1009 lines
44 KiB
YAML
1009 lines
44 KiB
YAML
|
{{- if .Values.crds.install }}
|
||
|
|
apiVersion: apiextensions.k8s.io/v1beta1
|
||
|
|
kind: CustomResourceDefinition
|
||
|
|
metadata:
|
||
|
|
name: rewritepolicies.citrix.com
|
||
|
|
{{- if .Values.crds.retainOnDelete }}
|
||
|
|
annotations:
|
||
|
|
"helm.sh/resource-policy": keep
|
||
|
|
{{- end }}
|
||
|
|
spec:
|
||
|
|
group: citrix.com
|
||
|
|
version: v1
|
||
|
|
names:
|
||
|
|
kind: rewritepolicy
|
||
|
|
plural: rewritepolicies
|
||
|
|
singular: rewritepolicy
|
||
|
|
scope: Namespaced
|
||
|
|
subresources:
|
||
|
|
status: {}
|
||
|
|
additionalPrinterColumns:
|
||
|
|
- name: Status
|
||
|
|
type: string
|
||
|
|
description: "Current Status of the CRD"
|
||
|
|
JSONPath: .status.state
|
||
|
|
- name: Message
|
||
|
|
type: string
|
||
|
|
description: "Status Message"
|
||
|
|
JSONPath: .status.status_message
|
||
|
|
validation:
|
||
|
|
openAPIV3Schema:
|
||
|
|
properties:
|
||
|
|
spec:
|
||
|
|
properties:
|
||
|
|
rewrite-policies:
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
properties:
|
||
|
|
servicenames:
|
||
|
|
description: 'Name of the services that needs to be binded to rewrite policy.'
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
maxLength: 127
|
||
|
|
goto-priority-expression:
|
||
|
|
description: 'Expression or other value specifying the next policy to be
|
||
|
|
evaluated if the current policy evaluates to TRUE.
|
||
|
|
Specify one of the following values:
|
||
|
|
* NEXT - Evaluate the policy with the next higher priority number.
|
||
|
|
* END - End policy evaluation.
|
||
|
|
Default value of goto-priority-expression: END'
|
||
|
|
type: string
|
||
|
|
maxLength: 1499
|
||
|
|
logpackets:
|
||
|
|
description: 'Adds an audit message action.
|
||
|
|
The action specifies whether to log the message, and to which log.'
|
||
|
|
properties:
|
||
|
|
logexpression:
|
||
|
|
description: 'Default-syntax expression that defines the format and content of the log message.'
|
||
|
|
type: string
|
||
|
|
maxLength: 7991
|
||
|
|
loglevel:
|
||
|
|
description: 'Audit log level, which specifies the severity level of the log message being generated.'
|
||
|
|
type: string
|
||
|
|
enum: ["EMERGENCY", "ALERT", "CRITICAL", "ERROR", "WARNING", "NOTICE", "INFORMATIONAL", "DEBUG"]
|
||
|
|
required: [logexpression, loglevel]
|
||
|
|
rewrite-policy:
|
||
|
|
properties:
|
||
|
|
rewrite-criteria:
|
||
|
|
description: 'Expression against which traffic is evaluated.'
|
||
|
|
type: string
|
||
|
|
maxLength: 1299
|
||
|
|
default-action:
|
||
|
|
description: 'Action to perform if the result of policy evaluation is undefined (UNDEF).
|
||
|
|
An UNDEF event indicates an internal error condition.'
|
||
|
|
type: string
|
||
|
|
maxLength: 77
|
||
|
|
enum: ['NOREWRITE', 'RESET', 'DROP']
|
||
|
|
operation:
|
||
|
|
description: 'Type of user-defined rewrite action.'
|
||
|
|
type: string
|
||
|
|
enum: ["noop", "delete", "insert_http_header", "delete_http_header",
|
||
|
|
"corrupt_http_header", "insert_before", "insert_after", "replace",
|
||
|
|
"replace_http_res", "delete_all", "replace_all", "insert_before_all",
|
||
|
|
"insert_after_all", "clientless_vpn_encode", "clientless_vpn_encode_all",
|
||
|
|
"clientless_vpn_decode", "clientless_vpn_decode_all", "insert_sip_header",
|
||
|
|
"delete_sip_header", "corrupt_sip_header", "replace_sip_res", "replace_diameter_header_field",
|
||
|
|
"replace_dns_header_field", "replace_dns_answer_section"]
|
||
|
|
target:
|
||
|
|
description: 'Default syntax expression that specifies which part of the request or response to rewrite.'
|
||
|
|
type: string
|
||
|
|
maxLength: 1229
|
||
|
|
modify-expression:
|
||
|
|
description: 'Default syntax expression that specifies the content to insert into the request
|
||
|
|
or response at the specified location, or that replaces the specified string.'
|
||
|
|
type: string
|
||
|
|
maxLength: 7991
|
||
|
|
multiple-occurence-modify:
|
||
|
|
description: 'Search facility that is used to match multiple strings in the request or response.'
|
||
|
|
type: string
|
||
|
|
maxLength: 171
|
||
|
|
additional-multiple-occurence-modify:
|
||
|
|
description: 'Specify additional criteria to refine the results of the search.
|
||
|
|
Always starts with the "extend(m,n)" operation, where "m" specifies number of bytes to the left of selected data
|
||
|
|
and "n" specifies number of bytes to the right of selected data.
|
||
|
|
You can use refineSearch only on body expressions, and only when rewrite-criteria is any one of this:
|
||
|
|
INSERT_BEFORE_ALL, INSERT_AFTER_ALL, REPLACE_ALL, and DELETE_ALL.'
|
||
|
|
type: string
|
||
|
|
maxLength: 1299
|
||
|
|
direction:
|
||
|
|
description: 'Bind point to which to bind the policy.'
|
||
|
|
type: string
|
||
|
|
enum: ["REQUEST","RESPONSE"]
|
||
|
|
comment:
|
||
|
|
description: 'Any comments to preserve information about this rewrite policy.'
|
||
|
|
type: string
|
||
|
|
maxLength: 255
|
||
|
|
required: [rewrite-criteria, operation, target, direction]
|
||
|
|
required: [servicenames, rewrite-policy]
|
||
|
|
|
||
|
|
responder-policies:
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
properties:
|
||
|
|
servicenames:
|
||
|
|
description: 'Name of the services that needs to be binded to responder policy.'
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
maxLength: 127
|
||
|
|
goto-priority-expression:
|
||
|
|
description: 'Expression or other value specifying the next policy to be
|
||
|
|
evaluated if the current policy evaluates to TRUE.
|
||
|
|
Specify one of the following values:
|
||
|
|
* NEXT - Evaluate the policy with the next higher priority number.
|
||
|
|
* END - End policy evaluation.
|
||
|
|
Default value of goto-priority-expression: END'
|
||
|
|
type: string
|
||
|
|
maxLength: 1499
|
||
|
|
logpackets:
|
||
|
|
description: 'Adds an audit message action.
|
||
|
|
The action specifies whether to log the message, and to which log.'
|
||
|
|
properties:
|
||
|
|
logexpression:
|
||
|
|
description: 'Default-syntax expression that defines the format and content of the log message.'
|
||
|
|
type: string
|
||
|
|
maxLength: 7991
|
||
|
|
loglevel:
|
||
|
|
description: 'Audit log level, which specifies the severity level of the log message being generated.'
|
||
|
|
type: string
|
||
|
|
enum: ["EMERGENCY", "ALERT", "CRITICAL", "ERROR", "WARNING",
|
||
|
|
"NOTICE", "INFORMATIONAL", "DEBUG"]
|
||
|
|
required: [logexpression, loglevel]
|
||
|
|
responder-policy:
|
||
|
|
properties:
|
||
|
|
redirect:
|
||
|
|
description: 'Use this option when you want to Redirect the request when request matches to policy.'
|
||
|
|
properties:
|
||
|
|
url:
|
||
|
|
description: 'URL on which you want to redirect the request.'
|
||
|
|
type: string
|
||
|
|
maxLength: 7991
|
||
|
|
redirect-status-code:
|
||
|
|
description: 'HTTP response status code, for example 200, 302, 404, etc.'
|
||
|
|
type: integer
|
||
|
|
minimum: 100
|
||
|
|
maximum: 599
|
||
|
|
redirect-reason:
|
||
|
|
description: 'Expression specifying the reason for redirecting the request.'
|
||
|
|
type: string
|
||
|
|
maxLength: 7991
|
||
|
|
required: [url]
|
||
|
|
respondwith:
|
||
|
|
description: 'Use this parameter when you want to respond to the request when request matches to policy.'
|
||
|
|
properties:
|
||
|
|
http-payload-string:
|
||
|
|
description: 'Expression that you want to sent as response to the request.'
|
||
|
|
type: string
|
||
|
|
maxLength: 7991
|
||
|
|
required: [http-payload-string]
|
||
|
|
noop:
|
||
|
|
description: 'Use this option when you want to send the request to the protected server instead of
|
||
|
|
responding to it when request matches to policy.'
|
||
|
|
properties:
|
||
|
|
target:
|
||
|
|
description: 'Default syntax expression that specifies to perform noop operation on'
|
||
|
|
type: string
|
||
|
|
maxLength: 1229
|
||
|
|
reset:
|
||
|
|
description: 'Use this option when you want to Reset the client connection by closing it when request matches to policy.'
|
||
|
|
properties:
|
||
|
|
drop:
|
||
|
|
description: 'Use this option when you want to drop the request without sending a response to the user when request matches to policy.'
|
||
|
|
properties:
|
||
|
|
respond-criteria:
|
||
|
|
description: 'Default syntax expression that the policy uses to determine whether to respond to the specified request.'
|
||
|
|
type: string
|
||
|
|
maxLength: 1299
|
||
|
|
default-action:
|
||
|
|
description: 'Action to perform if the result of policy evaluation is undefined (UNDEF).
|
||
|
|
An UNDEF event indicates an internal error condition.'
|
||
|
|
type: string
|
||
|
|
maxLength: 77
|
||
|
|
enum: ['NOOP', 'RESET', 'DROP']
|
||
|
|
comment:
|
||
|
|
description: 'Any comments to preserve information about this responder policy.'
|
||
|
|
type: string
|
||
|
|
maxLength: 255
|
||
|
|
required: [respond-criteria]
|
||
|
|
oneOf: [required: [redirect], required: [respondwith], required: [noop], required: [reset], required: [drop]]
|
||
|
|
required: [servicenames, responder-policy]
|
||
|
|
|
||
|
|
dataset:
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
properties:
|
||
|
|
name:
|
||
|
|
description: 'Name of the dataset.'
|
||
|
|
type: string
|
||
|
|
maxLength: 32
|
||
|
|
type:
|
||
|
|
description: 'Type of value to bind to the dataset.'
|
||
|
|
type: string
|
||
|
|
enum: ["ipv4", "number", "ipv6", "ulong", "double", "mac"]
|
||
|
|
comment:
|
||
|
|
description: 'Any comments to preserve information about this dataset.'
|
||
|
|
type: string
|
||
|
|
maxLength: 255
|
||
|
|
values:
|
||
|
|
description: 'Value of the specified type that is associated with this dataset.'
|
||
|
|
type: array
|
||
|
|
required: [name, type, values]
|
||
|
|
|
||
|
|
patset:
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
properties:
|
||
|
|
name:
|
||
|
|
description: 'Name of the Patset.'
|
||
|
|
type: string
|
||
|
|
maxLength: 32
|
||
|
|
comment:
|
||
|
|
description: 'Any comments to preserve information about this patset.'
|
||
|
|
type: string
|
||
|
|
maxLength: 255
|
||
|
|
values:
|
||
|
|
description: 'String of characters that constitutes a pattern and is associated with this patset.'
|
||
|
|
type: array
|
||
|
|
required: [name, values]
|
||
|
|
|
||
|
|
stringmap:
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
properties:
|
||
|
|
name:
|
||
|
|
description: 'Name of the Stringmap.'
|
||
|
|
type: string
|
||
|
|
maxLength: 32
|
||
|
|
comment:
|
||
|
|
description: 'Any comments to preserve information about this stringmap.'
|
||
|
|
type: string
|
||
|
|
maxLength: 255
|
||
|
|
values:
|
||
|
|
description: 'List of (key,value) pairs to be bound to this string map.'
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
properties:
|
||
|
|
key:
|
||
|
|
description: 'Character string constituting the key to be bound to this string map.'
|
||
|
|
type: string
|
||
|
|
maxLength: 2047
|
||
|
|
value:
|
||
|
|
description: 'Character string constituting the value associated with the key.'
|
||
|
|
type: string
|
||
|
|
maxLength: 2047
|
||
|
|
required: [name, values]
|
||
|
|
|
||
|
|
---
|
||
|
|
apiVersion: apiextensions.k8s.io/v1beta1
|
||
|
|
kind: CustomResourceDefinition
|
||
|
|
metadata:
|
||
|
|
name: ratelimits.citrix.com
|
||
|
|
{{- if .Values.crds.retainOnDelete }}
|
||
|
|
annotations:
|
||
|
|
"helm.sh/resource-policy": keep
|
||
|
|
{{- end }}
|
||
|
|
spec:
|
||
|
|
group: citrix.com
|
||
|
|
version: v1beta1
|
||
|
|
names:
|
||
|
|
kind: ratelimit
|
||
|
|
plural: ratelimits
|
||
|
|
singular: ratelimit
|
||
|
|
scope: Namespaced
|
||
|
|
subresources:
|
||
|
|
status: {}
|
||
|
|
additionalPrinterColumns:
|
||
|
|
- name: Status
|
||
|
|
type: string
|
||
|
|
description: "Current Status of the CRD"
|
||
|
|
JSONPath: .status.state
|
||
|
|
- name: Message
|
||
|
|
type: string
|
||
|
|
description: "Status Message"
|
||
|
|
JSONPath: .status.status_message
|
||
|
|
validation:
|
||
|
|
openAPIV3Schema:
|
||
|
|
properties:
|
||
|
|
spec:
|
||
|
|
properties:
|
||
|
|
servicenames:
|
||
|
|
description: 'Name of the services to which the ratelimit policies are applied.'
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
maxLength: 127
|
||
|
|
selector_keys:
|
||
|
|
description: 'Traffic match criteria to which apply above rate-limit/throttling. All keys are applied as AND condition. If no keys are specified, rate-limit applies at service level'
|
||
|
|
properties:
|
||
|
|
basic:
|
||
|
|
description: "Basic traffic stream selection criteria to which to apply the ratelimit"
|
||
|
|
properties:
|
||
|
|
path:
|
||
|
|
type: array
|
||
|
|
description: "api resource path prefix match. e.g. /api/v1/products"
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
method:
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
enum: ['GET', 'PUT', 'POST','DELETE']
|
||
|
|
header_name:
|
||
|
|
description: "HTTP header that identifies the unique API client for e.g. X-apikey"
|
||
|
|
type: string
|
||
|
|
per_client_ip:
|
||
|
|
description: "Setting this applies the throttling limit to each unique Client IP address accessing the API resource"
|
||
|
|
type: boolean
|
||
|
|
req_threshold:
|
||
|
|
description: 'Max requests per timeslice units to be allowed'
|
||
|
|
type: integer
|
||
|
|
timeslice:
|
||
|
|
description: 'Timeslice in miliseconds in multiple of 10. Defaults to 1000 miliseconds'
|
||
|
|
type: integer
|
||
|
|
limittype:
|
||
|
|
description: "Burst mode or smooth. Defaults to burst mode if the limittype is not specified"
|
||
|
|
type: string
|
||
|
|
enum: ['BURSTY','SMOOTH']
|
||
|
|
throttle_action:
|
||
|
|
type: string
|
||
|
|
enum: ['DROP', 'RESET','REDIRECT', 'RESPOND']
|
||
|
|
description: "Drop will drop the requests exceeding limits, RESET will reset the client connection, Redirect will redirect to specified URL, respond will respond with 429 'Exceeded allowed rate of requests'"
|
||
|
|
redirect_url:
|
||
|
|
type: string
|
||
|
|
description: "Redirect-URL"
|
||
|
|
required: [servicenames, req_threshold]
|
||
|
|
---
|
||
|
|
#Sample CRD instance
|
||
|
|
|
||
|
|
#apiVersion: citrix.com/v1
|
||
|
|
#description: VIP for apache service
|
||
|
|
#kind: vip
|
||
|
|
#metadata:
|
||
|
|
# name: service-apache
|
||
|
|
# namespace: default
|
||
|
|
#spec:
|
||
|
|
# description: VIP for the apache Service
|
||
|
|
# ipaddress: 10.99.98.90
|
||
|
|
# kind: service
|
||
|
|
# name: apache
|
||
|
|
|
||
|
|
apiVersion: apiextensions.k8s.io/v1beta1
|
||
|
|
kind: CustomResourceDefinition
|
||
|
|
metadata:
|
||
|
|
name: vips.citrix.com
|
||
|
|
{{- if .Values.crds.retainOnDelete }}
|
||
|
|
annotations:
|
||
|
|
"helm.sh/resource-policy": keep
|
||
|
|
{{- end }}
|
||
|
|
spec:
|
||
|
|
group: citrix.com
|
||
|
|
version: v1
|
||
|
|
names:
|
||
|
|
kind: vip
|
||
|
|
plural: vips
|
||
|
|
singular: vip
|
||
|
|
scope: Namespaced
|
||
|
|
subresources:
|
||
|
|
status: {}
|
||
|
|
additionalPrinterColumns:
|
||
|
|
- name: Status
|
||
|
|
type: string
|
||
|
|
description: "Current Status of the CRD"
|
||
|
|
JSONPath: .status.state
|
||
|
|
- name: Message
|
||
|
|
type: string
|
||
|
|
description: "Status Message"
|
||
|
|
JSONPath: .status.status_message
|
||
|
|
additionalPrinterColumns:
|
||
|
|
- JSONPath: .spec.ipaddress
|
||
|
|
name: VIP
|
||
|
|
type: string
|
||
|
|
- name: Age
|
||
|
|
type: date
|
||
|
|
JSONPath: .metadata.creationTimestamp
|
||
|
|
validation:
|
||
|
|
openAPIV3Schema:
|
||
|
|
properties:
|
||
|
|
spec:
|
||
|
|
properties:
|
||
|
|
ipaddress:
|
||
|
|
type: string
|
||
|
|
name:
|
||
|
|
type: string
|
||
|
|
kind:
|
||
|
|
type: string
|
||
|
|
enum: ["service", "ingress"]
|
||
|
|
description:
|
||
|
|
type: string
|
||
|
|
---
|
||
|
|
apiVersion: apiextensions.k8s.io/v1beta1
|
||
|
|
kind: CustomResourceDefinition
|
||
|
|
metadata:
|
||
|
|
name: authpolicies.citrix.com
|
||
|
|
{{- if .Values.crds.retainOnDelete }}
|
||
|
|
annotations:
|
||
|
|
"helm.sh/resource-policy": keep
|
||
|
|
{{- end }}
|
||
|
|
spec:
|
||
|
|
group: citrix.com
|
||
|
|
version: v1beta1
|
||
|
|
names:
|
||
|
|
kind: authpolicy
|
||
|
|
plural: authpolicies
|
||
|
|
singular: authpolicy
|
||
|
|
scope: Namespaced
|
||
|
|
subresources:
|
||
|
|
status: {}
|
||
|
|
additionalPrinterColumns:
|
||
|
|
- name: Status
|
||
|
|
type: string
|
||
|
|
description: "Current Status of the CRD"
|
||
|
|
JSONPath: .status.state
|
||
|
|
- name: Message
|
||
|
|
type: string
|
||
|
|
description: "Status Message"
|
||
|
|
JSONPath: .status.status_message
|
||
|
|
validation:
|
||
|
|
openAPIV3Schema:
|
||
|
|
properties:
|
||
|
|
spec:
|
||
|
|
properties:
|
||
|
|
servicenames:
|
||
|
|
description: 'Name of the services that needs to be binded to rewrite policy.'
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
maxLength: 127
|
||
|
|
auth_providers:
|
||
|
|
description: 'Auth Config for required auth providers, one or more of these can be created'
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
description: " create config for a single auth provider of a particular type"
|
||
|
|
properties:
|
||
|
|
name:
|
||
|
|
description: 'Name for this provider, has to be unique, referenced by auth policies'
|
||
|
|
type: string
|
||
|
|
|
||
|
|
oauth:
|
||
|
|
description: 'Auth provided by external oAuth provider'
|
||
|
|
properties:
|
||
|
|
issuer:
|
||
|
|
description: 'Identity of the server whose tokens are to be accepted'
|
||
|
|
type: string
|
||
|
|
jwks_uri:
|
||
|
|
description: 'URL of the endpoint that contains JWKs (Json Web Key) for JWT (Json Web Token) verification'
|
||
|
|
type: string
|
||
|
|
audience:
|
||
|
|
description: 'Audience for which token sent by Authorization server is applicable'
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
token_in_hdr:
|
||
|
|
description: 'custom header name where token is present, default is Authorization header'
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
token_in_param:
|
||
|
|
description: 'query parameter name where token is present'
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
|
||
|
|
basic_local_db:
|
||
|
|
description: 'Basic HTTP authentication, user data in local DB'
|
||
|
|
|
||
|
|
required:
|
||
|
|
- name
|
||
|
|
|
||
|
|
auth_policies:
|
||
|
|
description: "Auth policies"
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
description: "Auth policy"
|
||
|
|
properties:
|
||
|
|
resource:
|
||
|
|
description: " endpoint/resource selection criteria"
|
||
|
|
properties:
|
||
|
|
path:
|
||
|
|
description: "api resource path e.g. /products. "
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
method:
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
enum: ['GET', 'PUT', 'POST','DELETE']
|
||
|
|
required:
|
||
|
|
- path
|
||
|
|
provider:
|
||
|
|
description: "name of the auth provider for the policy, empty if no authentication required"
|
||
|
|
type: array
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
required:
|
||
|
|
- resource
|
||
|
|
- provider
|
||
|
|
|
||
|
|
required:
|
||
|
|
- servicenames
|
||
|
|
|
||
|
|
---
|
||
|
|
apiVersion: apiextensions.k8s.io/v1beta1
|
||
|
|
kind: CustomResourceDefinition
|
||
|
|
metadata:
|
||
|
|
name: listeners.citrix.com
|
||
|
|
{{- if .Values.crds.retainOnDelete }}
|
||
|
|
annotations:
|
||
|
|
"helm.sh/resource-policy": keep
|
||
|
|
{{- end }}
|
||
|
|
status:
|
||
|
|
spec:
|
||
|
|
group: citrix.com
|
||
|
|
version: v1alpha1
|
||
|
|
names:
|
||
|
|
kind: Listener
|
||
|
|
plural: listeners
|
||
|
|
singular: listener
|
||
|
|
scope: Namespaced
|
||
|
|
subresources:
|
||
|
|
status: {}
|
||
|
|
additionalPrinterColumns:
|
||
|
|
- name: Status
|
||
|
|
type: string
|
||
|
|
description: "Current Status of the CRD"
|
||
|
|
JSONPath: .status.state
|
||
|
|
- name: Message
|
||
|
|
type: string
|
||
|
|
description: "Status Message"
|
||
|
|
JSONPath: .status.status_message
|
||
|
|
validation:
|
||
|
|
openAPIV3Schema:
|
||
|
|
required: [spec]
|
||
|
|
properties:
|
||
|
|
spec:
|
||
|
|
type: object
|
||
|
|
required: [protocol]
|
||
|
|
properties:
|
||
|
|
protocol:
|
||
|
|
type: string
|
||
|
|
enum: ["https", "http"]
|
||
|
|
description: "Protocol for this listener"
|
||
|
|
vip:
|
||
|
|
type: string
|
||
|
|
description: "Endpoint IP address, Optional for CPX, required for Tier-1 deployments"
|
||
|
|
port:
|
||
|
|
type: integer
|
||
|
|
minimum: 1
|
||
|
|
maximum: 65535
|
||
|
|
certificates:
|
||
|
|
type: array
|
||
|
|
description: "certificates attached to the endpoints - Not applicable for HTTP"
|
||
|
|
minItems: 1
|
||
|
|
items:
|
||
|
|
type: object
|
||
|
|
properties:
|
||
|
|
preconfigured:
|
||
|
|
type: string
|
||
|
|
description: "Preconfigured Certificate name on ADC "
|
||
|
|
secret:
|
||
|
|
type: object
|
||
|
|
description: "Kuberentes secret object"
|
||
|
|
required: [name]
|
||
|
|
properties:
|
||
|
|
name:
|
||
|
|
type: string
|
||
|
|
description: "name of the Kubernetes Secret object where Cert is located"
|
||
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
||
|
|
namespace:
|
||
|
|
type: string
|
||
|
|
description: "Namespace of the kubernetes secret object; Default is same namespace where the Listener object is located"
|
||
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
||
|
|
default:
|
||
|
|
type: boolean
|
||
|
|
description: "Only one of the certificate can be marked as default which will be presented if none of the cert matches with the hostname"
|
||
|
|
routes:
|
||
|
|
type: array
|
||
|
|
description: "List of route objects attached to the listener"
|
||
|
|
minItems: 1
|
||
|
|
items:
|
||
|
|
type: object
|
||
|
|
properties:
|
||
|
|
name:
|
||
|
|
type: string
|
||
|
|
description: "Name of the HTTPRoute object"
|
||
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
||
|
|
namespace:
|
||
|
|
type: string
|
||
|
|
description: "Namespace of the HTTPRoute object"
|
||
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
||
|
|
labelSelector:
|
||
|
|
description: "Labels key value pair, if the route carries the same labels, it is automatically attached"
|
||
|
|
type: object
|
||
|
|
additionalProperties:
|
||
|
|
type: string
|
||
|
|
oneOf:
|
||
|
|
- required: [name, namespace]
|
||
|
|
- required: [labelSelector]
|
||
|
|
defaultAction:
|
||
|
|
type: object
|
||
|
|
description: "Default action for the listener: One of Backend or Redirect"
|
||
|
|
properties:
|
||
|
|
backend:
|
||
|
|
type: object
|
||
|
|
oneOf:
|
||
|
|
- required: [kube]
|
||
|
|
properties:
|
||
|
|
kube:
|
||
|
|
type: object
|
||
|
|
required: [service, port]
|
||
|
|
properties:
|
||
|
|
service:
|
||
|
|
description: "Name of the backend service"
|
||
|
|
type: string
|
||
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
||
|
|
port:
|
||
|
|
description: "Service port"
|
||
|
|
type: integer
|
||
|
|
minimum: 1
|
||
|
|
maximum: 65535
|
||
|
|
namespace:
|
||
|
|
description: "Service namespace"
|
||
|
|
type: string
|
||
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
||
|
|
backendConfig:
|
||
|
|
description: "General backend service options"
|
||
|
|
properties:
|
||
|
|
secure_backend:
|
||
|
|
description: "Use Secure communications to the backends"
|
||
|
|
type: boolean
|
||
|
|
lbConfig:
|
||
|
|
description: "Citrix ADC LB vserver configurations for the backend. Refer: https://developer-docs.citrix.com/projects/netscaler-nitro-api/en/12.0/configuration/load-balancing/lbvserver/lbvserver/ for all configurations"
|
||
|
|
type: object
|
||
|
|
additionalProperties:
|
||
|
|
type: string
|
||
|
|
servicegroupConfig:
|
||
|
|
description: "Citrix ADC service group configurations for the backend; Refer: https://developer-docs.citrix.com/projects/netscaler-nitro-api/en/12.0/configuration/basic/servicegroup/servicegroup/ for all configurations"
|
||
|
|
type: object
|
||
|
|
additionalProperties:
|
||
|
|
type: string
|
||
|
|
redirect:
|
||
|
|
type: object
|
||
|
|
oneOf:
|
||
|
|
- required: [targetExpression]
|
||
|
|
- required: [hostRedirect]
|
||
|
|
- required: [httpsRedirect]
|
||
|
|
properties:
|
||
|
|
httpsRedirect:
|
||
|
|
description: "Change the scheme from http to https keeping URL intact"
|
||
|
|
type: boolean
|
||
|
|
hostRedirect:
|
||
|
|
description: "Host name specified is used for redirection with URL intact"
|
||
|
|
type: string
|
||
|
|
targetExpression:
|
||
|
|
description: "A target can be specified using Citrix ADC policy expression"
|
||
|
|
type: string
|
||
|
|
responseCode:
|
||
|
|
description: "Default response code is 302, which can be customised using this attribute"
|
||
|
|
type: integer
|
||
|
|
minimum: 100
|
||
|
|
maximum: 599
|
||
|
|
oneOf:
|
||
|
|
- required: ["backend"]
|
||
|
|
- required: ["redirect"]
|
||
|
|
---
|
||
|
|
apiVersion: apiextensions.k8s.io/v1beta1
|
||
|
|
kind: CustomResourceDefinition
|
||
|
|
metadata:
|
||
|
|
name: httproutes.citrix.com
|
||
|
|
{{- if .Values.crds.retainOnDelete }}
|
||
|
|
annotations:
|
||
|
|
"helm.sh/resource-policy": keep
|
||
|
|
{{- end }}
|
||
|
|
spec:
|
||
|
|
group: citrix.com
|
||
|
|
version: v1alpha1
|
||
|
|
names:
|
||
|
|
kind: HTTPRoute
|
||
|
|
plural: httproutes
|
||
|
|
singular: httproute
|
||
|
|
scope: Namespaced
|
||
|
|
subresources:
|
||
|
|
status: {}
|
||
|
|
additionalPrinterColumns:
|
||
|
|
- name: Status
|
||
|
|
type: string
|
||
|
|
description: "Current Status of the CRD"
|
||
|
|
JSONPath: .status.state
|
||
|
|
- name: Message
|
||
|
|
type: string
|
||
|
|
description: "Status Message"
|
||
|
|
JSONPath: .status.status_message
|
||
|
|
validation:
|
||
|
|
openAPIV3Schema:
|
||
|
|
required: [spec]
|
||
|
|
properties:
|
||
|
|
spec:
|
||
|
|
type: object
|
||
|
|
required: [rules]
|
||
|
|
properties:
|
||
|
|
hostname:
|
||
|
|
type: array
|
||
|
|
description: "List of domain names that share the same route, default is '*'"
|
||
|
|
minItems: 1
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
description: "Domain name"
|
||
|
|
rules:
|
||
|
|
type: array
|
||
|
|
description: "List Content routing rules with an action defined"
|
||
|
|
minItems: 1
|
||
|
|
items:
|
||
|
|
type: object
|
||
|
|
required: [name, action]
|
||
|
|
properties:
|
||
|
|
name:
|
||
|
|
type: string
|
||
|
|
description: "A name to represent the rule, this is used as an identifier in content routing policy name in ADC"
|
||
|
|
minLength: 1
|
||
|
|
maxLength: 20
|
||
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
||
|
|
match:
|
||
|
|
type: array
|
||
|
|
description: "List of rules with same action"
|
||
|
|
minItems: 1
|
||
|
|
items:
|
||
|
|
type: object
|
||
|
|
anyOf:
|
||
|
|
- required: [path]
|
||
|
|
- required: [headers]
|
||
|
|
- required: [cookies]
|
||
|
|
- required: [queryParams]
|
||
|
|
- required: [method]
|
||
|
|
- required: [policyExpression]
|
||
|
|
properties:
|
||
|
|
path:
|
||
|
|
type: object
|
||
|
|
description: "URL Path based content routing"
|
||
|
|
properties:
|
||
|
|
prefix:
|
||
|
|
type: string
|
||
|
|
description: "URL path matches the prefix expression"
|
||
|
|
exact:
|
||
|
|
type: string
|
||
|
|
description: "URL Path must match exact path"
|
||
|
|
regex:
|
||
|
|
type: string
|
||
|
|
description: "PCRE based regex expression for path matching"
|
||
|
|
headers:
|
||
|
|
type: array
|
||
|
|
description: "List of header for content routing - Must match all the rules- Treated as AND condition if more than 1 rule"
|
||
|
|
minItems: 1
|
||
|
|
items:
|
||
|
|
type: object
|
||
|
|
description: "Header details for content routing, Check for existence of a header or header name-value match"
|
||
|
|
properties:
|
||
|
|
headerName:
|
||
|
|
type: object
|
||
|
|
description: "Header name based content routing, Here existence of header is used for routing"
|
||
|
|
properties:
|
||
|
|
exact:
|
||
|
|
type: string
|
||
|
|
description: "Header Name - treated as exact must exist"
|
||
|
|
contains:
|
||
|
|
type: string
|
||
|
|
description: "Header Name - A header must exist that contain the string the name"
|
||
|
|
regex:
|
||
|
|
type: string
|
||
|
|
description: "header Name - treated as PCRE regex expression"
|
||
|
|
not:
|
||
|
|
type: boolean
|
||
|
|
description: "Default False, if present, rules are inverted. I.e header name must not exist"
|
||
|
|
oneOf:
|
||
|
|
- required: [exact]
|
||
|
|
- required: [contains]
|
||
|
|
- required: [regex]
|
||
|
|
headerValue:
|
||
|
|
type: object
|
||
|
|
description: "Header Name and Value based match"
|
||
|
|
properties:
|
||
|
|
name:
|
||
|
|
type: string
|
||
|
|
description: "Header name that must match the value"
|
||
|
|
exact:
|
||
|
|
type: string
|
||
|
|
description: "Header value - treated as exact"
|
||
|
|
contains:
|
||
|
|
type: string
|
||
|
|
description: "Header value - treated as contains"
|
||
|
|
regex:
|
||
|
|
type: string
|
||
|
|
description: "header value - treated as PCRE regex expression"
|
||
|
|
not:
|
||
|
|
type: boolean
|
||
|
|
description: "Default False, if present, rules are inverted. I.e header if present must not match the value"
|
||
|
|
oneOf:
|
||
|
|
- required: [name, exact]
|
||
|
|
- required: [name, contains]
|
||
|
|
- required: [name, regex]
|
||
|
|
queryParams:
|
||
|
|
type: array
|
||
|
|
description: "List of Query parameters for content routing - Must match all the rules- Treated as AND condition if more than 1 rule"
|
||
|
|
minItems: 1
|
||
|
|
items:
|
||
|
|
type: object
|
||
|
|
description: "Query parameters Name and Value based match"
|
||
|
|
properties:
|
||
|
|
name:
|
||
|
|
type: string
|
||
|
|
description: "Query name that must match the value. If no value is specified, matches with any value"
|
||
|
|
exact:
|
||
|
|
type: string
|
||
|
|
description: "Query value - Exact match"
|
||
|
|
contains:
|
||
|
|
type: string
|
||
|
|
description: "Query value - value must have the string(substring)"
|
||
|
|
regex:
|
||
|
|
type: string
|
||
|
|
description: "Query value - Value must match this regex patterm"
|
||
|
|
not:
|
||
|
|
type: boolean
|
||
|
|
description: "Default False, if present, rules are inverted. I.e query if present must not match the value"
|
||
|
|
anyOf:
|
||
|
|
- required: [name]
|
||
|
|
- oneOf:
|
||
|
|
- required: [name, exact]
|
||
|
|
- required: [name, contains]
|
||
|
|
- required: [name, regex]
|
||
|
|
cookies:
|
||
|
|
type: array
|
||
|
|
description: "List of Cookie params for content routing - Must match all the rules- Treated as AND condition if more than 1 rule"
|
||
|
|
minItems: 1
|
||
|
|
items:
|
||
|
|
type: object
|
||
|
|
description: "Cookie based routing"
|
||
|
|
properties:
|
||
|
|
name:
|
||
|
|
type: string
|
||
|
|
description: "cookie name that must match the value. If no value specified, it matches with any value"
|
||
|
|
exact:
|
||
|
|
type: string
|
||
|
|
description: "cookie value - treated as exact"
|
||
|
|
contains:
|
||
|
|
type: string
|
||
|
|
description: "cookie value - treated as substring"
|
||
|
|
regex:
|
||
|
|
type: string
|
||
|
|
description: "cookie value - treated as PCRE regex expression"
|
||
|
|
not:
|
||
|
|
type: boolean
|
||
|
|
description: "Default False, if present, rules are inverted. I.e cookie if present must not match the value"
|
||
|
|
anyOf:
|
||
|
|
- required: [name]
|
||
|
|
- oneOf:
|
||
|
|
- required: [name, exact]
|
||
|
|
- required: [name, contains]
|
||
|
|
- required: [name, regex]
|
||
|
|
method:
|
||
|
|
type: string
|
||
|
|
description: "HTTP method for content routing eg: POST, PUT, DELETE etc"
|
||
|
|
policyExpression:
|
||
|
|
type: string
|
||
|
|
description: "Citrix ADC policy expressions; refer: https://docs.citrix.com/en-us/netscaler/media/expression-prefix.pdf"
|
||
|
|
action:
|
||
|
|
type: object
|
||
|
|
description: "Action for the matched rule"
|
||
|
|
properties:
|
||
|
|
backend:
|
||
|
|
type: object
|
||
|
|
oneOf:
|
||
|
|
- required: [kube]
|
||
|
|
properties:
|
||
|
|
kube:
|
||
|
|
type: object
|
||
|
|
required: [service, port]
|
||
|
|
properties:
|
||
|
|
service:
|
||
|
|
description: "Name of the backend service"
|
||
|
|
type: string
|
||
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
||
|
|
port:
|
||
|
|
description: "Service port"
|
||
|
|
type: integer
|
||
|
|
minimum: 1
|
||
|
|
maximum: 65535
|
||
|
|
backendConfig:
|
||
|
|
description: "General backend service options"
|
||
|
|
properties:
|
||
|
|
secure_backend:
|
||
|
|
description: "Use Secure communications to the backends"
|
||
|
|
type: boolean
|
||
|
|
lbConfig:
|
||
|
|
description: "Citrix ADC LB vserver configurations for the backend. Refer: https://developer-docs.citrix.com/projects/netscaler-nitro-api/en/12.0/configuration/load-balancing/lbvserver/lbvserver/ for all configurations"
|
||
|
|
type: object
|
||
|
|
additionalProperties:
|
||
|
|
type: string
|
||
|
|
servicegroupConfig:
|
||
|
|
description: "Citrix ADC service group configurations for the backend; Refer: https://developer-docs.citrix.com/projects/netscaler-nitro-api/en/12.0/configuration/basic/servicegroup/servicegroup/ for all configurations"
|
||
|
|
type: object
|
||
|
|
additionalProperties:
|
||
|
|
type: string
|
||
|
|
redirect:
|
||
|
|
type: object
|
||
|
|
oneOf:
|
||
|
|
- required: [targetExpression]
|
||
|
|
- required: [hostRedirect]
|
||
|
|
- required: [httpsRedirect]
|
||
|
|
properties:
|
||
|
|
httpsRedirect:
|
||
|
|
description: "Change the scheme from http to https keeping URL intact"
|
||
|
|
type: boolean
|
||
|
|
hostRedirect:
|
||
|
|
description: "Host name specified is used for redirection with URL intact"
|
||
|
|
type: string
|
||
|
|
targetExpression:
|
||
|
|
description: "A target can be specified using Citrix ADC policy expression"
|
||
|
|
type: string
|
||
|
|
responseCode:
|
||
|
|
description: "Default response code is 302, which can be customised using this attribute"
|
||
|
|
type: integer
|
||
|
|
minimum: 100
|
||
|
|
maximum: 599
|
||
|
|
oneOf:
|
||
|
|
- required: ["backend"]
|
||
|
|
- required: ["redirect"]
|
||
|
|
---
|
||
|
|
apiVersion: apiextensions.k8s.io/v1beta1
|
||
|
|
kind: CustomResourceDefinition
|
||
|
|
metadata:
|
||
|
|
# name must match the spec fields below, and be in the form: <plural>.<group>
|
||
|
|
name: continuousdeployments.citrix.com
|
||
|
|
{{- if .Values.crds.retainOnDelete }}
|
||
|
|
annotations:
|
||
|
|
"helm.sh/resource-policy": keep
|
||
|
|
{{- end }}
|
||
|
|
spec:
|
||
|
|
# group name to use for REST API: /apis/<group>/<version>
|
||
|
|
group: citrix.com
|
||
|
|
# list of versions supported by this CustomResourceDefinition
|
||
|
|
version: v1
|
||
|
|
# - name: v1
|
||
|
|
# Each version can be enabled/disabled by Served flag.
|
||
|
|
# served: true
|
||
|
|
# One and only one version must be marked as the storage version.
|
||
|
|
#storage: true
|
||
|
|
# either Namespaced or Cluster
|
||
|
|
scope: Namespaced
|
||
|
|
subresources:
|
||
|
|
status: {}
|
||
|
|
additionalPrinterColumns:
|
||
|
|
- name: Status
|
||
|
|
type: string
|
||
|
|
description: "Current Status of the CRD"
|
||
|
|
JSONPath: .status.state
|
||
|
|
- name: Message
|
||
|
|
type: string
|
||
|
|
description: "Status Message"
|
||
|
|
JSONPath: .status.status_message
|
||
|
|
names:
|
||
|
|
# plural name to be used in the URL: /apis/<group>/<version>/<plural>
|
||
|
|
plural: continuousdeployments
|
||
|
|
# singular name to be used as an alias on the CLI and for display
|
||
|
|
singular: continuousdeployment
|
||
|
|
# kind is normally the CamelCased singular type. Your resource manifests use this.
|
||
|
|
kind: continuousDeploymentCustomConfig
|
||
|
|
# shortNames allow shorter string to match your resource on the CLI
|
||
|
|
shortNames:
|
||
|
|
- crd
|
||
|
|
|
||
|
|
validation:
|
||
|
|
# openAPIV3Schema is the schema for validating custom objects.
|
||
|
|
openAPIV3Schema:
|
||
|
|
properties:
|
||
|
|
spec:
|
||
|
|
properties:
|
||
|
|
cronSpec:
|
||
|
|
type: integer
|
||
|
|
---
|
||
|
|
{{- end }}
|