1package v1
  2
  3import (
  4	"cue.dev/x/k8s.io/apimachinery/pkg/apis/meta/v1"
  5	v1_9 "cue.dev/x/k8s.io/api/core/v1"
  6	"cue.dev/x/k8s.io/apimachinery/pkg/util/intstr"
  7)
  8
  9// HTTPIngressPath associates a path with a backend. Incoming urls matching the
 10// path are forwarded to the backend.
 11#HTTPIngressPath: {
 12	// backend defines the referenced service endpoint to which the traffic will be forwarded to.
 13	"backend"!: #IngressBackend
 14
 15	// path is matched against the path of an incoming request. Currently it can
 16	// contain characters disallowed from the conventional "path" part of a URL as
 17	// defined by RFC 3986. Paths must begin with a '/' and must be present when
 18	// using PathType with value "Exact" or "Prefix".
 19	"path"?: string
 20
 21	// pathType determines the interpretation of the path matching. PathType can be
 22	// one of the following values: * Exact: Matches the URL path exactly. *
 23	// Prefix: Matches based on a URL path prefix split by '/'. Matching is
 24	// done on a path element by element basis. A path element refers is the
 25	// list of labels in the path split by the '/' separator. A request is a
 26	// match for path p if every p is an element-wise prefix of p of the
 27	// request path. Note that if the last element of the path is a substring
 28	// of the last element in request path, it is not a match (e.g. /foo/bar
 29	// matches /foo/bar/baz, but does not match /foo/barbaz).
 30	// * ImplementationSpecific: Interpretation of the Path matching is up to
 31	// the IngressClass. Implementations can treat this as a separate PathType
 32	// or treat it identically to Prefix or Exact path types.
 33	// Implementations are required to support all path types.
 34	"pathType"!: string
 35}
 36
 37// HTTPIngressRuleValue is a list of http selectors pointing to backends. In the
 38// example: http://<host>/<path>?<searchpart> -> backend where where parts of
 39// the url correspond to RFC 3986, this resource will be used to match against
 40// everything after the last '/' and before the first '?' or '#'.
 41#HTTPIngressRuleValue: {
 42	// paths is a collection of paths that map requests to backends.
 43	"paths"!: [...#HTTPIngressPath]
 44}
 45
 46// IPAddress represents a single IP of a single IP Family. The object is
 47// designed to be used by APIs that operate on IP addresses. The object is used
 48// by the Service core API for allocation of IP addresses. An IP address can be
 49// represented in different formats, to guarantee the uniqueness of the IP, the
 50// name of the object is the IP address in canonical format, four decimal
 51// digits separated by dots suppressing leading zeros for IPv4 and the
 52// representation defined by RFC 5952 for IPv6. Valid: 192.168.1.5 or
 53// 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1 Invalid: 10.01.2.3 or
 54// 2001:db8:0:0:0::1
 55#IPAddress: {
 56	// APIVersion defines the versioned schema of this representation of an object.
 57	// Servers should convert recognized schemas to the latest internal value, and
 58	// may reject unrecognized values. More info:
 59	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
 60	"apiVersion": "networking.k8s.io/v1"
 61
 62	// Kind is a string value representing the REST resource this object represents.
 63	// Servers may infer this from the endpoint the client submits requests to.
 64	// Cannot be updated. In CamelCase. More info:
 65	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 66	"kind": "IPAddress"
 67
 68	// Standard object's metadata. More info:
 69	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 70	"metadata"?: v1.#ObjectMeta
 71
 72	// spec is the desired state of the IPAddress. More info:
 73	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 74	"spec"!: #IPAddressSpec
 75}
 76
 77// IPAddressList contains a list of IPAddress.
 78#IPAddressList: {
 79	// APIVersion defines the versioned schema of this representation of an object.
 80	// Servers should convert recognized schemas to the latest internal value, and
 81	// may reject unrecognized values. More info:
 82	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
 83	"apiVersion": "networking.k8s.io/v1"
 84
 85	// items is the list of IPAddresses.
 86	"items"!: [...#IPAddress]
 87
 88	// Kind is a string value representing the REST resource this object represents.
 89	// Servers may infer this from the endpoint the client submits requests to.
 90	// Cannot be updated. In CamelCase. More info:
 91	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 92	"kind": "IPAddressList"
 93
 94	// Standard object's metadata. More info:
 95	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 96	"metadata"?: v1.#ListMeta
 97}
 98
 99// IPAddressSpec describe the attributes in an IP Address.
100#IPAddressSpec: {
101	// ParentRef references the resource that an IPAddress is attached to. An
102	// IPAddress must reference a parent object.
103	"parentRef"!: #ParentReference
104}
105
106// IPBlock describes a particular CIDR (Ex. "192.168.1.0/24","2001:db8::/64")
107// that is allowed to the pods matched by a NetworkPolicySpec's podSelector.
108// The except entry describes CIDRs that should not be included within this
109// rule.
110#IPBlock: {
111	// cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
112	"cidr"!: string
113
114	// except is a slice of CIDRs that should not be included within an IPBlock
115	// Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be
116	// rejected if they are outside the cidr range
117	"except"?: [...string]
118}
119
120// Ingress is a collection of rules that allow inbound connections to reach the
121// endpoints defined by a backend. An Ingress can be configured to give
122// services externally-reachable urls, load balance traffic, terminate SSL,
123// offer name based virtual hosting etc.
124#Ingress: {
125	// APIVersion defines the versioned schema of this representation of an object.
126	// Servers should convert recognized schemas to the latest internal value, and
127	// may reject unrecognized values. More info:
128	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
129	"apiVersion": "networking.k8s.io/v1"
130
131	// Kind is a string value representing the REST resource this object represents.
132	// Servers may infer this from the endpoint the client submits requests to.
133	// Cannot be updated. In CamelCase. More info:
134	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
135	"kind": "Ingress"
136
137	// Standard object's metadata. More info:
138	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
139	"metadata"?: v1.#ObjectMeta
140
141	// spec is the desired state of the Ingress. More info:
142	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
143	"spec"?: #IngressSpec
144
145	// status is the current state of the Ingress. More info:
146	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
147	"status"?: #IngressStatus
148}
149
150// IngressBackend describes all endpoints for a given service and port.
151#IngressBackend: {
152	// resource is an ObjectRef to another Kubernetes resource in the namespace of
153	// the Ingress object. If resource is specified, a service.Name and
154	// service.Port must not be specified. This is a mutually exclusive setting
155	// with "Service".
156	"resource"?: v1_9.#TypedLocalObjectReference
157
158	// service references a service as a backend. This is a mutually exclusive setting with "Resource".
159	"service"?: #IngressServiceBackend
160}
161
162// IngressClass represents the class of the Ingress, referenced by the Ingress
163// Spec. The `ingressclass.kubernetes.io/is-default-class` annotation can be
164// used to indicate that an IngressClass should be considered default. When a
165// single IngressClass resource has this annotation set to true, new Ingress
166// resources without a class specified will be assigned this default class.
167#IngressClass: {
168	// APIVersion defines the versioned schema of this representation of an object.
169	// Servers should convert recognized schemas to the latest internal value, and
170	// may reject unrecognized values. More info:
171	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
172	"apiVersion": "networking.k8s.io/v1"
173
174	// Kind is a string value representing the REST resource this object represents.
175	// Servers may infer this from the endpoint the client submits requests to.
176	// Cannot be updated. In CamelCase. More info:
177	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
178	"kind": "IngressClass"
179
180	// Standard object's metadata. More info:
181	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
182	"metadata"?: v1.#ObjectMeta
183
184	// spec is the desired state of the IngressClass. More info:
185	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
186	"spec"?: #IngressClassSpec
187}
188
189// IngressClassList is a collection of IngressClasses.
190#IngressClassList: {
191	// APIVersion defines the versioned schema of this representation of an object.
192	// Servers should convert recognized schemas to the latest internal value, and
193	// may reject unrecognized values. More info:
194	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
195	"apiVersion": "networking.k8s.io/v1"
196
197	// items is the list of IngressClasses.
198	"items"!: [...#IngressClass]
199
200	// Kind is a string value representing the REST resource this object represents.
201	// Servers may infer this from the endpoint the client submits requests to.
202	// Cannot be updated. In CamelCase. More info:
203	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
204	"kind": "IngressClassList"
205
206	// Standard list metadata.
207	"metadata"?: v1.#ListMeta
208}
209
210// IngressClassParametersReference identifies an API object. This can be used to
211// specify a cluster or namespace-scoped resource.
212#IngressClassParametersReference: {
213	// apiGroup is the group for the resource being referenced. If APIGroup is not
214	// specified, the specified Kind must be in the core API group. For any other
215	// third-party types, APIGroup is required.
216	"apiGroup"?: string
217
218	// kind is the type of resource being referenced.
219	"kind"!: string
220
221	// name is the name of resource being referenced.
222	"name"!: string
223
224	// namespace is the namespace of the resource being referenced. This field is
225	// required when scope is set to "Namespace" and must be unset when scope is
226	// set to "Cluster".
227	"namespace"?: string
228
229	// scope represents if this refers to a cluster or namespace scoped resource.
230	// This may be set to "Cluster" (default) or "Namespace".
231	"scope"?: string
232}
233
234// IngressClassSpec provides information about the class of an Ingress.
235#IngressClassSpec: {
236	// controller refers to the name of the controller that should handle this
237	// class. This allows for different "flavors" that are controlled by the same
238	// controller. For example, you may have different parameters for the same
239	// implementing controller. This should be specified as a domain-prefixed path
240	// no more than 250 characters in length, e.g. "acme.io/ingress-controller".
241	// This field is immutable.
242	"controller"?: string
243
244	// parameters is a link to a custom resource containing additional configuration
245	// for the controller. This is optional if the controller does not require
246	// extra parameters.
247	"parameters"?: #IngressClassParametersReference
248}
249
250// IngressList is a collection of Ingress.
251#IngressList: {
252	// APIVersion defines the versioned schema of this representation of an object.
253	// Servers should convert recognized schemas to the latest internal value, and
254	// may reject unrecognized values. More info:
255	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
256	"apiVersion": "networking.k8s.io/v1"
257
258	// items is the list of Ingress.
259	"items"!: [...#Ingress]
260
261	// Kind is a string value representing the REST resource this object represents.
262	// Servers may infer this from the endpoint the client submits requests to.
263	// Cannot be updated. In CamelCase. More info:
264	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
265	"kind": "IngressList"
266
267	// Standard object's metadata. More info:
268	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
269	"metadata"?: v1.#ListMeta
270}
271
272// IngressLoadBalancerIngress represents the status of a load-balancer ingress point.
273#IngressLoadBalancerIngress: {
274	// hostname is set for load-balancer ingress points that are DNS based.
275	"hostname"?: string
276
277	// ip is set for load-balancer ingress points that are IP based.
278	"ip"?: string
279
280	// ports provides information about the ports exposed by this LoadBalancer.
281	"ports"?: [...#IngressPortStatus]
282}
283
284// IngressLoadBalancerStatus represents the status of a load-balancer.
285#IngressLoadBalancerStatus: {
286	// ingress is a list containing ingress points for the load-balancer.
287	"ingress"?: [...#IngressLoadBalancerIngress]
288}
289
290// IngressPortStatus represents the error condition of a service port
291#IngressPortStatus: {
292	// error is to record the problem with the service port The format of the error
293	// shall comply with the following rules: - built-in error values shall be
294	// specified in this file and those shall use
295	// CamelCase names
296	// - cloud provider specific error values must have names that comply with the
297	// format foo.example.com/CamelCase.
298	"error"?: string
299
300	// port is the port number of the ingress port.
301	"port"!: int32 & int
302
303	// protocol is the protocol of the ingress port. The supported values are: "TCP", "UDP", "SCTP"
304	"protocol"!: string
305}
306
307// IngressRule represents the rules mapping the paths under a specified host to
308// the related backend services. Incoming requests are first evaluated for a
309// host match, then routed to the backend associated with the matching
310// IngressRuleValue.
311#IngressRule: {
312	// host is the fully qualified domain name of a network host, as defined by RFC
313	// 3986. Note the following deviations from the "host" part of the URI as
314	// defined in RFC 3986: 1. IPs are not allowed. Currently an IngressRuleValue
315	// can only apply to
316	// the IP in the Spec of the parent Ingress.
317	// 2. The `:` delimiter is not respected because ports are not allowed.
318	// Currently the port of an Ingress is implicitly :80 for http and
319	// :443 for https.
320	// Both these may change in the future. Incoming requests are matched against
321	// the host before the IngressRuleValue. If the host is unspecified, the
322	// Ingress routes all traffic based on the specified IngressRuleValue.
323	//
324	// host can be "precise" which is a domain name without the terminating dot of a
325	// network host (e.g. "foo.bar.com") or "wildcard", which is a domain name
326	// prefixed with a single wildcard label (e.g. "*.foo.com"). The wildcard
327	// character '*' must appear by itself as the first DNS label and matches only
328	// a single label. You cannot have a wildcard label by itself (e.g. Host ==
329	// "*"). Requests will be matched against the Host field in the following way:
330	// 1. If host is precise, the request matches this rule if the http host header
331	// is equal to Host. 2. If host is a wildcard, then the request matches this
332	// rule if the http host header is to equal to the suffix (removing the first
333	// label) of the wildcard rule.
334	"host"?: string
335	"http"?: #HTTPIngressRuleValue
336}
337
338// IngressServiceBackend references a Kubernetes Service as a Backend.
339#IngressServiceBackend: {
340	// name is the referenced service. The service must exist in the same namespace
341	// as the Ingress object.
342	"name"!: string
343
344	// port of the referenced service. A port name or port number is required for a
345	// IngressServiceBackend.
346	"port"?: #ServiceBackendPort
347}
348
349// IngressSpec describes the Ingress the user wishes to exist.
350#IngressSpec: {
351	// defaultBackend is the backend that should handle requests that don't match
352	// any rule. If Rules are not specified, DefaultBackend must be specified. If
353	// DefaultBackend is not set, the handling of requests that do not match any of
354	// the rules will be up to the Ingress controller.
355	"defaultBackend"?: #IngressBackend
356
357	// ingressClassName is the name of an IngressClass cluster resource. Ingress
358	// controller implementations use this field to know whether they should be
359	// serving this Ingress resource, by a transitive connection (controller ->
360	// IngressClass -> Ingress resource). Although the
361	// `kubernetes.io/ingress.class` annotation (simple constant name) was never
362	// formally defined, it was widely supported by Ingress controllers to create a
363	// direct binding between Ingress controller and Ingress resources. Newly
364	// created Ingress resources should prefer using the field. However, even
365	// though the annotation is officially deprecated, for backwards compatibility
366	// reasons, ingress controllers should still honor that annotation if present.
367	"ingressClassName"?: string
368
369	// rules is a list of host rules used to configure the Ingress. If unspecified,
370	// or no rule matches, all traffic is sent to the default backend.
371	"rules"?: [...#IngressRule]
372
373	// tls represents the TLS configuration. Currently the Ingress only supports a
374	// single TLS port, 443. If multiple members of this list specify different
375	// hosts, they will be multiplexed on the same port according to the hostname
376	// specified through the SNI TLS extension, if the ingress controller
377	// fulfilling the ingress supports SNI.
378	"tls"?: [...#IngressTLS]
379}
380
381// IngressStatus describe the current state of the Ingress.
382#IngressStatus: {
383	// loadBalancer contains the current status of the load-balancer.
384	"loadBalancer"?: #IngressLoadBalancerStatus
385}
386
387// IngressTLS describes the transport layer security associated with an ingress.
388#IngressTLS: {
389	// hosts is a list of hosts included in the TLS certificate. The values in this
390	// list must match the name/s used in the tlsSecret. Defaults to the wildcard
391	// host setting for the loadbalancer controller fulfilling this Ingress, if
392	// left unspecified.
393	"hosts"?: [...string]
394
395	// secretName is the name of the secret used to terminate TLS traffic on port
396	// 443. Field is left optional to allow TLS routing based on SNI hostname
397	// alone. If the SNI host in a listener conflicts with the "Host" header field
398	// used by an IngressRule, the SNI host is used for termination and value of
399	// the "Host" header is used for routing.
400	"secretName"?: string
401}
402
403// NetworkPolicy describes what network traffic is allowed for a set of Pods
404#NetworkPolicy: {
405	// APIVersion defines the versioned schema of this representation of an object.
406	// Servers should convert recognized schemas to the latest internal value, and
407	// may reject unrecognized values. More info:
408	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
409	"apiVersion": "networking.k8s.io/v1"
410
411	// Kind is a string value representing the REST resource this object represents.
412	// Servers may infer this from the endpoint the client submits requests to.
413	// Cannot be updated. In CamelCase. More info:
414	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
415	"kind": "NetworkPolicy"
416
417	// Standard object's metadata. More info:
418	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
419	"metadata"?: v1.#ObjectMeta
420
421	// spec represents the specification of the desired behavior for this NetworkPolicy.
422	"spec"?: #NetworkPolicySpec
423}
424
425// NetworkPolicyEgressRule describes a particular set of traffic that is allowed
426// out of pods matched by a NetworkPolicySpec's podSelector. The traffic must
427// match both ports and to. This type is beta-level in 1.8
428#NetworkPolicyEgressRule: {
429	// ports is a list of destination ports for outgoing traffic. Each item in this
430	// list is combined using a logical OR. If this field is empty or missing, this
431	// rule matches all ports (traffic not restricted by port). If this field is
432	// present and contains at least one item, then this rule allows traffic only
433	// if the traffic matches at least one port in the list.
434	"ports"?: [...#NetworkPolicyPort]
435
436	// to is a list of destinations for outgoing traffic of pods selected for this
437	// rule. Items in this list are combined using a logical OR operation. If this
438	// field is empty or missing, this rule matches all destinations (traffic not
439	// restricted by destination). If this field is present and contains at least
440	// one item, this rule allows traffic only if the traffic matches at least one
441	// item in the to list.
442	"to"?: [...#NetworkPolicyPeer]
443}
444
445// NetworkPolicyIngressRule describes a particular set of traffic that is
446// allowed to the pods matched by a NetworkPolicySpec's podSelector. The
447// traffic must match both ports and from.
448#NetworkPolicyIngressRule: {
449	// from is a list of sources which should be able to access the pods selected
450	// for this rule. Items in this list are combined using a logical OR operation.
451	// If this field is empty or missing, this rule matches all sources (traffic
452	// not restricted by source). If this field is present and contains at least
453	// one item, this rule allows traffic only if the traffic matches at least one
454	// item in the from list.
455	"from"?: [...#NetworkPolicyPeer]
456
457	// ports is a list of ports which should be made accessible on the pods selected
458	// for this rule. Each item in this list is combined using a logical OR. If
459	// this field is empty or missing, this rule matches all ports (traffic not
460	// restricted by port). If this field is present and contains at least one
461	// item, then this rule allows traffic only if the traffic matches at least one
462	// port in the list.
463	"ports"?: [...#NetworkPolicyPort]
464}
465
466// NetworkPolicyList is a list of NetworkPolicy objects.
467#NetworkPolicyList: {
468	// APIVersion defines the versioned schema of this representation of an object.
469	// Servers should convert recognized schemas to the latest internal value, and
470	// may reject unrecognized values. More info:
471	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
472	"apiVersion": "networking.k8s.io/v1"
473
474	// items is a list of schema objects.
475	"items"!: [...#NetworkPolicy]
476
477	// Kind is a string value representing the REST resource this object represents.
478	// Servers may infer this from the endpoint the client submits requests to.
479	// Cannot be updated. In CamelCase. More info:
480	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
481	"kind": "NetworkPolicyList"
482
483	// Standard list metadata. More info:
484	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
485	"metadata"?: v1.#ListMeta
486}
487
488// NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain
489// combinations of fields are allowed
490#NetworkPolicyPeer: {
491	// ipBlock defines policy on a particular IPBlock. If this field is set then
492	// neither of the other fields can be.
493	"ipBlock"?: #IPBlock
494
495	// namespaceSelector selects namespaces using cluster-scoped labels. This field
496	// follows standard label selector semantics; if present but empty, it selects
497	// all namespaces.
498	//
499	// If podSelector is also set, then the NetworkPolicyPeer as a whole selects the
500	// pods matching podSelector in the namespaces selected by namespaceSelector.
501	// Otherwise it selects all pods in the namespaces selected by
502	// namespaceSelector.
503	"namespaceSelector"?: v1.#LabelSelector
504
505	// podSelector is a label selector which selects pods. This field follows
506	// standard label selector semantics; if present but empty, it selects all
507	// pods.
508	//
509	// If namespaceSelector is also set, then the NetworkPolicyPeer as a whole
510	// selects the pods matching podSelector in the Namespaces selected by
511	// NamespaceSelector. Otherwise it selects the pods matching podSelector in the
512	// policy's own namespace.
513	"podSelector"?: v1.#LabelSelector
514}
515
516// NetworkPolicyPort describes a port to allow traffic on
517#NetworkPolicyPort: {
518	// endPort indicates that the range of ports from port to endPort if set,
519	// inclusive, should be allowed by the policy. This field cannot be defined if
520	// the port field is not defined or if the port field is defined as a named
521	// (string) port. The endPort must be equal or greater than port.
522	"endPort"?: int32 & int
523
524	// port represents the port on the given protocol. This can either be a
525	// numerical or named port on a pod. If this field is not provided, this
526	// matches all port names and numbers. If present, only traffic on the
527	// specified protocol AND port will be matched.
528	"port"?: intstr.#IntOrString
529
530	// protocol represents the protocol (TCP, UDP, or SCTP) which traffic must
531	// match. If not specified, this field defaults to TCP.
532	"protocol"?: string
533}
534
535// NetworkPolicySpec provides the specification of a NetworkPolicy
536#NetworkPolicySpec: {
537	// egress is a list of egress rules to be applied to the selected pods. Outgoing
538	// traffic is allowed if there are no NetworkPolicies selecting the pod (and
539	// cluster policy otherwise allows the traffic), OR if the traffic matches at
540	// least one egress rule across all of the NetworkPolicy objects whose
541	// podSelector matches the pod. If this field is empty then this NetworkPolicy
542	// limits all outgoing traffic (and serves solely to ensure that the pods it
543	// selects are isolated by default). This field is beta-level in 1.8
544	"egress"?: [...#NetworkPolicyEgressRule]
545
546	// ingress is a list of ingress rules to be applied to the selected pods.
547	// Traffic is allowed to a pod if there are no NetworkPolicies selecting the
548	// pod (and cluster policy otherwise allows the traffic), OR if the traffic
549	// source is the pod's local node, OR if the traffic matches at least one
550	// ingress rule across all of the NetworkPolicy objects whose podSelector
551	// matches the pod. If this field is empty then this NetworkPolicy does not
552	// allow any traffic (and serves solely to ensure that the pods it selects are
553	// isolated by default)
554	"ingress"?: [...#NetworkPolicyIngressRule]
555
556	// podSelector selects the pods to which this NetworkPolicy object applies. The
557	// array of rules is applied to any pods selected by this field. An empty
558	// selector matches all pods in the policy's namespace. Multiple network
559	// policies can select the same set of pods. In this case, the ingress rules
560	// for each are combined additively. This field is optional. If it is not
561	// specified, it defaults to an empty selector.
562	"podSelector"?: v1.#LabelSelector
563
564	// policyTypes is a list of rule types that the NetworkPolicy relates to. Valid
565	// options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field
566	// is not specified, it will default based on the existence of ingress or
567	// egress rules; policies that contain an egress section are assumed to affect
568	// egress, and all policies (whether or not they contain an ingress section)
569	// are assumed to affect ingress. If you want to write an egress-only policy,
570	// you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want
571	// to write a policy that specifies that no egress is allowed, you must specify
572	// a policyTypes value that include "Egress" (since such a policy would not
573	// include an egress section and would otherwise default to just [ "Ingress"
574	// ]). This field is beta-level in 1.8
575	"policyTypes"?: [...string]
576}
577
578// ParentReference describes a reference to a parent object.
579#ParentReference: {
580	// Group is the group of the object being referenced.
581	"group"?: string
582
583	// Name is the name of the object being referenced.
584	"name"!: string
585
586	// Namespace is the namespace of the object being referenced.
587	"namespace"?: string
588
589	// Resource is the resource of the object being referenced.
590	"resource"!: string
591}
592
593// ServiceBackendPort is the service port being referenced.
594#ServiceBackendPort: {
595	// name is the name of the port on the Service. This is a mutually exclusive setting with "Number".
596	"name"?: string
597
598	// number is the numerical port number (e.g. 80) on the Service. This is a
599	// mutually exclusive setting with "Name".
600	"number"?: int32 & int
601}
602
603// ServiceCIDR defines a range of IP addresses using CIDR format (e.g.
604// 192.168.0.0/24 or 2001:db2::/64). This range is used to allocate ClusterIPs
605// to Service objects.
606#ServiceCIDR: {
607	// APIVersion defines the versioned schema of this representation of an object.
608	// Servers should convert recognized schemas to the latest internal value, and
609	// may reject unrecognized values. More info:
610	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
611	"apiVersion": "networking.k8s.io/v1"
612
613	// Kind is a string value representing the REST resource this object represents.
614	// Servers may infer this from the endpoint the client submits requests to.
615	// Cannot be updated. In CamelCase. More info:
616	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
617	"kind": "ServiceCIDR"
618
619	// Standard object's metadata. More info:
620	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
621	"metadata"?: v1.#ObjectMeta
622
623	// spec is the desired state of the ServiceCIDR. More info:
624	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
625	"spec"?: #ServiceCIDRSpec
626
627	// status represents the current state of the ServiceCIDR. More info:
628	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
629	"status"?: #ServiceCIDRStatus
630}
631
632// ServiceCIDRList contains a list of ServiceCIDR objects.
633#ServiceCIDRList: {
634	// APIVersion defines the versioned schema of this representation of an object.
635	// Servers should convert recognized schemas to the latest internal value, and
636	// may reject unrecognized values. More info:
637	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
638	"apiVersion": "networking.k8s.io/v1"
639
640	// items is the list of ServiceCIDRs.
641	"items"!: [...#ServiceCIDR]
642
643	// Kind is a string value representing the REST resource this object represents.
644	// Servers may infer this from the endpoint the client submits requests to.
645	// Cannot be updated. In CamelCase. More info:
646	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
647	"kind": "ServiceCIDRList"
648
649	// Standard object's metadata. More info:
650	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
651	"metadata"?: v1.#ListMeta
652}
653
654// ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.
655#ServiceCIDRSpec: {
656	// CIDRs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or
657	// "2001:db8::/64") from which to assign service cluster IPs. Max of two CIDRs
658	// is allowed, one of each IP family. This field is immutable.
659	"cidrs"?: [...string]
660}
661
662// ServiceCIDRStatus describes the current state of the ServiceCIDR.
663#ServiceCIDRStatus: {
664	// conditions holds an array of metav1.Condition that describe the state of the
665	// ServiceCIDR. Current service state
666	"conditions"?: [...v1.#Condition]
667}