Installation reference

AWSEgressGateway defines the configurations for deploying EgressGateway in AWS

Field	Description
`nativeIP` NativeIP	(Optional) NativeIP defines if EgressGateway is to use an AWS backed IPPool. Default: Disabled
`elasticIPs` []string	(Optional) ElasticIPs defines the set of elastic IPs that can be used for Egress Gateway pods. NativeIP must be Enabled if elastic IPs are set.

AdditionalLogSourceSpec

(Appears on:

LogCollectorSpec)

Field	Description
`eksCloudwatchLog` EksCloudwatchLogsSpec	(Optional) If specified with EKS Provider in Installation, enables fetching EKS audit logs.

AdditionalLogStoreSpec

(Appears on:

LogCollectorSpec)

Field	Description
`s3` S3StoreSpec	(Optional) If specified, enables exporting of flow, audit, and DNS logs to Amazon S3 storage.
`syslog` SyslogStoreSpec	(Optional) If specified, enables exporting of flow, audit, and DNS logs to syslog.
`splunk` SplunkStoreSpec	(Optional) If specified, enables exporting of flow, audit, and DNS logs to splunk.

AmazonCloudIntegrationSpec

(Appears on:

AmazonCloudIntegration)

AmazonCloudIntegrationSpec defines the desired state of AmazonCloudIntegration

Field	Description
`defaultPodMetadataAccess` MetadataAccessAllowedType	(Optional) DefaultPodMetadataAccess defines what the default behavior will be for accessing the AWS metadata service from a pod. Default: Denied
`nodeSecurityGroupIDs` []string	NodeSecurityGroupIDs is a list of Security Group IDs that all nodes and masters will be in.
`podSecurityGroupID` string	PodSecurityGroupID is the ID of the Security Group which all pods should be placed in by default.
`vpcs` []string	VPCS is a list of VPC IDs to monitor for ENIs and Security Groups, only one is supported.
`sqsURL` string	SQSURL is the SQS URL needed to access the Simple Queue Service.
`awsRegion` string	AWSRegion is the region in which your cluster is located.
`enforcedSecurityGroupID` string	EnforcedSecurityGroupID is the ID of the Security Group which will be applied to all ENIs that are on a host that is also part of the Kubernetes cluster.
`trustEnforcedSecurityGroupID` string	TrustEnforcedSecurityGroupID is the ID of the Security Group which will be applied to all ENIs in the VPC.

AmazonCloudIntegrationStatus

(Appears on:

AmazonCloudIntegration)

AmazonCloudIntegrationStatus defines the observed state of AmazonCloudIntegration

Field	Description
`state` string	State provides user-readable status.
`conditions` []Kubernetes meta/v1.Condition	(Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

AnomalyDetectionSpec

(Appears on:

IntrusionDetectionSpec)

Field	Description
`storageClassName` string	(Optional) StorageClassName is now deprecated, and configuring it has no effect.

ApplicationLayerPolicyStatusType (`string` alias)

(Appears on:

ManagerSpec,ManagerStatus)

ApplicationLayerSpec

(Appears on:

ApplicationLayer)

ApplicationLayerSpec defines the desired state of ApplicationLayer

Field	Description
`webApplicationFirewall` WAFStatusType	WebApplicationFirewall controls whether or not ModSecurity enforcement is enabled for the cluster. When enabled, Services may opt-in to having ingress traffic examed by ModSecurity.
`logCollection` LogCollectionSpec	Specification for application layer (L7) log collection.
`applicationLayerPolicy` ApplicationLayerPolicyStatusType	Application Layer Policy controls whether or not ALP enforcement is enabled for the cluster. When enabled, NetworkPolicies with HTTP Match rules may be defined to opt-in workloads for traffic enforcement on the application layer.
`envoy` EnvoySettings	User-configurable settings for the Envoy proxy.

ApplicationLayerStatus

(Appears on:

ApplicationLayer)

ApplicationLayerStatus defines the observed state of ApplicationLayer

Field	Description
`state` string	State provides user-readable status.
`conditions` []Kubernetes meta/v1.Condition	(Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

Auth

(Appears on:

Auth defines authentication configuration.

Field	Description
`type` AuthType	Type configures the type of authentication used by the manager. Default: Token
`authority` string	(Optional) Authority configures the OAuth2/OIDC authority/issuer when using OAuth2 or OIDC login.
`clientID` string	(Optional) ClientId configures the OAuth2/OIDC client ID to use for OAuth2 or OIDC login.

AuthMethod (`string` alias)

AuthType (`string` alias)

(Appears on:

Auth)

AuthType represents the type of authentication to use. Valid options are: Token, Basic, OIDC, OAuth

AuthenticationLDAP

(Appears on:

AuthenticationSpec)

AuthenticationLDAP is the configuration needed to set up LDAP.

Field	Description
`host` string	The host and port of the LDAP server. Example: ad.example.com:636
`startTLS` bool	(Optional) StartTLS whether to enable the startTLS feature for establishing TLS on an existing LDAP session. If true, the ldap:// protocol is used and then issues a StartTLS command, otherwise, connections will use the ldaps:// protocol.
`userSearch` UserSearch	User entry search configuration to match the credentials with a user.
`groupSearch` GroupSearch	(Optional) Group search configuration to find the groups that a user is in.

AuthenticationOIDC

(Appears on:

AuthenticationSpec)

AuthenticationOIDC is the configuration needed to set up OIDC.

Field	Description
`issuerURL` string	IssuerURL is the URL to the OIDC provider.
`usernameClaim` string	UsernameClaim specifies which claim to use from the OIDC provider as the username.
`requestedScopes` []string	(Optional) RequestedScopes is a list of scopes to request from the OIDC provider. If not provided, the following scopes are requested: [“openid”, “email”, “profile”, “groups”, “offline_access”].
`usernamePrefix` string	(Optional) Deprecated. Please use Authentication.Spec.UsernamePrefix instead.
`groupsClaim` string	(Optional) GroupsClaim specifies which claim to use from the OIDC provider as the group.
`groupsPrefix` string	(Optional) Deprecated. Please use Authentication.Spec.GroupsPrefix instead.
`emailVerification` EmailVerificationType	(Optional) Some providers do not include the claim “email_verified” when there is no verification in the user enrollment process or if they are acting as a proxy for another identity provider. By default those tokens are deemed invalid. To skip this check, set the value to “InsecureSkip”. Default: Verify
`promptTypes` []PromptType	(Optional) PromptTypes is an optional list of string values that specifies whether the identity provider prompts the end user for re-authentication and consent. See the RFC for more information on prompt types:https://openid.net/specs/openid-connect-core-1_0.html. Default: “Consent”
`type` OIDCType	(Optional) Default: “Dex”

AuthenticationOpenshift

(Appears on:

AuthenticationSpec)

AuthenticationOpenshift is the configuration needed to set up Openshift.

Field	Description
`issuerURL` string	IssuerURL is the URL to the Openshift OAuth provider. Ex.: https://api.my-ocp-domain.com:6443

AuthenticationSpec

(Appears on:

Authentication)

AuthenticationSpec defines the desired state of Authentication

Field	Description
`managerDomain` string	ManagerDomain is the domain name of the Manager
`usernamePrefix` string	(Optional) If specified, UsernamePrefix is prepended to each user obtained from the identity provider. Note that Kibana does not support a user prefix, so this prefix is removed from Kubernetes User when translating log access ClusterRoleBindings into Elastic.
`groupsPrefix` string	(Optional) If specified, GroupsPrefix is prepended to each group obtained from the identity provider. Note that Kibana does not support a groups prefix, so this prefix is removed from Kubernetes Groups when translating log access ClusterRoleBindings into Elastic.
`oidc` AuthenticationOIDC	(Optional) OIDC contains the configuration needed to set up OIDC authentication.
`openshift` AuthenticationOpenshift	(Optional) Openshift contains the configuration needed to set up Openshift OAuth authentication.
`ldap` AuthenticationLDAP	(Optional) LDAP contains the configuration needed to set up LDAP authentication.

AuthenticationStatus

(Appears on:

Authentication)

AuthenticationStatus defines the observed state of Authentication

Field	Description
`state` string	State provides user-readable status.
`conditions` []Kubernetes meta/v1.Condition	(Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

BGPOption (`string` alias)

(Appears on:

BGPOption describes the mode of BGP to use.

One of: Enabled, Disabled

CAType (`string` alias)

(Appears on:

ManagementClusterTLS)

CAType specifies which verification method the tunnel client should use to verify the tunnel server’s identity.

One of: Tigera, Public

CNILogging

(Appears on:

Logging)

Field	Description
`logSeverity` LogLevel	(Optional) Default: Info
`logFileMaxSize` k8s.io/apimachinery/pkg/api/resource.Quantity	(Optional) Default: 100Mi
`logFileMaxAgeDays` uint32	(Optional) Default: 30 (days)
`logFileMaxCount` uint32	(Optional) Default: 10

CNIPluginType (`string` alias)

(Appears on:

CNISpec)

CNIPluginType describes the type of CNI plugin used.

One of: Calico, GKE, AmazonVPC, AzureVNET

CNISpec

(Appears on:

CNISpec contains configuration for the CNI plugin.

Field Description

type
CNIPluginType

Specifies the CNI plugin that will be used in the Calico or Calico Enterprise installation. * For KubernetesProvider GKE, this field defaults to GKE. * For KubernetesProvider AKS, this field defaults to AzureVNET. * For KubernetesProvider EKS, this field defaults to AmazonVPC. * If aws-node daemonset exists in kube-system when the Installation resource is created, this field defaults to AmazonVPC. * For all other cases this field defaults to Calico.

For the value Calico, the CNI plugin binaries and CNI config will be installed as part of deployment, for all other values the CNI plugin binaries and CNI config is a dependency that is expected to be installed separately.

Default: Calico

ipam
IPAMSpec

(Optional)

IPAM specifies the pod IP address management that will be used in the Calico or Calico Enterprise installation.

CSINodeDriverDaemonSet

(Appears on:

CSINodeDriverDaemonSetPodSpec)

CSINodeDriverDaemonSet is the configuration for the csi-node-driver DaemonSet.

Field Description

metadata
Metadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the DaemonSet.

spec
CSINodeDriverDaemonSetSpec

(Optional)

Spec is the specification of the csi-node-driver DaemonSet.

CSINodeDriverDaemonSetContainer

(Appears on:

CSINodeDriverDaemonSetContainer is a csi-node-driver DaemonSet container.

Field	Description
`name` string	Name is an enum which identifies the csi-node-driver DaemonSet container by name.
`resources` Kubernetes core/v1.ResourceRequirements	(Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named csi-node-driver DaemonSet container’s resources. If omitted, the csi-node-driver DaemonSet will use its default value for this container’s resources.

CSINodeDriverDaemonSetPodSpec

(Appears on:

CSINodeDriverDaemonSetPodTemplateSpec)

CSINodeDriverDaemonSetPodSpec is the csi-node-driver DaemonSet’s PodSpec.

Field	Description
`containers` []CSINodeDriverDaemonSetContainer	(Optional) Containers is a list of csi-node-driver containers. If specified, this overrides the specified csi-node-driver DaemonSet containers. If omitted, the csi-node-driver DaemonSet will use its default values for its containers.
`affinity` Kubernetes core/v1.Affinity	(Optional) Affinity is a group of affinity scheduling rules for the csi-node-driver pods. If specified, this overrides any affinity that may be set on the csi-node-driver DaemonSet. If omitted, the csi-node-driver DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default csi-node-driver DaemonSet affinity.
`nodeSelector` map[string]string	(Optional) NodeSelector is the csi-node-driver pod’s scheduling constraints. If specified, each of the key/value pairs are added to the csi-node-driver DaemonSet nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the csi-node-driver DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default csi-node-driver DaemonSet nodeSelector.
`tolerations` []Kubernetes core/v1.Toleration	(Optional) Tolerations is the csi-node-driver pod’s tolerations. If specified, this overrides any tolerations that may be set on the csi-node-driver DaemonSet. If omitted, the csi-node-driver DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default csi-node-driver DaemonSet tolerations.

CSINodeDriverDaemonSetPodTemplateSpec

(Appears on:

CSINodeDriverDaemonSetSpec)

CSINodeDriverDaemonSetPodTemplateSpec is the csi-node-driver DaemonSet’s PodTemplateSpec

Field Description

metadata
Metadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
CSINodeDriverDaemonSetPodSpec

(Optional)

Spec is the csi-node-driver DaemonSet’s PodSpec.

CSINodeDriverDaemonSetSpec

(Appears on:

CSINodeDriverDaemonSet)

CSINodeDriverDaemonSetSpec defines configuration for the csi-node-driver DaemonSet.

Field	Description
`minReadySeconds` int32	(Optional) MinReadySeconds is the minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the csi-node-driver DaemonSet. If omitted, the csi-node-driver DaemonSet will use its default value for minReadySeconds.
`template` CSINodeDriverDaemonSetPodTemplateSpec	(Optional) Template describes the csi-node-driver DaemonSet pod that will be created.

CalicoKubeControllersDeployment

(Appears on:

CalicoKubeControllersDeploymentPodSpec)

CalicoKubeControllersDeployment is the configuration for the calico-kube-controllers Deployment.

Field Description

metadata
Metadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the Deployment.

spec
CalicoKubeControllersDeploymentSpec

(Optional)

Spec is the specification of the calico-kube-controllers Deployment.

CalicoKubeControllersDeploymentContainer

(Appears on:

CalicoKubeControllersDeploymentContainer is a calico-kube-controllers Deployment container.

Field Description

name
string

Name is an enum which identifies the calico-kube-controllers Deployment container by name.

resources
Kubernetes core/v1.ResourceRequirements

(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-kube-controllers Deployment container’s resources. If omitted, the calico-kube-controllers Deployment will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

CalicoKubeControllersDeploymentPodSpec

(Appears on:

CalicoKubeControllersDeploymentPodTemplateSpec)

CalicoKubeControllersDeploymentPodSpec is the calico-kube-controller Deployment’s PodSpec.

Field	Description
`containers` []CalicoKubeControllersDeploymentContainer	(Optional) Containers is a list of calico-kube-controllers containers. If specified, this overrides the specified calico-kube-controllers Deployment containers. If omitted, the calico-kube-controllers Deployment will use its default values for its containers.
`affinity` Kubernetes core/v1.Affinity	(Optional) Affinity is a group of affinity scheduling rules for the calico-kube-controllers pods. If specified, this overrides any affinity that may be set on the calico-kube-controllers Deployment. If omitted, the calico-kube-controllers Deployment will use its default value for affinity. WARNING: Please note that this field will override the default calico-kube-controllers Deployment affinity.
`nodeSelector` map[string]string	NodeSelector is the calico-kube-controllers pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-kube-controllers Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If used in conjunction with ControlPlaneNodeSelector, that nodeSelector is set on the calico-kube-controllers Deployment and each of this field’s key/value pairs are added to the calico-kube-controllers Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-kube-controllers Deployment will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-kube-controllers Deployment nodeSelector.
`tolerations` []Kubernetes core/v1.Toleration	(Optional) Tolerations is the calico-kube-controllers pod’s tolerations. If specified, this overrides any tolerations that may be set on the calico-kube-controllers Deployment. If omitted, the calico-kube-controllers Deployment will use its default value for tolerations. WARNING: Please note that this field will override the default calico-kube-controllers Deployment tolerations.

CalicoKubeControllersDeploymentPodTemplateSpec

(Appears on:

CalicoKubeControllersDeploymentSpec)

CalicoKubeControllersDeploymentPodTemplateSpec is the calico-kube-controllers Deployment’s PodTemplateSpec

Field Description

metadata
Metadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
CalicoKubeControllersDeploymentPodSpec

(Optional)

Spec is the calico-kube-controllers Deployment’s PodSpec.

CalicoKubeControllersDeploymentSpec

(Appears on:

CalicoKubeControllersDeployment)

CalicoKubeControllersDeploymentSpec defines configuration for the calico-kube-controllers Deployment.

Field Description

minReadySeconds
int32

(Optional)

MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-kube-controllers Deployment. If omitted, the calico-kube-controllers Deployment will use its default value for minReadySeconds.

template
CalicoKubeControllersDeploymentPodTemplateSpec

(Optional)

Template describes the calico-kube-controllers Deployment pod that will be created.

CalicoNetworkSpec

(Appears on:

CalicoNetworkSpec specifies configuration options for Calico provided pod networking.

Field	Description
`linuxDataplane` LinuxDataplaneOption	(Optional) LinuxDataplane is used to select the dataplane used for Linux nodes. In particular, it causes the operator to add required mounts and environment variables for the particular dataplane. If not specified, iptables mode is used. Default: Iptables
`windowsDataplane` WindowsDataplaneOption	(Optional) WindowsDataplane is used to select the dataplane used for Windows nodes. In particular, it causes the operator to add required mounts and environment variables for the particular dataplane. If not specified, it is disabled and the operator will not render the Calico Windows nodes daemonset. Default: Disabled
`bgp` BGPOption	(Optional) BGP configures whether or not to enable Calico’s BGP capabilities.
`ipPools` []IPPool	(Optional) IPPools contains a list of IP pools to create if none exist. At most one IP pool of each address family may be specified. If omitted, a single pool will be configured if needed.
`mtu` int32	(Optional) MTU specifies the maximum transmission unit to use on the pod network. If not specified, Calico will perform MTU auto-detection based on the cluster network.
`nodeAddressAutodetectionV4` NodeAddressAutodetection	(Optional) NodeAddressAutodetectionV4 specifies an approach to automatically detect node IPv4 addresses. If not specified, will use default auto-detection settings to acquire an IPv4 address for each node.
`nodeAddressAutodetectionV6` NodeAddressAutodetection	(Optional) NodeAddressAutodetectionV6 specifies an approach to automatically detect node IPv6 addresses. If not specified, IPv6 addresses will not be auto-detected.
`hostPorts` HostPortsType	(Optional) HostPorts configures whether or not Calico will support Kubernetes HostPorts. Valid only when using the Calico CNI plugin. Default: Enabled
`multiInterfaceMode` MultiInterfaceMode	(Optional) MultiInterfaceMode configures what will configure multiple interface per pod. Only valid for Calico Enterprise installations using the Calico CNI plugin. Default: None
`containerIPForwarding` ContainerIPForwardingType	(Optional) ContainerIPForwarding configures whether ip forwarding will be enabled for containers in the CNI configuration. Default: Disabled

CalicoNodeDaemonSet

(Appears on:

CalicoNodeDaemonSetPodSpec)

CalicoNodeDaemonSet is the configuration for the calico-node DaemonSet.

Field Description

metadata
Metadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the DaemonSet.

spec
CalicoNodeDaemonSetSpec

(Optional)

Spec is the specification of the calico-node DaemonSet.

CalicoNodeDaemonSetContainer

(Appears on:

CalicoNodeDaemonSetContainer is a calico-node DaemonSet container.

Field	Description
`name` string	Name is an enum which identifies the calico-node DaemonSet container by name.
`resources` Kubernetes core/v1.ResourceRequirements	(Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node DaemonSet container’s resources. If omitted, the calico-node DaemonSet will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

CalicoNodeDaemonSetInitContainer

(Appears on:

CalicoNodeDaemonSetPodSpec)

CalicoNodeDaemonSetInitContainer is a calico-node DaemonSet init container.

Field	Description
`name` string	Name is an enum which identifies the calico-node DaemonSet init container by name.
`resources` Kubernetes core/v1.ResourceRequirements	(Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node DaemonSet init container’s resources. If omitted, the calico-node DaemonSet will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

CalicoNodeDaemonSetPodSpec

(Appears on:

CalicoNodeDaemonSetPodTemplateSpec)

CalicoNodeDaemonSetPodSpec is the calico-node DaemonSet’s PodSpec.

Field	Description
`initContainers` []CalicoNodeDaemonSetInitContainer	(Optional) InitContainers is a list of calico-node init containers. If specified, this overrides the specified calico-node DaemonSet init containers. If omitted, the calico-node DaemonSet will use its default values for its init containers.
`containers` []CalicoNodeDaemonSetContainer	(Optional) Containers is a list of calico-node containers. If specified, this overrides the specified calico-node DaemonSet containers. If omitted, the calico-node DaemonSet will use its default values for its containers.
`affinity` Kubernetes core/v1.Affinity	(Optional) Affinity is a group of affinity scheduling rules for the calico-node pods. If specified, this overrides any affinity that may be set on the calico-node DaemonSet. If omitted, the calico-node DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default calico-node DaemonSet affinity.
`nodeSelector` map[string]string	(Optional) NodeSelector is the calico-node pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-node DaemonSet nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-node DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-node DaemonSet nodeSelector.
`tolerations` []Kubernetes core/v1.Toleration	(Optional) Tolerations is the calico-node pod’s tolerations. If specified, this overrides any tolerations that may be set on the calico-node DaemonSet. If omitted, the calico-node DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default calico-node DaemonSet tolerations.

CalicoNodeDaemonSetPodTemplateSpec

(Appears on:

CalicoNodeDaemonSetSpec)

CalicoNodeDaemonSetPodTemplateSpec is the calico-node DaemonSet’s PodTemplateSpec

Field Description

metadata
Metadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
CalicoNodeDaemonSetPodSpec

(Optional)

Spec is the calico-node DaemonSet’s PodSpec.

CalicoNodeDaemonSetSpec

(Appears on:

CalicoNodeDaemonSet)

CalicoNodeDaemonSetSpec defines configuration for the calico-node DaemonSet.

Field	Description
`minReadySeconds` int32	(Optional) MinReadySeconds is the minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-node DaemonSet. If omitted, the calico-node DaemonSet will use its default value for minReadySeconds.
`template` CalicoNodeDaemonSetPodTemplateSpec	(Optional) Template describes the calico-node DaemonSet pod that will be created.

CalicoNodeWindowsDaemonSet

(Appears on:

CalicoNodeWindowsDaemonSetPodSpec)

CalicoNodeWindowsDaemonSet is the configuration for the calico-node-windows DaemonSet.

Field Description

metadata
Metadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the DaemonSet.

spec
CalicoNodeWindowsDaemonSetSpec

(Optional)

Spec is the specification of the calico-node-windows DaemonSet.

CalicoNodeWindowsDaemonSetContainer

(Appears on:

CalicoNodeWindowsDaemonSetContainer is a calico-node-windows DaemonSet container.

Field Description

name
string

Name is an enum which identifies the calico-node-windows DaemonSet container by name.

resources
Kubernetes core/v1.ResourceRequirements

(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node-windows DaemonSet container’s resources. If omitted, the calico-node-windows DaemonSet will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

CalicoNodeWindowsDaemonSetInitContainer

(Appears on:

CalicoNodeWindowsDaemonSetPodSpec)

CalicoNodeWindowsDaemonSetInitContainer is a calico-node-windows DaemonSet init container.

Field Description

name
string

Name is an enum which identifies the calico-node-windows DaemonSet init container by name.

resources
Kubernetes core/v1.ResourceRequirements

(Optional)

Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node-windows DaemonSet init container’s resources. If omitted, the calico-node-windows DaemonSet will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

CalicoNodeWindowsDaemonSetPodSpec

(Appears on:

CalicoNodeWindowsDaemonSetPodTemplateSpec)

CalicoNodeWindowsDaemonSetPodSpec is the calico-node-windows DaemonSet’s PodSpec.

Field	Description
`initContainers` []CalicoNodeWindowsDaemonSetInitContainer	(Optional) InitContainers is a list of calico-node-windows init containers. If specified, this overrides the specified calico-node-windows DaemonSet init containers. If omitted, the calico-node-windows DaemonSet will use its default values for its init containers.
`containers` []CalicoNodeWindowsDaemonSetContainer	(Optional) Containers is a list of calico-node-windows containers. If specified, this overrides the specified calico-node-windows DaemonSet containers. If omitted, the calico-node-windows DaemonSet will use its default values for its containers.
`affinity` Kubernetes core/v1.Affinity	(Optional) Affinity is a group of affinity scheduling rules for the calico-node-windows pods. If specified, this overrides any affinity that may be set on the calico-node-windows DaemonSet. If omitted, the calico-node-windows DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default calico-node-windows DaemonSet affinity.
`nodeSelector` map[string]string	(Optional) NodeSelector is the calico-node-windows pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-node-windows DaemonSet nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-node-windows DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-node-windows DaemonSet nodeSelector.
`tolerations` []Kubernetes core/v1.Toleration	(Optional) Tolerations is the calico-node-windows pod’s tolerations. If specified, this overrides any tolerations that may be set on the calico-node-windows DaemonSet. If omitted, the calico-node-windows DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default calico-node-windows DaemonSet tolerations.

CalicoNodeWindowsDaemonSetPodTemplateSpec

(Appears on:

CalicoNodeWindowsDaemonSetSpec)

CalicoNodeWindowsDaemonSetPodTemplateSpec is the calico-node-windows DaemonSet’s PodTemplateSpec

Field Description

metadata
Metadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
CalicoNodeWindowsDaemonSetPodSpec

(Optional)

Spec is the calico-node-windows DaemonSet’s PodSpec.

CalicoNodeWindowsDaemonSetSpec

(Appears on:

CalicoNodeWindowsDaemonSet)

CalicoNodeWindowsDaemonSetSpec defines configuration for the calico-node-windows DaemonSet.

Field	Description
`minReadySeconds` int32	(Optional) MinReadySeconds is the minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-node-windows DaemonSet. If omitted, the calico-node-windows DaemonSet will use its default value for minReadySeconds.
`template` CalicoNodeWindowsDaemonSetPodTemplateSpec	(Optional) Template describes the calico-node-windows DaemonSet pod that will be created.

CalicoWindowsUpgradeDaemonSet

(Appears on:

CalicoWindowsUpgradeDaemonSetPodSpec)

Deprecated. The CalicoWindowsUpgradeDaemonSet is deprecated and will be removed from the API in the future. CalicoWindowsUpgradeDaemonSet is the configuration for the calico-windows-upgrade DaemonSet.

Field Description

metadata
Metadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the Deployment.

spec
CalicoWindowsUpgradeDaemonSetSpec

(Optional)

Spec is the specification of the calico-windows-upgrade DaemonSet.

CalicoWindowsUpgradeDaemonSetContainer

(Appears on:

CalicoWindowsUpgradeDaemonSetContainer is a calico-windows-upgrade DaemonSet container.

Field	Description
`name` string	Name is an enum which identifies the calico-windows-upgrade DaemonSet container by name.
`resources` Kubernetes core/v1.ResourceRequirements	(Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-windows-upgrade DaemonSet container’s resources. If omitted, the calico-windows-upgrade DaemonSet will use its default value for this container’s resources.

CalicoWindowsUpgradeDaemonSetPodSpec

(Appears on:

CalicoWindowsUpgradeDaemonSetPodTemplateSpec)

CalicoWindowsUpgradeDaemonSetPodSpec is the calico-windows-upgrade DaemonSet’s PodSpec.

Field	Description
`containers` []CalicoWindowsUpgradeDaemonSetContainer	(Optional) Containers is a list of calico-windows-upgrade containers. If specified, this overrides the specified calico-windows-upgrade DaemonSet containers. If omitted, the calico-windows-upgrade DaemonSet will use its default values for its containers.
`affinity` Kubernetes core/v1.Affinity	(Optional) Affinity is a group of affinity scheduling rules for the calico-windows-upgrade pods. If specified, this overrides any affinity that may be set on the calico-windows-upgrade DaemonSet. If omitted, the calico-windows-upgrade DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default calico-windows-upgrade DaemonSet affinity.
`nodeSelector` map[string]string	(Optional) NodeSelector is the calico-windows-upgrade pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-windows-upgrade DaemonSet nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-windows-upgrade DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-windows-upgrade DaemonSet nodeSelector.
`tolerations` []Kubernetes core/v1.Toleration	(Optional) Tolerations is the calico-windows-upgrade pod’s tolerations. If specified, this overrides any tolerations that may be set on the calico-windows-upgrade DaemonSet. If omitted, the calico-windows-upgrade DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default calico-windows-upgrade DaemonSet tolerations.

CalicoWindowsUpgradeDaemonSetPodTemplateSpec

(Appears on:

CalicoWindowsUpgradeDaemonSetSpec)

CalicoWindowsUpgradeDaemonSetPodTemplateSpec is the calico-windows-upgrade DaemonSet’s PodTemplateSpec

Field Description

metadata
Metadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
CalicoWindowsUpgradeDaemonSetPodSpec

(Optional)

Spec is the calico-windows-upgrade DaemonSet’s PodSpec.

CalicoWindowsUpgradeDaemonSetSpec

(Appears on:

CalicoWindowsUpgradeDaemonSet)

CalicoWindowsUpgradeDaemonSetSpec defines configuration for the calico-windows-upgrade DaemonSet.

Field Description

minReadySeconds
int32

(Optional)

MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-windows-upgrade DaemonSet. If omitted, the calico-windows-upgrade DaemonSet will use its default value for minReadySeconds.

template
CalicoWindowsUpgradeDaemonSetPodTemplateSpec

(Optional)

Template describes the calico-windows-upgrade DaemonSet pod that will be created.

CertificateManagement

(Appears on:

CertificateManagement configures pods to submit a CertificateSigningRequest to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. This feature requires that you bring your own CSR signing and approval process, otherwise pods will be stuck during initialization.

Field	Description
`caCert` []byte	Certificate of the authority that signs the CertificateSigningRequests in PEM format.
`signerName` string	When a CSR is issued to the certificates.k8s.io API, the signerName is added to the request to accommodate for clusters with multiple signers. Must be formatted as: `<my-domain>/<my-signername>`.
`keyAlgorithm` string	(Optional) Specify the algorithm used by pods to generate a key pair that is associated with the X.509 certificate request. Default: RSAWithSize2048
`signatureAlgorithm` string	(Optional) Specify the algorithm used for the signature of the X.509 certificate request. Default: SHA256WithRSA

CollectProcessPathOption (`string` alias)

(Appears on:

LogCollectorSpec)

ComplianceSpec

(Appears on:

Compliance)

ComplianceSpec defines the desired state of Tigera compliance reporting capabilities.

ComplianceStatus

(Appears on:

Compliance)

ComplianceStatus defines the observed state of Tigera compliance reporting capabilities.

Field	Description
`state` string	State provides user-readable status.
`conditions` []Kubernetes meta/v1.Condition	(Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

ComponentName (`string` alias)

(Appears on:

ComponentResource)

ComponentName represents a single component.

One of: Node, Typha, KubeControllers

ComponentResource

(Appears on:

Deprecated. Please use component resource config fields in Installation.Spec instead. The ComponentResource struct associates a ResourceRequirements with a component by name

Field	Description
`componentName` ComponentName	ComponentName is an enum which identifies the component
`resourceRequirements` Kubernetes core/v1.ResourceRequirements	ResourceRequirements allows customization of limits and requests for compute resources such as cpu and memory.

ConditionStatus (`string` alias)

(Appears on:

TigeraStatusCondition)

ConditionStatus represents the status of a particular condition. A condition may be one of: True, False, Unknown.

ContainerIPForwardingType (`string` alias)

(Appears on:

EgressGatewayDeploymentPodSpec)

ContainerIPForwardingType specifies whether the CNI config for container ip forwarding is enabled.

DataType (`string` alias)

(Appears on:

Index)

DataType represent the type of data stored

EGWDeploymentContainer

(Appears on:

EGWDeploymentContainer is a Egress Gateway Deployment container.

Field	Description
`name` string	Name is an enum which identifies the EGW Deployment container by name.
`resources` Kubernetes core/v1.ResourceRequirements	(Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named EGW Deployment container’s resources. If omitted, the EGW Deployment will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

EGWDeploymentInitContainer

(Appears on:

EgressGatewayDeploymentPodSpec)

EGWDeploymentInitContainer is a Egress Gateway Deployment init container.

Field	Description
`name` string	Name is an enum which identifies the EGW Deployment init container by name.
`resources` Kubernetes core/v1.ResourceRequirements	(Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named EGW Deployment init container’s resources. If omitted, the EGW Deployment will use its default value for this init container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

EgressGatewayDeploymentPodSpec

(Appears on:

EgressGatewayDeploymentPodTemplateSpec)

EgressGatewayDeploymentPodSpec is the Egress Gateway Deployment’s PodSpec.

Field	Description
`initContainers` []EGWDeploymentInitContainer	(Optional) InitContainers is a list of EGW init containers. If specified, this overrides the specified EGW Deployment init containers. If omitted, the EGW Deployment will use its default values for its init containers.
`containers` []EGWDeploymentContainer	(Optional) Containers is a list of EGW containers. If specified, this overrides the specified EGW Deployment containers. If omitted, the EGW Deployment will use its default values for its containers.
`affinity` Kubernetes core/v1.Affinity	(Optional) Affinity is a group of affinity scheduling rules for the EGW pods.
`nodeSelector` map[string]string	(Optional) NodeSelector gives more control over the nodes where the Egress Gateway pods will run on.
`terminationGracePeriodSeconds` int64	(Optional) TerminationGracePeriodSeconds defines the termination grace period of the Egress Gateway pods in seconds.
`topologySpreadConstraints` []Kubernetes core/v1.TopologySpreadConstraint	(Optional) TopologySpreadConstraints defines how the Egress Gateway pods should be spread across different AZs.
`tolerations` []Kubernetes core/v1.Toleration	(Optional) Tolerations is the egress gateway pod’s tolerations. If specified, this overrides any tolerations that may be set on the EGW Deployment. If omitted, the EGW Deployment will use its default value for tolerations.

EgressGatewayDeploymentPodTemplateSpec

(Appears on:

EgressGatewayDeploymentPodTemplateSpec is the EGW Deployment’s PodTemplateSpec

Field Description

metadata
EgressGatewayMetadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
EgressGatewayDeploymentPodSpec

(Optional)

Spec is the EGW Deployment’s PodSpec.

EgressGatewayFailureDetection

(Appears on:

EgressGatewayFailureDetection defines the fields the needed for determining Egress Gateway readiness.

Field	Description
`healthTimeoutDataStoreSeconds` int32	(Optional) HealthTimeoutDataStoreSeconds defines how long Egress Gateway can fail to connect to the datastore before reporting not ready. This value must be greater than 0. Default: 90
`icmpProbe` ICMPProbe	(Optional) ICMPProbe define outgoing ICMP probes that Egress Gateway will use to verify its upstream connection. Egress Gateway will report not ready if all fail. Timeout must be greater than interval.
`httpProbe` HTTPProbe	(Optional) HTTPProbe define outgoing HTTP probes that Egress Gateway will use to verify its upsteam connection. Egress Gateway will report not ready if all fail. Timeout must be greater than interval.

EgressGatewayIPPool

(Appears on:

EgressGatewayDeploymentPodTemplateSpec)

Field	Description
`name` string	(Optional) Name is the name of the IPPool that the Egress Gateways can use.
`cidr` string	(Optional) CIDR is the IPPool CIDR that the Egress Gateways can use.

EgressGatewayMetadata

(Appears on:

EgressGatewayMetadata contains the standard Kubernetes labels and annotations fields.

Field	Description
`labels` map[string]string	(Optional) Labels is a map of string keys and values that may match replica set and service selectors. Each of these key/value pairs are added to the object’s labels provided the key does not already exist in the object’s labels. If not specified will default to projectcalico.org/egw:[name], where [name] is the name of the Egress Gateway resource.
`annotations` map[string]string	(Optional) Annotations is a map of arbitrary non-identifying metadata. Each of these key/value pairs are added to the object’s annotations provided the key does not already exist in the object’s annotations.

EgressGatewaySpec

(Appears on:

EgressGateway)

EgressGatewaySpec defines the desired state of EgressGateway

Field	Description
`replicas` int32	(Optional) Replicas defines how many instances of the Egress Gateway pod will run.
`ipPools` []EgressGatewayIPPool	IPPools defines the IP Pools that the Egress Gateway pods should be using. Either name or CIDR must be specified. IPPools must match existing IPPools.
`externalNetworks` []string	(Optional) ExternalNetworks defines the external network names this Egress Gateway is associated with. ExternalNetworks must match existing external networks.
`logSeverity` LogLevel	(Optional) LogSeverity defines the logging level of the Egress Gateway. Default: Info
`template` EgressGatewayDeploymentPodTemplateSpec	(Optional) Template describes the EGW Deployment pod that will be created.
`egressGatewayFailureDetection` EgressGatewayFailureDetection	(Optional) EgressGatewayFailureDetection is used to configure how Egress Gateway determines readiness. If both ICMP, HTTP probes are defined, one ICMP probe and one HTTP probe should succeed for Egress Gateways to become ready. Otherwise one of ICMP or HTTP probe should succeed for Egress gateways to become ready if configured.
`aws` AWSEgressGateway	(Optional) AWS defines the additional configuration options for Egress Gateways on AWS.

EgressGatewayStatus

(Appears on:

EgressGateway)

EgressGatewayStatus defines the observed state of EgressGateway

Field	Description
`state` string	State provides user-readable status.
`conditions` []Kubernetes meta/v1.Condition	(Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

EksCloudwatchLogsSpec

(Appears on:

AdditionalLogSourceSpec)

EksConfigSpec defines configuration for fetching EKS audit logs.

Field	Description
`region` string	AWS Region EKS cluster is hosted in.
`groupName` string	Cloudwatch log-group name containing EKS audit logs.
`streamPrefix` string	(Optional) Prefix of Cloudwatch log stream containing EKS audit logs in the log-group. Default: kube-apiserver-audit-
`fetchInterval` int32	(Optional) Cloudwatch audit logs fetching interval in seconds. Default: 60

EmailVerificationType (`string` alias)

(Appears on:

AuthenticationOIDC)

EncapsulationType (`string` alias)

(Appears on:

IPPool)

EncapsulationType is the type of encapsulation to use on an IP pool.

One of: IPIP, VXLAN, IPIPCrossSubnet, VXLANCrossSubnet, None

EncryptionOption (`string` alias)

(Appears on:

SyslogStoreSpec)

EncryptionOption specifies the traffic encryption mode when connecting to a Syslog server.

One of: None, TLS

EnvoySettings

(Appears on:

Field	Description
`xffNumTrustedHops` int32	(Optional) The number of additional ingress proxy hops from the right side of the x-forwarded-for HTTP header to trust when determining the origin client’s IP address. 0 is permitted, but >=1 is the typical setting.
`useRemoteAddress` bool	(Optional) If set to true, the Envoy connection manager will use the real remote address of the client connection when determining internal versus external origin and manipulating various headers.

FIPSMode (`string` alias)

(Appears on:

EgressGatewayFailureDetection)

GroupSearch

(Appears on:

AuthenticationLDAP)

Group search configuration to find the groups that a user is in.

Field	Description
`baseDN` string	BaseDN to start the search from. For example “cn=groups,dc=example,dc=com”
`filter` string	(Optional) Optional filter to apply when searching the directory. For example “(objectClass=posixGroup)”
`nameAttribute` string	The attribute of the group that represents its name. This attribute can be used to apply RBAC to a user group.
`userMatchers` []UserMatch	Following list contains field pairs that are used to match a user to a group. It adds an additional requirement to the filter that an attribute in the group must match the user’s attribute value.

HTTPProbe

(Appears on:

HTTPProbe defines the HTTP probe configuration for Egress Gateway.

Field	Description
`urls` []string	URLs define the list of HTTP probe URLs. Egress Gateway will probe each URL periodically.If all probes fail, Egress Gateway will report non-ready.
`intervalSeconds` int32	(Optional) IntervalSeconds defines the interval of HTTP probes. Used when URLs is non-empty. Default: 10
`timeoutSeconds` int32	(Optional) TimeoutSeconds defines the timeout value of HTTP probes. Used when URLs is non-empty. Default: 30

HostPortsType (`string` alias)

(Appears on:

EgressGatewayFailureDetection)

HostPortsType specifies host port support.

One of: Enabled, Disabled

ICMPProbe

(Appears on:

ICMPProbe defines the ICMP probe configuration for Egress Gateway.

Field	Description
`ips` []string	IPs define the list of ICMP probe IPs. Egress Gateway will probe each IP periodically. If all probes fail, Egress Gateway will report non-ready.
`intervalSeconds` int32	(Optional) IntervalSeconds defines the interval of ICMP probes. Used when IPs is non-empty. Default: 5
`timeoutSeconds` int32	(Optional) TimeoutSeconds defines the timeout value of ICMP probes. Used when IPs is non-empty. Default: 15

IPAMPluginType (`string` alias)

(Appears on:

IPAMSpec)

IPAMSpec

(Appears on:

CNISpec)

IPAMSpec contains configuration for pod IP address management.

Field Description

type
IPAMPluginType

Specifies the IPAM plugin that will be used in the Calico or Calico Enterprise installation. * For CNI Plugin Calico, this field defaults to Calico. * For CNI Plugin GKE, this field defaults to HostLocal. * For CNI Plugin AzureVNET, this field defaults to AzureVNET. * For CNI Plugin AmazonVPC, this field defaults to AmazonVPC.

The IPAM plugin is installed and configured only if the CNI plugin is set to Calico, for all other values of the CNI plugin the plugin binaries and CNI config is a dependency that is expected to be installed separately.

Default: Calico

IPPool

(Appears on:

Field	Description
`cidr` string	CIDR contains the address range for the IP Pool in classless inter-domain routing format.
`encapsulation` EncapsulationType	(Optional) Encapsulation specifies the encapsulation type that will be used with the IP Pool. Default: IPIP
`natOutgoing` NATOutgoingType	(Optional) NATOutgoing specifies if NAT will be enabled or disabled for outgoing traffic. Default: Enabled
`nodeSelector` string	(Optional) NodeSelector specifies the node selector that will be set for the IP Pool. Default: ‘all()’
`blockSize` int32	(Optional) BlockSize specifies the CIDR prefex length to use when allocating per-node IP blocks from the main IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)
`disableBGPExport` bool	(Optional) DisableBGPExport specifies whether routes from this IP pool’s CIDR are exported over BGP. Default: false

Image

(Appears on:

ImageSetSpec)

Field	Description
`image` string	Image is an image that the operator deploys and instead of using the built in tag the operator will use the Digest for the image identifier. The value should be the image name without registry or tag or digest. For the image `docker.io/calico/node:v3.17.1` it should be represented as `calico/node`
`digest` string	Digest is the image identifier that will be used for the Image. The field should not include a leading `@` and must be prefixed with `sha256:`.

ImageSetSpec

(Appears on:

ImageSet)

ImageSetSpec defines the desired state of ImageSet.

Field	Description
`images` []Image	Images is the list of images to use digests. All images that the operator will deploy must be specified.

Index

(Appears on:

TenantSpec)

Index defines how to store a tenant’s data

Field	Description
`baseIndexName` string	BaseIndexName defines the name of the index that will be used to store data (this name excludes the numerical identifier suffix)
`dataType` DataType	DataType represents the type of data stored in the defined index

Indices

(Appears on:

Installation,InstallationStatus)

Indices defines the configuration for the indices in an Elasticsearch cluster.

Field	Description
`replicas` int32	(Optional) Replicas defines how many replicas each index will have. See https://www.elastic.co/guide/en/elasticsearch/reference/current/scalability.html

InstallationSpec

(Appears on:

InstallationSpec defines configuration for a Calico or Calico Enterprise installation.

Field	Description
`variant` ProductVariant	(Optional) Variant is the product to install - one of Calico or TigeraSecureEnterprise Default: Calico
`registry` string	(Optional) Registry is the default Docker registry used for component Docker images. If specified then the given value must end with a slash character (`/`) and all images will be pulled from this registry. If not specified then the default registries will be used. A special case value, UseDefault, is supported to explicitly specify the default registries will be used. Image format:`<registry><imagePath>/<imagePrefix><imageName>:<image-tag>` This option allows configuring the `<registry>` portion of the above format.
`imagePath` string	(Optional) ImagePath allows for the path part of an image to be specified. If specified then the specified value will be used as the image path for each image. If not specified or empty, the default for each image will be used. A special case value, UseDefault, is supported to explicitly specify the default image path will be used for each image. Image format:`<registry><imagePath>/<imagePrefix><imageName>:<image-tag>` This option allows configuring the `<imagePath>` portion of the above format.
`imagePrefix` string	(Optional) ImagePrefix allows for the prefix part of an image to be specified. If specified then the given value will be used as a prefix on each image. If not specified or empty, no prefix will be used. A special case value, UseDefault, is supported to explicitly specify the default image prefix will be used for each image. Image format:`<registry><imagePath>/<imagePrefix><imageName>:<image-tag>` This option allows configuring the `<imagePrefix>` portion of the above format.
`imagePullSecrets` []Kubernetes core/v1.LocalObjectReference	(Optional) ImagePullSecrets is an array of references to container registry pull secrets to use. These are applied to all images to be pulled.
`kubernetesProvider` Provider	(Optional) KubernetesProvider specifies a particular provider of the Kubernetes platform and enables provider-specific configuration. If the specified value is empty, the Operator will attempt to automatically determine the current provider. If the specified value is not empty, the Operator will still attempt auto-detection, but will additionally compare the auto-detected value to the specified value to confirm they match.
`cni` CNISpec	(Optional) CNI specifies the CNI that will be used by this installation.
`calicoNetwork` CalicoNetworkSpec	(Optional) CalicoNetwork specifies networking configuration options for Calico.
`typhaAffinity` TyphaAffinity	(Optional) Deprecated. Please use Installation.Spec.TyphaDeployment instead. TyphaAffinity allows configuration of node affinity characteristics for Typha pods.
`controlPlaneNodeSelector` map[string]string	(Optional) ControlPlaneNodeSelector is used to select control plane nodes on which to run Calico components. This is globally applied to all resources created by the operator excluding daemonsets.
`controlPlaneTolerations` []Kubernetes core/v1.Toleration	(Optional) ControlPlaneTolerations specify tolerations which are then globally applied to all resources created by the operator.
`controlPlaneReplicas` int32	(Optional) ControlPlaneReplicas defines how many replicas of the control plane core components will be deployed. This field applies to all control plane components that support High Availability. Defaults to 2.
`nodeMetricsPort` int32	(Optional) NodeMetricsPort specifies which port calico/node serves prometheus metrics on. By default, metrics are not enabled. If specified, this overrides any FelixConfiguration resources which may exist. If omitted, then prometheus metrics may still be configured through FelixConfiguration.
`typhaMetricsPort` int32	(Optional) TyphaMetricsPort specifies which port calico/typha serves prometheus metrics on. By default, metrics are not enabled.
`flexVolumePath` string	(Optional) FlexVolumePath optionally specifies a custom path for FlexVolume. If not specified, FlexVolume will be enabled by default. If set to ‘None’, FlexVolume will be disabled. The default is based on the kubernetesProvider.
`kubeletVolumePluginPath` string	(Optional) KubeletVolumePluginPath optionally specifies enablement of Calico CSI plugin. If not specified, CSI will be enabled by default. If set to ‘None’, CSI will be disabled. Default: /var/lib/kubelet
`nodeUpdateStrategy` Kubernetes apps/v1.DaemonSetUpdateStrategy	(Optional) NodeUpdateStrategy can be used to customize the desired update strategy, such as the MaxUnavailable field.
`componentResources` []ComponentResource	(Optional) Deprecated. Please use CalicoNodeDaemonSet, TyphaDeployment, and KubeControllersDeployment. ComponentResources can be used to customize the resource requirements for each component. Node, Typha, and KubeControllers are supported for installations.
`certificateManagement` CertificateManagement	(Optional) CertificateManagement configures pods to submit a CertificateSigningRequest to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. This feature requires that you bring your own CSR signing and approval process, otherwise pods will be stuck during initialization.
`nonPrivileged` NonPrivilegedType	(Optional) NonPrivileged configures Calico to be run in non-privileged containers as non-root users where possible.
`calicoNodeDaemonSet` CalicoNodeDaemonSet	CalicoNodeDaemonSet configures the calico-node DaemonSet. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence.
`csiNodeDriverDaemonSet` CSINodeDriverDaemonSet	CSINodeDriverDaemonSet configures the csi-node-driver DaemonSet.
`calicoKubeControllersDeployment` CalicoKubeControllersDeployment	CalicoKubeControllersDeployment configures the calico-kube-controllers Deployment. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence.
`typhaDeployment` TyphaDeployment	TyphaDeployment configures the typha Deployment. If used in conjunction with the deprecated ComponentResources or TyphaAffinity, then these overrides take precedence.
`calicoWindowsUpgradeDaemonSet` CalicoWindowsUpgradeDaemonSet	Deprecated. The CalicoWindowsUpgradeDaemonSet is deprecated and will be removed from the API in the future. CalicoWindowsUpgradeDaemonSet configures the calico-windows-upgrade DaemonSet.
`calicoNodeWindowsDaemonSet` CalicoNodeWindowsDaemonSet	CalicoNodeWindowsDaemonSet configures the calico-node-windows DaemonSet.
`fipsMode` FIPSMode	(Optional) FIPSMode uses images and features only that are using FIPS 140-2 validated cryptographic modules and standards. Default: Disabled
`logging` Logging	(Optional) Logging Configuration for Components
`windowsNodes` WindowsNodeSpec	(Optional) Windows Configuration
`serviceCIDRs` []string	(Optional) Kubernetes Service CIDRs. Specifying this is required when using Calico for Windows.

InstallationStatus

(Appears on:

Installation)

InstallationStatus defines the observed state of the Calico or Calico Enterprise installation.

Field	Description
`variant` ProductVariant	Variant is the most recently observed installed variant - one of Calico or TigeraSecureEnterprise
`mtu` int32	MTU is the most recently observed value for pod network MTU. This may be an explicitly configured value, or based on Calico’s native auto-detetion.
`imageSet` string	(Optional) ImageSet is the name of the ImageSet being used, if there is an ImageSet that is being used. If an ImageSet is not being used then this will not be set.
`computed` InstallationSpec	(Optional) Computed is the final installation including overlaid resources.
`calicoVersion` string	CalicoVersion shows the current running version of calico. CalicoVersion along with Variant is needed to know the exact version deployed.
`conditions` []Kubernetes meta/v1.Condition	(Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

IntrusionDetectionComponentName (`string` alias)

(Appears on:

IntrusionDetectionComponentResource)

IntrusionDetectionComponentResource

(Appears on:

IntrusionDetectionSpec)

The ComponentResource struct associates a ResourceRequirements with a component by name

Field	Description
`componentName` IntrusionDetectionComponentName	ComponentName is an enum which identifies the component
`resourceRequirements` Kubernetes core/v1.ResourceRequirements	ResourceRequirements allows customization of limits and requests for compute resources such as cpu and memory.

IntrusionDetectionSpec

(Appears on:

IntrusionDetection)

IntrusionDetectionSpec defines the desired state of Tigera intrusion detection capabilities.

Field	Description
`componentResources` []IntrusionDetectionComponentResource	(Optional) ComponentResources can be used to customize the resource requirements for each component. Only DeepPacketInspection is supported for this spec.
`anomalyDetection` AnomalyDetectionSpec	(Optional) AnomalyDetection is now deprecated, and configuring it has no effect.

IntrusionDetectionStatus

(Appears on:

IntrusionDetection)

IntrusionDetectionStatus defines the observed state of Tigera intrusion detection capabilities.

Field	Description
`state` string	State provides user-readable status.
`conditions` []Kubernetes meta/v1.Condition	(Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

KubernetesAutodetectionMethod (`string` alias)

(Appears on:

NodeAddressAutodetection)

KubernetesAutodetectionMethod is a method of detecting an IP address based on the Kubernetes API.

One of: NodeInternalIP

LinuxDataplaneOption (`string` alias)

(Appears on:

LinuxDataplaneOption controls which dataplane is to be used on Linux nodes.

One of: Iptables, BPF

LogCollectionSpec

(Appears on:

CNILogging,EgressGatewaySpec)

Field	Description
`collectLogs` LogCollectionStatusType	(Optional) This setting enables or disable log collection. Allowed values are Enabled or Disabled.
`logIntervalSeconds` int64	(Optional) Interval in seconds for sending L7 log information for processing. Default: 5 sec
`logRequestsPerInterval` int64	(Optional) Maximum number of unique L7 logs that are sent LogIntervalSeconds. Adjust this to limit the number of L7 logs sent per LogIntervalSeconds to felix for further processing, use negative number to ignore limits. Default: -1

LogCollectionStatusType (`string` alias)

(Appears on:

LogCollectionSpec)

LogCollectorSpec

(Appears on:

LogCollector)

LogCollectorSpec defines the desired state of Tigera flow, audit, and DNS log collection.

Field	Description
`additionalStores` AdditionalLogStoreSpec	(Optional) Configuration for exporting flow, audit, and DNS logs to external storage.
`additionalSources` AdditionalLogSourceSpec	(Optional) Configuration for importing audit logs from managed kubernetes cluster log sources.
`collectProcessPath` CollectProcessPathOption	(Optional) Configuration for enabling/disabling process path collection in flowlogs. If Enabled, this feature sets hostPID to true to read process cmdline. Default: Enabled
`multiTenantManagementClusterNamespace` string	(Optional) If running as a multi-tenant management cluster, the namespace in which the management cluster’s tenant services are running.

LogCollectorStatus

(Appears on:

LogCollector)

LogCollectorStatus defines the observed state of Tigera flow and DNS log collection

Field	Description
`state` string	State provides user-readable status.
`conditions` []Kubernetes meta/v1.Condition	(Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

LogLevel (`string` alias)

(Appears on:

LogStorageComponentName (`string` alias)

(Appears on:

LogStorageComponentResource)

LogStorageComponentName CRD enum

LogStorageComponentResource

(Appears on:

The ComponentResource struct associates a ResourceRequirements with a component by name

Field	Description
`componentName` LogStorageComponentName	ComponentName is an enum which identifies the component
`resourceRequirements` Kubernetes core/v1.ResourceRequirements	ResourceRequirements allows customization of limits and requests for compute resources such as cpu and memory.

LogStorageSpec

(Appears on:

LogStorage)

LogStorageSpec defines the desired state of Tigera flow and DNS log storage.

Field	Description
`nodes` Nodes	Nodes defines the configuration for a set of identical Elasticsearch cluster nodes, each of type master, data, and ingest.
`indices` Indices	(Optional) Index defines the configuration for the indices in the Elasticsearch cluster.
`retention` Retention	(Optional) Retention defines how long data is retained in the Elasticsearch cluster before it is cleared.
`storageClassName` string	(Optional) StorageClassName will populate the PersistentVolumeClaim.StorageClassName that is used to provision disks to the Tigera Elasticsearch cluster. The StorageClassName should only be modified when no LogStorage is currently active. We recommend choosing a storage class dedicated to Tigera LogStorage only. Otherwise, data retention cannot be guaranteed during upgrades. See https://docs.tigera.io/maintenance/upgrading for up-to-date instructions. Default: tigera-elasticsearch
`dataNodeSelector` map[string]string	(Optional) DataNodeSelector gives you more control over the node that Elasticsearch will run on. The contents of DataNodeSelector will be added to the PodSpec of the Elasticsearch nodes. For the pod to be eligible to run on a node, the node must have each of the indicated key-value pairs as labels as well as access to the specified StorageClassName.
`componentResources` []LogStorageComponentResource	(Optional) ComponentResources can be used to customize the resource requirements for each component. Only ECKOperator is supported for this spec.

LogStorageStatus

(Appears on:

LogStorage)

LogStorageStatus defines the observed state of Tigera flow and DNS log storage.

Field	Description
`state` string	State provides user-readable status.
`elasticsearchHash` string	ElasticsearchHash represents the current revision and configuration of the installed Elasticsearch cluster. This is an opaque string which can be monitored for changes to perform actions when Elasticsearch is modified.
`kibanaHash` string	KibanaHash represents the current revision and configuration of the installed Kibana dashboard. This is an opaque string which can be monitored for changes to perform actions when Kibana is modified.
`conditions` []Kubernetes meta/v1.Condition	(Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

Logging

(Appears on:

ManagementClusterConnection)

Field	Description
`cni` CNILogging	(Optional) Customized logging specification for calico-cni plugin

ManagementClusterConnectionSpec

(Appears on:

ManagementClusterConnectionSpec defines the desired state of ManagementClusterConnection

Field	Description
`managementClusterAddr` string	(Optional) Specify where the managed cluster can reach the management cluster. Ex.: “10.128.0.10:30449”. A managed cluster should be able to access this address. This field is used by managed clusters only.
`tls` ManagementClusterTLS	(Optional) TLS provides options for configuring how Managed Clusters can establish an mTLS connection with the Management Cluster.

ManagementClusterConnectionStatus

(Appears on:

ManagementClusterConnection)

ManagementClusterConnectionStatus defines the observed state of ManagementClusterConnection

Field	Description
`conditions` []Kubernetes meta/v1.Condition	(Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

ManagementClusterSpec

(Appears on:

ManagementCluster)

ManagementClusterSpec defines the desired state of a ManagementCluster

Field	Description
`address` string	(Optional) This field specifies the externally reachable address to which your managed cluster will connect. When a managed cluster is added, this field is used to populate an easy-to-apply manifest that will connect both clusters. Valid examples are: “0.0.0.0:31000”, “example.com:32000”, “[::1]:32500”
`tls` TLS	(Optional) TLS provides options for configuring how Managed Clusters can establish an mTLS connection with the Management Cluster.

ManagementClusterTLS

(Appears on:

ManagementClusterConnectionSpec)

Field Description

ca
CAType

CA indicates which verification method the tunnel client should use to verify the tunnel server’s identity.

When left blank or set to ‘Tigera’, the tunnel client will expect a self-signed cert to be included in the certificate bundle and will expect the cert to have a Common Name (CN) of ‘voltron’.

When set to ‘Public’, the tunnel client will use its installed system certs and will use the managementClusterAddr to verify the tunnel server’s identity.

Default: Tigera

ManagerSpec

(Appears on:

Manager)

ManagerSpec defines configuration for the Calico Enterprise manager GUI.

Field	Description
`auth` Auth	(Optional) Deprecated. Please use the Authentication CR for configuring authentication.

ManagerStatus

(Appears on:

Manager)

ManagerStatus defines the observed state of the Calico Enterprise manager GUI.

Field	Description
`auth` Auth	(Optional) Deprecated. Please use the Authentication CR for configuring authentication.
`state` string	State provides user-readable status.
`conditions` []Kubernetes meta/v1.Condition	(Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

Metadata

(Appears on:

APIServerDeployment,APIServerDeploymentPodTemplateSpec,CSINodeDriverDaemonSet,CSINodeDriverDaemonSetPodTemplateSpec,CalicoKubeControllersDeployment,CalicoKubeControllersDeploymentPodTemplateSpec,CalicoNodeDaemonSet,CalicoNodeDaemonSetPodTemplateSpec,CalicoNodeWindowsDaemonSet,CalicoNodeWindowsDaemonSetPodTemplateSpec,CalicoWindowsUpgradeDaemonSet,CalicoWindowsUpgradeDaemonSetPodTemplateSpec,TyphaDeployment,TyphaDeploymentPodTemplateSpec)

Metadata contains the standard Kubernetes labels and annotations fields.

Field	Description
`labels` map[string]string	(Optional) Labels is a map of string keys and values that may match replicaset and service selectors. Each of these key/value pairs are added to the object’s labels provided the key does not already exist in the object’s labels.
`annotations` map[string]string	(Optional) Annotations is a map of arbitrary non-identifying metadata. Each of these key/value pairs are added to the object’s annotations provided the key does not already exist in the object’s annotations.

MetadataAccessAllowedType (`string` alias)

(Appears on:

AmazonCloudIntegrationSpec)

MetadataAccessAllowedType

MonitorSpec

(Appears on:

Monitor)

MonitorSpec defines the desired state of Tigera monitor.

MonitorStatus

(Appears on:

Monitor)

MonitorStatus defines the observed state of Tigera monitor.

Field	Description
`state` string	State provides user-readable status.
`conditions` []Kubernetes meta/v1.Condition	(Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types.

MultiInterfaceMode (`string` alias)

(Appears on:

MultiInterfaceMode describes the method of providing multiple pod interfaces.

One of: None, Multus

NATOutgoingType (`string` alias)

(Appears on:

IPPool)

NATOutgoingType describe the type of outgoing NAT to use.

One of: Enabled, Disabled

NativeIP (`string` alias)

(Appears on:

AWSEgressGateway)

NativeIP defines if Egress Gateway pods should have AWS IPs. When NativeIP is enabled, the IPPools should be backed by AWS subnet.

NodeAddressAutodetection

(Appears on:

NodeAddressAutodetection provides configuration options for auto-detecting node addresses. At most one option can be used. If no detection option is specified, then IP auto detection will be disabled for this address family and IPs must be specified directly on the Node resource.

Field	Description
`firstFound` bool	(Optional) FirstFound uses default interface matching parameters to select an interface, performing best-effort filtering based on well-known interface names.
`kubernetes` KubernetesAutodetectionMethod	(Optional) Kubernetes configures Calico to detect node addresses based on the Kubernetes API.
`interface` string	(Optional) Interface enables IP auto-detection based on interfaces that match the given regex.
`skipInterface` string	(Optional) SkipInterface enables IP auto-detection based on interfaces that do not match the given regex.
`canReach` string	(Optional) CanReach enables IP auto-detection based on which source address on the node is used to reach the specified IP or domain.
`cidrs` []string	CIDRS enables IP auto-detection based on which addresses on the nodes are within one of the provided CIDRs.

NodeAffinity

(Appears on:

TyphaAffinity)

NodeAffinity is similar to *v1.NodeAffinity, but allows us to limit available schedulers.

Field Description

preferredDuringSchedulingIgnoredDuringExecution
[]Kubernetes core/v1.PreferredSchedulingTerm

(Optional)

The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions.

requiredDuringSchedulingIgnoredDuringExecution
Kubernetes core/v1.NodeSelector

(Optional)

WARNING: Please note that if the affinity requirements specified by this field are not met at scheduling time, the pod will NOT be scheduled onto the node. There is no fallback to another affinity rules with this setting. This may cause networking disruption or even catastrophic failure! PreferredDuringSchedulingIgnoredDuringExecution should be used for affinity unless there is a specific well understood reason to use RequiredDuringSchedulingIgnoredDuringExecution and you can guarantee that the RequiredDuringSchedulingIgnoredDuringExecution will always have sufficient nodes to satisfy the requirement. NOTE: RequiredDuringSchedulingIgnoredDuringExecution is set by default for AKS nodes, to avoid scheduling Typhas on virtual-nodes. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.

NodeSet

(Appears on:

Nodes)

NodeSets defines configuration specific to each Elasticsearch Node Set

Field	Description
`selectionAttributes` []NodeSetSelectionAttribute	SelectionAttributes defines K8s node attributes a NodeSet should use when setting the Node Affinity selectors and Elasticsearch cluster awareness attributes for the Elasticsearch nodes. The list of SelectionAttributes are used to define Node Affinities and set the node awareness configuration in the running Elasticsearch instance.

NodeSetSelectionAttribute

(Appears on:

NodeSet)

NodeSetSelectionAttribute defines a K8s node “attribute” the Elasticsearch nodes should be aware of. The “Name” and “Value” are used together to set the “awareness” attributes in Elasticsearch, while the “NodeLabel” and “Value” are used together to define Node Affinity for the Pods created for the Elasticsearch nodes.

Field	Description
`name` string
`nodeLabel` string
`value` string

Nodes

(Appears on:

Nodes defines the configuration for a set of identical Elasticsearch cluster nodes, each of type master, data, and ingest.

Field	Description
`count` int64	Count defines the number of nodes in the Elasticsearch cluster.
`nodeSets` []NodeSet	(Optional) NodeSets defines configuration specific to each Elasticsearch Node Set
`resourceRequirements` Kubernetes core/v1.ResourceRequirements	(Optional) ResourceRequirements defines the resource limits and requirements for the Elasticsearch cluster.

NonPrivilegedType (`string` alias)

(Appears on:

InstallationSpec,InstallationStatus)

NonPrivilegedType specifies whether Calico runs as permissioned or not

One of: Enabled, Disabled

OIDCType (`string` alias)

(Appears on:

AuthenticationOIDC)

OIDCType defines how OIDC is configured for Tigera Enterprise. Dex should be the best option for most use-cases. The Tigera option can help in specific use-cases, for instance, when you are unable to configure a client secret. One of: Dex, Tigera

PolicyRecommendationSpec

(Appears on:

PolicyRecommendation)

PolicyRecommendationSpec defines configuration for the Calico Enterprise Policy Recommendation service.

PolicyRecommendationStatus

(Appears on:

PolicyRecommendation)

PolicyRecommendationStatus defines the observed state of Tigera policy recommendation.

Field	Description
`state` string	State provides user-readable status.

ProductVariant (`string` alias)

(Appears on:

ProductVariant represents the variant of the product.

One of: Calico, TigeraSecureEnterprise

PromptType (`string` alias)

(Appears on:

AuthenticationOIDC)

PromptType is a value that specifies whether the identity provider prompts the end user for re-authentication and consent. One of: None, Login, Consent, SelectAccount.

Provider (`string` alias)

(Appears on:

Provider represents a particular provider or flavor of Kubernetes. Valid options are: EKS, GKE, AKS, RKE2, OpenShift, DockerEnterprise.

Retention

(Appears on:

Retention defines how long data is retained in an Elasticsearch cluster before it is cleared.

Field	Description
`flows` int32	(Optional) Flows configures the retention period for flow logs, in days. Logs written on a day that started at least this long ago are removed. To keep logs for at least x days, use a retention period of x+1. Default: 8
`auditReports` int32	(Optional) AuditReports configures the retention period for audit logs, in days. Logs written on a day that started at least this long ago are removed. To keep logs for at least x days, use a retention period of x+1. Default: 91
`snapshots` int32	(Optional) Snapshots configures the retention period for snapshots, in days. Snapshots are periodic captures of resources which along with audit events are used to generate reports. Consult the Compliance Reporting documentation for more details on snapshots. Logs written on a day that started at least this long ago are removed. To keep logs for at least x days, use a retention period of x+1. Default: 91
`complianceReports` int32	(Optional) ComplianceReports configures the retention period for compliance reports, in days. Reports are output from the analysis of the system state and audit events for compliance reporting. Consult the Compliance Reporting documentation for more details on reports. Logs written on a day that started at least this long ago are removed. To keep logs for at least x days, use a retention period of x+1. Default: 91
`dnsLogs` int32	(Optional) DNSLogs configures the retention period for DNS logs, in days. Logs written on a day that started at least this long ago are removed. To keep logs for at least x days, use a retention period of x+1. Default: 8
`bgpLogs` int32	(Optional) BGPLogs configures the retention period for BGP logs, in days. Logs written on a day that started at least this long ago are removed. To keep logs for at least x days, use a retention period of x+1. Default: 8

S3StoreSpec

(Appears on:

AdditionalLogStoreSpec)

S3StoreSpec defines configuration for exporting logs to Amazon S3.

Field	Description
`region` string	AWS Region of the S3 bucket
`bucketName` string	Name of the S3 bucket to send logs
`bucketPath` string	Path in the S3 bucket where to send logs

SplunkStoreSpec

(Appears on:

AdditionalLogStoreSpec)

SplunkStoreSpec defines configuration for exporting logs to splunk.

Field	Description
`endpoint` string	Location for splunk’s http event collector end point. example `https://1.2.3.4:8088`

StatusConditionType (`string` alias)

(Appears on:

TigeraStatusCondition)

StatusConditionType is a type of condition that may apply to a particular component.

SyslogLogType (`string` alias)

(Appears on:

SyslogStoreSpec)

SyslogLogType represents the allowable log types for syslog. Allowable values are Audit, DNS, Flows and IDSEvents. * Audit corresponds to audit logs for both Kubernetes resources and Enterprise custom resources. * DNS corresponds to DNS logs generated by Calico node. * Flows corresponds to flow logs generated by Calico node. * IDSEvents corresponds to event logs for the intrusion detection system (anomaly detection, suspicious IPs, suspicious domains and global alerts).

SyslogStoreSpec

(Appears on:

AdditionalLogStoreSpec)

SyslogStoreSpec defines configuration for exporting logs to syslog.

Field	Description
`endpoint` string	Location of the syslog server. example: tcp://1.2.3.4:601
`packetSize` int32	(Optional) PacketSize defines the maximum size of packets to send to syslog. In general this is only needed if you notice long logs being truncated. Default: 1024
`logTypes` []SyslogLogType	If no values are provided, the list will be updated to include log types Audit, DNS and Flows. Default: Audit, DNS, Flows
`encryption` EncryptionOption	(Optional) Encryption configures traffic encryption to the Syslog server. Default: None

TLS

(Appears on:

ManagementClusterSpec)

Field Description

secretName
string

(Optional)

SecretName indicates the name of the secret in the tigera-operator namespace that contains the private key and certificate that the management cluster uses when it listens for incoming connections.

When set to tigera-management-cluster-connection voltron will use the same cert bundle which Guardian client certs are signed with.

When set to manager-tls, voltron will use the same cert bundle which Manager UI is served with. This cert bundle must be a publicly signed cert created by the user. Note that Tigera Operator will generate a self-signed manager-tls cert if one does not exist, and use of that cert will result in Guardian being unable to verify Voltron’s identity.

If changed on a running cluster with connected managed clusters, all managed clusters will disconnect as they will no longer be able to verify Voltron’s identity. To reconnect existing managed clusters, change the tls.ca of the managed clusters’ ManagementClusterConnection resource.

One of: tigera-management-cluster-connection, manager-tls

Default: tigera-management-cluster-connection

TenantElasticSpec

(Appears on:

TenantSpec)

Field	Description
`url` string
`kibana_url` string
`mutualTLS` bool

TenantSpec

(Appears on:

Tenant)

Field	Description
`id` string	ID is the unique identifier for this tenant.
`name` string	Name is a human readable name for this tenant.
`indices` []Index	Indices defines the how to store a tenant’s data
`elastic` TenantElasticSpec	Elastic configures per-tenant ElasticSearch and Kibana parameters. This field is required for clusters using external ES.
`controlPlaneReplicas` int32	(Optional) ControlPlaneReplicas defines how many replicas of the control plane core components will be deployed in the Tenant’s namespace. Defaults to the controlPlaneReplicas in Installation CR

TenantStatus

(Appears on:

Tenant)

TigeraStatusCondition

(Appears on:

TigeraStatusStatus)

TigeraStatusCondition represents a condition attached to a particular component.

Field	Description
`type` StatusConditionType	The type of condition. May be Available, Progressing, or Degraded.
`status` ConditionStatus	The status of the condition. May be True, False, or Unknown.
`lastTransitionTime` Kubernetes meta/v1.Time	The timestamp representing the start time for the current status.
`reason` string	A brief reason explaining the condition.
`message` string	Optionally, a detailed message providing additional context.
`observedGeneration` int64	(Optional) observedGeneration represents the generation that the condition was set based upon. For instance, if generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

TigeraStatusReason (`string` alias)

TigeraStatusReason represents the reason for a particular condition.

TigeraStatusSpec

(Appears on:

TigeraStatus)

TigeraStatusSpec defines the desired state of TigeraStatus

TigeraStatusStatus

(Appears on:

TigeraStatus)

TigeraStatusStatus defines the observed state of TigeraStatus

Field	Description
`conditions` []TigeraStatusCondition	Conditions represents the latest observed set of conditions for this component. A component may be one or more of Available, Progressing, or Degraded.

TyphaAffinity

(Appears on:

Deprecated. Please use TyphaDeployment instead. TyphaAffinity allows configuration of node affinity characteristics for Typha pods.

Field	Description
`nodeAffinity` NodeAffinity	(Optional) NodeAffinity describes node affinity scheduling rules for typha.

TyphaDeployment

(Appears on:

TyphaDeploymentPodTemplateSpec)

TyphaDeployment is the configuration for the typha Deployment.

Field Description

metadata
Metadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the Deployment.

spec
TyphaDeploymentSpec

(Optional)

Spec is the specification of the typha Deployment.

TyphaDeploymentContainer

(Appears on:

TyphaDeploymentPodSpec)

TyphaDeploymentContainer is a typha Deployment container.

Field	Description
`name` string	Name is an enum which identifies the typha Deployment container by name.
`resources` Kubernetes core/v1.ResourceRequirements	(Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named typha Deployment container’s resources. If omitted, the typha Deployment will use its default value for this container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

TyphaDeploymentInitContainer

(Appears on:

TyphaDeploymentPodSpec)

TyphaDeploymentInitContainer is a typha Deployment init container.

Field	Description
`name` string	Name is an enum which identifies the typha Deployment init container by name.
`resources` Kubernetes core/v1.ResourceRequirements	(Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named typha Deployment init container’s resources. If omitted, the typha Deployment will use its default value for this init container’s resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence.

TyphaDeploymentPodSpec

(Appears on:

TyphaDeploymentPodSpec is the typha Deployment’s PodSpec.

Field	Description
`initContainers` []TyphaDeploymentInitContainer	(Optional) InitContainers is a list of typha init containers. If specified, this overrides the specified typha Deployment init containers. If omitted, the typha Deployment will use its default values for its init containers.
`containers` []TyphaDeploymentContainer	(Optional) Containers is a list of typha containers. If specified, this overrides the specified typha Deployment containers. If omitted, the typha Deployment will use its default values for its containers.
`affinity` Kubernetes core/v1.Affinity	(Optional) Affinity is a group of affinity scheduling rules for the typha pods. If specified, this overrides any affinity that may be set on the typha Deployment. If omitted, the typha Deployment will use its default value for affinity. If used in conjunction with the deprecated TyphaAffinity, then this value takes precedence. WARNING: Please note that this field will override the default calico-typha Deployment affinity.
`nodeSelector` map[string]string	NodeSelector is the calico-typha pod’s scheduling constraints. If specified, each of the key/value pairs are added to the calico-typha Deployment nodeSelector provided the key does not already exist in the object’s nodeSelector. If omitted, the calico-typha Deployment will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-typha Deployment nodeSelector.
`terminationGracePeriodSeconds` int64	(Optional) Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). If this value is nil, the default grace period will be used instead. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. Defaults to 30 seconds.
`topologySpreadConstraints` []Kubernetes core/v1.TopologySpreadConstraint	(Optional) TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed.
`tolerations` []Kubernetes core/v1.Toleration	(Optional) Tolerations is the typha pod’s tolerations. If specified, this overrides any tolerations that may be set on the typha Deployment. If omitted, the typha Deployment will use its default value for tolerations. WARNING: Please note that this field will override the default calico-typha Deployment tolerations.

TyphaDeploymentPodTemplateSpec

(Appears on:

TyphaDeploymentSpec)

TyphaDeploymentPodTemplateSpec is the typha Deployment’s PodTemplateSpec

Field Description

metadata
Metadata

(Optional)

Metadata is a subset of a Kubernetes object’s metadata that is added to the pod’s metadata.

spec
TyphaDeploymentPodSpec

(Optional)

Spec is the typha Deployment’s PodSpec.

TyphaDeploymentSpec

(Appears on:

TyphaDeployment)

TyphaDeploymentSpec defines configuration for the typha Deployment.

Field	Description
`minReadySeconds` int32	(Optional) MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the typha Deployment. If omitted, the typha Deployment will use its default value for minReadySeconds.
`template` TyphaDeploymentPodTemplateSpec	(Optional) Template describes the typha Deployment pod that will be created.
`strategy` TyphaDeploymentStrategy	(Optional) The deployment strategy to use to replace existing pods with new ones.

TyphaDeploymentStrategy

(Appears on:

TyphaDeploymentSpec)

TyphaDeploymentStrategy describes how to replace existing pods with new ones. Only RollingUpdate is supported at this time so the Type field is not exposed.

Field	Description
`rollingUpdate` Kubernetes apps/v1.RollingUpdateDeployment	(Optional) Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate. to be.

UserMatch

(Appears on:

GroupSearch)

UserMatch when the value of a UserAttribute and a GroupAttribute match, a user belongs to the group.

Field	Description
`userAttribute` string	The attribute of a user that links it to a group.
`groupAttribute` string	The attribute of a group that links it to a user.

UserSearch

(Appears on:

AuthenticationLDAP)

User entry search configuration to match the credentials with a user.

Field	Description
`baseDN` string	BaseDN to start the search from. For example “cn=users,dc=example,dc=com”
`filter` string	(Optional) Optional filter to apply when searching the directory. For example “(objectClass=person)”
`nameAttribute` string	(Optional) A mapping of the attribute that is used as the username. This attribute can be used to apply RBAC to a user. Default: uid

WAFStatusType (`string` alias)

(Appears on:

WindowsDataplaneOption (`string` alias)

(Appears on:

WindowsNodeSpec

(Appears on: