The module lifecycle stage: Generally available version

The module has requirements for installation

Deckhouse Platform installs CRDs but does not remove them when a module is disabled. If you no longer need the created CRDs, delete them.

ClusterPeer

Short names: cpeer

Scope: Cluster
Version: v1alpha1

Peering with another cluster.
  • spec
    object
    • spec.capabilities
      array of strings
      Names of PeeringCapability objects available to modules of the other cluster.
      • spec.capabilities.Element of the array
        string

        Maximum length: 63

    • spec.invite
      object
      Settings for the Invite type.
      • spec.invite.expectedClusterUUID
        string
        UUID of the cluster allowed to join.

        Maximum length: 36

      • spec.invite.tokenTTL
        string
        Validity period of the connection string.
    • spec.join
      object
      Settings for the Join type.
      • spec.join.connectionString
        string

        Connection string issued by the other cluster.

        Without permission on the clusterpeers/sensitive subresource the API returns <omitted> instead of the value.

        Maximum length: 4096

      • spec.join.expectedClusterUUID
        string
        UUID of the cluster that issued the connection string.

        Maximum length: 36

    • spec.type
      string

      Required value

      Role of the cluster in the peering: Invite or Join.

      Allowed values: Invite, Join

  • status
    object
    • status.access
      object
      • status.access.audiences
        array of objects
        • status.access.audiences.audience
          string
        • status.access.audiences.capability
          string
      • status.access.caBundle
        string
      • status.access.endpoint
        string
    • status.conditions
      array of objects

      State of the peering.

      • Ready — whether the peering works; False carries the reason of the failure.
      • ClientCertEnforced — whether the peering-gateway entrance refuses a request without a client certificate: ClientCertRequired — it refuses; ClientCertNotRequired — it lets the request through; EntranceUnreachable — the self-check could not tell, the entrance did not answer or answered without serving.
      • ServerCertOurs — whether the peering-gateway entrance presents a certificate issued by the peering CA of this cluster for its host: PeeringRootCert — it does; ForeignCert — it does not, or the entrance certificate issued by the peering CA is expired or not yet valid, and peers cannot connect; EntranceUnreachable — the handshake brought no certificate.
      • TokenExchangeReady — whether user-authn made ready the TokenExchangeProvider of the peer, through which Dex of this cluster exchanges the tokens of the consumers of the peer: ProviderReady — it did; ProviderPending — the provider is just created or changed and user-authn has not applied it yet; ProviderDeleting — the provider is being deleted and is created again once it is gone; PrefixConflict, InvalidSpec, DiscoveryFailed, ApplyError — the reason user-authn gave the provider, passed as is with its message (ProviderNotReady when the reason or the status of the provider cannot be read); ProviderRejected — the API server refused to read or write the provider, or the keys of the peer are not a JWK Set; ForeignProvider — the provider name is taken by an object the module did not write; AwaitingIssuer — the peer has not published the issuer of its ServiceAccount tokens yet.

      ClientCertEnforced and ServerCertOurs do not affect Ready; neither does TokenExchangeReady, except that with ProviderRejected and ForeignProvider the pass also fails with Ready=False.

      • status.conditions.lastTransitionTime
        string
      • status.conditions.message
        string
      • status.conditions.observedGeneration
        integer

        Allowed values: 0 <= X

      • status.conditions.reason
        string

        Maximum length: 1024

      • status.conditions.status
        string

        Allowed values: True, False, Unknown

      • status.conditions.type
        string

        Maximum length: 316

    • status.effectiveCapabilities
      array of strings
      • status.effectiveCapabilities.Element of the array
        string

        Maximum length: 63

    • status.grants
      array of objects
      Access of the other cluster’s modules, per capability.
      • status.grants.capability
        string
        Capability name.
      • status.grants.namespaces
        array of strings
        Namespaces where the access applies.
    • status.invite
      object
      Issued connection string.
      • status.invite.connectionString
        string

        Connection string.

        Without permission on the clusterpeers/sensitive subresource the API returns <omitted> instead of the value.

        Maximum length: 4096

      • status.invite.expiresAt
        string
        Connection string expiration time.
      • status.invite.tokenHash
        string
        Connection string hash.

        Maximum length: 64

      • status.invite.tokenID
        string
        Connection string ID.

        Maximum length: 16

      • status.invite.used
        boolean
        Whether the connection string has been used.
    • status.observedGeneration
      integer
    • status.offer
      object
      Data the other cluster receives.
      • status.offer.capabilities
        array of objects
        Peering capabilities.
        • status.offer.capabilities.name
          string
          Capability name.
        • status.offer.capabilities.scope
          array of strings
          Capability scope: project or cluster.
        • status.offer.capabilities.version
          string
          Capability version.
      • status.offer.issuer
        object
        ServiceAccount token issuer.
        • status.offer.issuer.jwks
          string
          Issuer public keys in the JWKS format.
        • status.offer.issuer.url
          string
          Issuer URL.
      • status.offer.peeringVersion
        string
        Version of the peering module.

        Maximum length: 64

      • status.offer.projects
        array of objects
        Projects available for pairing.
        • status.offer.projects.name
          string
          Project name.
        • status.offer.projects.namespaces
          array of strings
          Project namespaces.
    • status.pairedProjectsCount
      integer
      Number of paired projects.
    • status.peer
      object
      Data received from the other cluster.
      • status.peer.alias
        string

        Maximum length: 1048576

      • status.peer.capabilities
        array of objects
        Peering capabilities.
        • status.peer.capabilities.name
          string
          Capability name.

          Maximum length: 1048576

        • status.peer.capabilities.scope
          array of strings
          Capability scope: project or cluster.
          • status.peer.capabilities.scope.Element of the array
            string

            Maximum length: 1048576

        • status.peer.capabilities.version
          string
          Capability version.

          Maximum length: 1048576

      • status.peer.clusterUUID
        string

        Maximum length: 1048576

      • status.peer.endpoint
        string

        Maximum length: 1048576

      • status.peer.issuer
        object
        ServiceAccount token issuer.
        • status.peer.issuer.jwks
          string
          Issuer public keys in the JWKS format.

          Maximum length: 1048576

        • status.peer.issuer.url
          string
          Issuer URL.

          Maximum length: 1048576

      • status.peer.lastSyncTime
        string
      • status.peer.peeringVersion
        string
        Version of the peering module.

        Maximum length: 64

      • status.peer.projects
        array of objects
        Projects available for pairing.
        • status.peer.projects.name
          string
          Project name.

          Maximum length: 1048576

        • status.peer.projects.namespaces
          array of strings
          Project namespaces.
          • status.peer.projects.namespaces.Element of the array
            string

            Maximum length: 1048576

    • status.phase
      string

      Allowed values: Pending, Active, Error

PeeringCapability

Short names: peercap

Scope: Cluster
Version: v1alpha1

Peering capability of a Deckhouse Platform module.
  • spec
    object
    • spec.consumers
      array of objects
      ServiceAccounts of the module controllers.
      • spec.consumers.kind
        string

        Default: ServiceAccount

        Allowed values: ServiceAccount

      • spec.consumers.name
        string

        Maximum length: 253

      • spec.consumers.namespace
        string

        Maximum length: 63

    • spec.rules
      array of objects
      Resource access rules.
      • spec.rules.apiGroups
        array of strings
        • spec.rules.apiGroups.Element of the array
          string

          Maximum length: 253

      • spec.rules.nonResourceURLs
        array of strings
        • spec.rules.nonResourceURLs.Element of the array
          string

          Maximum length: 253

      • spec.rules.resourceNames
        array of strings
        • spec.rules.resourceNames.Element of the array
          string

          Maximum length: 253

      • spec.rules.resources
        array of strings
        • spec.rules.resources.Element of the array
          string

          Maximum length: 253

      • spec.rules.verbs
        array of strings
        • spec.rules.verbs.Element of the array
          string

          Maximum length: 253

    • spec.version
      string

      Required value

      Capability version.

      Maximum length: 64

  • status
    object
    Peering capability validation status.
    • status.conditions
      array of objects
      • status.conditions.lastTransitionTime
        string
      • status.conditions.message
        string
      • status.conditions.observedGeneration
        integer

        Allowed values: 0 <= X

      • status.conditions.reason
        string

        Maximum length: 1024

      • status.conditions.status
        string

        Allowed values: True, False, Unknown

      • status.conditions.type
        string

        Maximum length: 316

    • status.observedGeneration
      integer

ProjectPeer

Scope: Namespaced
Version: v1alpha1

Pairing of the project with the project of the same name in another cluster.
  • status
    object
    • status.capabilities
      array of objects
      Peering capabilities in the project.
      • status.capabilities.name
        string
        Capability name.
      • status.capabilities.scope
        array of strings
        Capability scope: project or cluster.
      • status.capabilities.version
        string
        Capability version.
    • status.clusterUUID
      string
      UUID of the other cluster.
    • status.message
      string
      State details.
    • status.reason
      string
      Reason for the state.
    • status.remoteNamespaces
      array of strings
      Project namespaces in the other cluster.
    • status.state
      string
      Pairing state.

      Allowed values: Paired, PeerUnreachable