cfg_attr(feature = "builder", derive(TypedBuilder))]
21#[cfg_attr(feature = "schemars", derive(JsonSchema))]
22#[cfg_attr(not(feature = "schemars"), kube(schema = "disabled"))]
23#[kube(
24    group = "helm.cattle.io",
25    version = "v1",
26    kind = "HelmChart",
27    plural = "helmcharts"
28)]
29#[kube(namespaced)]
30#[kube(status = "HelmChartStatus")]
31#[kube(derive = "Default")]
32#[kube(derive = "PartialEq")]
33pub struct HelmChartSpec {
34    /// Pass Basic auth credentials to all domains.
35    /// Helm CLI positional argument/flag: `--pass-credentials`
36    #[serde(
37        default,
38        skip_serializing_if = "Option::is_none",
39        rename = "authPassCredentials"
40    )]
41    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
42    pub auth_pass_credentials: Option<bool>,
43    /// Reference to Secret of type kubernetes.io/basic-auth holding Basic auth credentials for the Chart repo.
44    #[serde(
45        default,
46        skip_serializing_if = "Option::is_none",
47        rename = "authSecret"
48    )]
49    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
50    pub auth_secret: Option<HelmChartAuthSecret>,
51    /// Specify the number of retries before considering the helm job failed.
52    #[serde(
53        default,
54        skip_serializing_if = "Option::is_none",
55        rename = "backOffLimit"
56    )]
57    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
58    pub back_off_limit: Option<i32>,
59    /// Set to True if this chart is needed to bootstrap the cluster (Cloud Controller Manager, CNI, etc).
60    #[serde(default, skip_serializing_if = "Option::is_none")]
61    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
62    pub bootstrap: Option<bool>,
63    /// Helm Chart name in repository, or complete HTTPS URL to chart archive (.tgz)
64    /// Helm CLI positional argument/flag: `CHART`
65    #[serde(default, skip_serializing_if = "Option::is_none")]
66    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
67    pub chart: Option<String>,
68    /// Base64-encoded chart archive .tgz; overides `.spec.chart` and `.spec.version`.
69    /// Helm CLI positional argument/flag: `CHART`
70    #[serde(
71        default,
72        skip_serializing_if = "Option::is_none",
73        rename = "chartContent"
74    )]
75    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
76    pub chart_content: Option<String>,
77    /// Create target namespace if not present.
78    /// Helm CLI positional argument/flag: `--create-namespace`
79    #[serde(
80        default,
81        skip_serializing_if = "Option::is_none",
82        rename = "createNamespace"
83    )]
84    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
85    pub create_namespace: Option<bool>,
86    /// Reference to Secret of type kubernetes.io/dockerconfigjson holding Docker auth credentials for the OCI-based registry acting as the Chart repo.
87    #[serde(
88        default,
89        skip_serializing_if = "Option::is_none",
90        rename = "dockerRegistrySecret"
91    )]
92    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
93    pub docker_registry_secret: Option<HelmChartDockerRegistrySecret>,
94    /// Configures handling of failed chart installation or upgrades.
95    /// - `reinstall` will perform a clean uninstall and reinstall of the chart.
96    /// - `abort` will take no action and leave the chart in a failed state so that the administrator can manually resolve the error.
97    #[serde(
98        default,
99        skip_serializing_if = "Option::is_none",
100        rename = "failurePolicy"
101    )]
102    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
103    pub failure_policy: Option<HelmChartFailurePolicy>,
104    /// DEPRECATED. Helm version to use. Only v3 is currently supported.
105    #[serde(
106        default,
107        skip_serializing_if = "Option::is_none",
108        rename = "helmVersion"
109    )]
110    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
111    pub helm_version: Option<String>,
112    /// Skip TLS certificate checks for the chart download.
113    /// Helm CLI positional argument/flag: `--insecure-skip-tls-verify`
114    #[serde(
115        default,
116        skip_serializing_if = "Option::is_none",
117        rename = "insecureSkipTLSVerify"
118    )]
119    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
120    pub insecure_skip_tls_verify: Option<bool>,
121    /// Specify the image to use for tht helm job pod when installing or upgrading the helm chart.
122    #[serde(default, skip_serializing_if = "Option::is_none", rename = "jobImage")]
123    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
124    pub job_image: Option<String>,
125    /// Use insecure HTTP connections for the chart download.
126    /// Helm CLI positional argument/flag: `--plain-http`
127    #[serde(default, skip_serializing_if = "Option::is_none", rename = "plainHTTP")]
128    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
129    pub plain_http: Option<bool>,
130    /// Custom PodSecurityContext for the helm job pod.
131    #[serde(
132        default,
133        skip_serializing_if = "Option::is_none",
134        rename = "podSecurityContext"
135    )]
136    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
137    pub pod_security_context: Option<HelmChartPodSecurityContext>,
138    /// Helm Chart repository URL.
139    /// Helm CLI positional argument/flag: `--repo`
140    #[serde(default, skip_serializing_if = "Option::is_none")]
141    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
142    pub repo: Option<String>,
143    /// Verify certificates of HTTPS-enabled servers using this CA bundle. Should be a string containing one or more PEM-encoded CA Certificates.
144    /// Helm CLI positional argument/flag: `--ca-file`
145    #[serde(default, skip_serializing_if = "Option::is_none", rename = "repoCA")]
146    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
147    pub repo_ca: Option<String>,
148    /// Reference to a ConfigMap containing CA Certificates to be be trusted by Helm. Can be used along with or instead of `.spec.repoCA`
149    /// Helm CLI positional argument/flag: `--ca-file`
150    #[serde(
151        default,
152        skip_serializing_if = "Option::is_none",
153        rename = "repoCAConfigMap"
154    )]
155    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
156    pub repo_ca_config_map: Option<HelmChartRepoCaConfigMap>,
157    /// custom SecurityContext for the helm job pod.
158    #[serde(
159        default,
160        skip_serializing_if = "Option::is_none",
161        rename = "securityContext"
162    )]
163    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
164    pub security_context: Option<HelmChartSecurityContext>,
165    /// Override simple Chart values. These take precedence over options set via valuesContent.
166    /// Helm CLI positional argument/flag: `--set`, `--set-string`
167    #[serde(default, skip_serializing_if = "Option::is_none")]
168    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
169    pub set: Option<BTreeMap<String, IntOrString>>,
170    /// Set to True if helm should take ownership of existing resources when installing/upgrading the chart.
171    /// Helm CLI positional argument/flag: `--take-ownership`
172    #[serde(
173        default,
174        skip_serializing_if = "Option::is_none",
175        rename = "takeOwnership"
176    )]
177    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
178    pub take_ownership: Option<bool>,
179    /// Helm Chart target namespace.
180    /// Helm CLI positional argument/flag: `--namespace`
181    #[serde(
182        default,
183        skip_serializing_if = "Option::is_none",
184        rename = "targetNamespace"
185    )]
186    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
187    pub target_namespace: Option<String>,
188    /// Timeout for Helm operations.
189    /// Helm CLI positional argument/flag: `--timeout`
190    #[serde(default, skip_serializing_if = "Option::is_none")]
191    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
192    pub timeout: Option<String>,
193    /// Override complex Chart values via inline YAML content.
194    /// Helm CLI positional argument/flag: `--values`
195    #[serde(
196        default,
197        skip_serializing_if = "Option::is_none",
198        rename = "valuesContent"
199    )]
200    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
201    pub values_content: Option<String>,
202    /// Override complex Chart values via references to external Secrets.
203    /// Helm CLI positional argument/flag: `--values`
204    #[serde(
205        default,
206        skip_serializing_if = "Option::is_none",
207        rename = "valuesSecrets"
208    )]
209    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
210    pub values_secrets: Option<Vec<HelmChartValuesSecrets>>,
211    /// Helm Chart version. Only used when installing from repository; ignored when .spec.chart or .spec.chartContent is used to install a specific chart archive.
212    /// Helm CLI positional argument/flag: `--version`
213    #[serde(default, skip_serializing_if = "Option::is_none")]
214    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
215    pub version: Option<String>,
216}
217
218/// Reference to Secret of type kubernetes.io/basic-auth holding Basic auth credentials for the Chart repo.
219#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
220#[cfg_attr(feature = "builder", derive(TypedBuilder))]
221#[cfg_attr(feature = "schemars", derive(JsonSchema))]
222pub struct HelmChartAuthSecret {
223    /// Name of the referent.
224    /// This field is effectively required, but due to backwards compatibility is
225    /// allowed to be empty. Instances of this type with an empty value here are
226    /// almost certainly wrong.
227    /// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
228    #[serde(default, skip_serializing_if = "Option::is_none")]
229    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
230    pub name: Option<String>,
231}
232
233/// Reference to Secret of type kubernetes.io/dockerconfigjson holding Docker auth credentials for the OCI-based registry acting as the Chart repo.
234#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
235#[cfg_attr(feature = "builder", derive(TypedBuilder))]
236#[cfg_attr(feature = "schemars", derive(JsonSchema))]
237pub struct HelmChartDockerRegistrySecret {
238    /// Name of the referent.
239    /// This field is effectively required, but due to backwards compatibility is
240    /// allowed to be empty. Instances of this type with an empty value here are
241    /// almost certainly wrong.
242    /// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
243    #[serde(default, skip_serializing_if = "Option::is_none")]
244    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
245    pub name: Option<String>,
246}
247
248/// HelmChartSpec represents the user-configurable details for installation and upgrade of a Helm chart release.
249#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
250#[cfg_attr(feature = "schemars", derive(JsonSchema))]
251pub enum HelmChartFailurePolicy {
252    #[serde(rename = "abort")]
253    Abort,
254    #[serde(rename = "reinstall")]
255    Reinstall,
256}
257
258/// Custom PodSecurityContext for the helm job pod.
259#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
260#[cfg_attr(feature = "builder", derive(TypedBuilder))]
261#[cfg_attr(feature = "schemars", derive(JsonSchema))]
262pub struct HelmChartPodSecurityContext {
263    /// appArmorProfile is the AppArmor options to use by the containers in this pod.
264    /// Note that this field cannot be set when spec.os.name is windows.
265    #[serde(
266        default,
267        skip_serializing_if = "Option::is_none",
268        rename = "appArmorProfile"
269    )]
270    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
271    pub app_armor_profile: Option<HelmChartPodSecurityContextAppArmorProfile>,
272    /// A special supplemental group that applies to all containers in a pod.
273    /// Some volume types allow the Kubelet to change the ownership of that volume
274    /// to be owned by the pod:
275    ///
276    /// 1. The owning GID will be the FSGroup
277    /// 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
278    /// 3. The permission bits are OR'd with rw-rw----
279    ///
280    /// If unset, the Kubelet will not modify the ownership and permissions of any volume.
281    /// Note that this field cannot be set when spec.os.name is windows.
282    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fsGroup")]
283    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
284    pub fs_group: Option<i64>,
285    /// fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
286    /// before being exposed inside Pod. This field will only apply to
287    /// volume types which support fsGroup based ownership(and permissions).
288    /// It will have no effect on ephemeral volume types such as: secret, configmaps
289    /// and emptydir.
290    /// Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
291    /// Note that this field cannot be set when spec.os.name is windows.
292    #[serde(
293        default,
294        skip_serializing_if = "Option::is_none",
295        rename = "fsGroupChangePolicy"
296    )]
297    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
298    pub fs_group_change_policy: Option<String>,
299    /// The GID to run the entrypoint of the container process.
300    /// Uses runtime default if unset.
301    /// May also be set in SecurityContext.  If set in both SecurityContext and
302    /// PodSecurityContext, the value specified in SecurityContext takes precedence
303    /// for that container.
304    /// Note that this field cannot be set when spec.os.name is windows.
305    #[serde(
306        default,
307        skip_serializing_if = "Option::is_none",
308        rename = "runAsGroup"
309    )]
310    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
311    pub run_as_group: Option<i64>,
312    /// Indicates that the container must run as a non-root user.
313    /// If true, the Kubelet will validate the image at runtime to ensure that it
314    /// does not run as UID 0 (root) and fail to start the container if it does.
315    /// If unset or false, no such validation will be performed.
316    /// May also be set in SecurityContext.  If set in both SecurityContext and
317    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
318    #[serde(
319        default,
320        skip_serializing_if = "Option::is_none",
321        rename = "runAsNonRoot"
322    )]
323    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
324    pub run_as_non_root: Option<bool>,
325    /// The UID to run the entrypoint of the container process.
326    /// Defaults to user specified in image metadata if unspecified.
327    /// May also be set in SecurityContext.  If set in both SecurityContext and
328    /// PodSecurityContext, the value specified in SecurityContext takes precedence
329    /// for that container.
330    /// Note that this field cannot be set when spec.os.name is windows.
331    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUser")]
332    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
333    pub run_as_user: Option<i64>,
334    /// seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.
335    /// It has no effect on nodes that do not support SELinux or to volumes does not support SELinux.
336    /// Valid values are "MountOption" and "Recursive".
337    ///
338    /// "Recursive" means relabeling of all files on all Pod volumes by the container runtime.
339    /// This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.
340    ///
341    /// "MountOption" mounts all eligible Pod volumes with `-o context` mount option.
342    /// This requires all Pods that share the same volume to use the same SELinux label.
343    /// It is not possible to share the same volume among privileged and unprivileged Pods.
344    /// Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
345    /// whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
346    /// CSIDriver instance. Other volumes are always re-labelled recursively.
347    /// "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
348    ///
349    /// If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
350    /// If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
351    /// and "Recursive" for all other volumes.
352    ///
353    /// This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
354    ///
355    /// All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.
356    /// Note that this field cannot be set when spec.os.name is windows.
357    #[serde(
358        default,
359        skip_serializing_if = "Option::is_none",
360        rename = "seLinuxChangePolicy"
361    )]
362    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
363    pub se_linux_change_policy: Option<String>,
364    /// The SELinux context to be applied to all containers.
365    /// If unspecified, the container runtime will allocate a random SELinux context for each
366    /// container.  May also be set in SecurityContext.  If set in
367    /// both SecurityContext and PodSecurityContext, the value specified in SecurityContext
368    /// takes precedence for that container.
369    /// Note that this field cannot be set when spec.os.name is windows.
370    #[serde(
371        default,
372        skip_serializing_if = "Option::is_none",
373        rename = "seLinuxOptions"
374    )]
375    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
376    pub se_linux_options: Option<HelmChartPodSecurityContextSeLinuxOptions>,
377    /// The seccomp options to use by the containers in this pod.
378    /// Note that this field cannot be set when spec.os.name is windows.
379    #[serde(
380        default,
381        skip_serializing_if = "Option::is_none",
382        rename = "seccompProfile"
383    )]
384    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
385    pub seccomp_profile: Option<HelmChartPodSecurityContextSeccompProfile>,
386    /// A list of groups applied to the first process run in each container, in
387    /// addition to the container's primary GID and fsGroup (if specified).  If
388    /// the SupplementalGroupsPolicy feature is enabled, the
389    /// supplementalGroupsPolicy field determines whether these are in addition
390    /// to or instead of any group memberships defined in the container image.
391    /// If unspecified, no additional groups are added, though group memberships
392    /// defined in the container image may still be used, depending on the
393    /// supplementalGroupsPolicy field.
394    /// Note that this field cannot be set when spec.os.name is windows.
395    #[serde(
396        default,
397        skip_serializing_if = "Option::is_none",
398        rename = "supplementalGroups"
399    )]
400    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
401    pub supplemental_groups: Option<Vec<i64>>,
402    /// Defines how supplemental groups of the first container processes are calculated.
403    /// Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
404    /// (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
405    /// and the container runtime must implement support for this feature.
406    /// Note that this field cannot be set when spec.os.name is windows.
407    #[serde(
408        default,
409        skip_serializing_if = "Option::is_none",
410        rename = "supplementalGroupsPolicy"
411    )]
412    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
413    pub supplemental_groups_policy: Option<String>,
414    /// Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
415    /// sysctls (by the container runtime) might fail to launch.
416    /// Note that this field cannot be set when spec.os.name is windows.
417    #[serde(default, skip_serializing_if = "Option::is_none")]
418    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
419    pub sysctls: Option<Vec<HelmChartPodSecurityContextSysctls>>,
420    /// The Windows specific settings applied to all containers.
421    /// If unspecified, the options within a container's SecurityContext will be used.
422    /// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
423    /// Note that this field cannot be set when spec.os.name is linux.
424    #[serde(
425        default,
426        skip_serializing_if = "Option::is_none",
427        rename = "windowsOptions"
428    )]
429    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
430    pub windows_options: Option<HelmChartPodSecurityContextWindowsOptions>,
431}
432
433/// appArmorProfile is the AppArmor options to use by the containers in this pod.
434/// Note that this field cannot be set when spec.os.name is windows.
435#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
436#[cfg_attr(feature = "builder", derive(TypedBuilder))]
437#[cfg_attr(feature = "schemars", derive(JsonSchema))]
438pub struct HelmChartPodSecurityContextAppArmorProfile {
439    /// localhostProfile indicates a profile loaded on the node that should be used.
440    /// The profile must be preconfigured on the node to work.
441    /// Must match the loaded name of the profile.
442    /// Must be set if and only if type is "Localhost".
443    #[serde(
444        default,
445        skip_serializing_if = "Option::is_none",
446        rename = "localhostProfile"
447    )]
448    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
449    pub localhost_profile: Option<String>,
450    /// type indicates which kind of AppArmor profile will be applied.
451    /// Valid options are:
452    ///   Localhost - a profile pre-loaded on the node.
453    ///   RuntimeDefault - the container runtime's default profile.
454    ///   Unconfined - no AppArmor enforcement.
455    #[serde(rename = "type")]
456    pub r#type: String,
457}
458
459/// The SELinux context to be applied to all containers.
460/// If unspecified, the container runtime will allocate a random SELinux context for each
461/// container.  May also be set in SecurityContext.  If set in
462/// both SecurityContext and PodSecurityContext, the value specified in SecurityContext
463/// takes precedence for that container.
464/// Note that this field cannot be set when spec.os.name is windows.
465#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
466#[cfg_attr(feature = "builder", derive(TypedBuilder))]
467#[cfg_attr(feature = "schemars", derive(JsonSchema))]
468pub struct HelmChartPodSecurityContextSeLinuxOptions {
469    /// Level is SELinux level label that applies to the container.
470    #[serde(default, skip_serializing_if = "Option::is_none")]
471    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
472    pub level: Option<String>,
473    /// Role is a SELinux role label that applies to the container.
474    #[serde(default, skip_serializing_if = "Option::is_none")]
475    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
476    pub role: Option<String>,
477    /// Type is a SELinux type label that applies to the container.
478    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
479    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
480    pub r#type: Option<String>,
481    /// User is a SELinux user label that applies to the container.
482    #[serde(default, skip_serializing_if = "Option::is_none")]
483    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
484    pub user: Option<String>,
485}
486
487/// The seccomp options to use by the containers in this pod.
488/// Note that this field cannot be set when spec.os.name is windows.
489#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
490#[cfg_attr(feature = "builder", derive(TypedBuilder))]
491#[cfg_attr(feature = "schemars", derive(JsonSchema))]
492pub struct HelmChartPodSecurityContextSeccompProfile {
493    /// localhostProfile indicates a profile defined in a file on the node should be used.
494    /// The profile must be preconfigured on the node to work.
495    /// Must be a descending path, relative to the kubelet's configured seccomp profile location.
496    /// Must be set if type is "Localhost". Must NOT be set for any other type.
497    #[serde(
498        default,
499        skip_serializing_if = "Option::is_none",
500        rename = "localhostProfile"
501    )]
502    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
503    pub localhost_profile: Option<String>,
504    /// type indicates which kind of seccomp profile will be applied.
505    /// Valid options are:
506    ///
507    /// Localhost - a profile defined in a file on the node should be used.
508    /// RuntimeDefault - the container runtime default profile should be used.
509    /// Unconfined - no profile should be applied.
510    #[serde(rename = "type")]
511    pub r#type: String,
512}
513
514/// Sysctl defines a kernel parameter to be set
515#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
516#[cfg_attr(feature = "builder", derive(TypedBuilder))]
517#[cfg_attr(feature = "schemars", derive(JsonSchema))]
518pub struct HelmChartPodSecurityContextSysctls {
519    /// Name of a property to set
520    pub name: String,
521    /// Value of a property to set
522    pub value: String,
523}
524
525/// The Windows specific settings applied to all containers.
526/// If unspecified, the options within a container's SecurityContext will be used.
527/// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
528/// Note that this field cannot be set when spec.os.name is linux.
529#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
530#[cfg_attr(feature = "builder", derive(TypedBuilder))]
531#[cfg_attr(feature = "schemars", derive(JsonSchema))]
532pub struct HelmChartPodSecurityContextWindowsOptions {
533    /// GMSACredentialSpec is where the GMSA admission webhook
534    /// (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
535    /// GMSA credential spec named by the GMSACredentialSpecName field.
536    #[serde(
537        default,
538        skip_serializing_if = "Option::is_none",
539        rename = "gmsaCredentialSpec"
540    )]
541    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
542    pub gmsa_credential_spec: Option<String>,
543    /// GMSACredentialSpecName is the name of the GMSA credential spec to use.
544    #[serde(
545        default,
546        skip_serializing_if = "Option::is_none",
547        rename = "gmsaCredentialSpecName"
548    )]
549    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
550    pub gmsa_credential_spec_name: Option<String>,
551    /// HostProcess determines if a container should be run as a 'Host Process' container.
552    /// All of a Pod's containers must have the same effective HostProcess value
553    /// (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
554    /// In addition, if HostProcess is true then HostNetwork must also be set to true.
555    #[serde(
556        default,
557        skip_serializing_if = "Option::is_none",
558        rename = "hostProcess"
559    )]
560    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
561    pub host_process: Option<bool>,
562    /// The UserName in Windows to run the entrypoint of the container process.
563    /// Defaults to the user specified in image metadata if unspecified.
564    /// May also be set in PodSecurityContext. If set in both SecurityContext and
565    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
566    #[serde(
567        default,
568        skip_serializing_if = "Option::is_none",
569        rename = "runAsUserName"
570    )]
571    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
572    pub run_as_user_name: Option<String>,
573}
574
575/// Reference to a ConfigMap containing CA Certificates to be be trusted by Helm. Can be used along with or instead of `.spec.repoCA`
576/// Helm CLI positional argument/flag: `--ca-file`
577#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
578#[cfg_attr(feature = "builder", derive(TypedBuilder))]
579#[cfg_attr(feature = "schemars", derive(JsonSchema))]
580pub struct HelmChartRepoCaConfigMap {
581    /// Name of the referent.
582    /// This field is effectively required, but due to backwards compatibility is
583    /// allowed to be empty. Instances of this type with an empty value here are
584    /// almost certainly wrong.
585    /// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
586    #[serde(default, skip_serializing_if = "Option::is_none")]
587    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
588    pub name: Option<String>,
589}
590
591/// custom SecurityContext for the helm job pod.
592#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
593#[cfg_attr(feature = "builder", derive(TypedBuilder))]
594#[cfg_attr(feature = "schemars", derive(JsonSchema))]
595pub struct HelmChartSecurityContext {
596    /// AllowPrivilegeEscalation controls whether a process can gain more
597    /// privileges than its parent process. This bool directly controls if
598    /// the no_new_privs flag will be set on the container process.
599    /// AllowPrivilegeEscalation is true always when the container is:
600    /// 1) run as Privileged
601    /// 2) has CAP_SYS_ADMIN
602    /// Note that this field cannot be set when spec.os.name is windows.
603    #[serde(
604        default,
605        skip_serializing_if = "Option::is_none",
606        rename = "allowPrivilegeEscalation"
607    )]
608    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
609    pub allow_privilege_escalation: Option<bool>,
610    /// appArmorProfile is the AppArmor options to use by this container. If set, this profile
611    /// overrides the pod's appArmorProfile.
612    /// Note that this field cannot be set when spec.os.name is windows.
613    #[serde(
614        default,
615        skip_serializing_if = "Option::is_none",
616        rename = "appArmorProfile"
617    )]
618    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
619    pub app_armor_profile: Option<HelmChartSecurityContextAppArmorProfile>,
620    /// The capabilities to add/drop when running containers.
621    /// Defaults to the default set of capabilities granted by the container runtime.
622    /// Note that this field cannot be set when spec.os.name is windows.
623    #[serde(default, skip_serializing_if = "Option::is_none")]
624    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
625    pub capabilities: Option<HelmChartSecurityContextCapabilities>,
626    /// Run container in privileged mode.
627    /// Processes in privileged containers are essentially equivalent to root on the host.
628    /// Defaults to false.
629    /// Note that this field cannot be set when spec.os.name is windows.
630    #[serde(default, skip_serializing_if = "Option::is_none")]
631    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
632    pub privileged: Option<bool>,
633    /// procMount denotes the type of proc mount to use for the containers.
634    /// The default value is Default which uses the container runtime defaults for
635    /// readonly paths and masked paths.
636    /// This requires the ProcMountType feature flag to be enabled.
637    /// Note that this field cannot be set when spec.os.name is windows.
638    #[serde(default, skip_serializing_if = "Option::is_none", rename = "procMount")]
639    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
640    pub proc_mount: Option<String>,
641    /// Whether this container has a read-only root filesystem.
642    /// Default is false.
643    /// Note that this field cannot be set when spec.os.name is windows.
644    #[serde(
645        default,
646        skip_serializing_if = "Option::is_none",
647        rename = "readOnlyRootFilesystem"
648    )]
649    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
650    pub read_only_root_filesystem: Option<bool>,
651    /// The GID to run the entrypoint of the container process.
652    /// Uses runtime default if unset.
653    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
654    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
655    /// Note that this field cannot be set when spec.os.name is windows.
656    #[serde(
657        default,
658        skip_serializing_if = "Option::is_none",
659        rename = "runAsGroup"
660    )]
661    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
662    pub run_as_group: Option<i64>,
663    /// Indicates that the container must run as a non-root user.
664    /// If true, the Kubelet will validate the image at runtime to ensure that it
665    /// does not run as UID 0 (root) and fail to start the container if it does.
666    /// If unset or false, no such validation will be performed.
667    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
668    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
669    #[serde(
670        default,
671        skip_serializing_if = "Option::is_none",
672        rename = "runAsNonRoot"
673    )]
674    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
675    pub run_as_non_root: Option<bool>,
676    /// The UID to run the entrypoint of the container process.
677    /// Defaults to user specified in image metadata if unspecified.
678    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
679    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
680    /// Note that this field cannot be set when spec.os.name is windows.
681    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUser")]
682    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
683    pub run_as_user: Option<i64>,
684    /// The SELinux context to be applied to the container.
685    /// If unspecified, the container runtime will allocate a random SELinux context for each
686    /// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
687    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
688    /// Note that this field cannot be set when spec.os.name is windows.
689    #[serde(
690        default,
691        skip_serializing_if = "Option::is_none",
692        rename = "seLinuxOptions"
693    )]
694    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
695    pub se_linux_options: Option<HelmChartSecurityContextSeLinuxOptions>,
696    /// The seccomp options to use by this container. If seccomp options are
697    /// provided at both the pod & container level, the container options
698    /// override the pod options.
699    /// Note that this field cannot be set when spec.os.name is windows.
700    #[serde(
701        default,
702        skip_serializing_if = "Option::is_none",
703        rename = "seccompProfile"
704    )]
705    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
706    pub seccomp_profile: Option<HelmChartSecurityContextSeccompProfile>,
707    /// The Windows specific settings applied to all containers.
708    /// If unspecified, the options from the PodSecurityContext will be used.
709    /// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
710    /// Note that this field cannot be set when spec.os.name is linux.
711    #[serde(
712        default,
713        skip_serializing_if = "Option::is_none",
714        rename = "windowsOptions"
715    )]
716    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
717    pub windows_options: Option<HelmChartSecurityContextWindowsOptions>,
718}
719
720/// appArmorProfile is the AppArmor options to use by this container. If set, this profile
721/// overrides the pod's appArmorProfile.
722/// Note that this field cannot be set when spec.os.name is windows.
723#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
724#[cfg_attr(feature = "builder", derive(TypedBuilder))]
725#[cfg_attr(feature = "schemars", derive(JsonSchema))]
726pub struct HelmChartSecurityContextAppArmorProfile {
727    /// localhostProfile indicates a profile loaded on the node that should be used.
728    /// The profile must be preconfigured on the node to work.
729    /// Must match the loaded name of the profile.
730    /// Must be set if and only if type is "Localhost".
731    #[serde(
732        default,
733        skip_serializing_if = "Option::is_none",
734        rename = "localhostProfile"
735    )]
736    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
737    pub localhost_profile: Option<String>,
738    /// type indicates which kind of AppArmor profile will be applied.
739    /// Valid options are:
740    ///   Localhost - a profile pre-loaded on the node.
741    ///   RuntimeDefault - the container runtime's default profile.
742    ///   Unconfined - no AppArmor enforcement.
743    #[serde(rename = "type")]
744    pub r#type: String,
745}
746
747/// The capabilities to add/drop when running containers.
748/// Defaults to the default set of capabilities granted by the container runtime.
749/// Note that this field cannot be set when spec.os.name is windows.
750#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
751#[cfg_attr(feature = "builder", derive(TypedBuilder))]
752#[cfg_attr(feature = "schemars", derive(JsonSchema))]
753pub struct HelmChartSecurityContextCapabilities {
754    /// Added capabilities
755    #[serde(default, skip_serializing_if = "Option::is_none")]
756    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
757    pub add: Option<Vec<String>>,
758    /// Removed capabilities
759    #[serde(default, skip_serializing_if = "Option::is_none")]
760    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
761    pub drop: Option<Vec<String>>,
762}
763
764/// The SELinux context to be applied to the container.
765/// If unspecified, the container runtime will allocate a random SELinux context for each
766/// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
767/// PodSecurityContext, the value specified in SecurityContext takes precedence.
768/// Note that this field cannot be set when spec.os.name is windows.
769#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
770#[cfg_attr(feature = "builder", derive(TypedBuilder))]
771#[cfg_attr(feature = "schemars", derive(JsonSchema))]
772pub struct HelmChartSecurityContextSeLinuxOptions {
773    /// Level is SELinux level label that applies to the container.
774    #[serde(default, skip_serializing_if = "Option::is_none")]
775    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
776    pub level: Option<String>,
777    /// Role is a SELinux role label that applies to the container.
778    #[serde(default, skip_serializing_if = "Option::is_none")]
779    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
780    pub role: Option<String>,
781    /// Type is a SELinux type label that applies to the container.
782    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
783    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
784    pub r#type: Option<String>,
785    /// User is a SELinux user label that applies to the container.
786    #[serde(default, skip_serializing_if = "Option::is_none")]
787    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
788    pub user: Option<String>,
789}
790
791/// The seccomp options to use by this container. If seccomp options are
792/// provided at both the pod & container level, the container options
793/// override the pod options.
794/// Note that this field cannot be set when spec.os.name is windows.
795#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
796#[cfg_attr(feature = "builder", derive(TypedBuilder))]
797#[cfg_attr(feature = "schemars", derive(JsonSchema))]
798pub struct HelmChartSecurityContextSeccompProfile {
799    /// localhostProfile indicates a profile defined in a file on the node should be used.
800    /// The profile must be preconfigured on the node to work.
801    /// Must be a descending path, relative to the kubelet's configured seccomp profile location.
802    /// Must be set if type is "Localhost". Must NOT be set for any other type.
803    #[serde(
804        default,
805        skip_serializing_if = "Option::is_none",
806        rename = "localhostProfile"
807    )]
808    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
809    pub localhost_profile: Option<String>,
810    /// type indicates which kind of seccomp profile will be applied.
811    /// Valid options are:
812    ///
813    /// Localhost - a profile defined in a file on the node should be used.
814    /// RuntimeDefault - the container runtime default profile should be used.
815    /// Unconfined - no profile should be applied.
816    #[serde(rename = "type")]
817    pub r#type: String,
818}
819
820/// The Windows specific settings applied to all containers.
821/// If unspecified, the options from the PodSecurityContext will be used.
822/// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
823/// Note that this field cannot be set when spec.os.name is linux.
824#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
825#[cfg_attr(feature = "builder", derive(TypedBuilder))]
826#[cfg_attr(feature = "schemars", derive(JsonSchema))]
827pub struct HelmChartSecurityContextWindowsOptions {
828    /// GMSACredentialSpec is where the GMSA admission webhook
829    /// (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
830    /// GMSA credential spec named by the GMSACredentialSpecName field.
831    #[serde(
832        default,
833        skip_serializing_if = "Option::is_none",
834        rename = "gmsaCredentialSpec"
835    )]
836    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
837    pub gmsa_credential_spec: Option<String>,
838    /// GMSACredentialSpecName is the name of the GMSA credential spec to use.
839    #[serde(
840        default,
841        skip_serializing_if = "Option::is_none",
842        rename = "gmsaCredentialSpecName"
843    )]
844    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
845    pub gmsa_credential_spec_name: Option<String>,
846    /// HostProcess determines if a container should be run as a 'Host Process' container.
847    /// All of a Pod's containers must have the same effective HostProcess value
848    /// (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
849    /// In addition, if HostProcess is true then HostNetwork must also be set to true.
850    #[serde(
851        default,
852        skip_serializing_if = "Option::is_none",
853        rename = "hostProcess"
854    )]
855    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
856    pub host_process: Option<bool>,
857    /// The UserName in Windows to run the entrypoint of the container process.
858    /// Defaults to the user specified in image metadata if unspecified.
859    /// May also be set in PodSecurityContext. If set in both SecurityContext and
860    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
861    #[serde(
862        default,
863        skip_serializing_if = "Option::is_none",
864        rename = "runAsUserName"
865    )]
866    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
867    pub run_as_user_name: Option<String>,
868}
869
870/// SecretSpec describes a key in a secret to load chart values from.
871#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
872#[cfg_attr(feature = "builder", derive(TypedBuilder))]
873#[cfg_attr(feature = "schemars", derive(JsonSchema))]
874pub struct HelmChartValuesSecrets {
875    /// Ignore changes to the secret, and mark the secret as optional.
876    /// By default, the secret must exist, and changes to the secret will trigger an upgrade of the chart to apply the updated values.
877    /// If `ignoreUpdates` is true, the secret is optional, and changes to the secret will not trigger an upgrade of the chart.
878    #[serde(
879        default,
880        skip_serializing_if = "Option::is_none",
881        rename = "ignoreUpdates"
882    )]
883    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
884    pub ignore_updates: Option<bool>,
885    /// Keys to read values content from. If no keys are specified, the secret is not used.
886    #[serde(default, skip_serializing_if = "Option::is_none")]
887    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
888    pub keys: Option<Vec<String>>,
889    /// Name of the secret. Must be in the same namespace as the HelmChart resource.
890    #[serde(default, skip_serializing_if = "Option::is_none")]
891    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
892    pub name: Option<String>,
893}
894
895/// HelmChartStatus represents the resulting state from processing HelmChart events
896#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
897#[cfg_attr(feature = "builder", derive(TypedBuilder))]
898#[cfg_attr(feature = "schemars", derive(JsonSchema))]
899pub struct HelmChartStatus {
900    /// `JobCreated` indicates that a job has been created to install or upgrade the chart.
901    /// `Failed` indicates that the helm job has failed and the failure policy is set to `abort`.
902    #[serde(default, skip_serializing_if = "Option::is_none")]
903    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
904    pub conditions: Option<Vec<HelmChartStatusConditions>>,
905    /// The name of the job created to install or upgrade the chart.
906    #[serde(default, skip_serializing_if = "Option::is_none", rename = "jobName")]
907    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
908    pub job_name: Option<String>,
909}
910
911#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
912#[cfg_attr(feature = "builder", derive(TypedBuilder))]
913#[cfg_attr(feature = "schemars", derive(JsonSchema))]
914pub struct HelmChartStatusConditions {
915    /// Human readable message indicating details about last transition.
916    #[serde(default, skip_serializing_if = "Option::is_none")]
917    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
918    pub message: Option<String>,
919    /// (brief) reason for the condition's last transition.
920    #[serde(default, skip_serializing_if = "Option::is_none")]
921    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
922    pub reason: Option<String>,
923    /// Status of the condition, one of True, False, Unknown.
924    pub status: String,
925    /// Type of job condition.
926    #[serde(rename = "type")]
927    pub r#type: String,
928}
k8s_crds_helm_controller/helmcharts.rs

k8s_crds_helm_controller/
helmcharts.rs
