--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.21.0 name: changewindows.addons.projectcapsule.dev spec: group: addons.projectcapsule.dev names: kind: ChangeWindow listKind: ChangeWindowList plural: changewindows shortNames: - cw singular: changewindow scope: Cluster versions: - additionalPrinterColumns: - jsonPath: .status.conditions[?(@.type=='Ready')].status name: Ready type: string - jsonPath: .status.active name: Active type: boolean - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: ChangeWindow describes scheduled resource changes and admission restrictions. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ChangeWindowSpec selects namespaces and resources for scheduled behavior. properties: actions: items: properties: capture: additionalProperties: properties: path: description: Path is an RFC 6901 JSON pointer. pattern: ^/ type: string subresource: type: string required: - path type: object description: Capture stores only explicitly selected JSON pointer values before any mutation. maxProperties: 32 type: object name: minLength: 1 type: string onEnd: properties: apply: properties: force: description: Force explicitly transfers ownership of conflicting fields. type: boolean subresource: description: Subresource is an actual Kubernetes subresource, e.g. scale (not rollout). type: string template: description: Template renders a partial YAML/JSON object. Identity is supplied by the controller. maxLength: 65536 minLength: 1 type: string required: - template type: object required: - apply type: object onStart: properties: apply: properties: force: description: Force explicitly transfers ownership of conflicting fields. type: boolean subresource: description: Subresource is an actual Kubernetes subresource, e.g. scale (not rollout). type: string template: description: Template renders a partial YAML/JSON object. Identity is supplied by the controller. maxLength: 65536 minLength: 1 type: string required: - template type: object required: - apply type: object targets: items: type: string minItems: 1 type: array required: - name - targets type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map admission: items: properties: action: default: Deny enum: - Deny type: string audience: description: Audience selects authenticated request identities. Omitted or empty means everyone. properties: exclude: items: description: Subject identifies an authenticated user, group, or namespaced service account. properties: kind: enum: - User - Group - ServiceAccount type: string name: maxLength: 256 minLength: 1 type: string namespace: description: Namespace is mandatory for ServiceAccounts and forbidden for Users and Groups. maxLength: 63 minLength: 1 type: string required: - kind - name type: object x-kubernetes-validations: - message: namespace is required only for ServiceAccount subjects rule: (self.kind == 'ServiceAccount') == has(self.namespace) maxItems: 64 type: array x-kubernetes-list-type: atomic include: items: description: Subject identifies an authenticated user, group, or namespaced service account. properties: kind: enum: - User - Group - ServiceAccount type: string name: maxLength: 256 minLength: 1 type: string namespace: description: Namespace is mandatory for ServiceAccounts and forbidden for Users and Groups. maxLength: 63 minLength: 1 type: string required: - kind - name type: object x-kubernetes-validations: - message: namespace is required only for ServiceAccount subjects rule: (self.kind == 'ServiceAccount') == has(self.namespace) maxItems: 64 type: array x-kubernetes-list-type: atomic type: object matchConditions: description: |- MatchConditions are ANDed CEL expressions. An empty list matches all requests. A false result skips this entry. Evaluation errors fail closed for denial rules; warning errors return a diagnostic warning without denying the request. Variables: object, oldObject, request, namespaceObject. Objects are the actual admission payloads (e.g. Scale for /scale); absent objects are null. items: description: MatchCondition is a named CEL boolean expression compiled with the policy. properties: expression: maxLength: 4096 minLength: 1 type: string name: maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string required: - expression - name type: object maxItems: 64 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map message: description: Message is a Go template with target and window context. maxLength: 4096 minLength: 1 type: string name: minLength: 1 type: string operations: items: enum: - CREATE - UPDATE - DELETE type: string minItems: 1 type: array subresources: description: |- Subresources defaults to the parent resource only. Use "scale" for /scale, "*" for all subresources, and ["", "*"] for parent and subresource writes. items: type: string type: array targets: items: type: string minItems: 1 type: array when: default: Active enum: - Active - Inactive type: string required: - message - name - operations - targets type: object maxItems: 32 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map config: properties: admission: properties: warnings: items: properties: audience: description: Audience selects authenticated request identities. Omitted or empty means everyone. properties: exclude: items: description: Subject identifies an authenticated user, group, or namespaced service account. properties: kind: enum: - User - Group - ServiceAccount type: string name: maxLength: 256 minLength: 1 type: string namespace: description: Namespace is mandatory for ServiceAccounts and forbidden for Users and Groups. maxLength: 63 minLength: 1 type: string required: - kind - name type: object x-kubernetes-validations: - message: namespace is required only for ServiceAccount subjects rule: (self.kind == 'ServiceAccount') == has(self.namespace) maxItems: 64 type: array x-kubernetes-list-type: atomic include: items: description: Subject identifies an authenticated user, group, or namespaced service account. properties: kind: enum: - User - Group - ServiceAccount type: string name: maxLength: 256 minLength: 1 type: string namespace: description: Namespace is mandatory for ServiceAccounts and forbidden for Users and Groups. maxLength: 63 minLength: 1 type: string required: - kind - name type: object x-kubernetes-validations: - message: namespace is required only for ServiceAccount subjects rule: (self.kind == 'ServiceAccount') == has(self.namespace) maxItems: 64 type: array x-kubernetes-list-type: atomic type: object matchConditions: description: |- MatchConditions are ANDed CEL expressions. An empty list matches all requests. A false result skips this entry. Evaluation errors fail closed for denial rules; warning errors return a diagnostic warning without denying the request. Variables: object, oldObject, request, namespaceObject. Objects are the actual admission payloads (e.g. Scale for /scale); absent objects are null. items: description: MatchCondition is a named CEL boolean expression compiled with the policy. properties: expression: maxLength: 4096 minLength: 1 type: string name: maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string required: - expression - name type: object maxItems: 64 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map message: maxLength: 4096 minLength: 1 type: string name: minLength: 1 type: string operations: items: enum: - CREATE - UPDATE - DELETE type: string minItems: 1 type: array subresources: description: |- Subresources defaults to the parent resource only. Use "scale" for /scale, "*" for all subresources, and ["", "*"] for parent and subresource writes. items: type: string type: array targets: items: type: string minItems: 1 type: array when: enum: - BeforeStart - Active - BeforeEnd type: string within: description: Within is required for BeforeStart/BeforeEnd and must be positive, at most 168h. type: string required: - message - name - operations - targets - when type: object maxItems: 32 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object type: object namespaceSelectors: description: |- NamespaceSelectors are ORed for namespaced targets. Required when any target is namespaced. Omit for Node-only windows; Node targets use their own label selector. An explicit empty selector matches all non-protected namespaces. items: description: |- A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic maxItems: 16 minItems: 1 type: array schedules: description: Schedules form a union of overlapping and adjacent windows. items: properties: cron: description: Cron is a standard five-field cron expression; seconds and TZ prefixes are not accepted. maxLength: 256 type: string duration: description: Duration is elapsed time, greater than zero and at most 168h. type: string name: maxLength: 63 minLength: 1 type: string timeZone: default: UTC type: string required: - cron - duration - name type: object maxItems: 16 minItems: 1 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map serviceAccount: description: ServiceAccount is the identity used for resource reads and SSA writes. properties: name: minLength: 1 type: string namespace: minLength: 1 type: string required: - name - namespace type: object targets: items: description: |- Target selects a resource kind and labels. Admission targets support Capsule GVK patterns and match namespaced resources only, except concrete v1 Node targets. Scheduled actions require a concrete namespaced apiVersion and kind. properties: apiVersion: description: |- APIVersion uses Capsule GVK matching: omitted/empty means core v1; apps matches any apps version, apps/v1 is exact, and * matches all groups and versions. Partial patterns such as apps/* and *.example.com/v1 work too. maxLength: 256 type: string kind: description: Kind is case-sensitive and supports * patterns, for example *Set or Deploy*. maxLength: 256 minLength: 1 type: string name: minLength: 1 type: string selector: description: |- Selector selects resource labels. For Nodes it selects nodes directly; for namespaced targets it applies within the selected namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic required: - kind - name type: object maxItems: 32 minItems: 1 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map required: - schedules - targets type: object x-kubernetes-validations: - message: actions require a serviceAccount rule: '!has(self.actions) || size(self.actions) == 0 || has(self.serviceAccount)' status: properties: active: type: boolean conditions: items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map nextTransition: format: date-time type: string observedGeneration: format: int64 type: integer pendingResources: description: PendingResources counts journal entries still requiring completion. format: int32 type: integer windowEnd: description: WindowEnd is absent when the effective end is beyond the bounded scheduling horizon. format: date-time type: string windowStart: format: date-time type: string type: object required: - spec type: object served: true storage: true subresources: status: {}