The module lifecycle stage: Experimental
The module has requirements for installation
The Deckhouse Kubernetes Platform installs CRDs but does not remove them when a module is disabled. If you no longer need the created CRDs, delete them.
AnsibleRun
Scope: Namespaced
Version: v1alpha1
-
stringapiVersionAPIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-
stringkindKind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-
objectmetadata
-
objectspecAnsibleRunSpec defines the desired state of AnsibleRun.
-
objectspec.connection
Required value
Connection defines over which transport, with which credentials and through which network the run reaches its hosts.-
objectspec.connection.network
Network the run goes through. Omitted means the main network, where the runner stays in the cluster pod network and reaches virtual machines at their status.ipAddress.
Naming an additional network of the sdn module states which network the run is executed in. The runner Pod is attached to that network, and the address of a target virtual machine is taken from it as well. The network must have an address pool (spec.ipam.ipAddressPoolRef). Without one neither the machine nor the runner has an address to use.
Additional networks are available in commercial editions. In the Community Edition a run is executed in the main network, and any other network type is refused.
-
stringspec.connection.network.nameName of the Network or ClusterNetwork. Required for those two types and not allowed for Main, which has no name of its own.
Minimal length:
1 -
stringspec.connection.network.typeType of the network.
Default:
MainAllowed values:
Main,Network,ClusterNetwork
-
-
objectspec.connection.secretRef
Required value
SecretRef references a Kubernetes Secret containing SSH credentials. The Secret must be in the same namespace as the AnsibleRun and contain at least one of (key names follow the built-in kubernetes.io/ssh-auth and kubernetes.io/basic-auth Secret types):
- ssh-privatekey: SSH private key.
- password: SSH password. Optional keys:
- username: SSH username.
- become-password: Password for privilege escalation.
- ansible-vault-password: Password for Ansible Vault, the file encryption format of Ansible itself. The name refers to that format, not to a secret store such as HashiCorp Vault or Deckhouse Stronghold.
-
stringspec.connection.secretRef.name
Required value
Name of the Secret.Minimal length:
1
-
stringspec.connection.typeType of the transport the run reaches its targets over. SSH is the only one today.
Default:
SSHAllowed values:
SSH
-
-
objectspec.playbook
Required value
Playbook defines where the playbook comes from, which part of it runs, and with which values. Options that do not change which tasks run (check mode, diff output, log verbosity) belong to Runner.-
objectspec.playbook.configMapRefConfigMap reference to a ConfigMap containing the playbook.
-
stringspec.playbook.configMapRef.keyKey is the data key in the ConfigMap containing the playbook. Defaults to “playbook.yaml”.
-
stringspec.playbook.configMapRef.name
Required value
Name is the name of the ConfigMap.
-
-
objectspec.playbook.gitGit checks out the playbook project from a Git repository.
-
stringspec.playbook.git.pathPath to the playbook file inside the repository. Defaults to “playbook.yaml”.
-
stringspec.playbook.git.revisionRevision is the branch, tag or commit SHA to check out. Defaults to the default branch of the repository.
-
objectspec.playbook.git.secretRef
SecretRef references a Kubernetes Secret with the repository credentials (key names follow the built-in kubernetes.io/ssh-auth and kubernetes.io/basic-auth Secret types):
- For SSH URLs: ssh-privatekey and known_hosts, both required.
- For HTTP(S) URLs: username and password, where a token is passed as the password, and optionally ca.crt for a self-hosted server with a custom certificate authority.
-
stringspec.playbook.git.secretRef.name
Required value
Name of the Secret.Minimal length:
1
-
stringspec.playbook.git.url
Required value
URL of the repository over HTTP(S) or SSH (explicit ssh:// form; the scp-like git@host:path shorthand is not accepted). SSH URLs require SecretRef.Pattern:
^(https?|ssh)://.+
-
-
stringspec.playbook.inlineInline playbook content.
Maximum length:
65536 -
array of stringsspec.playbook.skipTags
SkipTags leave out the tasks marked with these Ansible tags, the way “ansible-playbook –skip-tags” does.
A tag is any string without whitespace and without a comma. A comma separates tags in the argument, and Ansible strips whitespace itself.
-
stringspec.playbook.skipTags.Element of the array
Length:
1..63Pattern:
^[^\s,]+$
-
-
array of stringsspec.playbook.tags
Tags run only the tasks marked with these Ansible tags, the way “ansible-playbook –tags” does. Set together with SkipTags, the run is what Tags select minus what SkipTags exclude.
The tags Ansible reserves work as they do in the command line. “always” runs under any filter until it is named in SkipTags, “never” runs only when named here, and “tagged”, “untagged” and “all” select tasks by whether they carry a tag at all.
A filter that matches no task is not an error. ansible-playbook succeeds having done nothing, and the run reports it in .status.message.
-
stringspec.playbook.tags.Element of the array
Length:
1..63Pattern:
^[^\s,]+$
-
-
stringspec.playbook.typeType specifies the playbook source type.
Default:
InlineAllowed values:
Inline,ConfigMap,Git -
array of objectsspec.playbook.vars
Vars are the variables this run passes to the playbook, so that one playbook can run with different values. They reach ansible-playbook as –extra-vars, the highest level of Ansible precedence, so they take precedence over the values set by the playbook and its project, and over the host variables of a target.
A name may appear once. Entries are identified by name, so a server-side apply merges the list by variable rather than replacing it whole.
-
stringspec.playbook.vars.nameName of the variable, as the playbook refers to it. An Ansible identifier: a letter or an underscore, then letters, digits and underscores.
Length:
1..63Pattern:
^[A-Za-z_][A-Za-z0-9_]*$ -
spec.playbook.vars.valueValue of the variable. Any YAML the playbook expects, such as a string, a number, a list or a mapping.
-
objectspec.playbook.vars.valueFromValueFrom takes the value from a key of a Secret or a ConfigMap. Such a value is always a string, because it reaches the runner through the Pod environment, and the environment holds strings. A playbook that needs a list or a mapping parses the string itself with the from_yaml filter.
-
objectspec.playbook.vars.valueFrom.configMapKeyRefConfigMapKeyRef takes the value from a key of a ConfigMap in the same namespace.
-
stringspec.playbook.vars.valueFrom.configMapKeyRef.key
Required value
The key to select. -
stringspec.playbook.vars.valueFrom.configMapKeyRef.nameName of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
Default:
‘’ -
booleanspec.playbook.vars.valueFrom.configMapKeyRef.optionalSpecify whether the ConfigMap or its key must be defined
-
-
objectspec.playbook.vars.valueFrom.secretKeyRefSecretKeyRef takes the value from a key of a Secret in the same namespace.
-
stringspec.playbook.vars.valueFrom.secretKeyRef.key
Required value
The key of the secret to select from. Must be a valid secret key. -
stringspec.playbook.vars.valueFrom.secretKeyRef.nameName of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
Default:
‘’ -
booleanspec.playbook.vars.valueFrom.secretKeyRef.optionalSpecify whether the Secret or its key must be defined
-
-
-
-
array of objectsspec.playbook.varsFiles
VarsFiles takes whole sets of variables from YAML documents kept in Secrets and ConfigMaps. This is the manifest form of “-e @vars.yml”, and the place for what a project would keep in group_vars.
The key holds a mapping of variable names to values, and a value keeps the type it was written with. A list stays a list, and “1.10” stays a string because it was quoted. Use a file rather than a key per variable when the set has structure.
The kubelet mounts the file into the runner and the controller never reads it, so its contents never reach an object created by the module, and the variable names inside are not checked. A file is trusted the way the playbook is.
A later entry overrides an earlier one, and everything in Vars overrides all of them.
-
objectspec.playbook.varsFiles.configMapRefConfigMapRef takes the file from a ConfigMap in the same namespace.
-
stringspec.playbook.varsFiles.configMapRef.keyKey is the data key holding the YAML document. Defaults to “vars.yaml”.
Maximum length:
253 -
stringspec.playbook.varsFiles.configMapRef.name
Required value
Name of the object.Length:
1..253 -
booleanspec.playbook.varsFiles.configMapRef.optionalOptional lets the run proceed without these variables when the object or the key is absent. Without it a missing object holds the run in Pending until it appears, and a missing key fails the run.
-
-
objectspec.playbook.varsFiles.secretRefSecretRef takes the file from a Secret in the same namespace.
-
stringspec.playbook.varsFiles.secretRef.keyKey is the data key holding the YAML document. Defaults to “vars.yaml”.
Maximum length:
253 -
stringspec.playbook.varsFiles.secretRef.name
Required value
Name of the object.Length:
1..253 -
booleanspec.playbook.varsFiles.secretRef.optionalOptional lets the run proceed without these variables when the object or the key is absent. Without it a missing object holds the run in Pending until it appears, and a missing key fails the run.
-
-
-
-
objectspec.runnerRunner defines how ansible-playbook is executed, namely check mode, diff output and log verbosity. It never changes which tasks the playbook runs.
-
booleanspec.runner.diffDiff enables ansible-playbook –diff output.
-
booleanspec.runner.dryRunDryRun runs the playbook in Ansible check mode. The run reports what would change without changing anything on the target hosts. Combine with Diff to see the would-be changes in the run output.
-
integerspec.runner.verbosityVerbosity controls ansible-playbook log verbosity, where 0..4 maps to none/-v/-vv/-vvv/-vvvv.
Allowed values:
0 <= X <= 4
-
-
objectspec.target
Required value
Target defines what to run the playbook against, either virtual machines of the platform or hosts named by address. Exactly one block matching Type is set.-
array of objectsspec.target.hosts
Hosts targets hosts named by address. Required when Type is Hosts.
Available in commercial editions. The Community Edition runs against virtual machines of the platform, and a run targeting hosts by address is refused.
-
stringspec.target.hosts.addressAddress of the host: an IP address or a DNS name.
Length:
1..253 -
array of stringsspec.target.hosts.groupsGroups are Ansible groups this host belongs to, in addition to “all”. A group name follows the same rules as a variable name.
-
stringspec.target.hosts.groups.Element of the array
Maximum length:
63Pattern:
^[A-Za-z_][A-Za-z0-9_]*$
-
-
array of objectsspec.target.hosts.vars
Vars are Ansible host variables for this host, facts about this machine declared exactly the way a run variable is. A variable of the same name in spec.playbook.vars takes precedence over one here, because a fact about a machine is written in advance, while the run happens now.
The names follow the rules that apply wherever a variable is named in the spec: what the module sets itself, and the variables Ansible fills in itself, are refused. A name may appear once.
-
stringspec.target.hosts.vars.nameName of the variable, as the playbook refers to it. An Ansible identifier: a letter or an underscore, then letters, digits and underscores.
Length:
1..63Pattern:
^[A-Za-z_][A-Za-z0-9_]*$ -
spec.target.hosts.vars.valueValue of the variable. Any YAML the playbook expects, such as a string, a number, a list or a mapping.
-
objectspec.target.hosts.vars.valueFromValueFrom takes the value from a key of a Secret or a ConfigMap. Such a value is always a string, because it reaches the runner through the Pod environment, and the environment holds strings. A playbook that needs a list or a mapping parses the string itself with the from_yaml filter.
-
objectspec.target.hosts.vars.valueFrom.configMapKeyRefConfigMapKeyRef takes the value from a key of a ConfigMap in the same namespace.
-
stringspec.target.hosts.vars.valueFrom.configMapKeyRef.key
Required value
The key to select. -
stringspec.target.hosts.vars.valueFrom.configMapKeyRef.nameName of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
Default:
‘’ -
booleanspec.target.hosts.vars.valueFrom.configMapKeyRef.optionalSpecify whether the ConfigMap or its key must be defined
-
-
objectspec.target.hosts.vars.valueFrom.secretKeyRefSecretKeyRef takes the value from a key of a Secret in the same namespace.
-
stringspec.target.hosts.vars.valueFrom.secretKeyRef.key
Required value
The key of the secret to select from. Must be a valid secret key. -
stringspec.target.hosts.vars.valueFrom.secretKeyRef.nameName of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
Default:
‘’ -
booleanspec.target.hosts.vars.valueFrom.secretKeyRef.optionalSpecify whether the Secret or its key must be defined
-
-
-
-
-
stringspec.target.type
Required value
Type selects the target kind.Allowed values:
VirtualMachines,Hosts -
objectspec.target.virtualMachinesVirtualMachines targets virtual machines. Required when Type is VirtualMachines.
-
array of stringsspec.target.virtualMachines.namesNames lists specific VirtualMachine names to target. Mutually exclusive with Selector.
-
objectspec.target.virtualMachines.selectorSelector defines which VirtualMachines to target by labels. The selector must not be empty. A run is executed once, so targeting every VirtualMachine in the namespace by accident is not allowed. List explicit labels or use Names instead. Mutually exclusive with Names.
-
array of objectsspec.target.virtualMachines.selector.matchExpressionsmatchExpressions is a list of label selector requirements. The requirements are ANDed.
-
stringspec.target.virtualMachines.selector.matchExpressions.keykey is the label key that the selector applies to.
-
stringspec.target.virtualMachines.selector.matchExpressions.operatoroperator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-
array of stringsspec.target.virtualMachines.selector.matchExpressions.valuesvalues is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-
-
objectspec.target.virtualMachines.selector.matchLabelsmatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.
-
-
-
-
-
objectstatusAnsibleRunStatus defines the observed state of AnsibleRun.
-
stringstatus.completionTimeCompletionTime is the time the run finished.
-
array of objectsstatus.conditionsConditions represent the latest available observations of the object’s state.
-
stringstatus.conditions.lastTransitionTimelastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
-
stringstatus.conditions.messagemessage is a human readable message indicating details about the transition. This may be an empty string.
Maximum length:
32768 -
integerstatus.conditions.observedGenerationobservedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
Allowed values:
0 <= X -
stringstatus.conditions.reasonreason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
Length:
1..1024Pattern:
^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ -
stringstatus.conditions.statusstatus of the condition, one of True, False, Unknown.
Allowed values:
True,False,Unknown -
stringstatus.conditions.typetype of condition in CamelCase or in foo.example.com/CamelCase.
Maximum length:
316Pattern:
^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-
-
array of objectsstatus.failuresFailures contains details of failed tasks (max 20).
-
stringstatus.failures.hostHost where the task failed.
-
stringstatus.failures.messageError message.
-
stringstatus.failures.taskName of the failed task.
-
-
array of objectsstatus.hostsHosts contains one entry per targeted host. The entry holds the name and the address resolved when the run started, and the per-host playbook statistics filled in when the run finishes.
-
stringstatus.hosts.addressAddress of the host resolved when the run started.
-
integerstatus.hosts.changedNumber of changed tasks.
-
integerstatus.hosts.failedNumber of failed tasks.
-
integerstatus.hosts.ignoredNumber of tasks that failed under ignore_errors and did not fail the run.
-
stringstatus.hosts.nameName of the host.
-
integerstatus.hosts.okNumber of completed tasks.
-
integerstatus.hosts.rescuedNumber of tasks that failed and were recovered by a rescue block.
-
integerstatus.hosts.skippedNumber of skipped tasks.
-
integerstatus.hosts.unreachableNumber of unreachable results reported for this host by its PLAY RECAP line, and a non-zero value means the playbook could not reach the host.
-
-
stringstatus.messageMessage is a human-readable summary of the current state. On failure it also names the runner Pod whose logs hold the full playbook output. It is derived from the run outcome and PodRef, so it is always populated regardless of whether the Ansible output could be parsed.
-
stringstatus.phase
Required value
Phase represents the current state of the run:
- Pending: The dependencies and the eligible targets are being checked, and there is no Pod yet.
- Running: The runner Pod is created, the image is pulled, the init containers run, and then the playbook runs.
- PlaybookSucceeded: The playbook completed successfully.
- PlaybookFailed: The playbook ran and reported failed or unreachable hosts.
- Error: The run never reached the playbook, so there is no Ansible output. The stage it stopped at is named by the reason of the Completed condition.
Allowed values:
Pending,Running,PlaybookSucceeded,PlaybookFailed,Error -
stringstatus.playbookCommitPlaybookCommit is the Git commit SHA that was actually checked out and executed. Set only when the playbook source is Git.
-
objectstatus.podRefPodRef references the Pod running the Ansible playbook.
-
stringstatus.podRef.name
Required value
Name of the Pod. -
stringstatus.podRef.namespace
Required value
Namespace of the Pod.
-
-
array of objectsstatus.skippedHostsSkippedHosts contains hosts that were skipped during resolution.
-
stringstatus.skippedHosts.busyByBusyBy is the name of the AnsibleRun that is currently using this target. Only set when Reason is TargetBusy.
-
stringstatus.skippedHosts.nameName of the host.
-
stringstatus.skippedHosts.phasePhase of the target at the time of resolution.
-
stringstatus.skippedHosts.reasonReason for skipping.
Allowed values:
NoAddress,NetworkNotAttached,NoAddressInNetwork,TargetNotReady,TargetNotRunning,TargetNotFound,TargetBusy
-
-
stringstatus.startTimeStartTime is the time the run started.
-
objectstatus.summarySummary contains aggregated statistics across all hosts.
-
integerstatus.summary.failed
Required value
Number of failed hosts. -
integerstatus.summary.skipped
Required value
Number of skipped hosts. -
integerstatus.summary.successful
Required value
Number of successful hosts. -
integerstatus.summary.total
Required value
Total number of hosts targeted by the playbook run (skipped hosts are counted separately in Skipped). -
integerstatus.summary.unreachable
Required value
Number of unreachable hosts.
-
-
AnsibleRunSchedule
Scope: Namespaced
Version: v1alpha1
-
stringapiVersionAPIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-
stringkindKind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-
objectmetadata
-
objectspecAnsibleRunScheduleSpec defines the desired state of AnsibleRunSchedule.
-
stringspec.concurrencyPolicyConcurrencyPolicy describes what to do when the previous run is still active at the next tick: skip the tick (Forbid, default), run anyway (Allow) or delete the active run and start a new one (Replace).
Default:
ForbidAllowed values:
Forbid,Allow,Replace -
integerspec.failedRunsHistoryLimitFailedRunsHistoryLimit is how many failed runs to keep.
Default:
1Allowed values:
0 <= X -
stringspec.schedule
Required value
Schedule in standard cron format (five fields).Minimal length:
1 -
integerspec.startingDeadlineSecondsStartingDeadlineSeconds bounds how late a missed run may still start. A tick missed by more than this is skipped entirely; missed runs are never replayed.
Allowed values:
1 <= X -
integerspec.successfulRunsHistoryLimitSuccessfulRunsHistoryLimit is how many succeeded runs to keep.
Default:
3Allowed values:
0 <= X -
booleanspec.suspendSuspend stops scheduling new runs; already running ones are untouched.
-
objectspec.template
Required value
Template of the AnsibleRun created on every scheduled run.-
objectspec.template.metadataMetadata applied to the created AnsibleRuns.
-
objectspec.template.metadata.annotationsAnnotations to set on the created AnsibleRuns.
-
objectspec.template.metadata.labelsLabels to set on the created AnsibleRuns.
-
-
objectspec.template.spec
Required value
Spec of the created AnsibleRuns.-
objectspec.template.spec.connection
Required value
Connection defines over which transport, with which credentials and through which network the run reaches its hosts.-
objectspec.template.spec.connection.network
Network the run goes through. Omitted means the main network, where the runner stays in the cluster pod network and reaches virtual machines at their status.ipAddress.
Naming an additional network of the sdn module states which network the run is executed in. The runner Pod is attached to that network, and the address of a target virtual machine is taken from it as well. The network must have an address pool (spec.ipam.ipAddressPoolRef). Without one neither the machine nor the runner has an address to use.
Additional networks are available in commercial editions. In the Community Edition a run is executed in the main network, and any other network type is refused.
-
stringspec.template.spec.connection.network.nameName of the Network or ClusterNetwork. Required for those two types and not allowed for Main, which has no name of its own.
Minimal length:
1 -
stringspec.template.spec.connection.network.typeType of the network.
Default:
MainAllowed values:
Main,Network,ClusterNetwork
-
-
objectspec.template.spec.connection.secretRef
Required value
SecretRef references a Kubernetes Secret containing SSH credentials. The Secret must be in the same namespace as the AnsibleRun and contain at least one of (key names follow the built-in kubernetes.io/ssh-auth and kubernetes.io/basic-auth Secret types):
- ssh-privatekey: SSH private key.
- password: SSH password. Optional keys:
- username: SSH username.
- become-password: Password for privilege escalation.
- ansible-vault-password: Password for Ansible Vault, the file encryption format of Ansible itself. The name refers to that format, not to a secret store such as HashiCorp Vault or Deckhouse Stronghold.
-
stringspec.template.spec.connection.secretRef.name
Required value
Name of the Secret.Minimal length:
1
-
stringspec.template.spec.connection.typeType of the transport the run reaches its targets over. SSH is the only one today.
Default:
SSHAllowed values:
SSH
-
-
objectspec.template.spec.playbook
Required value
Playbook defines where the playbook comes from, which part of it runs, and with which values. Options that do not change which tasks run (check mode, diff output, log verbosity) belong to Runner.-
objectspec.template.spec.playbook.configMapRefConfigMap reference to a ConfigMap containing the playbook.
-
stringspec.template.spec.playbook.configMapRef.keyKey is the data key in the ConfigMap containing the playbook. Defaults to “playbook.yaml”.
-
stringspec.template.spec.playbook.configMapRef.name
Required value
Name is the name of the ConfigMap.
-
-
objectspec.template.spec.playbook.gitGit checks out the playbook project from a Git repository.
-
stringspec.template.spec.playbook.git.pathPath to the playbook file inside the repository. Defaults to “playbook.yaml”.
-
stringspec.template.spec.playbook.git.revisionRevision is the branch, tag or commit SHA to check out. Defaults to the default branch of the repository.
-
objectspec.template.spec.playbook.git.secretRef
SecretRef references a Kubernetes Secret with the repository credentials (key names follow the built-in kubernetes.io/ssh-auth and kubernetes.io/basic-auth Secret types):
- For SSH URLs: ssh-privatekey and known_hosts, both required.
- For HTTP(S) URLs: username and password, where a token is passed as the password, and optionally ca.crt for a self-hosted server with a custom certificate authority.
-
stringspec.template.spec.playbook.git.secretRef.name
Required value
Name of the Secret.Minimal length:
1
-
stringspec.template.spec.playbook.git.url
Required value
URL of the repository over HTTP(S) or SSH (explicit ssh:// form; the scp-like git@host:path shorthand is not accepted). SSH URLs require SecretRef.Pattern:
^(https?|ssh)://.+
-
-
stringspec.template.spec.playbook.inlineInline playbook content.
Maximum length:
65536 -
array of stringsspec.template.spec.playbook.skipTags
SkipTags leave out the tasks marked with these Ansible tags, the way “ansible-playbook –skip-tags” does.
A tag is any string without whitespace and without a comma. A comma separates tags in the argument, and Ansible strips whitespace itself.
-
stringspec.template.spec.playbook.skipTags.Element of the array
Length:
1..63Pattern:
^[^\s,]+$
-
-
array of stringsspec.template.spec.playbook.tags
Tags run only the tasks marked with these Ansible tags, the way “ansible-playbook –tags” does. Set together with SkipTags, the run is what Tags select minus what SkipTags exclude.
The tags Ansible reserves work as they do in the command line. “always” runs under any filter until it is named in SkipTags, “never” runs only when named here, and “tagged”, “untagged” and “all” select tasks by whether they carry a tag at all.
A filter that matches no task is not an error. ansible-playbook succeeds having done nothing, and the run reports it in .status.message.
-
stringspec.template.spec.playbook.tags.Element of the array
Length:
1..63Pattern:
^[^\s,]+$
-
-
stringspec.template.spec.playbook.typeType specifies the playbook source type.
Default:
InlineAllowed values:
Inline,ConfigMap,Git -
array of objectsspec.template.spec.playbook.vars
Vars are the variables this run passes to the playbook, so that one playbook can run with different values. They reach ansible-playbook as –extra-vars, the highest level of Ansible precedence, so they take precedence over the values set by the playbook and its project, and over the host variables of a target.
A name may appear once. Entries are identified by name, so a server-side apply merges the list by variable rather than replacing it whole.
-
stringspec.template.spec.playbook.vars.nameName of the variable, as the playbook refers to it. An Ansible identifier: a letter or an underscore, then letters, digits and underscores.
Length:
1..63Pattern:
^[A-Za-z_][A-Za-z0-9_]*$ -
spec.template.spec.playbook.vars.valueValue of the variable. Any YAML the playbook expects, such as a string, a number, a list or a mapping.
-
objectspec.template.spec.playbook.vars.valueFromValueFrom takes the value from a key of a Secret or a ConfigMap. Such a value is always a string, because it reaches the runner through the Pod environment, and the environment holds strings. A playbook that needs a list or a mapping parses the string itself with the from_yaml filter.
-
objectspec.template.spec.playbook.vars.valueFrom.configMapKeyRefConfigMapKeyRef takes the value from a key of a ConfigMap in the same namespace.
-
stringspec.template.spec.playbook.vars.valueFrom.configMapKeyRef.key
Required value
The key to select. -
stringspec.template.spec.playbook.vars.valueFrom.configMapKeyRef.nameName of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
Default:
‘’ -
booleanspec.template.spec.playbook.vars.valueFrom.configMapKeyRef.optionalSpecify whether the ConfigMap or its key must be defined
-
-
objectspec.template.spec.playbook.vars.valueFrom.secretKeyRefSecretKeyRef takes the value from a key of a Secret in the same namespace.
-
stringspec.template.spec.playbook.vars.valueFrom.secretKeyRef.key
Required value
The key of the secret to select from. Must be a valid secret key. -
stringspec.template.spec.playbook.vars.valueFrom.secretKeyRef.nameName of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
Default:
‘’ -
booleanspec.template.spec.playbook.vars.valueFrom.secretKeyRef.optionalSpecify whether the Secret or its key must be defined
-
-
-
-
array of objectsspec.template.spec.playbook.varsFiles
VarsFiles takes whole sets of variables from YAML documents kept in Secrets and ConfigMaps. This is the manifest form of “-e @vars.yml”, and the place for what a project would keep in group_vars.
The key holds a mapping of variable names to values, and a value keeps the type it was written with. A list stays a list, and “1.10” stays a string because it was quoted. Use a file rather than a key per variable when the set has structure.
The kubelet mounts the file into the runner and the controller never reads it, so its contents never reach an object created by the module, and the variable names inside are not checked. A file is trusted the way the playbook is.
A later entry overrides an earlier one, and everything in Vars overrides all of them.
-
objectspec.template.spec.playbook.varsFiles.configMapRefConfigMapRef takes the file from a ConfigMap in the same namespace.
-
stringspec.template.spec.playbook.varsFiles.configMapRef.keyKey is the data key holding the YAML document. Defaults to “vars.yaml”.
Maximum length:
253 -
stringspec.template.spec.playbook.varsFiles.configMapRef.name
Required value
Name of the object.Length:
1..253 -
booleanspec.template.spec.playbook.varsFiles.configMapRef.optionalOptional lets the run proceed without these variables when the object or the key is absent. Without it a missing object holds the run in Pending until it appears, and a missing key fails the run.
-
-
objectspec.template.spec.playbook.varsFiles.secretRefSecretRef takes the file from a Secret in the same namespace.
-
stringspec.template.spec.playbook.varsFiles.secretRef.keyKey is the data key holding the YAML document. Defaults to “vars.yaml”.
Maximum length:
253 -
stringspec.template.spec.playbook.varsFiles.secretRef.name
Required value
Name of the object.Length:
1..253 -
booleanspec.template.spec.playbook.varsFiles.secretRef.optionalOptional lets the run proceed without these variables when the object or the key is absent. Without it a missing object holds the run in Pending until it appears, and a missing key fails the run.
-
-
-
-
objectspec.template.spec.runnerRunner defines how ansible-playbook is executed, namely check mode, diff output and log verbosity. It never changes which tasks the playbook runs.
-
booleanspec.template.spec.runner.diffDiff enables ansible-playbook –diff output.
-
booleanspec.template.spec.runner.dryRunDryRun runs the playbook in Ansible check mode. The run reports what would change without changing anything on the target hosts. Combine with Diff to see the would-be changes in the run output.
-
integerspec.template.spec.runner.verbosityVerbosity controls ansible-playbook log verbosity, where 0..4 maps to none/-v/-vv/-vvv/-vvvv.
Allowed values:
0 <= X <= 4
-
-
objectspec.template.spec.target
Required value
Target defines what to run the playbook against, either virtual machines of the platform or hosts named by address. Exactly one block matching Type is set.-
array of objectsspec.template.spec.target.hosts
Hosts targets hosts named by address. Required when Type is Hosts.
Available in commercial editions. The Community Edition runs against virtual machines of the platform, and a run targeting hosts by address is refused.
-
stringspec.template.spec.target.hosts.addressAddress of the host: an IP address or a DNS name.
Length:
1..253 -
array of stringsspec.template.spec.target.hosts.groupsGroups are Ansible groups this host belongs to, in addition to “all”. A group name follows the same rules as a variable name.
-
stringspec.template.spec.target.hosts.groups.Element of the array
Maximum length:
63Pattern:
^[A-Za-z_][A-Za-z0-9_]*$
-
-
array of objectsspec.template.spec.target.hosts.vars
Vars are Ansible host variables for this host, facts about this machine declared exactly the way a run variable is. A variable of the same name in spec.playbook.vars takes precedence over one here, because a fact about a machine is written in advance, while the run happens now.
The names follow the rules that apply wherever a variable is named in the spec: what the module sets itself, and the variables Ansible fills in itself, are refused. A name may appear once.
-
stringspec.template.spec.target.hosts.vars.nameName of the variable, as the playbook refers to it. An Ansible identifier: a letter or an underscore, then letters, digits and underscores.
Length:
1..63Pattern:
^[A-Za-z_][A-Za-z0-9_]*$ -
spec.template.spec.target.hosts.vars.valueValue of the variable. Any YAML the playbook expects, such as a string, a number, a list or a mapping.
-
objectspec.template.spec.target.hosts.vars.valueFromValueFrom takes the value from a key of a Secret or a ConfigMap. Such a value is always a string, because it reaches the runner through the Pod environment, and the environment holds strings. A playbook that needs a list or a mapping parses the string itself with the from_yaml filter.
-
objectspec.template.spec.target.hosts.vars.valueFrom.configMapKeyRefConfigMapKeyRef takes the value from a key of a ConfigMap in the same namespace.
-
stringspec.template.spec.target.hosts.vars.valueFrom.configMapKeyRef.key
Required value
The key to select. -
stringspec.template.spec.target.hosts.vars.valueFrom.configMapKeyRef.nameName of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
Default:
‘’ -
booleanspec.template.spec.target.hosts.vars.valueFrom.configMapKeyRef.optionalSpecify whether the ConfigMap or its key must be defined
-
-
objectspec.template.spec.target.hosts.vars.valueFrom.secretKeyRefSecretKeyRef takes the value from a key of a Secret in the same namespace.
-
stringspec.template.spec.target.hosts.vars.valueFrom.secretKeyRef.key
Required value
The key of the secret to select from. Must be a valid secret key. -
stringspec.template.spec.target.hosts.vars.valueFrom.secretKeyRef.nameName of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
Default:
‘’ -
booleanspec.template.spec.target.hosts.vars.valueFrom.secretKeyRef.optionalSpecify whether the Secret or its key must be defined
-
-
-
-
-
stringspec.template.spec.target.type
Required value
Type selects the target kind.Allowed values:
VirtualMachines,Hosts -
objectspec.template.spec.target.virtualMachinesVirtualMachines targets virtual machines. Required when Type is VirtualMachines.
-
array of stringsspec.template.spec.target.virtualMachines.namesNames lists specific VirtualMachine names to target. Mutually exclusive with Selector.
-
objectspec.template.spec.target.virtualMachines.selectorSelector defines which VirtualMachines to target by labels. The selector must not be empty. A run is executed once, so targeting every VirtualMachine in the namespace by accident is not allowed. List explicit labels or use Names instead. Mutually exclusive with Names.
-
array of objectsspec.template.spec.target.virtualMachines.selector.matchExpressionsmatchExpressions is a list of label selector requirements. The requirements are ANDed.
-
stringspec.template.spec.target.virtualMachines.selector.matchExpressions.keykey is the label key that the selector applies to.
-
stringspec.template.spec.target.virtualMachines.selector.matchExpressions.operatoroperator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
-
array of stringsspec.template.spec.target.virtualMachines.selector.matchExpressions.valuesvalues is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
-
-
objectspec.template.spec.target.virtualMachines.selector.matchLabelsmatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.
-
-
-
-
-
-
stringspec.timeZoneTimeZone name for the schedule (IANA, for example “Europe/Moscow”). Defaults to UTC.
-
-
objectstatusAnsibleRunScheduleStatus defines the observed state of AnsibleRunSchedule.
-
array of stringsstatus.activeActive lists the names of currently running AnsibleRuns created by this schedule.
-
array of objectsstatus.conditionsConditions represent the latest available observations of the object’s state.
-
stringstatus.conditions.lastTransitionTimelastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
-
stringstatus.conditions.messagemessage is a human readable message indicating details about the transition. This may be an empty string.
Maximum length:
32768 -
integerstatus.conditions.observedGenerationobservedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
Allowed values:
0 <= X -
stringstatus.conditions.reasonreason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
Length:
1..1024Pattern:
^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ -
stringstatus.conditions.statusstatus of the condition, one of True, False, Unknown.
Allowed values:
True,False,Unknown -
stringstatus.conditions.typetype of condition in CamelCase or in foo.example.com/CamelCase.
Maximum length:
316Pattern:
^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-
-
stringstatus.lastScheduleTimeLastScheduleTime is when a run was last created.
-
stringstatus.lastSuccessfulTimeLastSuccessfulTime is when a run last finished successfully.
-