operator.proto

// Copyright 2019 Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

// $title: IstioOperator Options
// $description: Configuration affecting Istio control plane installation version and shape.
// $location: https://istio.io/docs/reference/config/istio.operator.v1alpha1.html
// $weight: 20

// Configuration affecting Istio control plane installation version and shape.
package istio.operator.v1alpha1;

option go_package="istio.io/api/operator/v1alpha1";

import "google/protobuf/any.proto";
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
import "gogoproto/gogo.proto";

option (gogoproto.marshaler_all) = false;
option (gogoproto.unmarshaler_all) = false;
option (gogoproto.sizer_all) = false;

// <!-- go code generation tags
// +kubetype-gen
// +kubetype-gen:groupVersion=install.istio.io/v1alpha1
// +genclient
// +k8s:deepcopy-gen=true
// -->

// IstioOperatorSpec defines the desired installed state of Istio components.
// The spec is a used to define a customization of the default profile values that are supplied with each Istio release.
// Because the spec is a customization API, specifying an empty IstioOperatorSpec results in a default Istio
// component values.
message IstioOperatorSpec {
    // Path or name for the profile e.g.
    //
    // * minimal (looks in profiles dir for a file called minimal.yaml)
    // * /tmp/istio/install/values/custom/custom-install.yaml (local file path)
    //
    // default profile is used if this field is unset.
    string profile = 10;
    // Path for the install package. e.g.
    //
    // * /tmp/istio-installer/nightly (local file path)
    //
    string install_package_path = 11;
    // Root for docker image paths e.g. `docker.io/istio`
    string hub = 12;
    // Version tag for docker images e.g. `1.7.2`
    TypeInterface tag = 13;

    // $hide_from_docs
    // Resource suffix is appended to all resources installed by each component.
    // Never implemented; replaced by revision.
    string resource_suffix = 14 [deprecated = true];
    // Namespace to install control plane resources into. If unset, Istio will be installed into the same namespace
    // as the `IstioOperator` CR.
    string namespace = 15;

    // Identify the revision this installation is associated with.
    // This option is currently experimental.
    string revision = 16;

    // Config used by control plane components internally.
    TypeMapStringInterface mesh_config = 40;

    // Kubernetes resource settings, enablement and component-specific settings that are not internal to the
    // component.
    IstioComponentSetSpec components = 50;

    // Extra addon components which are not explicitly specified above.
    map<string, ExternalComponentSpec> addon_components = 51;

    // Overrides for default `values.yaml`. This is a validated pass-through to Helm templates.
    // See the [Helm installation options](https://istio.io/v1.5/docs/reference/config/installation-options/) for schema details.
    // Anything that is available in `IstioOperatorSpec` should be set above rather than using the passthrough. This
    // includes Kubernetes resource settings for components in `KubernetesResourcesSpec`.
    TypeMapStringInterface values = 100;
    // Unvalidated overrides for default `values.yaml`. Used for custom templates where new parameters are added.
    TypeMapStringInterface unvalidated_values = 101;
}

// Observed state of IstioOperator
message InstallStatus {
    // Status describes the current state of a component.
    enum Status {
        // Component is not present.
        NONE = 0;
        // Component is being updated to a different version.
        UPDATING = 1;
        // Controller has started but not yet completed reconciliation loop for the component.
        RECONCILING = 2;
        // Component is healthy.
        HEALTHY = 3;
        // Component is in an error state.
        ERROR = 4;
        // Overall status only and would not be set as a component status.
        // Action is needed from the user for reconciliation to proceed
        // e.g. There are proxies still pointing to the control plane revision when try to remove an `IstioOperator` CR.
        ACTION_REQUIRED = 5;
    }
    // VersionStatus is the status and version of a component.
    message VersionStatus {
        string version = 1;
        Status status = 2;
        string error = 4;
    }
    // Overall status of all components controlled by the operator.
    //
    // * If all components have status `NONE`, overall status is `NONE`.
    // * If all components are `HEALTHY`, overall status is `HEALTHY`.
    // * If one or more components are `RECONCILING` and others are `HEALTHY`, overall status is `RECONCILING`.
    // * If one or more components are `UPDATING` and others are `HEALTHY`, overall status is `UPDATING`.
    // * If components are a mix of `RECONCILING`, `UPDATING` and `HEALTHY`, overall status is `UPDATING`.
    // * If any component is in `ERROR` state, overall status is `ERROR`.
    // * If further action is needed for reconciliation to proceed, overall status is `ACTION_REQUIRED`.
    //
    Status status = 1;
    // Optional message providing additional information about the existing overall status.
    string message = 3;
    // Individual status of each component controlled by the operator. The map key is the name of the component.
    map<string, VersionStatus> component_status = 2;
}

// IstioComponentSpec defines the desired installed state of Istio components.
message IstioComponentSetSpec {
    BaseComponentSpec base = 29;
    ComponentSpec pilot = 30;
    ComponentSpec cni = 38;
    ComponentSpec istiod_remote = 39;

    repeated GatewaySpec ingress_gateways = 40;
    repeated GatewaySpec egress_gateways = 41;

    reserved 31, 32, 33, 34, 35, 36, 37;
    reserved "citadel", "policy", "telemetry", "galley", "node_agent", "proxy", "sidecar_injector";
}

// Configuration for base component.
message BaseComponentSpec {
    // Selects whether this component is installed.
    TypeBoolValueForPB enabled = 1;

    // Kubernetes resource spec.
    KubernetesResourcesSpec k8s = 50;
}

// Configuration for internal components.
message ComponentSpec {
    // Selects whether this component is installed.
    TypeBoolValueForPB enabled = 1;
    // Namespace for the component.
    string namespace = 2;
    // Hub for the component (overrides top level hub setting).
    string hub = 10;
    // Tag for the component (overrides top level tag setting).
    TypeInterface tag = 11;

    // Arbitrary install time configuration for the component.
    TypeInterface spec = 30;

    // Kubernetes resource spec.
    KubernetesResourcesSpec k8s = 50;
}

// Configuration for external components.
message ExternalComponentSpec {
    // Selects whether this component is installed.
    TypeBoolValueForPB enabled = 1;
    // Namespace for the component.
    string namespace = 2;

    // Arbitrary install time configuration for the component.
    TypeInterface spec = 10;

    // Chart path for addon components.
    string chart_path = 30;
    // Optional schema to validate spec against.
    google.protobuf.Any schema = 35;

    // Kubernetes resource spec.
    KubernetesResourcesSpec k8s = 50;
}

// Configuration for gateways.
message GatewaySpec {
    // Selects whether this gateway is installed.
    TypeBoolValueForPB enabled = 1;
    // Namespace for the gateway.
    string namespace = 2;
    // Name for the gateway.
    string name = 3;
    // Labels for the gateway.
    map <string, string> label = 4;

    // Hub for the component (overrides top level hub setting).
    string hub = 10;
    // Tag for the component (overrides top level tag setting).
    TypeInterface tag = 11;

    // Kubernetes resource spec.
    KubernetesResourcesSpec k8s = 50;
}

// KubernetesResourcesConfig is a common set of k8s resource configs for components.
message KubernetesResourcesSpec {
    // k8s affinity.
    // [https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
    Affinity affinity = 1;
    // Deployment environment variables.
    // [https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
    repeated EnvVar env = 2;
    // k8s HorizontalPodAutoscaler settings.
    // [https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/)
    HorizontalPodAutoscalerSpec hpa_spec = 3;
    // k8s imagePullPolicy.
    // [https://kubernetes.io/docs/concepts/containers/images/](https://kubernetes.io/docs/concepts/containers/images/)
    string image_pull_policy = 4;
    // k8s nodeSelector.
    // [https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector)
    map<string, string> node_selector = 5;
    // k8s PodDisruptionBudget settings.
    // [https://kubernetes.io/docs/concepts/workloads/pods/disruptions/#how-disruption-budgets-work](https://kubernetes.io/docs/concepts/workloads/pods/disruptions/#how-disruption-budgets-work)
    PodDisruptionBudgetSpec pod_disruption_budget = 6;
    // k8s pod annotations.
    // [https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
    map<string, string> pod_annotations = 7;
    // k8s priority_class_name. Default for all resources unless overridden.
    // [https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass)
    string priority_class_name = 8;
    // k8s readinessProbe settings.
    // [https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)
    // k8s.io.api.core.v1.Probe readiness_probe = 9;
    ReadinessProbe readiness_probe = 9;
    // k8s Deployment replicas setting.
    // [https://kubernetes.io/docs/concepts/workloads/controllers/deployment/](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/)
    uint32 replica_count = 10;
    // k8s resources settings.
    // [https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container)
    Resources resources = 11;
    // k8s Service settings.
    // [https://kubernetes.io/docs/concepts/services-networking/service/](https://kubernetes.io/docs/concepts/services-networking/service/)
    ServiceSpec service = 12;
    // k8s deployment strategy.
    // [https://kubernetes.io/docs/concepts/workloads/controllers/deployment/](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/)
    DeploymentStrategy strategy = 13;
    // k8s toleration
    // [https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
    repeated Toleration tolerations = 14;
    // k8s service annotations.
    // [https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
    map<string, string> service_annotations = 15;
    // k8s pod security context
    // [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
    PodSecurityContext securityContext = 16;

    // Overlays for k8s resources in rendered manifests.
    repeated K8sObjectOverlay overlays = 100;
}

// Patch for an existing k8s resource.
message K8sObjectOverlay {
    message PathValue {
        // Path of the form a.[key1:value1].b.[:value2]
        // Where [key1:value1] is a selector for a key-value pair to identify a list element and [:value] is a value
        // selector to identify a list element in a leaf list.
        // All path intermediate nodes must exist.
        string path = 1;
        // Value to add, delete or replace.
        // For add, the path should be a new leaf.
        // For delete, value should be unset.
        // For replace, path should reference an existing node.
        // All values are strings but are converted into appropriate type based on schema.
        TypeInterface value = 2;
    }
    // Resource API version.
    string api_version = 1;
    // Resource kind.
    string kind = 2;
    // Name of resource.
    // Namespace is always the component namespace.
    string name = 3;

    // List of patches to apply to resource.
    repeated PathValue patches = 4;
}


// See k8s.io.api.core.v1.Affinity.
message Affinity {
    NodeAffinity nodeAffinity = 1;
    PodAffinity podAffinity = 2;
    PodAntiAffinity podAntiAffinity = 3;
}

// See k8s.io.api.core.v1.ConfigMapKeySelector.
message ConfigMapKeySelector {
    LocalObjectReference localObjectReference = 1;
    string key = 2;
    bool optional = 3;
}

// See k8s.io.api.core.v1.ClientIPConfig.
message ClientIPConfig {
    int32 timeoutSeconds = 1;
}

// See k8s.io.api.autoscaling.v2beta2.CrossVersionObjectReference.
message CrossVersionObjectReference {
    string kind = 1;
    string name = 2;
    string apiVersion = 3;
}

// See k8s.io.api.apps.v1.DeploymentStrategy.
message DeploymentStrategy {
    string type = 1;
    RollingUpdateDeployment rollingUpdate = 2;
}

// See k8s.io.api.core.v1.EnvVar.
message EnvVar {
    string name = 1;
    string value = 2;
    EnvVarSource valueFrom = 3;
}

// See k8s.io.api.core.v1.EnvVarSource.
message EnvVarSource {
    ObjectFieldSelector fieldRef = 1;
    ResourceFieldSelector resourceFieldRef = 2;
    ConfigMapKeySelector configMapKeyRef = 3;
    SecretKeySelector secretKeyRef = 4;
}

// See k8s.io.api.core.v1.ExecAction.
message ExecAction {
    repeated string command = 1;
}

// See k8s.io.api.autoscaling.v2beta2.CrossVersionObjectReference.
message ExternalMetricSource {
    string metricName = 1;
    k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector metricSelector = 2;
    TypeIntOrStringForPB targetValue = 3;
    TypeIntOrStringForPB targetAverageValue = 4;
}

// See k8s.io.api.core.v1.HTTPGetAction.
message HTTPGetAction {
    string path = 1;
    TypeIntOrStringForPB port = 2;
    string host = 3;
    string scheme = 4;
    repeated HTTPHeader httpHeaders = 5;
}

// See k8s.io.api.core.v1.HTTPHeader.
message HTTPHeader {
    string name = 1;
    string value = 2;
}

// See k8s.io.api.autoscaling.v2beta1.HorizontalPodAutoscalerSpec.
message HorizontalPodAutoscalerSpec {
    CrossVersionObjectReference scaleTargetRef = 1;
    int32 minReplicas = 2;
    int32 maxReplicas = 3;
    repeated MetricSpec metrics = 4;
}

// See k8s.io.api.core.v1.LocalObjectReference.
message LocalObjectReference {
    string name = 1;
}

// See k8s.io.autoscaling.v2beta1.MetricSpec.
message MetricSpec {
    string type = 1;
    ObjectMetricSource object = 2;
    PodsMetricSource pods = 3;
    ResourceMetricSource resource = 4;
    ExternalMetricSource external = 5;
}

// See k8s.io.api.core.v1.NodeAffinity.
message NodeAffinity {
    NodeSelector requiredDuringSchedulingIgnoredDuringExecution = 1;
    repeated PreferredSchedulingTerm preferredDuringSchedulingIgnoredDuringExecution = 2;
}

// See k8s.io.api.core.v1.NodeSelector.
message NodeSelector {
    repeated NodeSelectorTerm nodeSelectorTerms = 1;
}

// See k8s.io.api.core.v1.NodeSelectorTerm.
message NodeSelectorTerm {
    repeated NodeSelectorRequirement matchExpressions = 1;
    repeated NodeSelectorRequirement matchFields = 2;
}

// See k8s.io.api.core.v1.NodeSelectorRequirement.
message NodeSelectorRequirement {
    string key = 1;
    string operator = 2;
    repeated string values = 3;
}

// See k8s.io.api.core.v1.ObjectFieldSelector.
message ObjectFieldSelector {
    string apiVersion = 1;
    string fieldPath = 2;
}

// From k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta.
message ObjectMeta {
    string name = 5;
    string namespace = 6;
}

// See k8s.io.autoscaling.v2beta1.ObjectMetricSource.
message ObjectMetricSource {
    CrossVersionObjectReference target = 1;
    string metricName = 2;
    TypeIntOrStringForPB targetValue = 3;
    k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 4;
    TypeIntOrStringForPB averageValue = 5;
}

// See k8s.io.api.core.v1.PodAffinity.
message PodAffinity {
    repeated PodAffinityTerm requiredDuringSchedulingIgnoredDuringExecution = 1;
    repeated WeightedPodAffinityTerm preferredDuringSchedulingIgnoredDuringExecution = 2;
}

// See k8s.io.api.core.v1.PodAntiAffinity.
message PodAntiAffinity {
    repeated PodAffinityTerm requiredDuringSchedulingIgnoredDuringExecution = 1;
    repeated WeightedPodAffinityTerm preferredDuringSchedulingIgnoredDuringExecution = 2;
}

// See k8s.io.api.core.v1.PodAntiAffinity.
message PodAffinityTerm {
    k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector labelSelector = 1;
    repeated string namespaces = 2;
    string topologyKey = 3;
}

// See k8s.io.api.policy.v1beta1.PodDisruptionBudget.
message PodDisruptionBudgetSpec {
    uint32 minAvailable = 1;
    k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;
    uint32 maxUnavailable = 3;
}

// See k8s.io.api.core.v1.PodsMetricSource.
message PodsMetricSource {
    string metricName = 1;
    TypeIntOrStringForPB targetAverageValue = 2;
    k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 3;
}

// See k8s.io.api.core.v1.PreferredSchedulingTerm.
message PreferredSchedulingTerm {
    int32 weight = 1;
    NodeSelectorTerm preference = 2;
}

// See k8s.io.api.core.v1.ReadinessProbe.
message ReadinessProbe {
    ExecAction exec = 1;
    HTTPGetAction httpGet = 2;
    TCPSocketAction tcpSocket = 3;
    int32 initialDelaySeconds = 4;
    int32 timeoutSeconds = 5;
    int32 periodSeconds = 6;
    int32 successThreshold = 7;
    int32 failureThreshold = 8;
}

// See k8s.io.api.core.v1..
message ResourceFieldSelector {
    string containerName = 1;
    string resource = 2;
    TypeIntOrStringForPB divisor = 3;
}

// See k8s.io.api.core.v1.ResourceMetricSource.
message ResourceMetricSource {
    string name = 1;
    int32 targetAverageUtilization = 2;
    TypeIntOrStringForPB targetAverageValue = 3;
}

// See k8s.io.api.core.v1.ResourceRequirements.
message Resources {
    map<string, string> limits = 1;
    map<string, string> requests = 2;
}

// See k8s.io.api.apps.v1.RollingUpdateDeployment.
message RollingUpdateDeployment {
    TypeIntOrStringForPB maxUnavailable = 1;
    TypeIntOrStringForPB maxSurge = 2;
}

// See k8s.io.api.core.v1.SecretKeySelector.
message SecretKeySelector {
    LocalObjectReference localObjectReference = 1;
    string key = 2;
    bool optional = 3;
}

// See k8s.io.api.core.v1.ServiceSpec.
message ServiceSpec {
    repeated ServicePort ports = 1;
    map<string, string> selector = 2;
    string clusterIP = 3;
    string type = 4;
    repeated string externalIPs = 5;
    string sessionAffinity = 7;
    string loadBalancerIP = 8;
    repeated string loadBalancerSourceRanges = 9;
    string externalName = 10;
    string externalTrafficPolicy = 11;
    int32 healthCheckNodePort = 12;
    bool publishNotReadyAddresses = 13;
    SessionAffinityConfig sessionAffinityConfig = 14;
}

// See k8s.io.api.core.v1..
message ServicePort {
    string name = 1;
    string protocol = 2;
    int32 port = 3;
    TypeIntOrStringForPB targetPort = 4;
    int32 nodePort = 5;
}

// See k8s.io.api.core.v1.SessionAffinityConfig.
message SessionAffinityConfig {
    ClientIPConfig clientIP = 1;
}

// See k8s.io.api.core.v1.TCPSocketAction.
message TCPSocketAction {
    TypeIntOrStringForPB port = 1;
    string host = 2;
}

// See k8s.io.api.core.v1.Toleration.
message Toleration {
    string key = 1;
    string operator = 2;
    string value = 3;
    string effect = 4;
    int64 tolerationSeconds = 5;
}

// See k8s.io.api.core.v1.WeightedPodAffinityTerm.
message WeightedPodAffinityTerm {
    int32 weight = 1;
    PodAffinityTerm podAffinityTerm = 2;
}

// See k8s.io.api.core.v1.PodSecurityContext.
message PodSecurityContext {
    SELinuxOptions seLinuxOptions = 1;
    int64 runAsUser = 2;
    bool runAsNonRoot = 3;
    repeated int64 supplementalGroups = 4;
    int64 fsGroup = 5;
    int64 runAsGroup = 6;
    repeated Sysctl sysctls = 7;
    WindowsSecurityContextOptions windowsOptions = 8;
    string fsGroupChangePolicy = 9;
    SeccompProfile seccompProfile = 10;
}

// See k8s.io.api.core.v1.SELinuxOptions.
message SELinuxOptions {
    string user = 1;
    string role = 2;
    string type = 3;
    string level = 4;
}

// See k8s.io.api.core.v1.Sysctl.
message Sysctl {
    string name = 1;
    string value = 2;
}

// See k8s.io.api.core.v1.WindowsSecurityContextOptions.
message WindowsSecurityContextOptions {
    string gmsaCredentialSpecName = 1;
    string gmsaCredentialSpec = 2;
    string runAsUserName = 3;
}

// See k8s.io.api.core.v1.SeccompProfile.
message SeccompProfile {
    string type = 1;
    string localhostProfile = 2;
}

// Synthetic type for generating Go structs.
// GOTYPE: interface{}
message TypeInterface {}

// Synthetic type for generating Go structs.
// GOTYPE: map[string]interface{}
message TypeMapStringInterface {}

// Synthetic type for generating Go structs.
// GOTYPE: *IntOrStringForPB
message TypeIntOrStringForPB {}

// Synthetic type for generating Go structs.
// GOTYPE: *BoolValueForPB
message TypeBoolValueForPB {}