Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update Go version 1.19 (#2523)

Browse Source 
Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
This commit is contained in:
Sanket Sudake
2022-08-30 11:40:01 +05:30
committed by GitHub
parent b16010dfa3
commit 6971bcd287
10 changed files with 362 additions and 366 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crds/v1/fission.io_environments.yaml
+164 -72
View File
@@ -620,13 +620,13 @@ spec:
Cannot be updated.
type: string
ports:
description: List of ports to expose from the container. Exposing
a port here gives the system additional information about
the network connections a container uses, but is primarily
informational. Not specifying a port here DOES NOT prevent
that port from being exposed. Any port which is listening
on the default "0.0.0.0" address inside a container will
be accessible from the network. Cannot be updated.
description: List of ports to expose from the container. Not
specifying a port here DOES NOT prevent that port from being
exposed. Any port which is listening on the default "0.0.0.0"
address inside a container will be accessible from the network.
Modifying this array with strategic merge patch may corrupt
the data. For more information See https://github.com/kubernetes/kubernetes/issues/108255.
Cannot be updated.
items:
description: ContainerPort represents a network port in
a single container.
@@ -2806,13 +2806,13 @@ spec:
type: string
ports:
description: List of ports to expose from the container.
Exposing a port here gives the system additional information
about the network connections a container uses, but
is primarily informational. Not specifying a port
here DOES NOT prevent that port from being exposed.
Any port which is listening on the default "0.0.0.0"
address inside a container will be accessible from
the network. Cannot be updated.
Not specifying a port here DOES NOT prevent that port
from being exposed. Any port which is listening on
the default "0.0.0.0" address inside a container will
be accessible from the network. Modifying this array
with strategic merge patch may corrupt the data. For
more information See https://github.com/kubernetes/kubernetes/issues/108255.
Cannot be updated.
items:
description: ContainerPort represents a network port
in a single container.
@@ -3570,8 +3570,6 @@ spec:
be specified when creating a pod, and it cannot be modified
by updating the pod spec. In order to add an ephemeral container
to an existing pod, use the pod's ephemeralcontainers subresource.
This field is beta-level and available on clusters that
haven't disabled the EphemeralContainers feature gate.
items:
description: "An EphemeralContainer is a temporary container
that you may add to an existing Pod for user-initiated
@@ -3582,9 +3580,7 @@ spec:
container causes the Pod to exceed its resource allocation.
\n To add an ephemeral container, use the ephemeralcontainers
subresource of an existing Pod. Ephemeral containers may
not be removed or restarted. \n This is a beta feature
available on clusters that haven't disabled the EphemeralContainers
feature gate."
not be removed or restarted."
properties:
args:
description: 'Arguments to the entrypoint. The image''s
@@ -4898,6 +4894,19 @@ spec:
description: 'Use the host''s pid namespace. Optional: Default
to false.'
type: boolean
hostUsers:
description: 'Use the host''s user namespace. Optional: Default
to true. If set to true or not present, the pod will be
run in the host user namespace, useful for when the pod
needs a feature only available to the host user namespace,
such as loading a kernel module with CAP_SYS_MODULE. When
set to false, a new userns is created for the pod. Setting
false is useful for mitigating container breakout vulnerabilities
even allowing users to run their containers as root without
actually having root privileges on the host. This field
is alpha-level and is only honored by servers that enable
the UserNamespacesSupport feature.'
type: boolean
hostname:
description: Specifies the hostname of the Pod If not specified,
the pod's hostname will be set to a system-defined value.
@@ -5524,13 +5533,13 @@ spec:
type: string
ports:
description: List of ports to expose from the container.
Exposing a port here gives the system additional information
about the network connections a container uses, but
is primarily informational. Not specifying a port
here DOES NOT prevent that port from being exposed.
Any port which is listening on the default "0.0.0.0"
address inside a container will be accessible from
the network. Cannot be updated.
Not specifying a port here DOES NOT prevent that port
from being exposed. Any port which is listening on
the default "0.0.0.0" address inside a container will
be accessible from the network. Modifying this array
with strategic merge patch may corrupt the data. For
more information See https://github.com/kubernetes/kubernetes/issues/108255.
Cannot be updated.
items:
description: ContainerPort represents a network port
in a single container.
@@ -6250,7 +6259,7 @@ spec:
set. \n If the OS field is set to linux, the following fields
must be unset: -securityContext.windowsOptions \n If the
OS field is set to windows, following fields must be unset:
- spec.hostPID - spec.hostIPC - spec.securityContext.seLinuxOptions
- spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.seLinuxOptions
- spec.securityContext.seccompProfile - spec.securityContext.fsGroup
- spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls
- spec.shareProcessNamespace - spec.securityContext.runAsUser
@@ -6259,8 +6268,7 @@ spec:
- spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem
- spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation
- spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser
- spec.containers[*].securityContext.runAsGroup This is
a beta field and requires the IdentifyPodOS feature"
- spec.containers[*].securityContext.runAsGroup"
properties:
name:
description: 'Name is the name of the operating system.
@@ -6678,6 +6686,20 @@ spec:
type: object
type: object
x-kubernetes-map-type: atomic
matchLabelKeys:
description: MatchLabelKeys is a set of pod label keys
to select the pods over which spreading will be calculated.
The keys are used to lookup values from the incoming
pod labels, those key-value labels are ANDed with
labelSelector to select the group of existing pods
over which spreading will be calculated for the incoming
pod. Keys that don't exist in the incoming pod labels
will be ignored. A null or empty list means only match
against labelSelector.
items:
type: string
type: array
x-kubernetes-list-type: atomic
maxSkew:
description: 'MaxSkew describes the degree to which
pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`,
@@ -6723,10 +6745,34 @@ spec:
new pod with the same labelSelector cannot be scheduled,
because computed skew will be 3(3 - 0) if new Pod
is scheduled to any of the three zones, it will violate
MaxSkew. \n This is an alpha field and requires enabling
MinDomainsInPodTopologySpread feature gate."
MaxSkew. \n This is a beta field and requires the
MinDomainsInPodTopologySpread feature gate to be enabled
(enabled by default)."
format: int32
type: integer
nodeAffinityPolicy:
description: "NodeAffinityPolicy indicates how we will
treat Pod's nodeAffinity/nodeSelector when calculating
pod topology spread skew. Options are: - Honor: only
nodes matching nodeAffinity/nodeSelector are included
in the calculations. - Ignore: nodeAffinity/nodeSelector
are ignored. All nodes are included in the calculations.
\n If this value is nil, the behavior is equivalent
to the Honor policy. This is a alpha-level feature
enabled by the NodeInclusionPolicyInPodTopologySpread
feature flag."
type: string
nodeTaintsPolicy:
description: "NodeTaintsPolicy indicates how we will
treat node taints when calculating pod topology spread
skew. Options are: - Honor: nodes without taints,
along with tainted nodes for which the incoming pod
has a toleration, are included. - Ignore: node taints
are ignored. All nodes are included. \n If this value
is nil, the behavior is equivalent to the Ignore policy.
This is a alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread
feature flag."
type: string
topologyKey:
description: TopologyKey is the key of node labels.
Nodes that have a label with this key and identical
@@ -6735,11 +6781,11 @@ spec:
to put balanced number of pods into each bucket. We
define a domain as a particular instance of a topology.
Also, we define an eligible domain as a domain whose
nodes match the node selector. e.g. If TopologyKey
is "kubernetes.io/hostname", each Node is a domain
of that topology. And, if TopologyKey is "topology.kubernetes.io/zone",
each zone is a domain of that topology. It's a required
field.
nodes meet the requirements of nodeAffinityPolicy
and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname",
each Node is a domain of that topology. And, if TopologyKey
is "topology.kubernetes.io/zone", each zone is a domain
of that topology. It's a required field.
type: string
whenUnsatisfiable:
description: 'WhenUnsatisfiable indicates how to deal
@@ -9032,13 +9078,13 @@ spec:
Cannot be updated.
type: string
ports:
description: List of ports to expose from the container. Exposing
a port here gives the system additional information about
the network connections a container uses, but is primarily
informational. Not specifying a port here DOES NOT prevent
that port from being exposed. Any port which is listening
on the default "0.0.0.0" address inside a container will
be accessible from the network. Cannot be updated.
description: List of ports to expose from the container. Not
specifying a port here DOES NOT prevent that port from being
exposed. Any port which is listening on the default "0.0.0.0"
address inside a container will be accessible from the network.
Modifying this array with strategic merge patch may corrupt
the data. For more information See https://github.com/kubernetes/kubernetes/issues/108255.
Cannot be updated.
items:
description: ContainerPort represents a network port in
a single container.
@@ -11225,13 +11271,13 @@ spec:
type: string
ports:
description: List of ports to expose from the container.
Exposing a port here gives the system additional information
about the network connections a container uses, but
is primarily informational. Not specifying a port
here DOES NOT prevent that port from being exposed.
Any port which is listening on the default "0.0.0.0"
address inside a container will be accessible from
the network. Cannot be updated.
Not specifying a port here DOES NOT prevent that port
from being exposed. Any port which is listening on
the default "0.0.0.0" address inside a container will
be accessible from the network. Modifying this array
with strategic merge patch may corrupt the data. For
more information See https://github.com/kubernetes/kubernetes/issues/108255.
Cannot be updated.
items:
description: ContainerPort represents a network port
in a single container.
@@ -11989,8 +12035,6 @@ spec:
be specified when creating a pod, and it cannot be modified
by updating the pod spec. In order to add an ephemeral container
to an existing pod, use the pod's ephemeralcontainers subresource.
This field is beta-level and available on clusters that
haven't disabled the EphemeralContainers feature gate.
items:
description: "An EphemeralContainer is a temporary container
that you may add to an existing Pod for user-initiated
@@ -12001,9 +12045,7 @@ spec:
container causes the Pod to exceed its resource allocation.
\n To add an ephemeral container, use the ephemeralcontainers
subresource of an existing Pod. Ephemeral containers may
not be removed or restarted. \n This is a beta feature
available on clusters that haven't disabled the EphemeralContainers
feature gate."
not be removed or restarted."
properties:
args:
description: 'Arguments to the entrypoint. The image''s
@@ -13317,6 +13359,19 @@ spec:
description: 'Use the host''s pid namespace. Optional: Default
to false.'
type: boolean
hostUsers:
description: 'Use the host''s user namespace. Optional: Default
to true. If set to true or not present, the pod will be
run in the host user namespace, useful for when the pod
needs a feature only available to the host user namespace,
such as loading a kernel module with CAP_SYS_MODULE. When
set to false, a new userns is created for the pod. Setting
false is useful for mitigating container breakout vulnerabilities
even allowing users to run their containers as root without
actually having root privileges on the host. This field
is alpha-level and is only honored by servers that enable
the UserNamespacesSupport feature.'
type: boolean
hostname:
description: Specifies the hostname of the Pod If not specified,
the pod's hostname will be set to a system-defined value.
@@ -13943,13 +13998,13 @@ spec:
type: string
ports:
description: List of ports to expose from the container.
Exposing a port here gives the system additional information
about the network connections a container uses, but
is primarily informational. Not specifying a port
here DOES NOT prevent that port from being exposed.
Any port which is listening on the default "0.0.0.0"
address inside a container will be accessible from
the network. Cannot be updated.
Not specifying a port here DOES NOT prevent that port
from being exposed. Any port which is listening on
the default "0.0.0.0" address inside a container will
be accessible from the network. Modifying this array
with strategic merge patch may corrupt the data. For
more information See https://github.com/kubernetes/kubernetes/issues/108255.
Cannot be updated.
items:
description: ContainerPort represents a network port
in a single container.
@@ -14669,7 +14724,7 @@ spec:
set. \n If the OS field is set to linux, the following fields
must be unset: -securityContext.windowsOptions \n If the
OS field is set to windows, following fields must be unset:
- spec.hostPID - spec.hostIPC - spec.securityContext.seLinuxOptions
- spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.seLinuxOptions
- spec.securityContext.seccompProfile - spec.securityContext.fsGroup
- spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls
- spec.shareProcessNamespace - spec.securityContext.runAsUser
@@ -14678,8 +14733,7 @@ spec:
- spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem
- spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation
- spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser
- spec.containers[*].securityContext.runAsGroup This is
a beta field and requires the IdentifyPodOS feature"
- spec.containers[*].securityContext.runAsGroup"
properties:
name:
description: 'Name is the name of the operating system.
@@ -15097,6 +15151,20 @@ spec:
type: object
type: object
x-kubernetes-map-type: atomic
matchLabelKeys:
description: MatchLabelKeys is a set of pod label keys
to select the pods over which spreading will be calculated.
The keys are used to lookup values from the incoming
pod labels, those key-value labels are ANDed with
labelSelector to select the group of existing pods
over which spreading will be calculated for the incoming
pod. Keys that don't exist in the incoming pod labels
will be ignored. A null or empty list means only match
against labelSelector.
items:
type: string
type: array
x-kubernetes-list-type: atomic
maxSkew:
description: 'MaxSkew describes the degree to which
pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`,
@@ -15142,10 +15210,34 @@ spec:
new pod with the same labelSelector cannot be scheduled,
because computed skew will be 3(3 - 0) if new Pod
is scheduled to any of the three zones, it will violate
MaxSkew. \n This is an alpha field and requires enabling
MinDomainsInPodTopologySpread feature gate."
MaxSkew. \n This is a beta field and requires the
MinDomainsInPodTopologySpread feature gate to be enabled
(enabled by default)."
format: int32
type: integer
nodeAffinityPolicy:
description: "NodeAffinityPolicy indicates how we will
treat Pod's nodeAffinity/nodeSelector when calculating
pod topology spread skew. Options are: - Honor: only
nodes matching nodeAffinity/nodeSelector are included
in the calculations. - Ignore: nodeAffinity/nodeSelector
are ignored. All nodes are included in the calculations.
\n If this value is nil, the behavior is equivalent
to the Honor policy. This is a alpha-level feature
enabled by the NodeInclusionPolicyInPodTopologySpread
feature flag."
type: string
nodeTaintsPolicy:
description: "NodeTaintsPolicy indicates how we will
treat node taints when calculating pod topology spread
skew. Options are: - Honor: nodes without taints,
along with tainted nodes for which the incoming pod
has a toleration, are included. - Ignore: node taints
are ignored. All nodes are included. \n If this value
is nil, the behavior is equivalent to the Ignore policy.
This is a alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread
feature flag."
type: string
topologyKey:
description: TopologyKey is the key of node labels.
Nodes that have a label with this key and identical
@@ -15154,11 +15246,11 @@ spec:
to put balanced number of pods into each bucket. We
define a domain as a particular instance of a topology.
Also, we define an eligible domain as a domain whose
nodes match the node selector. e.g. If TopologyKey
is "kubernetes.io/hostname", each Node is a domain
of that topology. And, if TopologyKey is "topology.kubernetes.io/zone",
each zone is a domain of that topology. It's a required
field.
nodes meet the requirements of nodeAffinityPolicy
and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname",
each Node is a domain of that topology. And, if TopologyKey
is "topology.kubernetes.io/zone", each zone is a domain
of that topology. It's a required field.
type: string
whenUnsatisfiable:
description: 'WhenUnsatisfiable indicates how to deal
crds/v1/fission.io_functions.yaml
+73 -31
View File
@@ -2231,13 +2231,13 @@ spec:
type: string
ports:
description: List of ports to expose from the container.
Exposing a port here gives the system additional information
about the network connections a container uses, but is
primarily informational. Not specifying a port here DOES
NOT prevent that port from being exposed. Any port which
is listening on the default "0.0.0.0" address inside a
container will be accessible from the network. Cannot
be updated.
Not specifying a port here DOES NOT prevent that port
from being exposed. Any port which is listening on the
default "0.0.0.0" address inside a container will be accessible
from the network. Modifying this array with strategic
merge patch may corrupt the data. For more information
See https://github.com/kubernetes/kubernetes/issues/108255.
Cannot be updated.
items:
description: ContainerPort represents a network port in
a single container.
@@ -2967,9 +2967,7 @@ spec:
actions such as debugging. This list cannot be specified when
creating a pod, and it cannot be modified by updating the pod
spec. In order to add an ephemeral container to an existing
pod, use the pod's ephemeralcontainers subresource. This field
is beta-level and available on clusters that haven't disabled
the EphemeralContainers feature gate.
pod, use the pod's ephemeralcontainers subresource.
items:
description: "An EphemeralContainer is a temporary container
that you may add to an existing Pod for user-initiated activities
@@ -2979,9 +2977,7 @@ spec:
may evict a Pod if an ephemeral container causes the Pod to
exceed its resource allocation. \n To add an ephemeral container,
use the ephemeralcontainers subresource of an existing Pod.
Ephemeral containers may not be removed or restarted. \n This
is a beta feature available on clusters that haven't disabled
the EphemeralContainers feature gate."
Ephemeral containers may not be removed or restarted."
properties:
args:
description: 'Arguments to the entrypoint. The image''s
@@ -4247,6 +4243,18 @@ spec:
description: 'Use the host''s pid namespace. Optional: Default
to false.'
type: boolean
hostUsers:
description: 'Use the host''s user namespace. Optional: Default
to true. If set to true or not present, the pod will be run
in the host user namespace, useful for when the pod needs a
feature only available to the host user namespace, such as loading
a kernel module with CAP_SYS_MODULE. When set to false, a new
userns is created for the pod. Setting false is useful for mitigating
container breakout vulnerabilities even allowing users to run
their containers as root without actually having root privileges
on the host. This field is alpha-level and is only honored by
servers that enable the UserNamespacesSupport feature.'
type: boolean
hostname:
description: Specifies the hostname of the Pod If not specified,
the pod's hostname will be set to a system-defined value.
@@ -4850,13 +4858,13 @@ spec:
type: string
ports:
description: List of ports to expose from the container.
Exposing a port here gives the system additional information
about the network connections a container uses, but is
primarily informational. Not specifying a port here DOES
NOT prevent that port from being exposed. Any port which
is listening on the default "0.0.0.0" address inside a
container will be accessible from the network. Cannot
be updated.
Not specifying a port here DOES NOT prevent that port
from being exposed. Any port which is listening on the
default "0.0.0.0" address inside a container will be accessible
from the network. Modifying this array with strategic
merge patch may corrupt the data. For more information
See https://github.com/kubernetes/kubernetes/issues/108255.
Cannot be updated.
items:
description: ContainerPort represents a network port in
a single container.
@@ -5551,7 +5559,7 @@ spec:
the OS field is set to linux, the following fields must be unset:
-securityContext.windowsOptions \n If the OS field is set to
windows, following fields must be unset: - spec.hostPID - spec.hostIPC
- spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile
- spec.hostUsers - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile
- spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy
- spec.securityContext.sysctls - spec.shareProcessNamespace
- spec.securityContext.runAsUser - spec.securityContext.runAsGroup
@@ -5560,8 +5568,7 @@ spec:
- spec.containers[*].securityContext.readOnlyRootFilesystem
- spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation
- spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser
- spec.containers[*].securityContext.runAsGroup This is a beta
field and requires the IdentifyPodOS feature"
- spec.containers[*].securityContext.runAsGroup"
properties:
name:
description: 'Name is the name of the operating system. The
@@ -5961,6 +5968,19 @@ spec:
type: object
type: object
x-kubernetes-map-type: atomic
matchLabelKeys:
description: MatchLabelKeys is a set of pod label keys to
select the pods over which spreading will be calculated.
The keys are used to lookup values from the incoming pod
labels, those key-value labels are ANDed with labelSelector
to select the group of existing pods over which spreading
will be calculated for the incoming pod. Keys that don't
exist in the incoming pod labels will be ignored. A null
or empty list means only match against labelSelector.
items:
type: string
type: array
x-kubernetes-list-type: atomic
maxSkew:
description: 'MaxSkew describes the degree to which pods
may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`,
@@ -6003,11 +6023,33 @@ spec:
as 0. In this situation, new pod with the same labelSelector
cannot be scheduled, because computed skew will be 3(3
- 0) if new Pod is scheduled to any of the three zones,
it will violate MaxSkew. \n This is an alpha field and
requires enabling MinDomainsInPodTopologySpread feature
gate."
it will violate MaxSkew. \n This is a beta field and requires
the MinDomainsInPodTopologySpread feature gate to be enabled
(enabled by default)."
format: int32
type: integer
nodeAffinityPolicy:
description: "NodeAffinityPolicy indicates how we will treat
Pod's nodeAffinity/nodeSelector when calculating pod topology
spread skew. Options are: - Honor: only nodes matching
nodeAffinity/nodeSelector are included in the calculations.
- Ignore: nodeAffinity/nodeSelector are ignored. All nodes
are included in the calculations. \n If this value is
nil, the behavior is equivalent to the Honor policy. This
is a alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread
feature flag."
type: string
nodeTaintsPolicy:
description: "NodeTaintsPolicy indicates how we will treat
node taints when calculating pod topology spread skew.
Options are: - Honor: nodes without taints, along with
tainted nodes for which the incoming pod has a toleration,
are included. - Ignore: node taints are ignored. All nodes
are included. \n If this value is nil, the behavior is
equivalent to the Ignore policy. This is a alpha-level
feature enabled by the NodeInclusionPolicyInPodTopologySpread
feature flag."
type: string
topologyKey:
description: TopologyKey is the key of node labels. Nodes
that have a label with this key and identical values are
@@ -6015,11 +6057,11 @@ spec:
<key, value> as a "bucket", and try to put balanced number
of pods into each bucket. We define a domain as a particular
instance of a topology. Also, we define an eligible domain
as a domain whose nodes match the node selector. e.g.
If TopologyKey is "kubernetes.io/hostname", each Node
is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone",
each zone is a domain of that topology. It's a required
field.
as a domain whose nodes meet the requirements of nodeAffinityPolicy
and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname",
each Node is a domain of that topology. And, if TopologyKey
is "topology.kubernetes.io/zone", each zone is a domain
of that topology. It's a required field.
type: string
whenUnsatisfiable:
description: 'WhenUnsatisfiable indicates how to deal with
crds/v1/fission.io_messagequeuetriggers.yaml
+73 -31
View File
@@ -1561,13 +1561,13 @@ spec:
type: string
ports:
description: List of ports to expose from the container.
Exposing a port here gives the system additional information
about the network connections a container uses, but is
primarily informational. Not specifying a port here DOES
NOT prevent that port from being exposed. Any port which
is listening on the default "0.0.0.0" address inside a
container will be accessible from the network. Cannot
be updated.
Not specifying a port here DOES NOT prevent that port
from being exposed. Any port which is listening on the
default "0.0.0.0" address inside a container will be accessible
from the network. Modifying this array with strategic
merge patch may corrupt the data. For more information
See https://github.com/kubernetes/kubernetes/issues/108255.
Cannot be updated.
items:
description: ContainerPort represents a network port in
a single container.
@@ -2297,9 +2297,7 @@ spec:
actions such as debugging. This list cannot be specified when
creating a pod, and it cannot be modified by updating the pod
spec. In order to add an ephemeral container to an existing
pod, use the pod's ephemeralcontainers subresource. This field
is beta-level and available on clusters that haven't disabled
the EphemeralContainers feature gate.
pod, use the pod's ephemeralcontainers subresource.
items:
description: "An EphemeralContainer is a temporary container
that you may add to an existing Pod for user-initiated activities
@@ -2309,9 +2307,7 @@ spec:
may evict a Pod if an ephemeral container causes the Pod to
exceed its resource allocation. \n To add an ephemeral container,
use the ephemeralcontainers subresource of an existing Pod.
Ephemeral containers may not be removed or restarted. \n This
is a beta feature available on clusters that haven't disabled
the EphemeralContainers feature gate."
Ephemeral containers may not be removed or restarted."
properties:
args:
description: 'Arguments to the entrypoint. The image''s
@@ -3577,6 +3573,18 @@ spec:
description: 'Use the host''s pid namespace. Optional: Default
to false.'
type: boolean
hostUsers:
description: 'Use the host''s user namespace. Optional: Default
to true. If set to true or not present, the pod will be run
in the host user namespace, useful for when the pod needs a
feature only available to the host user namespace, such as loading
a kernel module with CAP_SYS_MODULE. When set to false, a new
userns is created for the pod. Setting false is useful for mitigating
container breakout vulnerabilities even allowing users to run
their containers as root without actually having root privileges
on the host. This field is alpha-level and is only honored by
servers that enable the UserNamespacesSupport feature.'
type: boolean
hostname:
description: Specifies the hostname of the Pod If not specified,
the pod's hostname will be set to a system-defined value.
@@ -4180,13 +4188,13 @@ spec:
type: string
ports:
description: List of ports to expose from the container.
Exposing a port here gives the system additional information
about the network connections a container uses, but is
primarily informational. Not specifying a port here DOES
NOT prevent that port from being exposed. Any port which
is listening on the default "0.0.0.0" address inside a
container will be accessible from the network. Cannot
be updated.
Not specifying a port here DOES NOT prevent that port
from being exposed. Any port which is listening on the
default "0.0.0.0" address inside a container will be accessible
from the network. Modifying this array with strategic
merge patch may corrupt the data. For more information
See https://github.com/kubernetes/kubernetes/issues/108255.
Cannot be updated.
items:
description: ContainerPort represents a network port in
a single container.
@@ -4881,7 +4889,7 @@ spec:
the OS field is set to linux, the following fields must be unset:
-securityContext.windowsOptions \n If the OS field is set to
windows, following fields must be unset: - spec.hostPID - spec.hostIPC
- spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile
- spec.hostUsers - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile
- spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy
- spec.securityContext.sysctls - spec.shareProcessNamespace
- spec.securityContext.runAsUser - spec.securityContext.runAsGroup
@@ -4890,8 +4898,7 @@ spec:
- spec.containers[*].securityContext.readOnlyRootFilesystem
- spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation
- spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser
- spec.containers[*].securityContext.runAsGroup This is a beta
field and requires the IdentifyPodOS feature"
- spec.containers[*].securityContext.runAsGroup"
properties:
name:
description: 'Name is the name of the operating system. The
@@ -5291,6 +5298,19 @@ spec:
type: object
type: object
x-kubernetes-map-type: atomic
matchLabelKeys:
description: MatchLabelKeys is a set of pod label keys to
select the pods over which spreading will be calculated.
The keys are used to lookup values from the incoming pod
labels, those key-value labels are ANDed with labelSelector
to select the group of existing pods over which spreading
will be calculated for the incoming pod. Keys that don't
exist in the incoming pod labels will be ignored. A null
or empty list means only match against labelSelector.
items:
type: string
type: array
x-kubernetes-list-type: atomic
maxSkew:
description: 'MaxSkew describes the degree to which pods
may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`,
@@ -5333,11 +5353,33 @@ spec:
as 0. In this situation, new pod with the same labelSelector
cannot be scheduled, because computed skew will be 3(3
- 0) if new Pod is scheduled to any of the three zones,
it will violate MaxSkew. \n This is an alpha field and
requires enabling MinDomainsInPodTopologySpread feature
gate."
it will violate MaxSkew. \n This is a beta field and requires
the MinDomainsInPodTopologySpread feature gate to be enabled
(enabled by default)."
format: int32
type: integer
nodeAffinityPolicy:
description: "NodeAffinityPolicy indicates how we will treat
Pod's nodeAffinity/nodeSelector when calculating pod topology
spread skew. Options are: - Honor: only nodes matching
nodeAffinity/nodeSelector are included in the calculations.
- Ignore: nodeAffinity/nodeSelector are ignored. All nodes
are included in the calculations. \n If this value is
nil, the behavior is equivalent to the Honor policy. This
is a alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread
feature flag."
type: string
nodeTaintsPolicy:
description: "NodeTaintsPolicy indicates how we will treat
node taints when calculating pod topology spread skew.
Options are: - Honor: nodes without taints, along with
tainted nodes for which the incoming pod has a toleration,
are included. - Ignore: node taints are ignored. All nodes
are included. \n If this value is nil, the behavior is
equivalent to the Ignore policy. This is a alpha-level
feature enabled by the NodeInclusionPolicyInPodTopologySpread
feature flag."
type: string
topologyKey:
description: TopologyKey is the key of node labels. Nodes
that have a label with this key and identical values are
@@ -5345,11 +5387,11 @@ spec:
<key, value> as a "bucket", and try to put balanced number
of pods into each bucket. We define a domain as a particular
instance of a topology. Also, we define an eligible domain
as a domain whose nodes match the node selector. e.g.
If TopologyKey is "kubernetes.io/hostname", each Node
is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone",
each zone is a domain of that topology. It's a required
field.
as a domain whose nodes meet the requirements of nodeAffinityPolicy
and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname",
each Node is a domain of that topology. And, if TopologyKey
is "topology.kubernetes.io/zone", each zone is a domain
of that topology. It's a required field.
type: string
whenUnsatisfiable:
description: 'WhenUnsatisfiable indicates how to deal with