Skip to content

Latest commit

 

History

History
2360 lines (1437 loc) · 173 KB

deployment.md

File metadata and controls

2360 lines (1437 loc) · 173 KB
subcategory page_title description
apps/v1
Kubernetes: kubernetes_deployment
A Deployment ensures that a specified number of pod “replicas” are running at any one time. In other words, a Deployment makes sure that a pod or homogeneous set of pods are always up and available. If there are too many pods, it will kill some. If there are too few, the Deployment will start more.

kubernetes_deployment

A Deployment ensures that a specified number of pod “replicas” are running at any one time. In other words, a Deployment makes sure that a pod or homogeneous set of pods are always up and available. If there are too many pods, it will kill some. If there are too few, the Deployment will start more.

Schema

Required

Optional

  • timeouts (Block, Optional) (see below for nested schema)
  • wait_for_rollout (Boolean) Wait for the rollout of the deployment to complete. Defaults to true.

Read-Only

  • id (String) The ID of this resource.

Nested Schema for metadata

Optional:

Read-Only:

Nested Schema for spec

Required:

  • template (Block List, Min: 1, Max: 1) Template describes the pods that will be created. (see below for nested schema)

Optional:

  • min_ready_seconds (Number) Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)
  • paused (Boolean) Indicates that the deployment is paused.
  • progress_deadline_seconds (Number) The maximum time in seconds for a deployment to make progress before it is considered to be failed. The deployment controller will continue to process failed deployments and a condition with a ProgressDeadlineExceeded reason will be surfaced in the deployment status. Note that progress will not be estimated during the time a deployment is paused. Defaults to 600s.
  • replicas (String) Number of desired pods. This is a string to be able to distinguish between explicit zero and not specified.
  • revision_history_limit (Number) The number of old ReplicaSets to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. Defaults to 10.
  • selector (Block List, Max: 1) A label query over pods that should match the Replicas count. (see below for nested schema)
  • strategy (Block List, Max: 1) The deployment strategy to use to replace existing pods with new ones. (see below for nested schema)

Nested Schema for spec.template

Required:

Nested Schema for spec.template.metadata

Optional:

Read-Only:

Nested Schema for spec.template.spec

Optional:

  • active_deadline_seconds (Number) Optional duration in seconds the pod may be active on the node relative to StartTime before the system will actively try to mark it failed and kill associated containers. Value must be a positive integer.
  • affinity (Block List, Max: 1) Optional pod scheduling constraints. (see below for nested schema)
  • automount_service_account_token (Boolean) AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
  • container (Block List) List of containers belonging to the pod. Containers cannot currently be added or removed. There must be at least one container in a Pod. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/ (see below for nested schema)
  • dns_config (Block List, Max: 1) Specifies the DNS parameters of a pod. Parameters specified here will be merged to the generated DNS configuration based on DNSPolicy. Optional: Defaults to empty (see below for nested schema)
  • dns_policy (String) Set DNS policy for containers within the pod. Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy. To have DNS options set along with hostNetwork, you have to specify DNS policy explicitly to 'ClusterFirstWithHostNet'. Defaults to 'ClusterFirst'. More info: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
  • enable_service_links (Boolean) Enables generating environment variables for service discovery. Defaults to true.
  • host_aliases (Block List) List of hosts and IPs that will be injected into the pod's hosts file if specified. Optional: Defaults to empty. (see below for nested schema)
  • host_ipc (Boolean) Use the host's ipc namespace. Optional: Defaults to false.
  • host_network (Boolean) Host networking requested for this pod. Use the host's network namespace. If this option is set, the ports that will be used must be specified.
  • host_pid (Boolean) Use the host's pid namespace.
  • hostname (String) Specifies the hostname of the Pod If not specified, the pod's hostname will be set to a system-defined value.
  • image_pull_secrets (Block List) ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. If specified, these secrets will be passed to individual puller implementations for them to use. For example, in the case of docker, only DockerConfig type secrets are honored. More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod (see below for nested schema)
  • init_container (Block List) List of init containers belonging to the pod. Init containers always run to completion and each must complete successfully before the next is started. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ (see below for nested schema)
  • node_name (String) NodeName is a request to schedule this pod onto a specific node. If it is non-empty, the scheduler simply schedules this pod onto that node, assuming that it fits resource requirements.
  • node_selector (Map of String) NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/.
  • os (Block List, Max: 1) Specifies the OS of the containers in the pod. (see below for nested schema)
  • priority_class_name (String) If specified, indicates the pod's priority. "system-node-critical" and "system-cluster-critical" are two special keywords which indicate the highest priorities with the former being the highest priority. Any other name must be defined by creating a PriorityClass object with that name. If not specified, the pod priority will be default or zero if there is no default.
  • readiness_gate (Block List) If specified, all readiness gates will be evaluated for pod readiness. A pod is ready when all its containers are ready AND all conditions specified in the readiness gates have status equal to "True" More info: https://git.k8s.io/enhancements/keps/sig-network/0007-pod-ready%2B%2B.md (see below for nested schema)
  • restart_policy (String) Restart policy for all containers within the pod. One of Always, OnFailure, Never. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy.
  • runtime_class_name (String) RuntimeClassName is a feature for selecting the container runtime configuration. The container runtime configuration is used to run a Pod's containers. More info: https://kubernetes.io/docs/concepts/containers/runtime-class
  • scheduler_name (String) If specified, the pod will be dispatched by specified scheduler. If not specified, the pod will be dispatched by default scheduler.
  • security_context (Block List, Max: 1) SecurityContext holds pod-level security attributes and common container settings. Optional: Defaults to empty (see below for nested schema)
  • service_account_name (String) ServiceAccountName is the name of the ServiceAccount to use to run this pod. More info: http://releases.k8s.io/HEAD/docs/design/service_accounts.md.
  • share_process_namespace (Boolean) Share a single process namespace between all of the containers in a pod. When this is set containers will be able to view and signal processes from other containers in the same pod, and the first process in each container will not be assigned PID 1. HostPID and ShareProcessNamespace cannot both be set. Optional: Defaults to false.
  • subdomain (String) If specified, the fully qualified Pod hostname will be "...svc.". If not specified, the pod will not have a domainname at all..
  • termination_grace_period_seconds (Number) Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period will be used instead. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process.
  • toleration (Block List) If specified, the pod's toleration. Optional: Defaults to empty (see below for nested schema)
  • topology_spread_constraint (Block List) describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. (see below for nested schema)
  • volume (Block List) List of volumes that can be mounted by containers belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes (see below for nested schema)

Nested Schema for spec.template.spec.affinity

Optional:

  • node_affinity (Block List, Max: 1) Node affinity scheduling rules for the pod. (see below for nested schema)
  • pod_affinity (Block List, Max: 1) Inter-pod topological affinity. rules that specify that certain pods should be placed in the same topological domain (e.g. same node, same rack, same zone, same power domain, etc.) (see below for nested schema)
  • pod_anti_affinity (Block List, Max: 1) Inter-pod topological affinity. rules that specify that certain pods should be placed in the same topological domain (e.g. same node, same rack, same zone, same power domain, etc.) (see below for nested schema)

Nested Schema for spec.template.spec.affinity.node_affinity

Optional:

  • preferred_during_scheduling_ignored_during_execution (Block List) The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, RequiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding 'weight' to the sum if the node matches the corresponding MatchExpressions; the node(s) with the highest sum are the most preferred. (see below for nested schema)
  • required_during_scheduling_ignored_during_execution (Block List, Max: 1) If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a node label update), the system may or may not try to eventually evict the pod from its node. (see below for nested schema)

Nested Schema for spec.template.spec.affinity.node_affinity.preferred_during_scheduling_ignored_during_execution

Required:

  • preference (Block List, Min: 1, Max: 1) A node selector term, associated with the corresponding weight. (see below for nested schema)
  • weight (Number) weight is in the range 1-100

Nested Schema for spec.template.spec.affinity.node_affinity.preferred_during_scheduling_ignored_during_execution.preference

Optional:

  • match_expressions (Block List) List of node selector requirements. The requirements are ANDed. (see below for nested schema)
  • match_fields (Block List) A list of node selector requirements by node's fields. The requirements are ANDed. (see below for nested schema)

Nested Schema for spec.template.spec.affinity.node_affinity.preferred_during_scheduling_ignored_during_execution.preference.match_expressions

Optional:

  • key (String) The label key that the selector applies to.
  • operator (String) Operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
  • values (Set of String) Values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.

Nested Schema for spec.template.spec.affinity.node_affinity.preferred_during_scheduling_ignored_during_execution.preference.match_fields

Required:

  • key (String) The label key that the selector applies to.
  • operator (String) A key's relationship to a set of values. Valid operators ard In, NotIn, Exists, DoesNotExist, Gt, and Lt.

Optional:

  • values (Set of String) An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

Nested Schema for spec.template.spec.affinity.node_affinity.required_during_scheduling_ignored_during_execution

Optional:

Nested Schema for spec.template.spec.affinity.node_affinity.required_during_scheduling_ignored_during_execution.node_selector_term

Optional:

  • match_expressions (Block List) List of node selector requirements. The requirements are ANDed. (see below for nested schema)
  • match_fields (Block List) A list of node selector requirements by node's fields. The requirements are ANDed. (see below for nested schema)

Nested Schema for spec.template.spec.affinity.node_affinity.required_during_scheduling_ignored_during_execution.node_selector_term.match_expressions

Optional:

  • key (String) The label key that the selector applies to.
  • operator (String) Operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
  • values (Set of String) Values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.

Nested Schema for spec.template.spec.affinity.node_affinity.required_during_scheduling_ignored_during_execution.node_selector_term.match_fields

Required:

  • key (String) The label key that the selector applies to.
  • operator (String) A key's relationship to a set of values. Valid operators ard In, NotIn, Exists, DoesNotExist, Gt, and Lt.

Optional:

  • values (Set of String) An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

Nested Schema for spec.template.spec.affinity.pod_affinity

Optional:

  • preferred_during_scheduling_ignored_during_execution (Block List) The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, RequiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding 'weight' to the sum if the node matches the corresponding MatchExpressions; the node(s) with the highest sum are the most preferred. (see below for nested schema)
  • required_during_scheduling_ignored_during_execution (Block List) If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each PodAffinityTerm are intersected, i.e. all terms must be satisfied. (see below for nested schema)

Nested Schema for spec.template.spec.affinity.pod_affinity.preferred_during_scheduling_ignored_during_execution

Required:

  • pod_affinity_term (Block List, Min: 1, Max: 1) A pod affinity term, associated with the corresponding weight (see below for nested schema)
  • weight (Number) weight associated with matching the corresponding podAffinityTerm, in the range 1-100

Nested Schema for spec.template.spec.affinity.pod_affinity.preferred_during_scheduling_ignored_during_execution.pod_affinity_term

Required:

  • topology_key (String) empty topology key is interpreted by the scheduler as 'all topologies'

Optional:

  • label_selector (Block List) A label query over a set of resources, in this case pods. (see below for nested schema)
  • namespaces (Set of String) namespaces specifies which namespaces the labelSelector applies to (matches against); null or empty list means 'this pod's namespace'

Nested Schema for spec.template.spec.affinity.pod_affinity.preferred_during_scheduling_ignored_during_execution.pod_affinity_term.label_selector

Optional:

  • match_expressions (Block List) A list of label selector requirements. The requirements are ANDed. (see below for nested schema)
  • match_labels (Map of String) A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of match_expressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

Nested Schema for spec.template.spec.affinity.pod_affinity.preferred_during_scheduling_ignored_during_execution.pod_affinity_term.label_selector.match_expressions

Optional:

  • key (String) The label key that the selector applies to.
  • operator (String) A key's relationship to a set of values. Valid operators ard In, NotIn, Exists and DoesNotExist.
  • values (Set of String) An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

Nested Schema for spec.template.spec.affinity.pod_affinity.required_during_scheduling_ignored_during_execution

Required:

  • topology_key (String) empty topology key is interpreted by the scheduler as 'all topologies'

Optional:

  • label_selector (Block List) A label query over a set of resources, in this case pods. (see below for nested schema)
  • namespaces (Set of String) namespaces specifies which namespaces the labelSelector applies to (matches against); null or empty list means 'this pod's namespace'

Nested Schema for spec.template.spec.affinity.pod_affinity.required_during_scheduling_ignored_during_execution.label_selector

Optional:

  • match_expressions (Block List) A list of label selector requirements. The requirements are ANDed. (see below for nested schema)
  • match_labels (Map of String) A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of match_expressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

Nested Schema for spec.template.spec.affinity.pod_affinity.required_during_scheduling_ignored_during_execution.label_selector.match_expressions

Optional:

  • key (String) The label key that the selector applies to.
  • operator (String) A key's relationship to a set of values. Valid operators ard In, NotIn, Exists and DoesNotExist.
  • values (Set of String) An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

Nested Schema for spec.template.spec.affinity.pod_anti_affinity

Optional:

  • preferred_during_scheduling_ignored_during_execution (Block List) The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, RequiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding 'weight' to the sum if the node matches the corresponding MatchExpressions; the node(s) with the highest sum are the most preferred. (see below for nested schema)
  • required_during_scheduling_ignored_during_execution (Block List) If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each PodAffinityTerm are intersected, i.e. all terms must be satisfied. (see below for nested schema)

Nested Schema for spec.template.spec.affinity.pod_anti_affinity.preferred_during_scheduling_ignored_during_execution

Required:

  • pod_affinity_term (Block List, Min: 1, Max: 1) A pod affinity term, associated with the corresponding weight (see below for nested schema)
  • weight (Number) weight associated with matching the corresponding podAffinityTerm, in the range 1-100

Nested Schema for spec.template.spec.affinity.pod_anti_affinity.preferred_during_scheduling_ignored_during_execution.pod_affinity_term

Required:

  • topology_key (String) empty topology key is interpreted by the scheduler as 'all topologies'

Optional:

  • label_selector (Block List) A label query over a set of resources, in this case pods. (see below for nested schema)
  • namespaces (Set of String) namespaces specifies which namespaces the labelSelector applies to (matches against); null or empty list means 'this pod's namespace'

Nested Schema for spec.template.spec.affinity.pod_anti_affinity.preferred_during_scheduling_ignored_during_execution.pod_affinity_term.label_selector

Optional:

  • match_expressions (Block List) A list of label selector requirements. The requirements are ANDed. (see below for nested schema)
  • match_labels (Map of String) A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of match_expressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

Nested Schema for spec.template.spec.affinity.pod_anti_affinity.preferred_during_scheduling_ignored_during_execution.pod_affinity_term.label_selector.match_expressions

Optional:

  • key (String) The label key that the selector applies to.
  • operator (String) A key's relationship to a set of values. Valid operators ard In, NotIn, Exists and DoesNotExist.
  • values (Set of String) An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

Nested Schema for spec.template.spec.affinity.pod_anti_affinity.required_during_scheduling_ignored_during_execution

Required:

  • topology_key (String) empty topology key is interpreted by the scheduler as 'all topologies'

Optional:

  • label_selector (Block List) A label query over a set of resources, in this case pods. (see below for nested schema)
  • namespaces (Set of String) namespaces specifies which namespaces the labelSelector applies to (matches against); null or empty list means 'this pod's namespace'

Nested Schema for spec.template.spec.affinity.pod_anti_affinity.required_during_scheduling_ignored_during_execution.label_selector

Optional:

  • match_expressions (Block List) A list of label selector requirements. The requirements are ANDed. (see below for nested schema)
  • match_labels (Map of String) A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of match_expressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

Nested Schema for spec.template.spec.affinity.pod_anti_affinity.required_during_scheduling_ignored_during_execution.label_selector.match_expressions

Optional:

  • key (String) The label key that the selector applies to.
  • operator (String) A key's relationship to a set of values. Valid operators ard In, NotIn, Exists and DoesNotExist.
  • values (Set of String) An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

Nested Schema for spec.template.spec.container

Required:

  • name (String) Name of the container specified as a DNS_LABEL. Each container in a pod must have a unique name (DNS_LABEL). Cannot be updated.

Optional:

  • args (List of String) Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
  • command (List of String) Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
  • env (Block List) List of environment variables to set in the container. Cannot be updated. (see below for nested schema)
  • env_from (Block List) List of sources to populate environment variables in the container. The keys defined within a source must be a C_IDENTIFIER. All invalid keys will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. (see below for nested schema)
  • image (String) Docker image name. More info: https://kubernetes.io/docs/concepts/containers/images/
  • image_pull_policy (String) Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images/#updating-images
  • lifecycle (Block List, Max: 1) Actions that the management system should take in response to container lifecycle events (see below for nested schema)
  • liveness_probe (Block List, Max: 1) Periodic probe of container liveness. Container will be restarted if the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes (see below for nested schema)
  • port (Block List) List of ports to expose from the container. Exposing a port here gives the system additional information about the network connections a container uses, but is primarily informational. Not specifying a port here DOES NOT prevent that port from being exposed. Any port which is listening on the default "0.0.0.0" address inside a container will be accessible from the network. Cannot be updated. (see below for nested schema)
  • readiness_probe (Block List, Max: 1) Periodic probe of container service readiness. Container will be removed from service endpoints if the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes (see below for nested schema)
  • resources (Block List, Max: 1) Compute Resources required by this container. Cannot be updated. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources (see below for nested schema)
  • security_context (Block List, Max: 1) Security options the pod should run with. More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ (see below for nested schema)
  • startup_probe (Block List, Max: 1) StartupProbe indicates that the Pod has successfully initialized. If specified, no other probes are executed until this completes successfully. If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, when it might take a long time to load data or warm a cache, than during steady-state operation. This cannot be updated. This is an alpha feature enabled by the StartupProbe feature flag. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes (see below for nested schema)
  • stdin (Boolean) Whether this container should allocate a buffer for stdin in the container runtime. If this is not set, reads from stdin in the container will always result in EOF.
  • stdin_once (Boolean) Whether the container runtime should close the stdin channel after it has been opened by a single attach. When stdin is true the stdin stream will remain open across multiple attach sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the first client attaches to stdin, and then remains open and accepts data until the client disconnects, at which time stdin is closed and remains closed until the container is restarted. If this flag is false, a container processes that reads from stdin will never receive an EOF.
  • termination_message_path (String) Optional: Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Defaults to /dev/termination-log. Cannot be updated.
  • termination_message_policy (String) Optional: Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
  • tty (Boolean) Whether this container should allocate a TTY for itself
  • volume_mount (Block List) Pod volumes to mount into the container's filesystem. Cannot be updated. (see below for nested schema)
  • volume_device (Block List) Raw volume devices to attach into the container's filesystem as raw block devices. Cannot be updated. More info: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 (see below for nested schema)
  • working_dir (String) Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. Cannot be updated.

Nested Schema for spec.template.spec.container.env

Required:

  • name (String) Name of the environment variable. Must be a C_IDENTIFIER

Optional:

  • value (String) Variable references $(VAR_NAME) are expanded using the previous defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".
  • value_from (Block List, Max: 1) Source for the environment variable's value (see below for nested schema)

Nested Schema for spec.template.spec.container.env.value_from

Optional:

  • config_map_key_ref (Block List, Max: 1) Selects a key of a ConfigMap. (see below for nested schema)
  • field_ref (Block List, Max: 1) Selects a field of the pod: supports metadata.name, metadata.namespace, metadata.labels, metadata.annotations, spec.nodeName, spec.serviceAccountName, status.podIP. (see below for nested schema)
  • resource_field_ref (Block List, Max: 1) Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. (see below for nested schema)
  • secret_key_ref (Block List, Max: 1) Selects a key of a secret in the pod's namespace. (see below for nested schema)

Nested Schema for spec.template.spec.container.env.value_from.config_map_key_ref

Optional:

Nested Schema for spec.template.spec.container.env.value_from.field_ref

Optional:

  • api_version (String) Version of the schema the FieldPath is written in terms of, defaults to "v1".
  • field_path (String) Path of the field to select in the specified API version

Nested Schema for spec.template.spec.container.env.value_from.resource_field_ref

Required:

  • resource (String) Resource to select

Optional:

  • container_name (String)
  • divisor (String)

Nested Schema for spec.template.spec.container.env.value_from.secret_key_ref

Optional:

Nested Schema for spec.template.spec.container.env_from

Optional:

  • config_map_ref (Block List, Max: 1) The ConfigMap to select from (see below for nested schema)
  • prefix (String) An optional identifer to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
  • secret_ref (Block List, Max: 1) The Secret to select from (see below for nested schema)

Nested Schema for spec.template.spec.container.env_from.config_map_ref

Required:

Optional:

  • optional (Boolean) Specify whether the ConfigMap must be defined

Nested Schema for spec.template.spec.container.env_from.secret_ref

Required:

Optional:

  • optional (Boolean) Specify whether the Secret must be defined

Nested Schema for spec.template.spec.container.lifecycle

Optional:

Nested Schema for spec.template.spec.container.lifecycle.post_start

Optional:

Nested Schema for spec.template.spec.container.lifecycle.post_start.exec

Optional:

  • command (List of String) Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.

Nested Schema for spec.template.spec.container.lifecycle.post_start.http_get

Optional:

  • host (String) Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead.
  • http_header (Block List) Scheme to use for connecting to the host. (see below for nested schema)
  • path (String) Path to access on the HTTP server.
  • port (String) Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
  • scheme (String) Scheme to use for connecting to the host.

Nested Schema for spec.template.spec.container.lifecycle.post_start.http_get.http_header

Optional:

  • name (String) The header field name
  • value (String) The header field value

Nested Schema for spec.template.spec.container.lifecycle.post_start.tcp_socket

Required:

  • port (String) Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.

Nested Schema for spec.template.spec.container.lifecycle.pre_stop

Optional:

Nested Schema for spec.template.spec.container.lifecycle.pre_stop.exec

Optional:

  • command (List of String) Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.

Nested Schema for spec.template.spec.container.lifecycle.pre_stop.http_get

Optional:

  • host (String) Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead.
  • http_header (Block List) Scheme to use for connecting to the host. (see below for nested schema)
  • path (String) Path to access on the HTTP server.
  • port (String) Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
  • scheme (String) Scheme to use for connecting to the host.

Nested Schema for spec.template.spec.container.lifecycle.pre_stop.http_get.http_header

Optional:

  • name (String) The header field name
  • value (String) The header field value

Nested Schema for spec.template.spec.container.lifecycle.pre_stop.tcp_socket

Required:

  • port (String) Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.

Nested Schema for spec.template.spec.container.liveness_probe

Optional:

Nested Schema for spec.template.spec.container.liveness_probe.exec

Optional:

  • command (List of String) Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.

Nested Schema for spec.template.spec.container.liveness_probe.grpc

Required:

  • port (Number) Number of the port to access on the container. Number must be in the range 1 to 65535.

Optional:

Nested Schema for spec.template.spec.container.liveness_probe.http_get

Optional:

  • host (String) Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead.
  • http_header (Block List) Scheme to use for connecting to the host. (see below for nested schema)
  • path (String) Path to access on the HTTP server.
  • port (String) Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
  • scheme (String) Scheme to use for connecting to the host.

Nested Schema for spec.template.spec.container.liveness_probe.http_get.http_header

Optional:

  • name (String) The header field name
  • value (String) The header field value

Nested Schema for spec.template.spec.container.liveness_probe.tcp_socket

Required:

  • port (String) Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.

Nested Schema for spec.template.spec.container.port

Required:

  • container_port (Number) Number of port to expose on the pod's IP address. This must be a valid port number, 0 < x < 65536.

Optional:

  • host_ip (String) What host IP to bind the external port to.
  • host_port (Number) Number of port to expose on the host. If specified, this must be a valid port number, 0 < x < 65536. If HostNetwork is specified, this must match ContainerPort. Most containers do not need this.
  • name (String) If specified, this must be an IANA_SVC_NAME and unique within the pod. Each named port in a pod must have a unique name. Name for the port that can be referred to by services
  • protocol (String) Protocol for port. Must be UDP or TCP. Defaults to "TCP".

Nested Schema for spec.template.spec.container.readiness_probe

Optional:

Nested Schema for spec.template.spec.container.readiness_probe.exec

Optional:

  • command (List of String) Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.

Nested Schema for spec.template.spec.container.readiness_probe.grpc

Required:

  • port (Number) Number of the port to access on the container. Number must be in the range 1 to 65535.

Optional:

Nested Schema for spec.template.spec.container.readiness_probe.http_get

Optional:

  • host (String) Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead.
  • http_header (Block List) Scheme to use for connecting to the host. (see below for nested schema)
  • path (String) Path to access on the HTTP server.
  • port (String) Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
  • scheme (String) Scheme to use for connecting to the host.

Nested Schema for spec.template.spec.container.readiness_probe.http_get.http_header

Optional:

  • name (String) The header field name
  • value (String) The header field value

Nested Schema for spec.template.spec.container.readiness_probe.tcp_socket

Required:

  • port (String) Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.

Nested Schema for spec.template.spec.container.resources

Optional:

Nested Schema for spec.template.spec.container.security_context

Optional:

  • allow_privilege_escalation (Boolean) AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN
  • capabilities (Block List, Max: 1) The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. (see below for nested schema)
  • privileged (Boolean) Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false.
  • read_only_root_filesystem (Boolean) Whether this container has a read-only root filesystem. Default is false.
  • run_as_group (String) The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
  • run_as_non_root (Boolean) Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
  • run_as_user (String) The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
  • se_linux_options (Block List, Max: 1) The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. (see below for nested schema)
  • seccomp_profile (Block List, Max: 1) The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. (see below for nested schema)

Nested Schema for spec.template.spec.container.security_context.capabilities

Optional:

  • add (List of String) Added capabilities
  • drop (List of String) Removed capabilities

Nested Schema for spec.template.spec.container.security_context.se_linux_options

Optional:

  • level (String) Level is SELinux level label that applies to the container.
  • role (String) Role is a SELinux role label that applies to the container.
  • type (String) Type is a SELinux type label that applies to the container.
  • user (String) User is a SELinux user label that applies to the container.

Nested Schema for spec.template.spec.container.security_context.seccomp_profile

Optional:

  • localhost_profile (String) Localhost Profile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work.
  • type (String) Type indicates which kind of seccomp profile will be applied. Valid options are: Localhost, RuntimeDefault, Unconfined.

Nested Schema for spec.template.spec.container.startup_probe

Optional:

Nested Schema for spec.template.spec.container.startup_probe.exec

Optional:

  • command (List of String) Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.

Nested Schema for spec.template.spec.container.startup_probe.grpc

Required:

  • port (Number) Number of the port to access on the container. Number must be in the range 1 to 65535.

Optional:

Nested Schema for spec.template.spec.container.startup_probe.http_get

Optional:

  • host (String) Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead.
  • http_header (Block List) Scheme to use for connecting to the host. (see below for nested schema)
  • path (String) Path to access on the HTTP server.
  • port (String) Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
  • scheme (String) Scheme to use for connecting to the host.

Nested Schema for spec.template.spec.container.startup_probe.http_get.http_header

Optional:

  • name (String) The header field name
  • value (String) The header field value

Nested Schema for spec.template.spec.container.startup_probe.tcp_socket

Required:

  • port (String) Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.

Nested Schema for spec.template.spec.container.volume_mount

Required:

  • mount_path (String) Path within the container at which the volume should be mounted. Must not contain ':'.
  • name (String) This must match the Name of a Volume.

Optional:

  • mount_propagation (String) Mount propagation mode. mount_propagation determines how mounts are propagated from the host to container and the other way around. Valid values are None (default), HostToContainer and Bidirectional.
  • read_only (Boolean) Mounted read-only if true, read-write otherwise (false or unspecified). Defaults to false.
  • sub_path (String) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
  • sub_path_expr (String) Expanded path within the volume from which the container's volume should be mounted. Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. Defaults to "" (volume's root).

Nested Schema for spec.template.spec.container.volume_device

Required:

  • device_path (String) Path within the container at which the volume device should be attached. For example '/dev/xvda'.
  • name (String) This must match the Name of a PersistentVolumeClaim.

Nested Schema for spec.template.spec.dns_config

Optional:

  • nameservers (List of String) A list of DNS name server IP addresses. This will be appended to the base nameservers generated from DNSPolicy. Duplicated nameservers will be removed.
  • option (Block List) A list of DNS resolver options. This will be merged with the base options generated from DNSPolicy. Duplicated entries will be removed. Resolution options given in Options will override those that appear in the base DNSPolicy. (see below for nested schema)
  • searches (List of String) A list of DNS search domains for host-name lookup. This will be appended to the base search paths generated from DNSPolicy. Duplicated search paths will be removed.

Nested Schema for spec.template.spec.dns_config.option

Required:

  • name (String) Name of the option.

Optional:

  • value (String) Value of the option. Optional: Defaults to empty.

Nested Schema for spec.template.spec.host_aliases

Required:

  • hostnames (List of String) Hostnames for the IP address.
  • ip (String) IP address of the host file entry.

Nested Schema for spec.template.spec.image_pull_secrets

Required:

Nested Schema for spec.template.spec.init_container

Required:

  • name (String) Name of the container specified as a DNS_LABEL. Each container in a pod must have a unique name (DNS_LABEL). Cannot be updated.

Optional:

  • args (List of String) Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
  • command (List of String) Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
  • env (Block List) List of environment variables to set in the container. Cannot be updated. (see below for nested schema)
  • env_from (Block List) List of sources to populate environment variables in the container. The keys defined within a source must be a C_IDENTIFIER. All invalid keys will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. (see below for nested schema)
  • image (String) Docker image name. More info: https://kubernetes.io/docs/concepts/containers/images/
  • image_pull_policy (String) Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images/#updating-images
  • lifecycle (Block List, Max: 1) Actions that the management system should take in response to container lifecycle events (see below for nested schema)
  • liveness_probe (Block List, Max: 1) Periodic probe of container liveness. Container will be restarted if the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes (see below for nested schema)
  • port (Block List) List of ports to expose from the container. Exposing a port here gives the system additional information about the network connections a container uses, but is primarily informational. Not specifying a port here DOES NOT prevent that port from being exposed. Any port which is listening on the default "0.0.0.0" address inside a container will be accessible from the network. Cannot be updated. (see below for nested schema)
  • readiness_probe (Block List, Max: 1) Periodic probe of container service readiness. Container will be removed from service endpoints if the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes (see below for nested schema)
  • resources (Block List, Max: 1) Compute Resources required by this container. Cannot be updated. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources (see below for nested schema)
  • security_context (Block List, Max: 1) Security options the pod should run with. More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ (see below for nested schema)
  • startup_probe (Block List, Max: 1) StartupProbe indicates that the Pod has successfully initialized. If specified, no other probes are executed until this completes successfully. If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, when it might take a long time to load data or warm a cache, than during steady-state operation. This cannot be updated. This is an alpha feature enabled by the StartupProbe feature flag. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes (see below for nested schema)
  • stdin (Boolean) Whether this container should allocate a buffer for stdin in the container runtime. If this is not set, reads from stdin in the container will always result in EOF.
  • stdin_once (Boolean) Whether the container runtime should close the stdin channel after it has been opened by a single attach. When stdin is true the stdin stream will remain open across multiple attach sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the first client attaches to stdin, and then remains open and accepts data until the client disconnects, at which time stdin is closed and remains closed until the container is restarted. If this flag is false, a container processes that reads from stdin will never receive an EOF.
  • termination_message_path (String) Optional: Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Defaults to /dev/termination-log. Cannot be updated.
  • termination_message_policy (String) Optional: Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.
  • tty (Boolean) Whether this container should allocate a TTY for itself
  • volume_mount (Block List) Pod volumes to mount into the container's filesystem. Cannot be updated. (see below for nested schema)
  • volume_device (Block List) Raw volume devices to attach into the container's filesystem as raw block devices. Cannot be updated. More info: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 (see below for nested schema)
  • working_dir (String) Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. Cannot be updated.

Nested Schema for spec.template.spec.init_container.env

Required:

  • name (String) Name of the environment variable. Must be a C_IDENTIFIER

Optional:

  • value (String) Variable references $(VAR_NAME) are expanded using the previous defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".
  • value_from (Block List, Max: 1) Source for the environment variable's value (see below for nested schema)

Nested Schema for spec.template.spec.init_container.env.value_from

Optional:

  • config_map_key_ref (Block List, Max: 1) Selects a key of a ConfigMap. (see below for nested schema)
  • field_ref (Block List, Max: 1) Selects a field of the pod: supports metadata.name, metadata.namespace, metadata.labels, metadata.annotations, spec.nodeName, spec.serviceAccountName, status.podIP. (see below for nested schema)
  • resource_field_ref (Block List, Max: 1) Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. (see below for nested schema)
  • secret_key_ref (Block List, Max: 1) Selects a key of a secret in the pod's namespace. (see below for nested schema)

Nested Schema for spec.template.spec.init_container.env.value_from.config_map_key_ref

Optional:

Nested Schema for spec.template.spec.init_container.env.value_from.field_ref

Optional:

  • api_version (String) Version of the schema the FieldPath is written in terms of, defaults to "v1".
  • field_path (String) Path of the field to select in the specified API version

Nested Schema for spec.template.spec.init_container.env.value_from.resource_field_ref

Required:

  • resource (String) Resource to select

Optional:

  • container_name (String)
  • divisor (String)

Nested Schema for spec.template.spec.init_container.env.value_from.secret_key_ref

Optional:

Nested Schema for spec.template.spec.init_container.env_from

Optional:

  • config_map_ref (Block List, Max: 1) The ConfigMap to select from (see below for nested schema)
  • prefix (String) An optional identifer to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
  • secret_ref (Block List, Max: 1) The Secret to select from (see below for nested schema)

Nested Schema for spec.template.spec.init_container.env_from.config_map_ref

Required:

Optional:

  • optional (Boolean) Specify whether the ConfigMap must be defined

Nested Schema for spec.template.spec.init_container.env_from.secret_ref

Required:

Optional:

  • optional (Boolean) Specify whether the Secret must be defined

Nested Schema for spec.template.spec.init_container.lifecycle

Optional:

Nested Schema for spec.template.spec.init_container.lifecycle.post_start

Optional:

Nested Schema for spec.template.spec.init_container.lifecycle.post_start.exec

Optional:

  • command (List of String) Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.

Nested Schema for spec.template.spec.init_container.lifecycle.post_start.http_get

Optional:

  • host (String) Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead.
  • http_header (Block List) Scheme to use for connecting to the host. (see below for nested schema)
  • path (String) Path to access on the HTTP server.
  • port (String) Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
  • scheme (String) Scheme to use for connecting to the host.

Nested Schema for spec.template.spec.init_container.lifecycle.post_start.http_get.http_header

Optional:

  • name (String) The header field name
  • value (String) The header field value

Nested Schema for spec.template.spec.init_container.lifecycle.post_start.tcp_socket

Required:

  • port (String) Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.

Nested Schema for spec.template.spec.init_container.lifecycle.pre_stop

Optional:

Nested Schema for spec.template.spec.init_container.lifecycle.pre_stop.exec

Optional:

  • command (List of String) Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.

Nested Schema for spec.template.spec.init_container.lifecycle.pre_stop.http_get

Optional:

  • host (String) Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead.
  • http_header (Block List) Scheme to use for connecting to the host. (see below for nested schema)
  • path (String) Path to access on the HTTP server.
  • port (String) Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
  • scheme (String) Scheme to use for connecting to the host.

Nested Schema for spec.template.spec.init_container.lifecycle.pre_stop.http_get.http_header

Optional:

  • name (String) The header field name
  • value (String) The header field value

Nested Schema for spec.template.spec.init_container.lifecycle.pre_stop.tcp_socket

Required:

  • port (String) Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.

Nested Schema for spec.template.spec.init_container.liveness_probe

Optional:

Nested Schema for spec.template.spec.init_container.liveness_probe.exec

Optional:

  • command (List of String) Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.

Nested Schema for spec.template.spec.init_container.liveness_probe.grpc

Required:

  • port (Number) Number of the port to access on the container. Number must be in the range 1 to 65535.

Optional:

Nested Schema for spec.template.spec.init_container.liveness_probe.http_get

Optional:

  • host (String) Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead.
  • http_header (Block List) Scheme to use for connecting to the host. (see below for nested schema)
  • path (String) Path to access on the HTTP server.
  • port (String) Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
  • scheme (String) Scheme to use for connecting to the host.

Nested Schema for spec.template.spec.init_container.liveness_probe.http_get.http_header

Optional:

  • name (String) The header field name
  • value (String) The header field value

Nested Schema for spec.template.spec.init_container.liveness_probe.tcp_socket

Required:

  • port (String) Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.

Nested Schema for spec.template.spec.init_container.port

Required:

  • container_port (Number) Number of port to expose on the pod's IP address. This must be a valid port number, 0 < x < 65536.

Optional:

  • host_ip (String) What host IP to bind the external port to.
  • host_port (Number) Number of port to expose on the host. If specified, this must be a valid port number, 0 < x < 65536. If HostNetwork is specified, this must match ContainerPort. Most containers do not need this.
  • name (String) If specified, this must be an IANA_SVC_NAME and unique within the pod. Each named port in a pod must have a unique name. Name for the port that can be referred to by services
  • protocol (String) Protocol for port. Must be UDP or TCP. Defaults to "TCP".

Nested Schema for spec.template.spec.init_container.readiness_probe

Optional:

Nested Schema for spec.template.spec.init_container.readiness_probe.exec

Optional:

  • command (List of String) Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.

Nested Schema for spec.template.spec.init_container.readiness_probe.grpc

Required:

  • port (Number) Number of the port to access on the container. Number must be in the range 1 to 65535.

Optional:

Nested Schema for spec.template.spec.init_container.readiness_probe.http_get

Optional:

  • host (String) Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead.
  • http_header (Block List) Scheme to use for connecting to the host. (see below for nested schema)
  • path (String) Path to access on the HTTP server.
  • port (String) Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
  • scheme (String) Scheme to use for connecting to the host.

Nested Schema for spec.template.spec.init_container.readiness_probe.http_get.http_header

Optional:

  • name (String) The header field name
  • value (String) The header field value

Nested Schema for spec.template.spec.init_container.readiness_probe.tcp_socket

Required:

  • port (String) Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.

Nested Schema for spec.template.spec.init_container.resources

Optional:

Nested Schema for spec.template.spec.init_container.security_context

Optional:

  • allow_privilege_escalation (Boolean) AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN
  • capabilities (Block List, Max: 1) The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. (see below for nested schema)
  • privileged (Boolean) Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false.
  • read_only_root_filesystem (Boolean) Whether this container has a read-only root filesystem. Default is false.
  • run_as_group (String) The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
  • run_as_non_root (Boolean) Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
  • run_as_user (String) The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
  • se_linux_options (Block List, Max: 1) The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. (see below for nested schema)
  • seccomp_profile (Block List, Max: 1) The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. (see below for nested schema)

Nested Schema for spec.template.spec.init_container.security_context.capabilities

Optional:

  • add (List of String) Added capabilities
  • drop (List of String) Removed capabilities

Nested Schema for spec.template.spec.init_container.security_context.se_linux_options

Optional:

  • level (String) Level is SELinux level label that applies to the container.
  • role (String) Role is a SELinux role label that applies to the container.
  • type (String) Type is a SELinux type label that applies to the container.
  • user (String) User is a SELinux user label that applies to the container.

Nested Schema for spec.template.spec.init_container.security_context.seccomp_profile

Optional:

  • localhost_profile (String) Localhost Profile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work.
  • type (String) Type indicates which kind of seccomp profile will be applied. Valid options are: Localhost, RuntimeDefault, Unconfined.

Nested Schema for spec.template.spec.init_container.startup_probe

Optional:

Nested Schema for spec.template.spec.init_container.startup_probe.exec

Optional:

  • command (List of String) Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.

Nested Schema for spec.template.spec.init_container.startup_probe.grpc

Required:

  • port (Number) Number of the port to access on the container. Number must be in the range 1 to 65535.

Optional:

Nested Schema for spec.template.spec.init_container.startup_probe.http_get

Optional:

  • host (String) Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead.
  • http_header (Block List) Scheme to use for connecting to the host. (see below for nested schema)
  • path (String) Path to access on the HTTP server.
  • port (String) Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
  • scheme (String) Scheme to use for connecting to the host.

Nested Schema for spec.template.spec.init_container.startup_probe.http_get.http_header

Optional:

  • name (String) The header field name
  • value (String) The header field value

Nested Schema for spec.template.spec.init_container.startup_probe.tcp_socket

Required:

  • port (String) Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.

Nested Schema for spec.template.spec.init_container.volume_mount

Required:

  • mount_path (String) Path within the container at which the volume should be mounted. Must not contain ':'.
  • name (String) This must match the Name of a Volume.

Optional:

  • mount_propagation (String) Mount propagation mode. mount_propagation determines how mounts are propagated from the host to container and the other way around. Valid values are None (default), HostToContainer and Bidirectional.
  • read_only (Boolean) Mounted read-only if true, read-write otherwise (false or unspecified). Defaults to false.
  • sub_path (String) Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
  • sub_path_expr (String) Expanded path within the volume from which the container's volume should be mounted. Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. Defaults to "" (volume's root).

Nested Schema for spec.template.spec.init_container.volume_device

Required:

  • device_path (String) Path within the container at which the volume device should be attached. For example '/dev/xvda'.
  • name (String) This must match the Name of a PersistentVolumeClaim.

Nested Schema for spec.template.spec.os

Required:

  • name (String) Name is the name of the operating system. The currently supported values are linux and windows.

Nested Schema for spec.template.spec.readiness_gate

Required:

  • condition_type (String) refers to a condition in the pod's condition list with matching type.

Nested Schema for spec.template.spec.security_context

Optional:

  • fs_group (String) A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod: 1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw---- If unset, the Kubelet will not modify the ownership and permissions of any volume.
  • fs_group_change_policy (String) fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir.
  • run_as_group (String) The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.
  • run_as_non_root (Boolean) Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
  • run_as_user (String) The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.
  • se_linux_options (Block List, Max: 1) The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. (see below for nested schema)
  • seccomp_profile (Block List, Max: 1) The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. (see below for nested schema)
  • supplemental_groups (Set of Number) A list of groups applied to the first process run in each container, in addition to the container's primary GID. If unspecified, no groups will be added to any container.
  • sysctl (Block List) holds a list of namespaced sysctls used for the pod. (see below for nested schema)
  • windows_options (Block List, Max: 1) The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux. (see below for nested schema)

Nested Schema for spec.template.spec.security_context.se_linux_options

Optional:

  • level (String) Level is SELinux level label that applies to the container.
  • role (String) Role is a SELinux role label that applies to the container.
  • type (String) Type is a SELinux type label that applies to the container.
  • user (String) User is a SELinux user label that applies to the container.

Nested Schema for spec.template.spec.security_context.seccomp_profile

Optional:

  • localhost_profile (String) Localhost Profile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work.
  • type (String) Type indicates which kind of seccomp profile will be applied. Valid options are: Localhost, RuntimeDefault, Unconfined.

Nested Schema for spec.template.spec.security_context.sysctl

Required:

  • name (String) Name of a property to set.
  • value (String) Value of a property to set.

Nested Schema for spec.template.spec.security_context.windows_options

Optional:

  • gmsa_credential_spec (String) GMSACredentialSpec is where the GMSA admission webhook inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field
  • gmsa_credential_spec_name (String) GMSACredentialSpecName is the name of the GMSA credential spec to use.
  • host_process (Boolean) HostProcess determines if a container should be run as a 'Host Process' container. Default value is false.
  • run_as_username (String) The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

Nested Schema for spec.template.spec.toleration

Optional:

  • effect (String) Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
  • key (String) Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.
  • operator (String) Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.
  • toleration_seconds (String) TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.
  • value (String) Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.

Nested Schema for spec.template.spec.topology_spread_constraint

Optional:

  • label_selector (Block List) A label query over a set of resources, in this case pods. (see below for nested schema)
  • match_label_keys (Set of String) is a set of pod label keys to select the pods over which spreading will be calculated.
  • max_skew (Number) describes the degree to which pods may be unevenly distributed.
  • min_domains (Number) indicates a minimum number of eligible domains.
  • node_affinity_policy (String) indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew.
  • node_taints_policy (String) indicates how we will treat node taints when calculating pod topology spread skew.
  • topology_key (String) the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology.
  • when_unsatisfiable (String) indicates how to deal with a pod if it doesn't satisfy the spread constraint.

Nested Schema for spec.template.spec.topology_spread_constraint.label_selector

Optional:

  • match_expressions (Block List) A list of label selector requirements. The requirements are ANDed. (see below for nested schema)
  • match_labels (Map of String) A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of match_expressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

Nested Schema for spec.template.spec.topology_spread_constraint.label_selector.match_expressions

Optional:

  • key (String) The label key that the selector applies to.
  • operator (String) A key's relationship to a set of values. Valid operators ard In, NotIn, Exists and DoesNotExist.
  • values (Set of String) An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

Nested Schema for spec.template.spec.volume

Optional:

Nested Schema for spec.template.spec.volume.aws_elastic_block_store

Required:

Optional:

  • fs_type (String) Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
  • partition (Number) The partition in the volume that you want to mount. If omitted, the default is to mount by volume name. Examples: For volume /dev/sda1, you specify the partition as "1". Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty).
  • read_only (Boolean) Whether to set the read-only property in VolumeMounts to "true". If omitted, the default is "false". More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore

Nested Schema for spec.template.spec.volume.azure_disk

Required:

  • caching_mode (String) Host Caching mode: None, Read Only, Read Write.
  • data_disk_uri (String) The URI the data disk in the blob storage
  • disk_name (String) The Name of the data disk in the blob storage

Optional:

  • fs_type (String) Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
  • kind (String) The type for the data disk. Expected values: Shared, Dedicated, Managed. Defaults to Shared
  • read_only (Boolean) Whether to force the read-only setting in VolumeMounts. Defaults to false (read/write).

Nested Schema for spec.template.spec.volume.azure_file

Required:

  • secret_name (String) The name of secret that contains Azure Storage Account Name and Key
  • share_name (String) Share Name

Optional:

  • read_only (Boolean) Whether to force the read-only setting in VolumeMounts. Defaults to false (read/write).
  • secret_namespace (String) The namespace of the secret that contains Azure Storage Account Name and Key. For Kubernetes up to 1.18.x the default is the same as the Pod. For Kubernetes 1.19.x and later the default is "default" namespace.

Nested Schema for spec.template.spec.volume.ceph_fs

Required:

Optional:

Nested Schema for spec.template.spec.volume.ceph_fs.secret_ref

Optional:

Nested Schema for spec.template.spec.volume.cinder

Required:

Optional:

Nested Schema for spec.template.spec.volume.config_map

Optional:

  • default_mode (String) Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
  • items (Block List) If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'. (see below for nested schema)
  • name (String) Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  • optional (Boolean) Optional: Specify whether the ConfigMap or its keys must be defined.

Nested Schema for spec.template.spec.volume.config_map.items

Optional:

  • key (String) The key to project.
  • mode (String) Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
  • path (String) The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'.

Nested Schema for spec.template.spec.volume.csi

Required:

Optional:

  • fs_type (String) Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
  • node_publish_secret_ref (Block List, Max: 1) A reference to the secret object containing sensitive information to pass to the CSI driver to complete the CSI NodePublishVolume and NodeUnpublishVolume calls. (see below for nested schema)
  • read_only (Boolean) Whether to set the read-only property in VolumeMounts to "true". If omitted, the default is "false". More info: https://kubernetes.io/docs/concepts/storage/volumes#csi
  • volume_attributes (Map of String) Attributes of the volume to publish.

Nested Schema for spec.template.spec.volume.csi.node_publish_secret_ref

Optional:

Nested Schema for spec.template.spec.volume.downward_api

Optional:

  • default_mode (String) Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
  • items (Block List) If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error. Paths must be relative and may not contain the '..' path or start with '..'. (see below for nested schema)

Nested Schema for spec.template.spec.volume.downward_api.items

Required:

  • field_ref (Block List, Min: 1, Max: 1) Required: Selects a field of the pod: only annotations, labels, name and namespace are supported. (see below for nested schema)
  • path (String) Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'

Optional:

  • mode (String) Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
  • resource_field_ref (Block List, Max: 1) Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. (see below for nested schema)

Nested Schema for spec.template.spec.volume.downward_api.items.field_ref

Optional:

  • api_version (String) Version of the schema the FieldPath is written in terms of, defaults to "v1".
  • field_path (String) Path of the field to select in the specified API version

Nested Schema for spec.template.spec.volume.downward_api.items.resource_field_ref

Required:

  • container_name (String)
  • resource (String) Resource to select

Optional:

  • divisor (String)

Nested Schema for spec.template.spec.volume.empty_dir

Optional:

  • medium (String) What type of storage medium should back this directory. The default is "" which means to use the node's default medium. Must be one of ["" "Memory" "HugePages" "HugePages-2Mi" "HugePages-1Gi"]. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
  • size_limit (String) Total amount of local storage required for this EmptyDir volume.

Nested Schema for spec.template.spec.volume.ephemeral

Required:

  • volume_claim_template (Block List, Min: 1, Max: 1) Will be used to create a stand-alone PVC to provision the volume. The pod in which this EphemeralVolumeSource is embedded will be the owner of the PVC. (see below for nested schema)

Nested Schema for spec.template.spec.volume.ephemeral.volume_claim_template

Required:

  • spec (Block List, Min: 1, Max: 1) The specification for the PersistentVolumeClaim. The entire content is copied unchanged into the PVC that gets created from this template. The same fields as in a PersistentVolumeClaim are also valid here. (see below for nested schema)

Optional:

  • metadata (Block List, Max: 1) May contain labels and annotations that will be copied into the PVC when creating it. No other fields are allowed and will be rejected during validation. (see below for nested schema)

Nested Schema for spec.template.spec.volume.ephemeral.volume_claim_template.spec

Required:

Optional:

  • selector (Block List, Max: 1) A label query over volumes to consider for binding. (see below for nested schema)
  • storage_class_name (String) Name of the storage class requested by the claim
  • volume_mode (String) Defines what type of volume is required by the claim.
  • volume_name (String) The binding reference to the PersistentVolume backing this claim.

Nested Schema for spec.template.spec.volume.ephemeral.volume_claim_template.spec.resources

Optional:

Nested Schema for spec.template.spec.volume.ephemeral.volume_claim_template.spec.selector

Optional:

  • match_expressions (Block List) A list of label selector requirements. The requirements are ANDed. (see below for nested schema)
  • match_labels (Map of String) A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of match_expressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

Nested Schema for spec.template.spec.volume.ephemeral.volume_claim_template.spec.selector.match_expressions

Optional:

  • key (String) The label key that the selector applies to.
  • operator (String) A key's relationship to a set of values. Valid operators ard In, NotIn, Exists and DoesNotExist.
  • values (Set of String) An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

Nested Schema for spec.template.spec.volume.ephemeral.volume_claim_template.metadata

Optional:

Nested Schema for spec.template.spec.volume.fc

Required:

  • lun (Number) FC target lun number
  • target_ww_ns (Set of String) FC target worldwide names (WWNs)

Optional:

  • fs_type (String) Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
  • read_only (Boolean) Whether to force the read-only setting in VolumeMounts. Defaults to false (read/write).

Nested Schema for spec.template.spec.volume.flex_volume

Required:

  • driver (String) Driver is the name of the driver to use for this volume.

Optional:

  • fs_type (String) Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script.
  • options (Map of String) Extra command options if any.
  • read_only (Boolean) Whether to force the ReadOnly setting in VolumeMounts. Defaults to false (read/write).
  • secret_ref (Block List, Max: 1) Reference to the secret object containing sensitive information to pass to the plugin scripts. This may be empty if no secret object is specified. If the secret object contains more than one secret, all secrets are passed to the plugin scripts. (see below for nested schema)

Nested Schema for spec.template.spec.volume.flex_volume.secret_ref

Optional:

Nested Schema for spec.template.spec.volume.flocker

Optional:

  • dataset_name (String) Name of the dataset stored as metadata -> name on the dataset for Flocker should be considered as deprecated
  • dataset_uuid (String) UUID of the dataset. This is unique identifier of a Flocker dataset

Nested Schema for spec.template.spec.volume.gce_persistent_disk

Required:

Optional:

Nested Schema for spec.template.spec.volume.git_repo

Optional:

  • directory (String) Target directory name. Must not contain or start with '..'. If '.' is supplied, the volume directory will be the git repository. Otherwise, if specified, the volume will contain the git repository in the subdirectory with the given name.
  • repository (String) Repository URL
  • revision (String) Commit hash for the specified revision.

Nested Schema for spec.template.spec.volume.glusterfs

Required:

Optional:

Nested Schema for spec.template.spec.volume.host_path

Optional:

Nested Schema for spec.template.spec.volume.iscsi

Required:

  • iqn (String) Target iSCSI Qualified Name.
  • target_portal (String) iSCSI target portal. The portal is either an IP or ip_addr:port if the port is other than default (typically TCP ports 860 and 3260).

Optional:

  • chap_auth_discovery (Boolean) Whether target supports iSCSI Discovery CHAP authentication.
  • chap_auth_session (Boolean) Whether target supports iSCSI Session CHAP authentication.
  • fs_type (String) Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi
  • initiator_name (String) The custom iSCSI Initiator Name. If initiator_name is specified with iscsi_interface simultaneously, new iSCSI interface target portal:volume name will be created for the connection.
  • iscsi_interface (String) iSCSI interface name that uses an iSCSI transport. Defaults to 'default' (tcp).
  • lun (Number) iSCSI target lun number.
  • portals (List of String) The iSCSI Target Portal List. The Portal is either an IP or ip_addr:port if the port is other than default (typically TCP ports 860 and 3260).
  • read_only (Boolean) Whether to force the read-only setting in VolumeMounts. Defaults to false.
  • secret_ref (Block List, Max: 1) The CHAP Secret for iSCSI target and initiator authentication. Default is nil. More info: https://github.com/kubernetes/examples/tree/master/_archived/volumes/iscsi (see below for nested schema)

Nested Schema for spec.persistent_volume_source.iscsi.secret_ref

Optional:

Nested Schema for spec.template.spec.volume.local

Optional:

Nested Schema for spec.template.spec.volume.nfs

Required:

Optional:

Nested Schema for spec.template.spec.volume.persistent_volume_claim

Optional:

  • claim_name (String) ClaimName is the name of a PersistentVolumeClaim in the same
  • read_only (Boolean) Will force the ReadOnly setting in VolumeMounts.

Nested Schema for spec.template.spec.volume.photon_persistent_disk

Required:

  • pd_id (String) ID that identifies Photon Controller persistent disk

Optional:

  • fs_type (String) Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.

Nested Schema for spec.template.spec.volume.projected

Required:

Optional:

  • default_mode (String) Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.

Nested Schema for spec.template.spec.volume.projected.sources

Optional:

Nested Schema for spec.template.spec.volume.projected.sources.config_map

Optional:

  • items (Block List) If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error. Paths must be relative and may not contain the '..' path or start with '..'. (see below for nested schema)
  • name (String) Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  • optional (Boolean) Optional: Specify whether the ConfigMap or it's keys must be defined.

Nested Schema for spec.template.spec.volume.projected.sources.config_map.items

Optional:

  • key (String) The key to project.
  • mode (String) Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
  • path (String) The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'.

Nested Schema for spec.template.spec.volume.projected.sources.downward_api

Optional:

  • items (Block List) Represents a volume containing downward API info. Downward API volumes support ownership management and SELinux relabeling. (see below for nested schema)

Nested Schema for spec.template.spec.volume.projected.sources.downward_api.items

Required:

  • path (String) Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'

Optional:

  • field_ref (Block List, Max: 1) Selects a field of the pod: only annotations, labels, name and namespace are supported. (see below for nested schema)
  • mode (String) Mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
  • resource_field_ref (Block List, Max: 1) Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. (see below for nested schema)

Nested Schema for spec.template.spec.volume.projected.sources.downward_api.items.field_ref

Optional:

  • api_version (String) Version of the schema the FieldPath is written in terms of, defaults to 'v1'.
  • field_path (String) Path of the field to select in the specified API version

Nested Schema for spec.template.spec.volume.projected.sources.downward_api.items.resource_field_ref

Required:

  • container_name (String)
  • resource (String) Resource to select

Optional:

  • divisor (String)

Nested Schema for spec.template.spec.volume.projected.sources.secret

Optional:

  • items (Block List) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'. (see below for nested schema)
  • name (String) Name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secrets
  • optional (Boolean) Optional: Specify whether the Secret or it's keys must be defined.

Nested Schema for spec.template.spec.volume.projected.sources.secret.items

Optional:

  • key (String) The key to project.
  • mode (String) Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
  • path (String) The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'.

Nested Schema for spec.template.spec.volume.projected.sources.service_account_token

Required:

  • path (String) Path specifies a relative path to the mount point of the projected volume.

Optional:

  • audience (String) Audience is the intended audience of the token
  • expiration_seconds (Number) ExpirationSeconds is the expected duration of validity of the service account token. It defaults to 1 hour and must be at least 10 minutes (600 seconds).

Nested Schema for spec.template.spec.volume.quobyte

Required:

  • registry (String) Registry represents a single or multiple Quobyte Registry services specified as a string as host:port pair (multiple entries are separated with commas) which acts as the central registry for volumes
  • volume (String) Volume is a string that references an already created Quobyte volume by name.

Optional:

  • group (String) Group to map volume access to Default is no group
  • read_only (Boolean) Whether to force the Quobyte volume to be mounted with read-only permissions. Defaults to false.
  • user (String) User to map volume access to Defaults to serivceaccount user

Nested Schema for spec.template.spec.volume.rbd

Required:

Optional:

Nested Schema for spec.template.spec.volume.rbd.secret_ref

Optional:

Nested Schema for spec.template.spec.volume.secret

Optional:

  • default_mode (String) Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
  • items (Block List) If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'. (see below for nested schema)
  • optional (Boolean) Optional: Specify whether the Secret or its keys must be defined.
  • secret_name (String) Name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secrets

Nested Schema for spec.template.spec.volume.secret.items

Optional:

  • key (String) The key to project.
  • mode (String) Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
  • path (String) The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'.

Nested Schema for spec.template.spec.volume.vsphere_volume

Required:

  • volume_path (String) Path that identifies vSphere volume vmdk

Optional:

  • fs_type (String) Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.

Nested Schema for spec.selector

Optional:

  • match_expressions (Block List) A list of label selector requirements. The requirements are ANDed. (see below for nested schema)
  • match_labels (Map of String) A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of match_expressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

Nested Schema for spec.selector.match_expressions

Optional:

  • key (String) The label key that the selector applies to.
  • operator (String) A key's relationship to a set of values. Valid operators ard In, NotIn, Exists and DoesNotExist.
  • values (Set of String) An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

Nested Schema for spec.strategy

Optional:

  • rolling_update (Block List, Max: 1) Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate. (see below for nested schema)
  • type (String) Type of deployment. Can be 'Recreate' or 'RollingUpdate'. Default is RollingUpdate.

Nested Schema for spec.strategy.rolling_update

Optional:

  • max_surge (String) The maximum number of pods that can be scheduled above the desired number of pods. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up. Defaults to 25%. Example: when this is set to 30%, the new RC can be scaled up immediately when the rolling update starts, such that the total number of old and new pods do not exceed 130% of desired pods. Once old pods have been killed, new RC can be scaled up further, ensuring that total number of pods running at any time during the update is atmost 130% of desired pods.
  • max_unavailable (String) The maximum number of pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). Absolute number is calculated from percentage by rounding down. This can not be 0 if MaxSurge is 0. Defaults to 25%. Example: when this is set to 30%, the old RC can be scaled down to 70% of desired pods immediately when the rolling update starts. Once new pods are ready, old RC can be scaled down further, followed by scaling up the new RC, ensuring that the total number of pods available at all times during the update is at least 70% of desired pods.

Nested Schema for timeouts

Optional:

  • create (String)
  • delete (String)
  • update (String)

Example Usage

resource "kubernetes_deployment" "example" {
  metadata {
    name = "terraform-example"
    labels = {
      test = "MyExampleApp"
    }
  }

  spec {
    replicas = 3

    selector {
      match_labels = {
        test = "MyExampleApp"
      }
    }

    template {
      metadata {
        labels = {
          test = "MyExampleApp"
        }
      }

      spec {
        container {
          image = "nginx:1.21.6"
          name  = "example"

          resources {
            limits = {
              cpu    = "0.5"
              memory = "512Mi"
            }
            requests = {
              cpu    = "250m"
              memory = "50Mi"
            }
          }

          liveness_probe {
            http_get {
              path = "/"
              port = 80

              http_header {
                name  = "X-Custom-Header"
                value = "Awesome"
              }
            }

            initial_delay_seconds = 3
            period_seconds        = 3
          }
        }
      }
    }
  }
}

Import

Deployment can be imported using the namespace and name, e.g.

$ terraform import kubernetes_deployment.example default/terraform-example