Custom resources
The fields of every OpenFief custom resource, read from the CRDs the operator's Go types generate.
Generated from deploy/crds on every build; controller-gen writes those files from the Go types (task gen). The operator page explains how the resources are used.
PluginGrant#
openfief.io/v1alpha1, namespaced-scoped, plural plugingrants.
PluginGrant v1alpha1#
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | yes | Spec is the approved permissions. |
spec.capabilities | []string | Capabilities are what the plugin may act as. | |
spec.dataTiers | []string | DataTiers lists data tier names. | |
spec.egress | []string | Egress lists hosts as “host” (port 443) or “host:port”. | |
spec.secrets | []string | Secrets lists Secret names. | |
status | object | PluginGrantStatus says whether the grant is well-formed. | |
status.conditions | []object | Conditions holds Valid. | |
status.conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string matching ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ | yes | reason contains a programmatic identifier indicating the reason for the condition’s last transition. |
status.conditions[].status | string: True, False, Unknown | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string matching ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.observedGeneration | integer | ObservedGeneration is the spec generation the status describes. |
Plugin#
openfief.io/v1alpha1, namespaced-scoped, plural plugins.
Plugin v1alpha1#
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | yes | PluginSpec is one version of a plugin. |
spec.config | object | Config is the plugin’s configuration, a JSON object checked against manifest.configSchema. | |
spec.image | string matching ^[^@]+@sha256:[0-9a-f]{64}$ | yes | Image is the plugin’s container image, pinned by digest: repository@sha256:<64 hex digits>. |
spec.manifest | object | yes | Manifest is what the plugin requests. |
spec.manifest.capabilities | []string | yes | Capabilities are what the plugin acts as. |
spec.manifest.configSchema | object | ConfigSchema is the JSON Schema that spec.config must satisfy. | |
spec.manifest.dataTiers | []string | DataTiers lists the classes of data the plugin asks to see. | |
spec.manifest.egress | []string | Egress lists the hosts the plugin reaches through the egress proxy, as “host” (port 443) or “host:port”. | |
spec.manifest.secrets | []object | Secrets lists the Kubernetes Secrets, in the openfief namespace, that the plugin needs mounted read-only. | |
spec.manifest.secrets[].mountPath | string | yes | MountPath is an absolute path outside /var/run/secrets. |
spec.manifest.secrets[].name | string | yes | Name is the Secret’s name. |
status | object | PluginStatus is what the operator observed and did. | |
status.conditions | []object | Conditions are Ready, ApprovalRequired and SignatureVerified. | |
status.conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string matching ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ | yes | reason contains a programmatic identifier indicating the reason for the condition’s last transition. |
status.conditions[].status | string: True, False, Unknown | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string matching ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.deployed | object | Deployed is the plugin version that runs now; absent when nothing runs. | |
status.deployed.config | object | Config is the plugin’s configuration, a JSON object checked against manifest.configSchema. | |
status.deployed.image | string matching ^[^@]+@sha256:[0-9a-f]{64}$ | yes | Image is the plugin’s container image, pinned by digest: repository@sha256:<64 hex digits>. |
status.deployed.manifest | object | yes | Manifest is what the plugin requests. |
status.deployed.manifest.capabilities | []string | yes | Capabilities are what the plugin acts as. |
status.deployed.manifest.configSchema | object | ConfigSchema is the JSON Schema that spec.config must satisfy. | |
status.deployed.manifest.dataTiers | []string | DataTiers lists the classes of data the plugin asks to see. | |
status.deployed.manifest.egress | []string | Egress lists the hosts the plugin reaches through the egress proxy, as “host” (port 443) or “host:port”. | |
status.deployed.manifest.secrets | []object | Secrets lists the Kubernetes Secrets, in the openfief namespace, that the plugin needs mounted read-only. | |
status.deployed.manifest.secrets[].mountPath | string | yes | MountPath is an absolute path outside /var/run/secrets. |
status.deployed.manifest.secrets[].name | string | yes | Name is the Secret’s name. |
status.effective | object | Effective is what the running version is allowed: only what it requests and the PluginGrant approves (D-16). | |
status.effective.capabilities | []string | Capabilities are what the plugin may act as. | |
status.effective.dataTiers | []string | DataTiers lists data tier names. | |
status.effective.egress | []string | Egress lists hosts as “host” (port 443) or “host:port”. | |
status.effective.secrets | []string | Secrets lists Secret names. | |
status.observedGeneration | integer | ObservedGeneration is the spec generation the status describes. | |
status.pendingApproval | object | PendingApproval is what spec requests and the PluginGrant does not approve. | |
status.pendingApproval.capabilities | []string | Capabilities are what the plugin may act as. | |
status.pendingApproval.dataTiers | []string | DataTiers lists data tier names. | |
status.pendingApproval.egress | []string | Egress lists hosts as “host” (port 443) or “host:port”. | |
status.pendingApproval.secrets | []string | Secrets lists Secret names. |