v1alpha1

package
v0.22.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: AGPL-3.0, Apache-2.0 Imports: 20 Imported by: 0

Documentation

Overview

Package v1alpha1 contains the compute.apoxy.dev API group, a redesign of the extensions.apoxy.dev/v1alpha2 EdgeFunction around the workerd runtime and OCI bundles as the primary code-distribution mechanism.

Object model: 

(push) Service.spec.source.oci --resolve tag--> (digest) --\
                                                            >--> ServiceRevision.spec.bundle --> served
(git)  Service.spec.source.git --> Build --emits--> (digest) -/

The OCI bundle digest is the single primitive a Service runs, and it appears only on a minted ServiceRevision.spec.bundle — never authored in the template. Both code sources are variants of one field, spec.source: an oci push or a git/CI pipeline (mutually exclusive). The controller resolves the source to a digest, mints a ServiceRevision, and reports liveRevision/latestRevision in status; it never writes spec. spec.liveRevision selects which revision serves (empty = the latest ready revision, set = pinned for rollback or manual promotion).

Tenancy: single tenant per account. All kinds are cluster-scoped.

Index

Constants

View Source 
const (
	// ServiceBundleConfigMediaType is the OCI config blob: a JSON-encoded
	// BundleManifest describing modules, bindings, and workerd compat.
	ServiceBundleConfigMediaType = "application/vnd.apoxy.dev.service.config.v1+json"
	// ServiceBundleModuleLayerMediaType carries executable modules (JS/Wasm).
	ServiceBundleModuleLayerMediaType = "application/vnd.apoxy.dev.service.modules.v1.tar+gzip"
	// ServiceBundleAssetsLayerMediaType carries static assets served via disk-backed services.
	ServiceBundleAssetsLayerMediaType = "application/vnd.apoxy.dev.service.assets.v1.tar+gzip"
)
View Source 
const (
	// ConditionAccepted (on Service) reports that the Service spec is valid and a
	// ServiceRevision has been minted from spec.template + spec.source.
	ConditionAccepted = "Accepted"
	// ConditionReady (on Service) reports that the Service's intended revision is
	// being served. Which revision each backplane actually serves is a per-node
	// decision the workerd-manager reports over the private publish channel, so
	// this is a control-plane summary and is never written by the data plane.
	ConditionReady = "Ready"
	// ConditionEgressReady (on Service) reports that the service's egress
	// config resolves: the selected EgressGateway exists (or is the implicit
	// built-in "default"), is Ready, and the compiled egress config has been
	// dispatched to the data plane. Reasons: Applied, GatewayNotFound,
	// GatewayNotReady, Disabled. GatewayNotFound can only fire for an
	// explicit ref to a name other than "default" — the "default" name always
	// resolves, to the built-in allow-all gateway when no object exists (see
	// DefaultEgressGatewayName). Control-plane-written only, per this file's
	// contract.
	ConditionEgressReady = "EgressReady"
)

Condition types for the compute control plane (the Service minting reconciler, APO-796). The data plane (the workerd resident reconciler) is READ-ONLY on these objects — it reports per-node readiness over the private publish channel, never by writing a condition — so there is no data-plane-written condition here.

View Source 
const (
	// EgressReadyReasonApplied: the egress config resolved and was compiled
	// for the data plane (including the implicit built-in "default" gateway).
	EgressReadyReasonApplied = "Applied"
	// EgressReadyReasonGatewayNotFound: an explicit gatewayRef names a gateway
	// that does not exist. The service's egress fails closed.
	EgressReadyReasonGatewayNotFound = "GatewayNotFound"
	// EgressReadyReasonGatewayNotReady: the selected gateway exists but its
	// data plane is not ready; compiled config is dispatched with no dialable
	// backend addresses.
	EgressReadyReasonGatewayNotReady = "GatewayNotReady"
	// EgressReadyReasonDisabled: the service set egress.disabled — all egress
	// is hard-denied, as configured.
	EgressReadyReasonDisabled = "Disabled"
)

Reasons for ConditionEgressReady.

View Source 
const (
	// EgressGatewayReasonReady: every listener has a dialable data plane.
	EgressGatewayReasonReady = "ListenersReady"
	// EgressGatewayReasonListenersPending: one or more listeners have no data
	// plane address yet (the gateway data plane has not been provisioned).
	EgressGatewayReasonListenersPending = "ListenersPending"
)

Reasons for EgressGatewayConditionReady.

View Source 
const DefaultEgressGatewayName = "default"

DefaultEgressGatewayName is the well-known gateway name a Service resolves to when it has no egress block (or an empty gatewayRef). The name always resolves: when no EgressGateway object with this name exists, the control plane compiles a built-in allow-all gateway, so egress works out of the box (Cloudflare parity). Creating an EgressGateway named "default" overrides the built-in — e.g. to tighten the project-wide default policy.

View Source 
const EgressControllerName gwapiv1.GatewayController = "compute.apoxy.dev/egress-controller"

EgressControllerName identifies the compute egress controller in EgressRoute status.parents entries.

View Source 
const EgressGatewayConditionReady = "Ready"

EgressGatewayConditionReady is the readiness summary on EgressGateway.Status.Conditions. The control plane only pushes a listener's BackendAddress to the data plane once Ready=True.

View Source 
const GroupName = "compute.apoxy.dev"

GroupName specifies the group name used to register the objects.

Variables

View Source 
var (
	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
	SchemeBuilder runtime.SchemeBuilder

	// Deprecated: use Install instead
	AddToScheme = localSchemeBuilder.AddToScheme
	Install     = localSchemeBuilder.AddToScheme
)
View Source 
var GroupVersion = v1.GroupVersion{Group: GroupName, Version: "v1alpha1"}

GroupVersion specifies the group and the version used to register the objects.

View Source 
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}

SchemeGroupVersion is group version used to register these objects Deprecated: use GroupVersion instead.

Functions

func Resource 

func Resource(resource string) schema.GroupResource

Resource takes an unqualified resource and returns a Group qualified GroupResource

func ShapePriority 

func ShapePriority(s EgressListenerShape) int

ShapePriority orders listener shapes for tie-breaking at dial time when multiple listeners catch the same destination port. Higher value wins. TLS-terminate / HTTPS go first because they sniff and can carry any byte stream; plain TCP is last-resort because it hard-commits the connection to passthrough.

Types

type BackendConfig 

type BackendConfig struct {
	// +optional
	// +kubebuilder:default=http1
	Protocol BackendProtocol `json:"protocol,omitempty"`
	// Port is only meaningful for tcp/udp; ignored for http1/http2.
	// +optional
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	Port *int32 `json:"port,omitempty"`
}

BackendConfig configures a service running in backend mode (the default).

Protocol is the discriminator that decides whether Port is user-meaningful:

  • http1/http2: the service is served via Envoy. The listen port is the internal Envoy<->runtime contract, programmed by the controller, and is NOT set here (Port is ignored). This mirrors workerd, which keeps port off the Service entirely and on a separate top-level `sockets` entry.
  • tcp/udp (future): the service is an L4 listener, so Port IS the contract and the demux key. This is also the value an HTTPRoute-style backendRef port would later select among, once a Service can expose multiple L4 listeners. For http services a backendRef should omit port (Gateway API only requires it for core Services; PortNumber min=1 rejects a 0 sentinel).

func (*BackendConfig) DeepCopy 

func (in *BackendConfig) DeepCopy() *BackendConfig

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendConfig.

func (*BackendConfig) DeepCopyInto 

func (in *BackendConfig) DeepCopyInto(out *BackendConfig)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type BackendProtocol 

type BackendProtocol string
const (
	HTTP1 BackendProtocol = "http1"
	HTTP2 BackendProtocol = "http2"
	// L4 protocols (future). The service becomes a raw listener with no L7
	// router in front. workerd is HTTP-inbound-only (its socket union is
	// http/https/tls), so these are served via Apoxy's own L4 data path, not
	// workerd sockets.
	TCP BackendProtocol = "tcp"
	UDP BackendProtocol = "udp"
)

type Binding 

type Binding struct {
	// Name is the identifier exposed to service code (env.<Name>).
	Name string      `json:"name"`
	Type BindingType `json:"type"`

	// +optional
	Secret *SecretBinding `json:"secret,omitempty"`
	// +optional
	KV *KVBinding `json:"kv,omitempty"`
	// +optional
	Service *ServiceBinding `json:"service,omitempty"`
}

Binding grants a platform resource capability to the service (secrets, KV, service-to-service): a service reaches no platform resource it isn't explicitly bound to. Outbound network access is NOT a binding — it is governed by the egress block (see ServiceEgress) and is on by default via the project's default gateway.

func (*Binding) DeepCopy 

func (in *Binding) DeepCopy() *Binding

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Binding.

func (*Binding) DeepCopyInto 

func (in *Binding) DeepCopyInto(out *Binding)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type BindingType 

type BindingType string

BindingType discriminates the Binding union. 

const (
	SecretBindingType  BindingType = "secret"
	KVBindingType      BindingType = "kv"
	ServiceBindingType BindingType = "service"
)

type Build 

type Build struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              BuildSpec   `json:"spec,omitempty"`
	Status            BuildStatus `json:"status,omitempty"`
}

+kubebuilder:object:root=true +kubebuilder:subresource:status +genclient +genclient:nonNamespaced +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

func (*Build) DeepCopy 

func (in *Build) DeepCopy() *Build

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Build.

func (*Build) DeepCopyInto 

func (in *Build) DeepCopyInto(out *Build)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Build) DeepCopyObject 

func (in *Build) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*Build) GetGroupVersionResource 

func (b *Build) GetGroupVersionResource() schema.GroupVersionResource

func (*Build) GetObjectMeta 

func (b *Build) GetObjectMeta() *metav1.ObjectMeta

func (*Build) GetSingularName 

func (b *Build) GetSingularName() string

func (*Build) GetStatus 

func (b *Build) GetStatus() resource.StatusSubResource

func (*Build) IsStorageVersion 

func (b *Build) IsStorageVersion() bool

func (*Build) NamespaceScoped 

func (b *Build) NamespaceScoped() bool

func (*Build) New 

func (b *Build) New() runtime.Object

func (*Build) NewList 

func (b *Build) NewList() runtime.Object

func (*Build) Validate 

func (b *Build) Validate(_ context.Context) field.ErrorList

func (*Build) ValidateUpdate 

func (b *Build) ValidateUpdate(ctx context.Context, old runtime.Object) field.ErrorList

type BuildConfig 

type BuildConfig struct {
	// RootDir within the repo, default ".".
	// +optional
	RootDir string `json:"rootDir,omitempty"`
	// Builder image used to produce the bundle (e.g. an image wrapping wrangler/esbuild).
	// +optional
	Builder string `json:"builder,omitempty"`
	// Command overrides the builder default build command.
	// +optional
	Command []string `json:"command,omitempty"`
	// Output is where built bundles are pushed. The per-build digest lands in Build.Status.
	Output BundleRef `json:"output"`
	// +optional
	Env []EnvVar `json:"env,omitempty"`
}

func (*BuildConfig) DeepCopy 

func (in *BuildConfig) DeepCopy() *BuildConfig

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BuildConfig.

func (*BuildConfig) DeepCopyInto 

func (in *BuildConfig) DeepCopyInto(out *BuildConfig)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type BuildList 

type BuildList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Build `json:"items"`
}

+kubebuilder:object:root=true +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

func (*BuildList) DeepCopy 

func (in *BuildList) DeepCopy() *BuildList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BuildList.

func (*BuildList) DeepCopyInto 

func (in *BuildList) DeepCopyInto(out *BuildList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*BuildList) DeepCopyObject 

func (in *BuildList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*BuildList) GetListMeta 

func (l *BuildList) GetListMeta() *metav1.ListMeta

type BuildPhase 

type BuildPhase string
const (
	BuildPending   BuildPhase = "Pending"
	BuildRunning   BuildPhase = "Building"
	BuildSucceeded BuildPhase = "Succeeded"
	BuildFailed    BuildPhase = "Failed"
)

type BuildSpec 

type BuildSpec struct {
	// ServiceRef is the owning Service.
	ServiceRef corev1alpha.ObjectName `json:"serviceRef"`
	// Commit being built.
	Commit string `json:"commit"`
	// Ref (branch or tag) the commit came from.
	Ref string `json:"ref"`
}

BuildSpec is the immutable input of a build. Builds are owned (ownerRef) by the Service whose spec.source produced them.

func (*BuildSpec) DeepCopy 

func (in *BuildSpec) DeepCopy() *BuildSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BuildSpec.

func (*BuildSpec) DeepCopyInto 

func (in *BuildSpec) DeepCopyInto(out *BuildSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type BuildStatus 

type BuildStatus struct {
	// +optional
	Phase BuildPhase `json:"phase,omitempty"`
	// Bundle is the produced artifact (digest filled) on success.
	// +optional
	Bundle *BundleRef `json:"bundle,omitempty"`
	// LogsRef points at build logs (e.g. an object-store URL).
	// +optional
	LogsRef string `json:"logsRef,omitempty"`
	// +optional
	StartedAt *metav1.Time `json:"startedAt,omitempty"`
	// +optional
	CompletedAt *metav1.Time `json:"completedAt,omitempty"`
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

func (*BuildStatus) CopyTo 

func (s *BuildStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*BuildStatus) DeepCopy 

func (in *BuildStatus) DeepCopy() *BuildStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BuildStatus.

func (*BuildStatus) DeepCopyInto 

func (in *BuildStatus) DeepCopyInto(out *BuildStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*BuildStatus) SubResourceName 

func (s *BuildStatus) SubResourceName() string

type BundleManifest 

type BundleManifest struct {
	Modules           []Module `json:"modules"`
	CompatibilityDate string   `json:"compatibilityDate"`
	// +optional
	CompatibilityFlags []string `json:"compatibilityFlags,omitempty"`
	// AssetsPrefix, if set, indicates a disk-backed static service mounted here.
	// +optional
	AssetsPrefix string `json:"assetsPrefix,omitempty"`
}

BundleManifest is the on-disk schema embedded as the OCI config blob. It is NOT a stored API object; the builder emits it and the data plane reads it to reconstruct a workerd config. Kept here so build and serve agree on a schema.

func (*BundleManifest) DeepCopy 

func (in *BundleManifest) DeepCopy() *BundleManifest

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BundleManifest.

func (*BundleManifest) DeepCopyInto 

func (in *BundleManifest) DeepCopyInto(out *BundleManifest)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type BundleRef 

type BundleRef struct {
	// Repo is the OCI repository, e.g. "registry.apoxy.dev/acme/api".
	Repo string `json:"repo"`
	// Digest pins the exact artifact, e.g. "sha256:...". Strongly preferred:
	// the serving path is digest-addressed and immutable.
	// +optional
	Digest string `json:"digest,omitempty"`
	// Tag is resolved to a Digest by the controller if Digest is unset.
	//
	// Resolution happens once, when the spec changes, and the resulting digest
	// is what every replica runs. Re-pushing the tag does not roll the service
	// on its own — re-apply the Service to pick up the tag's new target.
	// +optional
	// +kubebuilder:default="latest"
	Tag string `json:"tag,omitempty"`

	// Only one of Credentials or CredentialsRef may be set.
	// +optional
	Credentials *OCICredentials `json:"credentials,omitempty"`
	// +optional
	CredentialsRef *OCICredentialsRef `json:"credentialsRef,omitempty"`
}

BundleRef points at an OCI artifact containing a service bundle. Digest is preferred and is what controllers pin; Tag is a convenience for humans/CLI.

func (*BundleRef) DeepCopy 

func (in *BundleRef) DeepCopy() *BundleRef

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BundleRef.

func (*BundleRef) DeepCopyInto 

func (in *BundleRef) DeepCopyInto(out *BundleRef)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressDefaultPolicy 

type EgressDefaultPolicy string

EgressDefaultPolicy controls the action for outbound traffic matching no attached EgressRoute rule. +kubebuilder:validation:Enum=allow-all;deny-all 

const (
	EgressPolicyAllowAll EgressDefaultPolicy = "allow-all"
	EgressPolicyDenyAll  EgressDefaultPolicy = "deny-all"
)

type EgressGateway 

type EgressGateway struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              EgressGatewaySpec   `json:"spec,omitempty"`
	Status            EgressGatewayStatus `json:"status,omitempty"`
}

EgressGateway mediates outbound network access for compute Services. Egress is transparent to worker code: there are no bindings and no fetch wrapper — plain fetch() works, and enforcement happens host-side (sandbox netstack + gateway data plane), never inside workerd. A Service selects a gateway via spec.template.spec.egress.gatewayRef; with no egress block it uses the project "default" gateway (see DefaultEgressGatewayName).

NOT YET ENFORCED: the egress control/data planes are still landing, and until they do the runtime denies all worker egress regardless of gateway configuration. The API is stable; these semantics take effect when enforcement ships.

+kubebuilder:object:root=true +kubebuilder:subresource:status +genclient +genclient:nonNamespaced +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

func (*EgressGateway) ConvertToTable added in v0.22.0 

func (g *EgressGateway) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements rest.TableConvertor that handles table pretty printing.

func (*EgressGateway) DeepCopy 

func (in *EgressGateway) DeepCopy() *EgressGateway

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGateway.

func (*EgressGateway) DeepCopyInto 

func (in *EgressGateway) DeepCopyInto(out *EgressGateway)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressGateway) DeepCopyObject 

func (in *EgressGateway) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*EgressGateway) Default 

func (g *EgressGateway) Default()

Default fills the EgressGateway's documented defaults in Go (kubebuilder default markers don't fire on the aggregated apiserver — see defaultConfigSpec). The defaultPolicy pin matters: an explicitly created gateway must persist as deny-all so it fails closed. Deliberate asymmetry: the implicit built-in "default" gateway (no object) is allow-all so egress works out of the box — see DefaultEgressGatewayName.

ServiceConfigSpec.Egress is intentionally NOT materialized by any defaulter: absent must stay absent (it means "the default gateway" at compile time, resolved by the control plane, not stored in the spec). EgressRoute has nothing to default.

func (*EgressGateway) GetGroupVersionResource 

func (g *EgressGateway) GetGroupVersionResource() schema.GroupVersionResource

func (*EgressGateway) GetObjectMeta 

func (g *EgressGateway) GetObjectMeta() *metav1.ObjectMeta

func (*EgressGateway) GetSingularName 

func (g *EgressGateway) GetSingularName() string

func (*EgressGateway) GetStatus 

func (g *EgressGateway) GetStatus() resource.StatusSubResource

func (*EgressGateway) IsStorageVersion 

func (g *EgressGateway) IsStorageVersion() bool

func (*EgressGateway) NamespaceScoped 

func (g *EgressGateway) NamespaceScoped() bool

func (*EgressGateway) New 

func (g *EgressGateway) New() runtime.Object

func (*EgressGateway) NewList 

func (g *EgressGateway) NewList() runtime.Object

func (*EgressGateway) Validate 

func (g *EgressGateway) Validate(_ context.Context) field.ErrorList

func (*EgressGateway) ValidateUpdate 

func (g *EgressGateway) ValidateUpdate(ctx context.Context, _ runtime.Object) field.ErrorList

ValidateUpdate re-runs full validation; the spec is mutable (routes and policy are meant to be tightened live).

type EgressGatewayList 

type EgressGatewayList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []EgressGateway `json:"items"`
}

+kubebuilder:object:root=true +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

func (*EgressGatewayList) ConvertToTable added in v0.22.0 

func (gl *EgressGatewayList) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements rest.TableConvertor that handles table pretty printing.

func (*EgressGatewayList) DeepCopy 

func (in *EgressGatewayList) DeepCopy() *EgressGatewayList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGatewayList.

func (*EgressGatewayList) DeepCopyInto 

func (in *EgressGatewayList) DeepCopyInto(out *EgressGatewayList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressGatewayList) DeepCopyObject 

func (in *EgressGatewayList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*EgressGatewayList) GetListMeta 

func (l *EgressGatewayList) GetListMeta() *metav1.ListMeta

type EgressGatewaySpec 

type EgressGatewaySpec struct {
	// DefaultPolicy applies to traffic that matches no attached route.
	// Defaults to deny-all: an explicitly created gateway fails closed. (The
	// implicit built-in "default" gateway — which exists only when no object
	// named "default" does — is allow-all; see DefaultEgressGatewayName.)
	// +optional
	// +kubebuilder:default=deny-all
	DefaultPolicy EgressDefaultPolicy `json:"defaultPolicy,omitempty"`

	// Listeners declare interception capabilities by protocol layer.
	// Routes attach to a specific listener by name via parentRef.sectionName.
	// +kubebuilder:validation:MinItems=1
	Listeners []EgressListener `json:"listeners"`
}

EgressGatewaySpec defines the desired state of an EgressGateway.

func (*EgressGatewaySpec) DeepCopy 

func (in *EgressGatewaySpec) DeepCopy() *EgressGatewaySpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGatewaySpec.

func (*EgressGatewaySpec) DeepCopyInto 

func (in *EgressGatewaySpec) DeepCopyInto(out *EgressGatewaySpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressGatewayStatus 

type EgressGatewayStatus struct {
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// +optional
	Listeners []EgressListenerStatus `json:"listeners,omitempty"`
}

EgressGatewayStatus describes the observed state of an EgressGateway.

func (*EgressGatewayStatus) CopyTo 

func (s *EgressGatewayStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*EgressGatewayStatus) DeepCopy 

func (in *EgressGatewayStatus) DeepCopy() *EgressGatewayStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGatewayStatus.

func (*EgressGatewayStatus) DeepCopyInto 

func (in *EgressGatewayStatus) DeepCopyInto(out *EgressGatewayStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressGatewayStatus) SubResourceName 

func (s *EgressGatewayStatus) SubResourceName() string

type EgressListener 

type EgressListener struct {
	// Name identifies this listener within the gateway.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	Name string `json:"name"`

	// Protocol selects the interception layer.
	Protocol EgressListenerProtocol `json:"protocol"`

	// Port constrains interception to a single destination port. If unset,
	// all ports are intercepted at this protocol layer.
	// +optional
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	Port *int32 `json:"port,omitempty"`

	// TLS configures TLS handling. Only meaningful when protocol=TLS
	// (Passthrough vs Terminate); forbidden for TCP/HTTP/HTTPS.
	// +optional
	TLS *EgressListenerTLS `json:"tls,omitempty"`
}

EgressListener declares an interception capability by protocol layer. Routes reference a listener via parentRef.sectionName.

func (*EgressListener) DeepCopy 

func (in *EgressListener) DeepCopy() *EgressListener

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressListener.

func (*EgressListener) DeepCopyInto 

func (in *EgressListener) DeepCopyInto(out *EgressListener)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressListenerProtocol 

type EgressListenerProtocol string

EgressListenerProtocol selects the interception layer of a listener. UDP is deliberately absent: the sandbox netstack is fail-closed on UDP and the gateway data plane has no UDP shape. +kubebuilder:validation:Enum=TCP;TLS;HTTP;HTTPS 

const (
	EgressProtocolTCP   EgressListenerProtocol = "TCP"
	EgressProtocolTLS   EgressListenerProtocol = "TLS"
	EgressProtocolHTTP  EgressListenerProtocol = "HTTP"
	EgressProtocolHTTPS EgressListenerProtocol = "HTTPS"
)

type EgressListenerShape 

type EgressListenerShape string

EgressListenerShape is the on-the-wire shape of a listener: how the sandbox-side dialer treats connections it steers to that listener's backend. It is the value carried in the compiled config (apoxy.workerd.v1.BackendListener.shape). Ported from clrk's clrk.apoxy.dev/v1alpha1 so agents and compute share one shape vocabulary. 

const (
	EgressShapeHTTP           EgressListenerShape = "http"
	EgressShapeHTTPS          EgressListenerShape = "https"
	EgressShapeTLSTerminate   EgressListenerShape = "tls-terminate"
	EgressShapeTLSPassthrough EgressListenerShape = "tls-passthrough"
	EgressShapeTCP            EgressListenerShape = "tcp"
)

func ShapeForListener 

func ShapeForListener(l EgressListener) (EgressListenerShape, error)

ShapeForListener resolves an EgressListener to its on-the-wire shape. Returns ("", error) for unsupported combinations — callers surface the error on Status.Conditions[Ready] instead of compiling the listener.

type EgressListenerStatus 

type EgressListenerStatus struct {
	Name string `json:"name"`

	// Port is the TCP port the gateway data plane listens on for this
	// listener.
	// +optional
	Port int32 `json:"port,omitempty"`

	// BackendAddress is the host:port the sandbox-side dialer uses to reach
	// this listener's data plane. Empty means the listener exists but its
	// data plane isn't ready yet; the dialer skips it.
	// +optional
	BackendAddress string `json:"backendAddress,omitempty"`

	// AttachedRoutes counts the EgressRoutes attached to this listener.
	AttachedRoutes int32 `json:"attachedRoutes"`

	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

EgressListenerStatus describes the observed state of a single listener.

func (*EgressListenerStatus) DeepCopy 

func (in *EgressListenerStatus) DeepCopy() *EgressListenerStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressListenerStatus.

func (*EgressListenerStatus) DeepCopyInto 

func (in *EgressListenerStatus) DeepCopyInto(out *EgressListenerStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressListenerTLS 

type EgressListenerTLS struct {
	// Mode controls TLS handling.
	//   Passthrough: SNI-route only, no termination.
	//   Terminate:   MITM decrypt for L7 inspection, re-encrypt to upstream.
	// +optional
	// +kubebuilder:default=Passthrough
	Mode EgressTLSMode `json:"mode,omitempty"`

	// CACertRef names the SecretStore key holding the PEM-encoded CA
	// certificate + key bundle used for on-the-fly certificate minting.
	// Required when mode=Terminate; forbidden for Passthrough.
	// +optional
	CACertRef *SecretKeyRef `json:"caCertRef,omitempty"`
}

EgressListenerTLS configures TLS handling for a listener.

func (*EgressListenerTLS) DeepCopy 

func (in *EgressListenerTLS) DeepCopy() *EgressListenerTLS

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressListenerTLS.

func (*EgressListenerTLS) DeepCopyInto 

func (in *EgressListenerTLS) DeepCopyInto(out *EgressListenerTLS)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressPortMatch 

type EgressPortMatch struct {
	// Port matches a single destination port.
	// +optional
	Port *int32 `json:"port,omitempty"`

	// StartPort + EndPort define an inclusive range. Both must be set
	// together. Mutually exclusive with Port.
	// +optional
	StartPort *int32 `json:"startPort,omitempty"`
	// +optional
	EndPort *int32 `json:"endPort,omitempty"`
}

EgressPortMatch matches a single port or an inclusive port range. Exactly one of Port or the StartPort/EndPort pair must be set.

func (*EgressPortMatch) DeepCopy 

func (in *EgressPortMatch) DeepCopy() *EgressPortMatch

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressPortMatch.

func (*EgressPortMatch) DeepCopyInto 

func (in *EgressPortMatch) DeepCopyInto(out *EgressPortMatch)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressRoute 

type EgressRoute struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              EgressRouteSpec   `json:"spec,omitempty"`
	Status            EgressRouteStatus `json:"status,omitempty"`
}

EgressRoute allows destination hostname/CIDR/port matched egress for the Services attached to its parent EgressGateway(s). Traffic matching no route falls to the gateway's defaultPolicy.

+kubebuilder:object:root=true +kubebuilder:subresource:status +genclient +genclient:nonNamespaced +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

func (*EgressRoute) ConvertToTable added in v0.22.0 

func (r *EgressRoute) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements rest.TableConvertor that handles table pretty printing.

func (*EgressRoute) DeepCopy 

func (in *EgressRoute) DeepCopy() *EgressRoute

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressRoute.

func (*EgressRoute) DeepCopyInto 

func (in *EgressRoute) DeepCopyInto(out *EgressRoute)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressRoute) DeepCopyObject 

func (in *EgressRoute) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*EgressRoute) GetGroupVersionResource 

func (r *EgressRoute) GetGroupVersionResource() schema.GroupVersionResource

func (*EgressRoute) GetObjectMeta 

func (r *EgressRoute) GetObjectMeta() *metav1.ObjectMeta

func (*EgressRoute) GetSingularName 

func (r *EgressRoute) GetSingularName() string

func (*EgressRoute) GetStatus 

func (r *EgressRoute) GetStatus() resource.StatusSubResource

func (*EgressRoute) IsStorageVersion 

func (r *EgressRoute) IsStorageVersion() bool

func (*EgressRoute) NamespaceScoped 

func (r *EgressRoute) NamespaceScoped() bool

func (*EgressRoute) New 

func (r *EgressRoute) New() runtime.Object

func (*EgressRoute) NewList 

func (r *EgressRoute) NewList() runtime.Object

func (*EgressRoute) Validate 

func (r *EgressRoute) Validate(_ context.Context) field.ErrorList

func (*EgressRoute) ValidateUpdate 

func (r *EgressRoute) ValidateUpdate(ctx context.Context, _ runtime.Object) field.ErrorList

ValidateUpdate re-runs full validation; the spec is mutable.

type EgressRouteList 

type EgressRouteList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []EgressRoute `json:"items"`
}

+kubebuilder:object:root=true +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

func (*EgressRouteList) ConvertToTable added in v0.22.0 

func (rl *EgressRouteList) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements rest.TableConvertor that handles table pretty printing.

func (*EgressRouteList) DeepCopy 

func (in *EgressRouteList) DeepCopy() *EgressRouteList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressRouteList.

func (*EgressRouteList) DeepCopyInto 

func (in *EgressRouteList) DeepCopyInto(out *EgressRouteList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressRouteList) DeepCopyObject 

func (in *EgressRouteList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*EgressRouteList) GetListMeta 

func (l *EgressRouteList) GetListMeta() *metav1.ListMeta

type EgressRouteMatch 

type EgressRouteMatch struct {
	// DestinationCIDRs matches by IP range. Single IPs as /32 or /128.
	// IPv4 and IPv6 CIDRs are both honored.
	// +optional
	// +listType=set
	DestinationCIDRs []string `json:"destinationCIDRs,omitempty"`

	// DestinationHostnames matches by hostname. Exact (`api.openai.com`) and
	// wildcard (`*.openai.com`) forms are accepted (gwapiv1.Hostname
	// semantics — a wildcard matches exactly one prefix label). On
	// TLS-terminated listeners the match runs against SNI.
	// +optional
	// +listType=set
	DestinationHostnames []gwapiv1.Hostname `json:"destinationHostnames,omitempty"`

	// Ports restricts to specific destination ports or port ranges.
	// +optional
	Ports []EgressPortMatch `json:"ports,omitempty"`

	// Protocol selects TCP or UDP. If unset, inherits from the parent
	// listener. UDP is not yet supported.
	// +optional
	Protocol *EgressRouteProtocol `json:"protocol,omitempty"`
}

EgressRouteMatch defines match criteria for outbound traffic. Dimensions are ANDed within a match; matches are ORed within a rule.

func (*EgressRouteMatch) DeepCopy 

func (in *EgressRouteMatch) DeepCopy() *EgressRouteMatch

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressRouteMatch.

func (*EgressRouteMatch) DeepCopyInto 

func (in *EgressRouteMatch) DeepCopyInto(out *EgressRouteMatch)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressRouteProtocol 

type EgressRouteProtocol string

EgressRouteProtocol selects the L4 protocol of a match. UDP is defined for forward compatibility but rejected by validation for now (the sandbox netstack is fail-closed on UDP). +kubebuilder:validation:Enum=TCP;UDP 

const (
	EgressRouteProtocolTCP EgressRouteProtocol = "TCP"
	EgressRouteProtocolUDP EgressRouteProtocol = "UDP"
)

type EgressRouteRule 

type EgressRouteRule struct {
	// Matches lists the destinations this rule admits.
	// +kubebuilder:validation:MinItems=1
	Matches []EgressRouteMatch `json:"matches"`
}

EgressRouteRule defines one allow rule within an EgressRoute.

A `mode` field (values: gateway | direct, default gateway) is RESERVED here for per-destination egress mode selection: `gateway` transits the EgressGateway data plane; `direct` is policy-checked in the host netstack but dials upstream without gateway transit. It is intentionally not defined yet — its compiled wire slot is the reserved field 6 of apoxy.workerd.v1.EgressRule.

func (*EgressRouteRule) DeepCopy 

func (in *EgressRouteRule) DeepCopy() *EgressRouteRule

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressRouteRule.

func (*EgressRouteRule) DeepCopyInto 

func (in *EgressRouteRule) DeepCopyInto(out *EgressRouteRule)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressRouteSpec 

type EgressRouteSpec struct {
	// ParentRefs attaches this route to EgressGateway listeners. Group and
	// kind default to compute.apoxy.dev/EgressGateway and, when set, must be
	// exactly that; namespace must be unset (all compute kinds are
	// cluster-scoped). sectionName selects a single listener by name; absent
	// attaches to every listener.
	// +kubebuilder:validation:MinItems=1
	ParentRefs []gwapiv1.ParentReference `json:"parentRefs"`

	// +kubebuilder:validation:MinItems=1
	Rules []EgressRouteRule `json:"rules"`
}

EgressRouteSpec defines the desired state of an EgressRoute.

func (*EgressRouteSpec) DeepCopy 

func (in *EgressRouteSpec) DeepCopy() *EgressRouteSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressRouteSpec.

func (*EgressRouteSpec) DeepCopyInto 

func (in *EgressRouteSpec) DeepCopyInto(out *EgressRouteSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressRouteStatus 

type EgressRouteStatus struct {
	// +optional
	Parents []gwapiv1.RouteParentStatus `json:"parents,omitempty"`
}

EgressRouteStatus describes the observed state of an EgressRoute.

func (*EgressRouteStatus) CopyTo 

func (s *EgressRouteStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*EgressRouteStatus) DeepCopy 

func (in *EgressRouteStatus) DeepCopy() *EgressRouteStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressRouteStatus.

func (*EgressRouteStatus) DeepCopyInto 

func (in *EgressRouteStatus) DeepCopyInto(out *EgressRouteStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressRouteStatus) SubResourceName 

func (s *EgressRouteStatus) SubResourceName() string

type EgressTLSMode 

type EgressTLSMode string

EgressTLSMode controls TLS handling on a listener. +kubebuilder:validation:Enum=Passthrough;Terminate 

const (
	EgressTLSPassthrough EgressTLSMode = "Passthrough"
	EgressTLSTerminate   EgressTLSMode = "Terminate"
)

type EnvVar 

type EnvVar struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

func (*EnvVar) DeepCopy 

func (in *EnvVar) DeepCopy() *EnvVar

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvVar.

func (*EnvVar) DeepCopyInto 

func (in *EnvVar) DeepCopyInto(out *EnvVar)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type FailureMode 

type FailureMode string
const (
	FailOpen   FailureMode = "failOpen"
	FailClosed FailureMode = "failClosed"
)

type FilterConfig 

type FilterConfig struct {
	// +optional
	// +kubebuilder:default=request
	Phase FilterPhase `json:"phase,omitempty"`
	// +optional
	// +kubebuilder:default=failClosed
	FailureMode FailureMode `json:"failureMode,omitempty"`
}

FilterConfig configures a service running in filter mode; its presence in a ServiceConfig selects filter mode.

func (*FilterConfig) DeepCopy 

func (in *FilterConfig) DeepCopy() *FilterConfig

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FilterConfig.

func (*FilterConfig) DeepCopyInto 

func (in *FilterConfig) DeepCopyInto(out *FilterConfig)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type FilterPhase 

type FilterPhase string
const (
	RequestPhase  FilterPhase = "request"
	ResponsePhase FilterPhase = "response"
	BothPhases    FilterPhase = "both"
)

type GitRepo 

type GitRepo struct {
	// URL of the git repository.
	URL string `json:"url"`
	// +optional
	CredentialsRef *OCICredentialsRef `json:"credentialsRef,omitempty"`
}

func (*GitRepo) DeepCopy 

func (in *GitRepo) DeepCopy() *GitRepo

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitRepo.

func (*GitRepo) DeepCopyInto 

func (in *GitRepo) DeepCopyInto(out *GitRepo)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type GitSource 

type GitSource struct {
	GitRepo  `json:",inline"`
	Build    BuildConfig `json:"build"`
	Triggers Triggers    `json:"triggers"`
	// +optional
	Previews *PreviewPolicy `json:"previews,omitempty"`
}

GitSource is the self-contained git/CI pipeline for a Service (spec.source.git). Everything git-related lives here: the repo, how it's built, what triggers a build, and optional preview environments. Whether a new build goes live is not configured here — that is governed by spec.liveRevision (empty = auto-promote the latest revision, set = pinned).

func (*GitSource) DeepCopy 

func (in *GitSource) DeepCopy() *GitSource

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitSource.

func (*GitSource) DeepCopyInto 

func (in *GitSource) DeepCopyInto(out *GitSource)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type KVBinding 

type KVBinding struct {
	// Namespace identifies the KV store partition (a store name, not a k8s namespace).
	Namespace string `json:"namespace"`
}

func (*KVBinding) DeepCopy 

func (in *KVBinding) DeepCopy() *KVBinding

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KVBinding.

func (*KVBinding) DeepCopyInto 

func (in *KVBinding) DeepCopyInto(out *KVBinding)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type Module 

type Module struct {
	Name string     `json:"name"`
	Type ModuleType `json:"type"`
	// Path within the modules layer of the bundle.
	Path string `json:"path"`
}

Module is one entry in the service's flat module namespace. The first esModule is the entrypoint. These map 1:1 onto workerd capnp `modules` entries.

func (*Module) DeepCopy 

func (in *Module) DeepCopy() *Module

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Module.

func (*Module) DeepCopyInto 

func (in *Module) DeepCopyInto(out *Module)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ModuleType 

type ModuleType string

ModuleType mirrors workerd's module union. 

const (
	ESModule       ModuleType = "esModule"
	CommonJSModule ModuleType = "commonJsModule"
	TextModule     ModuleType = "text"
	DataModule     ModuleType = "data"
	JSONModule     ModuleType = "json"
	WasmModule     ModuleType = "wasm"
)

type OCICredentials 

type OCICredentials struct {
	Username string `json:"username,omitempty"`
	// Password is the write-only plain-text form; use PasswordData when
	// authoring programmatically.
	Password string `json:"password,omitempty"`
	// PasswordData is the RAW password bytes. NOT base64 of the password
	// (unlike the extensions API field of the same name) — JSON's []byte
	// encoding already handles the transport encoding. Takes precedence over
	// Password when both are set.
	PasswordData []byte `json:"passwordData,omitempty"`
	// AccessToken is a registry bearer token sent as-is (Authorization: Bearer),
	// skipping the token-service exchange.
	// +optional
	AccessToken string `json:"accessToken,omitempty"`
	// RefreshToken is an OAuth2 refresh token (docker's "identity token")
	// exchanged with the registry's token service for access tokens.
	// +optional
	RefreshToken string `json:"refreshToken,omitempty"`
}

OCICredentials are inline registry credentials, mirroring the docker/oras credential model. Username+password covers basic auth AND the standard registry token-service flow (Docker Hub/GHCR PATs, GAR oauth2accesstoken, ECR authorization tokens — the puller exchanges the pair for a bearer automatically). AccessToken/RefreshToken cover registries that issue tokens directly instead (e.g. ACR identity tokens).

Password is write-only: defaulting moves it into PasswordData on admission, so reads never return the plain string field. The other secret fields currently round-trip on reads; prefer short-lived tokens until secret-store-backed credentialsRef lands.

func (*OCICredentials) DeepCopy 

func (in *OCICredentials) DeepCopy() *OCICredentials

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCICredentials.

func (*OCICredentials) DeepCopyInto 

func (in *OCICredentials) DeepCopyInto(out *OCICredentials)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type OCICredentialsRef 

type OCICredentialsRef struct {
	Group     corev1alpha.Group      `json:"group"`
	Kind      corev1alpha.Kind       `json:"kind"`
	Name      corev1alpha.ObjectName `json:"name"`
	Namespace corev1alpha.Namespace  `json:"namespace"`
}

OCICredentialsRef references a Secret (or equivalent) holding pull credentials. Namespace is retained here (unlike intra-group refs) because on-prem this points at a real Kubernetes Secret, which may be namespaced even though our own CRDs are cluster-scoped.

func (*OCICredentialsRef) DeepCopy 

func (in *OCICredentialsRef) DeepCopy() *OCICredentialsRef

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCICredentialsRef.

func (*OCICredentialsRef) DeepCopyInto 

func (in *OCICredentialsRef) DeepCopyInto(out *OCICredentialsRef)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type PreviewPolicy 

type PreviewPolicy struct {
	// Enabled spawns ephemeral preview Services (owned by this Service) per
	// non-production branch / PR.
	Enabled bool `json:"enabled"`
	// TTL after which idle previews are garbage-collected.
	// +optional
	TTL *metav1.Duration `json:"ttl,omitempty"`
}

func (*PreviewPolicy) DeepCopy 

func (in *PreviewPolicy) DeepCopy() *PreviewPolicy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PreviewPolicy.

func (*PreviewPolicy) DeepCopyInto 

func (in *PreviewPolicy) DeepCopyInto(out *PreviewPolicy)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SecretBinding 

type SecretBinding struct {
	// Store names the SecretStore (cluster-scoped, same project).
	Store corev1alpha.ObjectName `json:"store"`
	// Key within the store's values map.
	Key string `json:"key"`
}

SecretBinding exposes one key of a core.apoxy.dev SecretStore to service code as env.<Binding.Name>. The store's scopes must admit this service (surface "compute"). The value is resolved at worker materialization time and never enters the bundle or the revision.

func (*SecretBinding) DeepCopy 

func (in *SecretBinding) DeepCopy() *SecretBinding

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretBinding.

func (*SecretBinding) DeepCopyInto 

func (in *SecretBinding) DeepCopyInto(out *SecretBinding)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SecretKeyRef 

type SecretKeyRef struct {
	// Store names the SecretStore.
	Store corev1alpha.ObjectName `json:"store"`
	// Key within the store's values map.
	Key string `json:"key"`
}

SecretKeyRef names one key of a core.apoxy.dev SecretStore (cluster-scoped, same project). The project apiserver has no corev1 Secrets; SecretStore is its only secret primitive, so egress reuses the same store+key addressing as SecretBinding. The store's scopes must admit the "compute" surface; that check happens at resolve time in the control plane, not at admission.

func (*SecretKeyRef) DeepCopy 

func (in *SecretKeyRef) DeepCopy() *SecretKeyRef

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretKeyRef.

func (*SecretKeyRef) DeepCopyInto 

func (in *SecretKeyRef) DeepCopyInto(out *SecretKeyRef)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type Service 

type Service struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              ServiceSpec   `json:"spec,omitempty"`
	Status            ServiceStatus `json:"status,omitempty"`
}

+kubebuilder:object:root=true +kubebuilder:subresource:status +genclient +genclient:nonNamespaced +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

func (*Service) ConvertToTable added in v0.22.0 

func (s *Service) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements rest.TableConvertor that handles table pretty printing.

func (*Service) DeepCopy 

func (in *Service) DeepCopy() *Service

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Service.

func (*Service) DeepCopyInto 

func (in *Service) DeepCopyInto(out *Service)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Service) DeepCopyObject 

func (in *Service) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*Service) Default 

func (w *Service) Default()

Default fills server-side defaults for a Service. Cross-field invariants (mode mutual-exclusion, source union, port rules, immutability) are enforced in Validate (service_validate.go), not here.

func (*Service) GetGroupVersionResource 

func (w *Service) GetGroupVersionResource() schema.GroupVersionResource

func (*Service) GetObjectMeta 

func (w *Service) GetObjectMeta() *metav1.ObjectMeta

func (*Service) GetSingularName 

func (w *Service) GetSingularName() string

func (*Service) GetStatus 

func (w *Service) GetStatus() resource.StatusSubResource

func (*Service) IsStorageVersion 

func (w *Service) IsStorageVersion() bool

func (*Service) NamespaceScoped 

func (w *Service) NamespaceScoped() bool

func (*Service) New 

func (w *Service) New() runtime.Object

func (*Service) NewList 

func (w *Service) NewList() runtime.Object

func (*Service) Validate 

func (w *Service) Validate(_ context.Context) field.ErrorList

func (*Service) ValidateUpdate 

func (w *Service) ValidateUpdate(ctx context.Context, old runtime.Object) field.ErrorList

ValidateUpdate runs full validation on the new object and additionally enforces that the runtime mode is immutable. The receiver is the new object; old is the stored one.

type ServiceBinding 

type ServiceBinding struct {
	ServiceRef corev1alpha.ObjectName `json:"serviceRef"`
}

ServiceBinding wires service-to-service calls (e.g. a filter Service invoking a backend Service) without going back out over the network. ServiceRef is cluster-scoped (single tenant), so no namespace.

func (*ServiceBinding) DeepCopy 

func (in *ServiceBinding) DeepCopy() *ServiceBinding

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceBinding.

func (*ServiceBinding) DeepCopyInto 

func (in *ServiceBinding) DeepCopyInto(out *ServiceBinding)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ServiceConfig 

type ServiceConfig struct {
	// Filter selects filter mode and its settings.
	// +optional
	Filter *FilterConfig `json:"filter,omitempty"`
	// Backend selects backend mode and its settings; this is the default mode
	// when neither member is set.
	// +optional
	Backend *BackendConfig `json:"backend,omitempty"`
}

ServiceConfig is the runtime-mode union. The mode is implicit in which member is set rather than carried in a separate discriminator field:

  • filter set -> filter mode
  • backend set -> backend mode
  • neither set -> backend mode (the default; the defaulter materializes an empty backend block)
  • both set -> rejected by validation

func (*ServiceConfig) DeepCopy 

func (in *ServiceConfig) DeepCopy() *ServiceConfig

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceConfig.

func (*ServiceConfig) DeepCopyInto 

func (in *ServiceConfig) DeepCopyInto(out *ServiceConfig)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ServiceConfig) Mode 

func (c *ServiceConfig) Mode() ServiceMode

Mode returns the effective runtime mode implied by which member is set. Only an explicit filter block selects filter mode; a nil config, an empty config, or a backend-only config is backend mode. A config with both members set is invalid (rejected in validation); Mode reports it as filter and lets the validator surface the error.

type ServiceConfigSpec 

type ServiceConfigSpec struct {
	// ServiceConfig is inlined: its variant blocks (filter / backend) appear
	// directly rather than nested under a wrapper. Exactly one of filter /
	// backend may be set; the populated block IS the mode discriminator — there
	// is no separate mode field. When neither is set the service defaults to
	// backend mode (the defaulter materializes an empty backend block), so a
	// plain backend service needs no block at all. The mode is immutable:
	// switching backend<->filter on an existing Service is rejected.
	ServiceConfig `json:",inline"`

	// +optional
	Runtime *ServiceRuntime `json:"runtime,omitempty"`
	// +optional
	Bindings []Binding `json:"bindings,omitempty"`
	// +optional
	Env []EnvVar `json:"env,omitempty"`
	// Egress selects how outbound network traffic is mediated. Absent means
	// the project "default" egress gateway (egress on by default); see
	// ServiceEgress for the full semantics and the disabled opt-out.
	// +optional
	Egress *ServiceEgress `json:"egress,omitempty"`
}

ServiceConfigSpec is the user-owned serving configuration shared by a Service template and a minted ServiceRevision: the runtime-mode union plus runtime settings, bindings, and env. It deliberately carries NO bundle — the bundle a service runs always comes from spec.source resolution, never from this config.

func (*ServiceConfigSpec) DeepCopy 

func (in *ServiceConfigSpec) DeepCopy() *ServiceConfigSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceConfigSpec.

func (*ServiceConfigSpec) DeepCopyInto 

func (in *ServiceConfigSpec) DeepCopyInto(out *ServiceConfigSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ServiceEgress 

type ServiceEgress struct {
	// GatewayRef names the compute.apoxy.dev EgressGateway that mediates
	// this service's outbound traffic. Empty means the project "default"
	// gateway. Existence is not validated at admission; a dangling ref
	// surfaces as the EgressReady=False condition on Service status.
	// +optional
	GatewayRef corev1alpha.ObjectName `json:"gatewayRef,omitempty"`

	// Disabled hard-denies all egress for this service (globalOutbound is
	// unset in workerd and the sandbox netstack resets any outbound
	// attempt). Mutually exclusive with a non-empty gatewayRef.
	// +optional
	Disabled bool `json:"disabled,omitempty"`
}

ServiceEgress selects how the service's outbound network traffic ("egress") is mediated. Egress is transparent to worker code: there is no binding and no fetch wrapper — a plain fetch() works, subject to the selected gateway's routes and default policy. Enforcement is host-side (sandbox netstack + egress gateway), never inside workerd.

Egress is ON by default: an absent block (or an empty gatewayRef) resolves to the project "default" gateway, which is a built-in allow-all unless an EgressGateway named "default" exists (see DefaultEgressGatewayName). Set disabled: true to hard-deny all egress for this service.

NOT YET ENFORCED: the egress control/data planes are still landing, and until they do the runtime denies all worker egress regardless of this block. The API is stable; the described semantics take effect when enforcement ships.

func (*ServiceEgress) DeepCopy 

func (in *ServiceEgress) DeepCopy() *ServiceEgress

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceEgress.

func (*ServiceEgress) DeepCopyInto 

func (in *ServiceEgress) DeepCopyInto(out *ServiceEgress)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ServiceLimits 

type ServiceLimits struct {
	// CPUTime is the per-request CPU budget (workerd-style), e.g. "50ms".
	// +optional
	CPUTime *metav1.Duration `json:"cpuTime,omitempty"`
	// Memory cap, e.g. "128Mi".
	// +optional
	Memory *string `json:"memory,omitempty"`
}

func (*ServiceLimits) DeepCopy 

func (in *ServiceLimits) DeepCopy() *ServiceLimits

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceLimits.

func (*ServiceLimits) DeepCopyInto 

func (in *ServiceLimits) DeepCopyInto(out *ServiceLimits)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ServiceList 

type ServiceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Service `json:"items"`
}

+kubebuilder:object:root=true +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

func (*ServiceList) ConvertToTable added in v0.22.0 

func (sl *ServiceList) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements rest.TableConvertor that handles table pretty printing.

func (*ServiceList) DeepCopy 

func (in *ServiceList) DeepCopy() *ServiceList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceList.

func (*ServiceList) DeepCopyInto 

func (in *ServiceList) DeepCopyInto(out *ServiceList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ServiceList) DeepCopyObject 

func (in *ServiceList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*ServiceList) GetListMeta 

func (l *ServiceList) GetListMeta() *metav1.ListMeta

type ServiceMode 

type ServiceMode string

ServiceMode is the service's effective runtime mode. It is not a spec field: the mode is derived from which ServiceConfig member is set (see ServiceConfig.Mode). These constants are used by controllers and status. 

const (
	// BackendMode: full fetch handler serving HTTP; referenced as a backendRef.
	// This is the default mode when no config block is set.
	BackendMode ServiceMode = "backend"
	// FilterMode: runs inline in the data path via ext_proc before/around the backend.
	FilterMode ServiceMode = "filter"
)

type ServiceRevision 

type ServiceRevision struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              ServiceRevisionSpec `json:"spec,omitempty"`
	Status            ServiceStatus       `json:"status,omitempty"`
}

+kubebuilder:object:root=true +kubebuilder:subresource:status +genclient +genclient:nonNamespaced +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

func (*ServiceRevision) ConvertToTable added in v0.22.0 

func (r *ServiceRevision) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements rest.TableConvertor that handles table pretty printing.

func (*ServiceRevision) DeepCopy 

func (in *ServiceRevision) DeepCopy() *ServiceRevision

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceRevision.

func (*ServiceRevision) DeepCopyInto 

func (in *ServiceRevision) DeepCopyInto(out *ServiceRevision)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ServiceRevision) DeepCopyObject 

func (in *ServiceRevision) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*ServiceRevision) Default 

func (r *ServiceRevision) Default()

Default fills server-side defaults for a ServiceRevision. Revisions are normally minted by the controller already resolved, but a direct create is defaulted the same way.

func (*ServiceRevision) GetGroupVersionResource 

func (r *ServiceRevision) GetGroupVersionResource() schema.GroupVersionResource

func (*ServiceRevision) GetObjectMeta 

func (r *ServiceRevision) GetObjectMeta() *metav1.ObjectMeta

func (*ServiceRevision) GetSingularName 

func (r *ServiceRevision) GetSingularName() string

func (*ServiceRevision) GetStatus 

func (r *ServiceRevision) GetStatus() resource.StatusSubResource

func (*ServiceRevision) IsStorageVersion 

func (r *ServiceRevision) IsStorageVersion() bool

func (*ServiceRevision) NamespaceScoped 

func (r *ServiceRevision) NamespaceScoped() bool

func (*ServiceRevision) New 

func (r *ServiceRevision) New() runtime.Object

func (*ServiceRevision) NewList 

func (r *ServiceRevision) NewList() runtime.Object

func (*ServiceRevision) Validate 

func (r *ServiceRevision) Validate(_ context.Context) field.ErrorList

func (*ServiceRevision) ValidateUpdate 

func (r *ServiceRevision) ValidateUpdate(ctx context.Context, old runtime.Object) field.ErrorList

type ServiceRevisionList 

type ServiceRevisionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ServiceRevision `json:"items"`
}

+kubebuilder:object:root=true +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

func (*ServiceRevisionList) ConvertToTable added in v0.22.0 

func (rl *ServiceRevisionList) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements rest.TableConvertor that handles table pretty printing.

func (*ServiceRevisionList) DeepCopy 

func (in *ServiceRevisionList) DeepCopy() *ServiceRevisionList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceRevisionList.

func (*ServiceRevisionList) DeepCopyInto 

func (in *ServiceRevisionList) DeepCopyInto(out *ServiceRevisionList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ServiceRevisionList) DeepCopyObject 

func (in *ServiceRevisionList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*ServiceRevisionList) GetListMeta 

func (l *ServiceRevisionList) GetListMeta() *metav1.ListMeta

type ServiceRevisionSpec 

type ServiceRevisionSpec struct {
	ServiceConfigSpec `json:",inline"`

	// Bundle is the resolved OCI artifact this revision runs. It is always
	// digest-pinned and is set by the controller when minting the revision from
	// spec.source; it is never user-authored.
	Bundle BundleRef `json:"bundle"`
}

ServiceRevisionSpec is a minted, immutable revision: a snapshot of the serving config plus the concrete resolved bundle. Unlike the template, Bundle is always present and digest-pinned — it is the artifact the data plane runs.

func (*ServiceRevisionSpec) DeepCopy 

func (in *ServiceRevisionSpec) DeepCopy() *ServiceRevisionSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceRevisionSpec.

func (*ServiceRevisionSpec) DeepCopyInto 

func (in *ServiceRevisionSpec) DeepCopyInto(out *ServiceRevisionSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ServiceRuntime 

type ServiceRuntime struct {
	// CompatibilityDate is required by workerd; pinned per revision.
	CompatibilityDate string `json:"compatibilityDate"`
	// +optional
	CompatibilityFlags []string `json:"compatibilityFlags,omitempty"`
	// Timeout is the wall-clock request timeout. Default 30s.
	// +optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`
	// +optional
	Limits *ServiceLimits `json:"limits,omitempty"`
}

func (*ServiceRuntime) DeepCopy 

func (in *ServiceRuntime) DeepCopy() *ServiceRuntime

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceRuntime.

func (*ServiceRuntime) DeepCopyInto 

func (in *ServiceRuntime) DeepCopyInto(out *ServiceRuntime)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ServiceSource 

type ServiceSource struct {
	// OCI is a directly-pushed OCI bundle (push model). The controller
	// resolves its tag to a digest and mints a revision pinned to that digest.
	// +optional
	OCI *BundleRef `json:"oci,omitempty"`
	// Git is a git/CI build pipeline (git model). Builds produce the digest and
	// mint revisions.
	// +optional
	Git *GitSource `json:"git,omitempty"`
}

ServiceSource is where a Service's bundle comes from. Exactly one variant is set; the populated member IS the discriminator. The resolved digest always lands in the minted ServiceRevision.spec.bundle — users never author a bundle directly.

func (*ServiceSource) DeepCopy 

func (in *ServiceSource) DeepCopy() *ServiceSource

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceSource.

func (*ServiceSource) DeepCopyInto 

func (in *ServiceSource) DeepCopyInto(out *ServiceSource)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ServiceSpec 

type ServiceSpec struct {
	// Template is the desired serving config for the next minted revision.
	// Always user-owned. A change to Template mints a ServiceRevision.
	Template ServiceTemplateSpec `json:"template"`

	// Source is where the service's bundle comes from. Exactly one variant:
	// a directly-pushed OCI bundle (oci) or a git/CI pipeline (git). The resolved
	// digest always lands in the minted ServiceRevision.spec.bundle.
	Source ServiceSource `json:"source"`

	// LiveRevision selects which ServiceRevision serves:
	//   - empty: auto — the latest ready revision is served (continuous deploy
	//     for push, auto-promote for git). The served name is reported in
	//     status.liveRevision; the controller never writes this field.
	//   - set: pinned — exactly the named revision is served (rollback, or
	//     manual git promotion). New revisions are still minted but do not go
	//     live until this is repointed. The target must still be retained
	//     (see RevisionHistoryLimit).
	// +optional
	LiveRevision string `json:"liveRevision,omitempty"`

	// RevisionHistoryLimit defaults to 10.
	// +optional
	RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty"`
}

func (*ServiceSpec) DeepCopy 

func (in *ServiceSpec) DeepCopy() *ServiceSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceSpec.

func (*ServiceSpec) DeepCopyInto 

func (in *ServiceSpec) DeepCopyInto(out *ServiceSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ServiceStatus 

type ServiceStatus struct {
	// ObservedGeneration is the most recent spec generation the controller has
	// reconciled into this status.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// LiveRevision is the ServiceRevision currently being served. When
	// spec.liveRevision is empty (auto) it tracks LatestRevision; when pinned it
	// echoes the pinned revision once that revision is actually serving.
	// +optional
	LiveRevision string `json:"liveRevision,omitempty"`
	// LatestRevision is the most recently minted ServiceRevision name. A gap
	// between this and LiveRevision means a newer revision exists but is not live
	// (a pending rollout, or a held manual promotion).
	// +optional
	LatestRevision string `json:"latestRevision,omitempty"`
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

func (*ServiceStatus) CopyTo 

func (s *ServiceStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*ServiceStatus) DeepCopy 

func (in *ServiceStatus) DeepCopy() *ServiceStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceStatus.

func (*ServiceStatus) DeepCopyInto 

func (in *ServiceStatus) DeepCopyInto(out *ServiceStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ServiceStatus) SubResourceName 

func (s *ServiceStatus) SubResourceName() string

type ServiceTemplateSpec 

type ServiceTemplateSpec struct {
	// metadata's labels/annotations propagate to minted revisions; an explicit
	// name (or generateName) controls revision naming. Namespace is rejected:
	// these kinds are cluster-scoped.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec ServiceConfigSpec `json:"spec"`
}

ServiceTemplateSpec is Service.spec.template: the desired config for the NEXT minted revision. Following the Knative Service/Revision shape, it pairs metadata (propagated onto minted ServiceRevisions) with the bundle-less config spec. Editing it mints a new ServiceRevision.

func (*ServiceTemplateSpec) DeepCopy 

func (in *ServiceTemplateSpec) DeepCopy() *ServiceTemplateSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceTemplateSpec.

func (*ServiceTemplateSpec) DeepCopyInto 

func (in *ServiceTemplateSpec) DeepCopyInto(out *ServiceTemplateSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type Triggers 

type Triggers struct {
	// ProductionBranch is built+promoted on push. Default "main".
	// +optional
	// +kubebuilder:default="main"
	ProductionBranch string `json:"productionBranch,omitempty"`
	// Paths, if set, restricts triggering to changes under these globs.
	// +optional
	Paths []string `json:"paths,omitempty"`
	// OnPullRequest enables preview builds for PR branches.
	// +optional
	OnPullRequest bool `json:"onPullRequest,omitempty"`
}

func (*Triggers) DeepCopy 

func (in *Triggers) DeepCopy() *Triggers

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Triggers.

func (*Triggers) DeepCopyInto 

func (in *Triggers) DeepCopyInto(out *Triggers)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.