Title here
Summary here
API reference
Packages
addons.projectcapsule.dev/v1alpha1
Package v1alpha1 contains API Schema definitions for the addons v1alpha1 API group.
Resource Types
ActionStep
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
apply Apply |
AdmissionConfig
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
warnings AdmissionWarning array | MaxItems: 32 Optional: {} |
AdmissionRule
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
name string | MinLength: 1 | ||
targets string array | MinItems: 1 | ||
operations string array | MinItems: 1 items:Enum: [CREATE UPDATE DELETE] | ||
subresources string array | Subresources defaults to the parent resource only. Use “scale” for /scale, "" for all subresources, and ["", “”] for parent and subresource writes. | Optional: {} | |
audience Audience | Audience selects authenticated request identities. Omitted or empty means everyone. | Optional: {} | |
matchConditions MatchCondition array | MatchConditions are ANDed CEL expressions. An empty list matches all requests. A false result skips this entry. Evaluation errors fail closed for denial rules; warning errors return a diagnostic warning without denying the request. Variables: object, oldObject, request, namespaceObject. Objects are the actual admission payloads (e.g. Scale for /scale); absent objects are null. | MaxItems: 64 Optional: {} | |
when string | Active | Enum: [Active Inactive] | |
action string | Deny | Enum: [Deny] | |
message string | Message is a Go template with target and window context. | MaxLength: 4096 MinLength: 1 |
AdmissionWarning
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
name string | MinLength: 1 | ||
targets string array | MinItems: 1 | ||
operations string array | MinItems: 1 items:Enum: [CREATE UPDATE DELETE] | ||
subresources string array | Subresources defaults to the parent resource only. Use “scale” for /scale, "" for all subresources, and ["", “”] for parent and subresource writes. | Optional: {} | |
audience Audience | Audience selects authenticated request identities. Omitted or empty means everyone. | Optional: {} | |
matchConditions MatchCondition array | MatchConditions are ANDed CEL expressions. An empty list matches all requests. A false result skips this entry. Evaluation errors fail closed for denial rules; warning errors return a diagnostic warning without denying the request. Variables: object, oldObject, request, namespaceObject. Objects are the actual admission payloads (e.g. Scale for /scale); absent objects are null. | MaxItems: 64 Optional: {} | |
when string | Enum: [BeforeStart Active BeforeEnd] | ||
within Duration | Within is required for BeforeStart/BeforeEnd and must be positive, at most 168h. | Optional: {} | |
message string | MaxLength: 4096 MinLength: 1 |
Apply
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
subresource string | Subresource is an actual Kubernetes subresource, e.g. scale (not rollout). | Optional: {} | |
force boolean | Force explicitly transfers ownership of conflicting fields. | Optional: {} | |
template string | Template renders a partial YAML/JSON object. Identity is supplied by the controller. | MaxLength: 65536 MinLength: 1 |
Audience
Audience matches any include subject unless any exclude subject matches. Empty include matches everyone. Subjects are exact, case-sensitive identities; matching a subject does not grant RBAC permissions.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
include Subject array | MaxItems: 64 Optional: {} | ||
exclude Subject array | MaxItems: 64 Optional: {} |
Capture
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
subresource string | Optional: {} | ||
path string | Path is an RFC 6901 JSON pointer. | Pattern: ^/ |
ChangeWindow
ChangeWindow describes scheduled resource changes and admission restrictions.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | addons.projectcapsule.dev/v1alpha1 | ||
kind string | ChangeWindow | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | Optional: {} | |
spec ChangeWindowSpec | |||
status ChangeWindowStatus | Optional: {} |
ChangeWindowSpec
ChangeWindowSpec selects namespaces and resources for scheduled behavior.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
namespaceSelectors LabelSelector array | NamespaceSelectors are ORed for namespaced targets. Required when any target is namespaced. Omit for Node-only windows; Node targets use their own label selector. An explicit empty selector matches all non-protected namespaces. | MaxItems: 16 MinItems: 1 Optional: {} | |
schedules Schedule array | Schedules form a union of overlapping and adjacent windows. | MaxItems: 16 MinItems: 1 | |
targets Target array | MaxItems: 32 MinItems: 1 | ||
serviceAccount ServiceAccountReference | ServiceAccount is the identity used for resource reads and SSA writes. | Optional: {} | |
actions ResourceAction array | MaxItems: 16 Optional: {} | ||
admission AdmissionRule array | MaxItems: 32 Optional: {} | ||
config Config | Optional: {} |
ChangeWindowStatus
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
observedGeneration integer | Optional: {} | ||
active boolean | Optional: {} | ||
windowStart Time | Optional: {} | ||
windowEnd Time | WindowEnd is absent when the effective end is beyond the bounded scheduling horizon. | Optional: {} | |
nextTransition Time | Optional: {} | ||
pendingResources integer | PendingResources counts journal entries still requiring completion. | Optional: {} | |
conditions Condition array | Optional: {} |
Config
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
admission AdmissionConfig | Optional: {} |
MatchCondition
MatchCondition is a named CEL boolean expression compiled with the policy.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
name string | MaxLength: 63 MinLength: 1 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ | ||
expression string | MaxLength: 4096 MinLength: 1 |
RequestMatch
RequestMatch restricts every admission rule and warning by request, identity and CEL conditions.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
targets string array | MinItems: 1 | ||
operations string array | MinItems: 1 items:Enum: [CREATE UPDATE DELETE] | ||
subresources string array | Subresources defaults to the parent resource only. Use “scale” for /scale, "" for all subresources, and ["", “”] for parent and subresource writes. | Optional: {} | |
audience Audience | Audience selects authenticated request identities. Omitted or empty means everyone. | Optional: {} | |
matchConditions MatchCondition array | MatchConditions are ANDed CEL expressions. An empty list matches all requests. A false result skips this entry. Evaluation errors fail closed for denial rules; warning errors return a diagnostic warning without denying the request. Variables: object, oldObject, request, namespaceObject. Objects are the actual admission payloads (e.g. Scale for /scale); absent objects are null. | MaxItems: 64 Optional: {} |
ResourceAction
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
name string | MinLength: 1 | ||
targets string array | MinItems: 1 | ||
capture object (keys:string, values:
Capture) | Capture stores only explicitly selected JSON pointer values before any mutation. | MaxProperties: 32 Optional: {} | |
onStart ActionStep | Optional: {} | ||
onEnd ActionStep | Optional: {} |
Schedule
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
name string | MaxLength: 63 MinLength: 1 | ||
cron string | Cron is a standard five-field cron expression; seconds and TZ prefixes are not accepted. | MaxLength: 256 | |
timeZone string | UTC | ||
duration Duration | Duration is elapsed time, greater than zero and at most 168h. |
ServiceAccountReference
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
namespace string | MinLength: 1 | ||
name string | MinLength: 1 |
Subject
Subject identifies an authenticated user, group, or namespaced service account.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
kind string | Enum: [User Group ServiceAccount] | ||
name string | MaxLength: 256 MinLength: 1 | ||
namespace string | Namespace is mandatory for ServiceAccounts and forbidden for Users and Groups. | MaxLength: 63 MinLength: 1 Optional: {} |
Target
Target selects a resource kind and labels. Admission targets support Capsule GVK patterns and match namespaced resources only, except concrete v1 Node targets. Scheduled actions require a concrete namespaced apiVersion and kind.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
name string | MinLength: 1 | ||
apiVersion string | APIVersion uses Capsule GVK matching: omitted/empty means core v1; apps matches any apps version, apps/v1 is exact, and * matches all groups and versions. Partial patterns such as apps/* and *.example.com/v1 work too. | MaxLength: 256 Optional: {} | |
kind string | Kind is case-sensitive and supports * patterns, for example Set or Deploy. | MaxLength: 256 MinLength: 1 | |
selector LabelSelector | Selector selects resource labels. For Nodes it selects nodes directly; for namespaced targets it applies within the selected namespaces. | Optional: {} |