API Reference

Packages:

capsule.clastix.io/v1beta2
capsule.clastix.io/v1beta1

capsule.clastix.io/v1beta2

Resource Types:

CapsuleConfiguration
CustomQuota
GlobalCustomQuota
GlobalResourceQuota
GlobalTenantResource
QuantityLedger
ResourcePoolClaim
ResourcePool
RuleStatus
TenantOwner
TenantResource
Tenant

CapsuleConfiguration

CapsuleConfiguration is the Schema for the Capsule configuration API.

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta2	true
kind	string	CapsuleConfiguration	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	CapsuleConfigurationSpec defines the Capsule configuration.	true
status	object	CapsuleConfigurationStatus defines the Capsule configuration status.	false

CapsuleConfiguration.spec

CapsuleConfigurationSpec defines the Capsule configuration.

Name	Type	Description	Required
cacheInvalidation	string	Define the period of time upon a cache invalidation is executed for all caches. Default: 24h	true
enableTLSReconciler	boolean	Toggles the TLS reconciler, the controller that is able to generate CA and certificates for the webhooks when not using an already provided CA and certificate, or when these are managed externally with Vault, or cert-manager. Default: false	true
rbac	object	Define Properties for managed ClusterRoles by Capsule Default: map[]	true
administrators	[]object	Define entities which can act as Administrators in the capsule construct These entities are automatically owners for all existing tenants. Meaning they can add namespaces to any tenant. However they must be specific by using the capsule label for interacting with namespaces. Because if that label is not defined, it’s assumed that namespace interaction was not targeted towards a tenant and will therefore be ignored by capsule.	false
admission	object	Configuration for dynamic Validating and Mutating Admission webhooks managed by Capsule.	false
allowServiceAccountPromotion	boolean	ServiceAccounts within tenant namespaces can be promoted to owners of the given tenant this can be achieved by labeling the serviceaccount and then they are considered owners. This can only be done by other owners of the tenant. However ServiceAccounts which have been promoted to owner can not promote further serviceAccounts. Default: false	false
events	object	Event (Audit) Configuration Default: map[namespace:default]	false
forceTenantPrefix	boolean	Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment. Default: false	false
ignoreUserWithGroups	[]string	Define groups which when found in the request of a user will be ignored by the Capsule this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups.	false
impersonation	object	Service Account Client configuration for impersonation properties	false
nodeMetadata	object	Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant. This applies only if the Tenant has an active NodeSelector, and the Owner have right to patch their nodes.	false
overrides	object	Allows to set different name rather than the canonical one for the Capsule configuration objects, such as webhook secret or configurations. Default: map[TLSSecretName:capsule-tls mutatingWebhookConfigurationName:capsule-mutating-webhook-configuration validatingWebhookConfigurationName:capsule-validating-webhook-configuration]	false
protectedNamespaceRegex	string	Disallow creation of namespaces, whose name matches this regexp	false
userGroups	[]string	Deprecated: use users property instead (https://projectcapsule.dev/docs/operating/setup/configuration/#users) Names of the groups considered as Capsule users.	false
userNames	[]string	Deprecated: use users property instead (https://projectcapsule.dev/docs/operating/setup/configuration/#users) Names of the users considered as Capsule users.	false
users	[]object	Define entities which are considered part of the Capsule construct Users not mentioned here will be ignored by Capsule	false

CapsuleConfiguration.spec.rbac

Define Properties for managed ClusterRoles by Capsule

Name	Type	Description	Required
administrationClusterRoles	[]string	The ClusterRoles applied for Administrators Default: [capsule-namespace-deleter]	false
deleter	string	Name for the ClusterRole required to grant Namespace Deletion permissions. Default: capsule-namespace-deleter	false
promotionClusterRoles	[]string	The ClusterRoles applied for ServiceAccounts which had owner Promotion Default: [capsule-namespace-provisioner capsule-namespace-deleter]	false
provisioner	string	Name for the ClusterRole required to grant Namespace Provision permissions. Default: capsule-namespace-provisioner	false

CapsuleConfiguration.spec.administrators[index]

Name	Type	Description	Required
kind	enum	Kind of entity. Possible values are “User”, “Group”, and “ServiceAccount” Enum: User, Group, ServiceAccount	true
name	string	Name of the entity.	true

CapsuleConfiguration.spec.admission

Configuration for dynamic Validating and Mutating Admission webhooks managed by Capsule.

Name	Type	Description	Required
mutating	object	Configure dynamic Mutating Admission for Capsule	false
serviceName	string	Service Name of the Admission Service Default: capsule-webhook-service	false
validating	object	Configure dynamic Validating Admission for Capsule	false

CapsuleConfiguration.spec.admission.mutating

Configure dynamic Mutating Admission for Capsule

Name	Type	Description	Required
client	object	Client defines how the Kubernetes API server reaches the admission webhook. Exactly one of URL or Service must be configured.	true
annotations	map[string]string	Annotations added to the Admission Webhook	false
labels	map[string]string	Labels added to the Admission Webhook	false
name	string	Name the Admission Webhook	false
webhooks	[]object	Define Dynamic Admission Webhooks	false

CapsuleConfiguration.spec.admission.mutating.client

Client defines how the Kubernetes API server reaches the admission webhook. Exactly one of URL or Service must be configured.

Name	Type	Description	Required
caBundle	string	caBundle is a PEM encoded CA bundle which will be used to validate the webhook’s server certificate. If unspecified, system trust roots on the apiserver are used. Format: byte	false
service	object	service is a reference to the service for this webhook. Either `service` or `url` must be specified. If the webhook is running within the cluster, then you should use `service`.	false
url	string	url gives the location of the webhook, in standard URL form (`scheme://host:port/path`). Exactly one of `url` or `service` must be specified. The `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address. Please note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster. The scheme must be “https”; the URL must begin with “https://”. A path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier. Attempting to use a user or basic auth e.g. “user:password@” is not allowed. Fragments ("#…") and query parameters ("?…") are not allowed, either.	false

CapsuleConfiguration.spec.admission.mutating.client.service

service is a reference to the service for this webhook. Either service or url must be specified.

If the webhook is running within the cluster, then you should use service.

Name	Type	Description	Required
name	string	name is the name of the service. Required	true
namespace	string	namespace is the namespace of the service. Required	true
path	string	path is an optional URL path which will be sent in any request to this service.	false
port	integer	port is the port on the service that hosts the webhook. Default to 443 for backward compatibility. `port` should be a valid port number (1-65535, inclusive). Format: int32	false

CapsuleConfiguration.spec.admission.mutating.webhooks[index]

Name	Type	Description	Required
admissionReviewVersions	[]string	AdmissionReviewVersions is an ordered list of preferred `AdmissionReview` versions the Webhook expects. API server will try to use first version in the list which it supports. If none of the versions specified in this list supported by API server, validation will fail for this object. If a persisted webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail and be subject to the failure policy.	true
name	string	The name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where “imagepolicy” is the name of the webhook, and kubernetes.io is the name of the organization. Required.	true
path	string	`path` is the URL path which will be sent in any request to this service.	true
sideEffects	string	SideEffects states whether this webhook has side effects. Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown). Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some.	true
failurePolicy	string	FailurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Fail.	false
matchConditions	[]object	MatchConditions is a list of conditions that must be met for a request to be sent to this webhook. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed. The exact matching logic is (in order): 1. If ANY matchCondition evaluates to FALSE, the webhook is skipped. 2. If ALL matchConditions evaluate to TRUE, the webhook is called. 3. If any matchCondition evaluates to an error (but none are FALSE): - If failurePolicy=Fail, reject the request - If failurePolicy=Ignore, the error is ignored and the webhook is skipped	false
matchPolicy	string	matchPolicy defines how the “rules” list is used to match incoming requests. Allowed values are “Exact” or “Equivalent”. - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but “rules” only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook. - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and “rules” only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook. Defaults to “Equivalent”	false
namespaceSelector	object	NamespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook. For example, to run the webhook on any objects whose namespace is not associated with “runlevel” of “0” or “1”; you will set the selector as follows: “namespaceSelector”: { “matchExpressions”: [ { “key”: “runlevel”, “operator”: “NotIn”, “values”: [ “0”, “1” ] } ] } If instead you want to only run the webhook on any objects whose namespace is associated with the “environment” of “prod” or “staging”; you will set the selector as follows: “namespaceSelector”: { “matchExpressions”: [ { “key”: “environment”, “operator”: “In”, “values”: [ “prod”, “staging” ] } ] } See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors. Default to the empty LabelSelector, which matches everything.	false
objectSelector	object	ObjectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.	false
opts	object	Capsule Custom Admission Options	false
reinvocationPolicy	string	reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation. Allowed values are “Never” and “IfNeeded”. Never: the webhook will not be called more than once in a single admission evaluation. IfNeeded: the webhook will be called at least one additional time as part of the admission evaluation if the object being admitted is modified by other admission plugins after the initial webhook call. Webhooks that specify this option must be idempotent, able to process objects they previously admitted. Note: * the number of additional invocations is not guaranteed to be exactly one. * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again. * webhooks that use this option may be reordered to minimize the number of additional invocations. * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead. Defaults to “Never”.	false
rules	[]object	Rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches any Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.	false
timeoutSeconds	integer	TimeoutSeconds specifies the timeout for this webhook. After the timeout passes, the webhook call will be ignored or the API call will fail based on the failure policy. The timeout value must be between 1 and 30 seconds. Default to 10 seconds. Format: int32	false

CapsuleConfiguration.spec.admission.mutating.webhooks[index].matchConditions[index]

MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.

Name	Type	Description	Required
expression	string	expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: ‘object’ - The object from the incoming request. The value is null for DELETE requests. ‘oldObject’ - The existing object. The value is null for CREATE requests. ‘request’ - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). ‘authorizer’ - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz ‘authorizer.requestResource’ - A CEL ResourceCheck constructed from the ‘authorizer’ and configured with the request resource. Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ Required.	true
name	string	name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, ‘-’, ‘’ or ‘.’, and must start and end with an alphanumeric character (e.g. ‘MyName’, or ‘my.name’, or ‘123-abc’, regex used for validation is ‘([A-Za-z0-9][-A-Za-z0-9.]*)?[A-Za-z0-9]’) with an optional DNS subdomain prefix and ‘/’ (e.g. ’example.com/MyName’) Required.	true

CapsuleConfiguration.spec.admission.mutating.webhooks[index].namespaceSelector

NamespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook.

For example, to run the webhook on any objects whose namespace is not associated with “runlevel” of “0” or “1”; you will set the selector as follows: “namespaceSelector”: { “matchExpressions”: [ { “key”: “runlevel”, “operator”: “NotIn”, “values”: [ “0”, “1” ] } ] }

If instead you want to only run the webhook on any objects whose namespace is associated with the “environment” of “prod” or “staging”; you will set the selector as follows: “namespaceSelector”: { “matchExpressions”: [ { “key”: “environment”, “operator”: “In”, “values”: [ “prod”, “staging” ] } ] }

See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.

Default to the empty LabelSelector, which matches everything.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

CapsuleConfiguration.spec.admission.mutating.webhooks[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

CapsuleConfiguration.spec.admission.mutating.webhooks[index].objectSelector

ObjectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

CapsuleConfiguration.spec.admission.mutating.webhooks[index].objectSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

CapsuleConfiguration.spec.admission.mutating.webhooks[index].opts

Capsule Custom Admission Options

Name	Type	Description	Required
administrators	boolean	If enabled, the request is only sent to admission if the user is mentioned As Part of the Capsule Administrators Default: false	true
capsuleUsers	boolean	If enabled, the request is only sent to admission if the user is mentioned As Part of the Capsule Users Default: false	true

CapsuleConfiguration.spec.admission.mutating.webhooks[index].rules[index]

RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.

Name	Type	Description	Required
apiGroups	[]string	apiGroups is the API groups the resources belong to. ‘’ is all groups. If ‘’ is present, the length of the slice must be one. Required.	false
apiVersions	[]string	apiVersions is the API versions the resources belong to. ‘’ is all versions. If ‘’ is present, the length of the slice must be one. Required.	false
operations	[]string	operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or for all of those operations and any future admission operations that are added. If ‘’ is present, the length of the slice must be one. Required.	false
resources	[]string	resources is a list of resources this rule applies to. For example: ‘pods’ means pods. ‘pods/log’ means the log subresource of pods. ’’ means all resources, but not subresources. ‘pods/’ means all subresources of pods. ’/scale’ means all scale subresources. ’/*’ means all resources and their subresources. If wildcard is present, the validation rule will ensure resources do not overlap with each other. Depending on the enclosing object, subresources might not be allowed. Required.	false
scope	string	scope specifies the scope of this rule. Valid values are “Cluster”, “Namespaced”, and “" “Cluster” means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. “Namespaced” means that only namespaced resources will match this rule. ”" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is “*”.	false

CapsuleConfiguration.spec.admission.validating

Configure dynamic Validating Admission for Capsule

Name	Type	Description	Required
client	object	Client defines how the Kubernetes API server reaches the admission webhook. Exactly one of URL or Service must be configured.	true
annotations	map[string]string	Annotations added to the Admission Webhook	false
labels	map[string]string	Labels added to the Admission Webhook	false
name	string	Name the Admission Webhook	false
webhooks	[]object	Define Dynamic Admission Webhooks	false

CapsuleConfiguration.spec.admission.validating.client

Client defines how the Kubernetes API server reaches the admission webhook. Exactly one of URL or Service must be configured.

Name	Type	Description	Required
caBundle	string	caBundle is a PEM encoded CA bundle which will be used to validate the webhook’s server certificate. If unspecified, system trust roots on the apiserver are used. Format: byte	false
service	object	service is a reference to the service for this webhook. Either `service` or `url` must be specified. If the webhook is running within the cluster, then you should use `service`.	false
url	string	url gives the location of the webhook, in standard URL form (`scheme://host:port/path`). Exactly one of `url` or `service` must be specified. The `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address. Please note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster. The scheme must be “https”; the URL must begin with “https://”. A path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier. Attempting to use a user or basic auth e.g. “user:password@” is not allowed. Fragments ("#…") and query parameters ("?…") are not allowed, either.	false

CapsuleConfiguration.spec.admission.validating.client.service

service is a reference to the service for this webhook. Either service or url must be specified.

If the webhook is running within the cluster, then you should use service.

Name	Type	Description	Required
name	string	name is the name of the service. Required	true
namespace	string	namespace is the namespace of the service. Required	true
path	string	path is an optional URL path which will be sent in any request to this service.	false
port	integer	port is the port on the service that hosts the webhook. Default to 443 for backward compatibility. `port` should be a valid port number (1-65535, inclusive). Format: int32	false

CapsuleConfiguration.spec.admission.validating.webhooks[index]

Name	Type	Description	Required
admissionReviewVersions	[]string	AdmissionReviewVersions is an ordered list of preferred `AdmissionReview` versions the Webhook expects. API server will try to use first version in the list which it supports. If none of the versions specified in this list supported by API server, validation will fail for this object. If a persisted webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail and be subject to the failure policy.	true
name	string	The name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where “imagepolicy” is the name of the webhook, and kubernetes.io is the name of the organization. Required.	true
path	string	`path` is the URL path which will be sent in any request to this service.	true
sideEffects	string	SideEffects states whether this webhook has side effects. Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown). Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some.	true
failurePolicy	string	FailurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Fail.	false
matchConditions	[]object	MatchConditions is a list of conditions that must be met for a request to be sent to this webhook. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed. The exact matching logic is (in order): 1. If ANY matchCondition evaluates to FALSE, the webhook is skipped. 2. If ALL matchConditions evaluate to TRUE, the webhook is called. 3. If any matchCondition evaluates to an error (but none are FALSE): - If failurePolicy=Fail, reject the request - If failurePolicy=Ignore, the error is ignored and the webhook is skipped	false
matchPolicy	string	matchPolicy defines how the “rules” list is used to match incoming requests. Allowed values are “Exact” or “Equivalent”. - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but “rules” only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook. - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and “rules” only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook. Defaults to “Equivalent”	false
namespaceSelector	object	NamespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook. For example, to run the webhook on any objects whose namespace is not associated with “runlevel” of “0” or “1”; you will set the selector as follows: “namespaceSelector”: { “matchExpressions”: [ { “key”: “runlevel”, “operator”: “NotIn”, “values”: [ “0”, “1” ] } ] } If instead you want to only run the webhook on any objects whose namespace is associated with the “environment” of “prod” or “staging”; you will set the selector as follows: “namespaceSelector”: { “matchExpressions”: [ { “key”: “environment”, “operator”: “In”, “values”: [ “prod”, “staging” ] } ] } See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels for more examples of label selectors. Default to the empty LabelSelector, which matches everything.	false
objectSelector	object	ObjectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.	false
opts	object	Capsule Custom Admission Options	false
rules	[]object	Rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches any Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.	false
timeoutSeconds	integer	TimeoutSeconds specifies the timeout for this webhook. After the timeout passes, the webhook call will be ignored or the API call will fail based on the failure policy. The timeout value must be between 1 and 30 seconds. Default to 10 seconds. Format: int32	false

CapsuleConfiguration.spec.admission.validating.webhooks[index].matchConditions[index]

MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.

Name	Type	Description	Required
expression	string	expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: ‘object’ - The object from the incoming request. The value is null for DELETE requests. ‘oldObject’ - The existing object. The value is null for CREATE requests. ‘request’ - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). ‘authorizer’ - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz ‘authorizer.requestResource’ - A CEL ResourceCheck constructed from the ‘authorizer’ and configured with the request resource. Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ Required.	true
name	string	name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, ‘-’, ‘’ or ‘.’, and must start and end with an alphanumeric character (e.g. ‘MyName’, or ‘my.name’, or ‘123-abc’, regex used for validation is ‘([A-Za-z0-9][-A-Za-z0-9.]*)?[A-Za-z0-9]’) with an optional DNS subdomain prefix and ‘/’ (e.g. ’example.com/MyName’) Required.	true

CapsuleConfiguration.spec.admission.validating.webhooks[index].namespaceSelector

See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels for more examples of label selectors.

Default to the empty LabelSelector, which matches everything.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

CapsuleConfiguration.spec.admission.validating.webhooks[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

CapsuleConfiguration.spec.admission.validating.webhooks[index].objectSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

CapsuleConfiguration.spec.admission.validating.webhooks[index].objectSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

CapsuleConfiguration.spec.admission.validating.webhooks[index].opts

Capsule Custom Admission Options

Name	Type	Description	Required
administrators	boolean	If enabled, the request is only sent to admission if the user is mentioned As Part of the Capsule Administrators Default: false	true
capsuleUsers	boolean	If enabled, the request is only sent to admission if the user is mentioned As Part of the Capsule Users Default: false	true

CapsuleConfiguration.spec.admission.validating.webhooks[index].rules[index]

RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.

Name	Type	Description	Required
apiGroups	[]string	apiGroups is the API groups the resources belong to. ‘’ is all groups. If ‘’ is present, the length of the slice must be one. Required.	false
apiVersions	[]string	apiVersions is the API versions the resources belong to. ‘’ is all versions. If ‘’ is present, the length of the slice must be one. Required.	false
operations	[]string	operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or for all of those operations and any future admission operations that are added. If ‘’ is present, the length of the slice must be one. Required.	false
resources	[]string	resources is a list of resources this rule applies to. For example: ‘pods’ means pods. ‘pods/log’ means the log subresource of pods. ’’ means all resources, but not subresources. ‘pods/’ means all subresources of pods. ’/scale’ means all scale subresources. ’/*’ means all resources and their subresources. If wildcard is present, the validation rule will ensure resources do not overlap with each other. Depending on the enclosing object, subresources might not be allowed. Required.	false
scope	string	scope specifies the scope of this rule. Valid values are “Cluster”, “Namespaced”, and “" “Cluster” means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. “Namespaced” means that only namespaced resources will match this rule. ”" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is “*”.	false

CapsuleConfiguration.spec.events

Event (Audit) Configuration

Name	Type	Description	Required
namespace	string	Namespace where the events are logged for cluster scoped resources or deny events (default namespace) Default: default	false

CapsuleConfiguration.spec.impersonation

Service Account Client configuration for impersonation properties

Name	Type	Description	Required
caSecretKey	string	Key in the secret that holds the CA certificate (e.g., “ca.crt”) Default: ca.crt	false
caSecretName	string	Name of the secret containing the CA certificate	false
caSecretNamespace	string	Namespace where the CA certificate secret is located	false
endpoint	string	Kubernetes API Endpoint to use for impersonation	false
globalDefaultServiceAccount	string	Default ServiceAccount for global resources (GlobalTenantResource) When defined, users are required to use this ServiceAccount anywhere in the cluster unless they explicitly provide their own.	false
globalDefaultServiceAccountNamespace	string	Namespace of the default ServiceAccount for global resources (GlobalTenantResource) When defined, users are required to use this ServiceAccount anywhere in the cluster unless they explicitly provide their own.	false
skipTlsVerify	boolean	If true, TLS certificate verification is skipped (not recommended for production) Default: false	false
tenantDefaultServiceAccount	string	Default ServiceAccount for namespaced resources (TenantResource) When defined, users are required to use this ServiceAccount within the namespace where they deploy the resource, unless they explicitly provide their own.	false

CapsuleConfiguration.spec.nodeMetadata

Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant. This applies only if the Tenant has an active NodeSelector, and the Owner have right to patch their nodes.

Name	Type	Description	Required
forbiddenAnnotations	object	Define the annotations that a Tenant Owner cannot set for their nodes.	false
forbiddenLabels	object	Define the labels that a Tenant Owner cannot set for their nodes.	false

CapsuleConfiguration.spec.nodeMetadata.forbiddenAnnotations

Define the annotations that a Tenant Owner cannot set for their nodes.

Name	Type	Description	Required
denied	[]string		false
deniedRegex	string		false

CapsuleConfiguration.spec.nodeMetadata.forbiddenLabels

Define the labels that a Tenant Owner cannot set for their nodes.

Name	Type	Description	Required
denied	[]string		false
deniedRegex	string		false

CapsuleConfiguration.spec.overrides

Allows to set different name rather than the canonical one for the Capsule configuration objects, such as webhook secret or configurations.

Name	Type	Description	Required
TLSSecretName	string	Defines the Secret name used for the webhook server. Must be in the same Namespace where the Capsule Deployment is deployed. Default: capsule-tls	true
mutatingWebhookConfigurationName	string	Deprecated: use dynamic admission instead Name of the MutatingWebhookConfiguration which contains the dynamic admission controller paths and resources. Default: capsule-mutating-webhook-configuration	true
validatingWebhookConfigurationName	string	Deprecated: use dynamic admission instead Name of the ValidatingWebhookConfiguration which contains the dynamic admission controller paths and resources. Default: capsule-validating-webhook-configuration	true

CapsuleConfiguration.spec.users[index]

Name	Type	Description	Required
kind	enum	Kind of entity. Possible values are “User”, “Group”, and “ServiceAccount” Enum: User, Group, ServiceAccount	true
name	string	Name of the entity.	true

CapsuleConfiguration.status

CapsuleConfigurationStatus defines the Capsule configuration status.

Name	Type	Description	Required
conditions	[]object	Conditions holds the reconciliation conditions for this CapsuleConfiguration. Includes a Ready condition indicating whether the configuration was successfully validated and applied.	false
observedGeneration	integer	ObservedGeneration is the most recent generation the controller has observed. Format: int64	false
tenants	[]string	Tenants is the sorted list of Tenant names currently present in the cluster. The total count is available via len(Tenants).	false
users	[]object	Users which are considered Capsule Users and are bound to the Capsule Tenant construct.	false

CapsuleConfiguration.status.conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

CapsuleConfiguration.status.users[index]

Name	Type	Description	Required
kind	enum	Kind of entity. Possible values are “User”, “Group”, and “ServiceAccount” Enum: User, Group, ServiceAccount	true
name	string	Name of the entity.	true

CustomQuota

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta2	true
kind	string	CustomQuota	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	CustomQuotaSpec.	true
status	object	CustomQuotaStatus defines the observed state of GlobalResourceQuota.	false

CustomQuota.spec

CustomQuotaSpec.

Name	Type	Description	Required
limit	int or string	Resource Quantity as limit	true
options	object	Additional Options for the CustomQuotaSpecification Default: map[emitMetricPerClaimUsage:false]	true
sources	[]object	Target resource	true
scopeSelectors	[]object	Select items governed by this quota	false

CustomQuota.spec.options

Additional Options for the CustomQuotaSpecification

Name	Type	Description	Required
emitMetricPerClaimUsage	boolean	Additionally expose usage metrics for each claim contributing to the quota. This is disabled by default to avoid high cardinality in the metrics, but can be enabled for more granular monitoring and alerting. Default: false	false

CustomQuota.spec.sources[index]

Name	Type	Description	Required
kind	string	Kind of the referent. Use “*” to match all kinds.	true
apiVersion	string	API version, API group, or API group/version selector of the referent. Empty APIVersion means the core Kubernetes API version “v1”. Use “” to explicitly match all API groups and versions. Examples: - "" means core “v1”. - “v1” means core “v1”. - “apps” means any version in the “apps” API group. - “apps/v1” means the “apps/v1” API group/version. - “apps/” means any version in the “apps” API group.	false
cel	string	CEL expression evaluated against the source object. The object is available as “object”. Must evaluate to kubernetes.Quantity or list<kubernetes.Quantity>. Mutually exclusive with path and must be empty when op is “count”.	false
op	enum	Operation used to evaluate usage. Enum: add, sub, count Default: add	false
path	string	Path on GVK where usage is evaluated. Must be empty when op is “count”. Required and non-empty for all other operations.	false
selectors	[]object	Provide more granular selectors for these sources The ScopeSelector and NamespaceSelector are always applied Allowing these selectors to make further selecting on the resulting subset.	false

CustomQuota.spec.sources[index].selectors[index]

Name	Type	Description	Required
celExpressions	[]string	Additional CEL expressions evaluated against the selected object. The object is available as “object”. All must evaluate to true for this selector to match. CEL expressions and fieldSelectors may be used together.	false
fieldSelectors	[]string	Additional boolean JSONPath expressions. All must evaluate to true for this selector to match.	false
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

CustomQuota.spec.sources[index].selectors[index].matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

CustomQuota.spec.scopeSelectors[index]

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

CustomQuota.spec.scopeSelectors[index].matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

CustomQuota.status

CustomQuotaStatus defines the observed state of GlobalResourceQuota.

Name	Type	Description	Required
conditions	[]object	Conditions	true
targets	[]object	Targeting GVK	true
claims	[]object	Objects regarding this policy	false
observedGeneration	integer	ObservedGeneration is the most recent generation the controller has observed. Format: int64	false
usage	object	Usage measurements	false

CustomQuota.status.conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

CustomQuota.status.targets[index]

Name	Type	Description	Required
group	string		true
kind	string		true
version	string		true
cel	string	CEL expression evaluated against the source object. The object is available as “object”. Must evaluate to kubernetes.Quantity or list<kubernetes.Quantity>. Mutually exclusive with path and must be empty when op is “count”.	false
op	enum	Operation used to evaluate usage. Enum: add, sub, count Default: add	false
path	string	Path on GVK where usage is evaluated. Must be empty when op is “count”. Required and non-empty for all other operations.	false
scope	string	Scope of the GVK where usage is evaluated.	false
selectors	[]object	Provide more granular selectors for these sources The ScopeSelector and NamespaceSelector are always applied Allowing these selectors to make further selecting on the resulting subset.	false

CustomQuota.status.targets[index].selectors[index]

Name	Type	Description	Required
celExpressions	[]string	Additional CEL expressions evaluated against the selected object. The object is available as “object”. All must evaluate to true for this selector to match. CEL expressions and fieldSelectors may be used together.	false
fieldSelectors	[]string	Additional boolean JSONPath expressions. All must evaluate to true for this selector to match.	false
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

CustomQuota.status.targets[index].selectors[index].matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

CustomQuota.status.claims[index]

Name	Type	Description	Required
group	string		true
kind	string		true
name	string	Name of the referent.	true
uid	string	UID of the tracked Tenant to pin point tracking	true
usage	int or string	Resource Quantity for given item	true
version	string		true
namespace	string	Namespace of the referent, when not specified it acts as LocalObjectReference.	false

CustomQuota.status.usage

Usage measurements

Name	Type	Description	Required
available	int or string	Used is the current observed total available of the resource (limit - used).	false
used	int or string	Used is the current observed total usage of the resource.	false

GlobalCustomQuota

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta2	true
kind	string	GlobalCustomQuota	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	ClusterCustomQuotaSpec.	true
status	object	CustomQuotaStatus defines the observed state of GlobalResourceQuota.	false

GlobalCustomQuota.spec

ClusterCustomQuotaSpec.

Name	Type	Description	Required
limit	int or string	Resource Quantity as limit	true
options	object	Additional Options for the CustomQuotaSpecification Default: map[emitMetricPerClaimUsage:false]	true
sources	[]object	Target resource	true
namespaceSelectors	[]object	Select specifc namespaces where this Quota selects items.	false
scopeSelectors	[]object	Select items governed by this quota	false

GlobalCustomQuota.spec.options

Additional Options for the CustomQuotaSpecification

Name	Type	Description	Required
emitMetricPerClaimUsage	boolean	Additionally expose usage metrics for each claim contributing to the quota. This is disabled by default to avoid high cardinality in the metrics, but can be enabled for more granular monitoring and alerting. Default: false	false

GlobalCustomQuota.spec.sources[index]

Name	Type	Description	Required
kind	string	Kind of the referent. Use “*” to match all kinds.	true
apiVersion	string	API version, API group, or API group/version selector of the referent. Empty APIVersion means the core Kubernetes API version “v1”. Use “” to explicitly match all API groups and versions. Examples: - "" means core “v1”. - “v1” means core “v1”. - “apps” means any version in the “apps” API group. - “apps/v1” means the “apps/v1” API group/version. - “apps/” means any version in the “apps” API group.	false
cel	string	CEL expression evaluated against the source object. The object is available as “object”. Must evaluate to kubernetes.Quantity or list<kubernetes.Quantity>. Mutually exclusive with path and must be empty when op is “count”.	false
op	enum	Operation used to evaluate usage. Enum: add, sub, count Default: add	false
path	string	Path on GVK where usage is evaluated. Must be empty when op is “count”. Required and non-empty for all other operations.	false
selectors	[]object	Provide more granular selectors for these sources The ScopeSelector and NamespaceSelector are always applied Allowing these selectors to make further selecting on the resulting subset.	false

GlobalCustomQuota.spec.sources[index].selectors[index]

Name	Type	Description	Required
celExpressions	[]string	Additional CEL expressions evaluated against the selected object. The object is available as “object”. All must evaluate to true for this selector to match. CEL expressions and fieldSelectors may be used together.	false
fieldSelectors	[]string	Additional boolean JSONPath expressions. All must evaluate to true for this selector to match.	false
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

GlobalCustomQuota.spec.sources[index].selectors[index].matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

GlobalCustomQuota.spec.namespaceSelectors[index]

Selector for resources and their labels or selecting origin namespaces

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

GlobalCustomQuota.spec.namespaceSelectors[index].matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

GlobalCustomQuota.spec.scopeSelectors[index]

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

GlobalCustomQuota.spec.scopeSelectors[index].matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

GlobalCustomQuota.status

CustomQuotaStatus defines the observed state of GlobalResourceQuota.

Name	Type	Description	Required
conditions	[]object	Conditions	true
targets	[]object	Targeting GVK	true
claims	[]object	Objects regarding this policy	false
namespaces	[]string	Observed Namespaces	false
observedGeneration	integer	ObservedGeneration is the most recent generation the controller has observed. Format: int64	false
usage	object	Usage measurements	false

GlobalCustomQuota.status.conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

GlobalCustomQuota.status.targets[index]

Name	Type	Description	Required
group	string		true
kind	string		true
version	string		true
cel	string	CEL expression evaluated against the source object. The object is available as “object”. Must evaluate to kubernetes.Quantity or list<kubernetes.Quantity>. Mutually exclusive with path and must be empty when op is “count”.	false
op	enum	Operation used to evaluate usage. Enum: add, sub, count Default: add	false
path	string	Path on GVK where usage is evaluated. Must be empty when op is “count”. Required and non-empty for all other operations.	false
scope	string	Scope of the GVK where usage is evaluated.	false
selectors	[]object	Provide more granular selectors for these sources The ScopeSelector and NamespaceSelector are always applied Allowing these selectors to make further selecting on the resulting subset.	false

GlobalCustomQuota.status.targets[index].selectors[index]

Name	Type	Description	Required
celExpressions	[]string	Additional CEL expressions evaluated against the selected object. The object is available as “object”. All must evaluate to true for this selector to match. CEL expressions and fieldSelectors may be used together.	false
fieldSelectors	[]string	Additional boolean JSONPath expressions. All must evaluate to true for this selector to match.	false
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

GlobalCustomQuota.status.targets[index].selectors[index].matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

GlobalCustomQuota.status.claims[index]

Name	Type	Description	Required
group	string		true
kind	string		true
name	string	Name of the referent.	true
uid	string	UID of the tracked Tenant to pin point tracking	true
usage	int or string	Resource Quantity for given item	true
version	string		true
namespace	string	Namespace of the referent, when not specified it acts as LocalObjectReference.	false

GlobalCustomQuota.status.usage

Usage measurements

Name	Type	Description	Required
available	int or string	Used is the current observed total available of the resource (limit - used).	false
used	int or string	Used is the current observed total usage of the resource.	false

GlobalResourceQuota

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta2	true
kind	string	GlobalResourceQuota	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	GlobalResourceQuotaSpec defines a native ResourceQuota shared by every namespace matched by any namespace selector.	true
status	object		false

GlobalResourceQuota.spec

GlobalResourceQuotaSpec defines a native ResourceQuota shared by every namespace matched by any namespace selector.

Name	Type	Description	Required
quota	object	Quota is the native Kubernetes ResourceQuota specification enforced across the selected namespaces.	true
namespaceSelectors	[]object	NamespaceSelectors select the namespaces that share this quota. Selectors are ORed; requirements within one selector are ANDed. An empty label selector matches all namespaces.	false

GlobalResourceQuota.spec.quota

Quota is the native Kubernetes ResourceQuota specification enforced across the selected namespaces.

Name	Type	Description	Required
hard	map[string]int or string	hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/	false
scopeSelector	object	scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.	false
scopes	[]string	A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.	false

GlobalResourceQuota.spec.quota.scopeSelector

scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.

Name	Type	Description	Required
matchExpressions	[]object	A list of scope selector requirements by scope of the resources.	false

GlobalResourceQuota.spec.quota.scopeSelector.matchExpressions[index]

A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.

Name	Type	Description	Required
operator	string	Represents a scope’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.	true
scopeName	string	The name of the scope that the selector applies to.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

GlobalResourceQuota.spec.namespaceSelectors[index]

Selector for resources and their labels or selecting origin namespaces

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

GlobalResourceQuota.spec.namespaceSelectors[index].matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

GlobalResourceQuota.status

Name	Type	Description	Required
conditions	[]object	Conditions report reconciliation and admission readiness.	true
total	object	Total contains aggregate quota usage across all selected namespaces.	true
namespaceCount	integer	NamespaceSize is the number of selected namespaces. Default: 0	false
namespaceUsage	map[string]object	NamespaceUsage contains observed quota usage per selected namespace.	false
namespaces	[]string	Namespaces is the ordered set of selected namespace names.	false
observedGeneration	integer	ObservedGeneration is the most recent generation observed by the controller. Format: int64	false

GlobalResourceQuota.status.conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

GlobalResourceQuota.status.total

Total contains aggregate quota usage across all selected namespaces.

Name	Type	Description	Required
available	map[string]int or string	Available is max(Hard-Used, 0).	false
hard	map[string]int or string	Hard is the configured shared limit.	false
used	map[string]int or string	Used is the usage observed across the relevant namespace set.	false

GlobalResourceQuota.status.namespaceUsage[key]

Name	Type	Description	Required
used	map[string]int or string	Used is the usage observed in this namespace.	false

GlobalTenantResource

GlobalTenantResource allows to propagate resource replications to a specific subset of Tenant resources.

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta2	true
kind	string	GlobalTenantResource	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	GlobalTenantResourceSpec defines the desired state of GlobalTenantResource.	true
status	object	GlobalTenantResourceStatus defines the observed state of GlobalTenantResource.	false

GlobalTenantResource.spec

GlobalTenantResourceSpec defines the desired state of GlobalTenantResource.

Name	Type	Description	Required
resources	[]object	Defines the rules to select targeting Namespace, along with the objects that must be replicated.	true
resyncPeriod	string	Define the period of time upon a second reconciliation must be invoked. Keep in mind that any change to the manifests will trigger a new reconciliation. Default: 60s	true
settings	object	Deprecated: configure resources[].policy instead. Admission converts Settings into policies for blocks without one. Retained as a compatibility fallback for stored resources that have not passed through admission again. Default: map[]	true
cordoned	boolean	When cordoning a replication it will no longer execute any applies or deletions (paused). This is useful for maintenances Default: false	false
dependsOn	[]object	DependsOn may contain a meta.NamespacedObjectReference slice with references to TenantResource resources that must be ready before this TenantResource can be reconciled.	false
pruningOnDelete	boolean	When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted. Disable this to keep replicated resources although the deletion of the replication manifest. Deprecated: use resources[].policy.deletion instead. Retained for blocks without a policy. Default: true	false
scope	enum	Resource Scope, Can either be - Tenant: Create Resources for each tenant in selected Tenants - Namespace: Create Resources for each namespace in selected Tenants Enum: Namespace, Tenant, None Default: Namespace	false
serviceAccount	object	Local ServiceAccount which will perform all the actions defined in the TenantResource You must provide permissions accordingly to that ServiceAccount	false
tenantSelector	object	Defines the Tenant selector used target the tenants on which resources must be propagated.	false

GlobalTenantResource.spec.resources[index]

Name	Type	Description	Required
additionalMetadata	object	Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be added to the replicated resources.	false
context	object	Provide additional template context, which can be used throughout all the declared items for the replication	false
generators	[]object	Templates for advanced use cases	false
namespaceSelector	object	Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. In case of nil value, all the Tenant Namespaces are targeted.	false
namespacedItems	[]object	List of the resources already existing in other Namespaces that must be replicated.	false
policy	object	Policy controls creation, admission protection, SSA conflict ownership, and deletion for every raw item, namespaced item, and generator in this block. An explicit policy replaces the deprecated spec.settings for this block. When omitted, admission converts legacy settings and pruningOnDelete into a policy.	false
rawItems	[]object	List of raw resources that must be replicated.	false

GlobalTenantResource.spec.resources[index].additionalMetadata

Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be added to the replicated resources.

Name	Type	Description	Required
annotations	map[string]string		false
labels	map[string]string		false

GlobalTenantResource.spec.resources[index].context

Provide additional template context, which can be used throughout all the declared items for the replication

Name	Type	Description	Required
resources	[]object		false

GlobalTenantResource.spec.resources[index].context.resources[index]

Name	Type	Description	Required
kind	string	Kind of the referent. Use “*” to match all kinds.	true
apiVersion	string	API version, API group, or API group/version selector of the referent. Empty APIVersion means the core Kubernetes API version “v1”. Use “” to explicitly match all API groups and versions. Examples: - "" means core “v1”. - “v1” means core “v1”. - “apps” means any version in the “apps” API group. - “apps/v1” means the “apps/v1” API group/version. - “apps/” means any version in the “apps” API group.	false
index	string	Index to mount the resource in the template context	false
name	string	Name of the values referent. This is useful when you traying to get a specific resource	false
namespace	string	Namespace of the values referent.	false
optional	boolean	Only relevant if name is set. If an item is not optional, there will be an error thrown when it does not exist Default: true	false
selector	object	Selector which allows to get any amount of these resources based on labels	false

GlobalTenantResource.spec.resources[index].context.resources[index].selector

Selector which allows to get any amount of these resources based on labels

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

GlobalTenantResource.spec.resources[index].context.resources[index].selector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

GlobalTenantResource.spec.resources[index].generators[index]

Name	Type	Description	Required
missingKey	enum	Missing Key Option for templating Enum: invalid, zero, error Default: zero	false
template	string	Template contains any amount of yaml which is applied to Kubernetes. This can be a single resource or multiple resources	false

GlobalTenantResource.spec.resources[index].namespaceSelector

Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. In case of nil value, all the Tenant Namespaces are targeted.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

GlobalTenantResource.spec.resources[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

GlobalTenantResource.spec.resources[index].namespacedItems[index]

Reference

Name	Type	Description	Required
kind	string	Kind of the referent. Use “*” to match all kinds.	true
apiVersion	string	API version, API group, or API group/version selector of the referent. Empty APIVersion means the core Kubernetes API version “v1”. Use “” to explicitly match all API groups and versions. Examples: - "" means core “v1”. - “v1” means core “v1”. - “apps” means any version in the “apps” API group. - “apps/v1” means the “apps/v1” API group/version. - “apps/” means any version in the “apps” API group.	false
name	string	Name of the values referent. This is useful when you traying to get a specific resource	false
namespace	string	Namespace of the values referent.	false
optional	boolean	Only relevant if name is set. If an item is not optional, there will be an error thrown when it does not exist Default: true	false
selector	object	Selector which allows to get any amount of these resources based on labels	false

GlobalTenantResource.spec.resources[index].namespacedItems[index].selector

Selector which allows to get any amount of these resources based on labels

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

GlobalTenantResource.spec.resources[index].namespacedItems[index].selector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

GlobalTenantResource.spec.resources[index].policy

Policy controls creation, admission protection, SSA conflict ownership, and deletion for every raw item, namespaced item, and generator in this block. An explicit policy replaces the deprecated spec.settings for this block. When omitted, admission converts legacy settings and pruningOnDelete into a policy.

Name	Type	Description	Required
condition	string	Condition is an optional CEL boolean expression checked before each target is applied. object is the existing destination object, or null when absent; now is the evaluation timestamp. False skips rendered content without pruning or releasing an already managed object. Policy and protection are still reconciled for managed objects. Evaluation errors prevent writes. Rendering still occurs before evaluation. Omitting Condition preserves the existing apply behavior. Conditions do not affect deletion or orphaning.	false
creation	enum	Creation controls how an existing target is handled. Owner requires the resource to have been created by the applying controller and otherwise returns an error. Merge adopts an existing resource when possible and creates the resource when it does not exist. Enum: Owner, Merge Default: Owner	false
deletion	enum	Deletion controls what happens when the parent stops managing the target. Remove deletes resources created for the parent and relinquishes adopted resources. Orphan keeps the resource and removes Capsule’s lifecycle metadata. Removal is the default. Enum: Remove, Orphan Default: Remove	false
force	boolean	Force allows server-side apply to acquire conflicting field ownership. Default: false	false
protect	boolean	Protect prevents users from changing or deleting the target through admission while it is managed. Protection is enabled by default. Default: true	false

GlobalTenantResource.spec.settings

Deprecated: configure resources[].policy instead. Admission converts Settings into policies for blocks without one. Retained as a compatibility fallback for stored resources that have not passed through admission again.

Name	Type	Description	Required
adopt	boolean	Enabling this allows TenanResources to interact with objects which were not created by a TenantResource. In this case on prune no deletion of the entire object is made. Deprecated: use resources[].policy.creation: Merge instead. Default: false	false
force	boolean	Force indicates that in case of conflicts with server-side apply, the client should acquire ownership of the conflicting field. You may create collisions with this. Deprecated: use resources[].policy.force instead. Default: false	false

GlobalTenantResource.spec.dependsOn[index]

LocalObjectReference contains enough information to locate the referenced Kubernetes resource object.

Name	Type	Description	Required
name	string	Name of the referent.	true

GlobalTenantResource.spec.serviceAccount

Local ServiceAccount which will perform all the actions defined in the TenantResource You must provide permissions accordingly to that ServiceAccount

Name	Type	Description	Required
name	string	Name of the referent.	true
namespace	string	Namespace of the referent.	true

GlobalTenantResource.spec.tenantSelector

Defines the Tenant selector used target the tenants on which resources must be propagated.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

GlobalTenantResource.spec.tenantSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

GlobalTenantResource.status

GlobalTenantResourceStatus defines the observed state of GlobalTenantResource.

Name	Type	Description	Required
size	integer	Number of managed resources.	true
conditions	[]object	Condition of the GlobalTenantResource.	false
observedGeneration	integer	ObservedGeneration is the most recent generation the controller has observed. Format: int64	false
processedItems	[]object	List of resources managed by the API object.	false
selectedTenants	[]string	List of Tenants addressed by the GlobalTenantResource.	false
serviceAccount	object	Serviceaccount used for impersonation	false

GlobalTenantResource.status.conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

GlobalTenantResource.status.processedItems[index]

Advanced Status Item for pin pointing items in tenants/namespaces.

Name	Type	Required
group	string	false
kind	string	false
name	string	false
namespace	string	false
origin	string	false
status	object	false
tenant	string	false
version	string	false

GlobalTenantResource.status.processedItems[index].status

Name	Type	Description	Required
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
clusterScoped	boolean	Indicates whether the referenced resource is cluster-scoped.	false
created	boolean	Indicates wether the resource was created or adopted	false
lastApply	string	An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency Format: date-time	false
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	false
policy	object	Policy is a lifecycle snapshot for protection and cleanup. Conditions are evaluated from the source block and omitted here. Failed updates retain the previous snapshot; a first successful content write records its policy even if metadata reconciliation fails, so cleanup respects explicit retention. An absent policy on an already applied item preserves legacy behavior.	false

GlobalTenantResource.status.processedItems[index].status.policy

Policy is a lifecycle snapshot for protection and cleanup. Conditions are evaluated from the source block and omitted here. Failed updates retain the previous snapshot; a first successful content write records its policy even if metadata reconciliation fails, so cleanup respects explicit retention. An absent policy on an already applied item preserves legacy behavior.

Name	Type	Description	Required
creation	enum	Creation controls how an existing target is handled. Owner requires the resource to have been created by the applying controller and otherwise returns an error. Merge adopts an existing resource when possible and creates the resource when it does not exist. Enum: Owner, Merge Default: Owner	false
deletion	enum	Deletion controls what happens when the parent stops managing the target. Remove deletes resources created for the parent and relinquishes adopted resources. Orphan keeps the resource and removes Capsule’s lifecycle metadata. Removal is the default. Enum: Remove, Orphan Default: Remove	false
force	boolean	Force allows server-side apply to acquire conflicting field ownership. Default: false	false
protect	boolean	Protect prevents users from changing or deleting the target through admission while it is managed. Protection is enabled by default. Default: true	false

GlobalTenantResource.status.serviceAccount

Serviceaccount used for impersonation

Name	Type	Description	Required
name	string	Name of the referent.	true
namespace	string	Namespace of the referent.	true

QuantityLedger

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta2	true
kind	string	QuantityLedger	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	QuotaLedgerSpec contains the immutable target reference.	false
status	object	QuantityLedgerStatus contains the mutable coordination state used by admission and quota controllers.	false

QuantityLedger.spec

QuotaLedgerSpec contains the immutable target reference.

Name	Type	Description	Required
targetRef	object	TargetRef points to the quota object that this ledger belongs to.	true

QuantityLedger.spec.targetRef

TargetRef points to the quota object that this ledger belongs to.

Name	Type	Description	Required
kind	string	Kind of the target quota resource, for example “CustomQuota” or “GlobalCustomQuota”.	true
name	string	Name of the target quota resource.	true
apiGroup	string	APIGroup of the target quota resource, for example “capsule.clastix.io”.	false
namespace	string	Namespace of the target quota resource. Must be empty for cluster-scoped targets.	false
uid	string	UID of the target quota resource. Optional, but useful for stale reference detection.	false

QuantityLedger.status

QuantityLedgerStatus contains the mutable coordination state used by admission and quota controllers.

Name	Type	Description	Required
allocated	int or string	Allocated is the admission-owned total that has been accepted by the webhook. It must be updated only through optimistic concurrency on QuantityLedger.	false
conditions	[]object	Conditions for the resource claim	false
pendingDeletes	[]object	Pending delete hints carried over from admission delete handling.	false
reservations	[]object	Active inflight reservations for this quota.	false
reserved	int or string	Reserved is the aggregate sum of all active reservations. Controllers/webhooks should treat this as derived data from Reservations.	false
resourceQuota	object	ResourceQuota contains coordination state for GlobalResourceQuota. It is unset for CustomQuota and GlobalCustomQuota ledgers.	false

QuantityLedger.status.conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

QuantityLedger.status.pendingDeletes[index]

QuantityLedgerPendingDelete tracks objects that are expected to disappear from claims soon, but may still temporarily appear during rebuild due to propagation delay.

Name	Type	Description	Required
createdAt	string	Format: date-time	true
objectRef	object	QuotaLedgerObjectRef identifies the object for which a reservation exists. UID may be empty for CREATE admission before the object is persisted.	true
id	string	ID identifies the admission request that added this hint. It allows a failed multi-quota admission to roll back only its own hint.	false

QuantityLedger.status.pendingDeletes[index].objectRef

QuotaLedgerObjectRef identifies the object for which a reservation exists. UID may be empty for CREATE admission before the object is persisted.

Name	Type	Description	Required
apiVersion	string	APIVersion of the tracked object, for example “v1”.	true
kind	string	Kind of the tracked object, for example “Pod”.	true
apiGroup	string	APIGroup of the tracked object.	false
name	string	Name of the tracked object.	false
namespace	string	Namespace of the tracked object.	false
uid	string	UID of the tracked object.	false

QuantityLedger.status.reservations[index]

QuantityLedgerReservation represents one active inflight reservation. ID should be stable for retries of the same admission request. In practice, admission.Request.UID is a good default.

Name	Type	Description	Required
createdAt	string	Time the reservation was first created. Format: date-time	true
id	string	Unique reservation identifier.	true
objectRef	object	Object that this reservation is intended to create/update.	true
updatedAt	string	Time the reservation was last refreshed or updated. Format: date-time	true
usage	int or string	Amount reserved for this request.	true
delta	int or string	Delta is the additional amount held against the quota while the admitted object is materializing. For creates this is normally equal to Usage. For updates it is max(newUsage-oldUsage, 0), so admission never releases capacity before the API server has persisted the update. A nil value is interpreted as Usage for backwards compatibility with ledgers written before this field was introduced.	false
expiresAt	string	Time after which the reservation may be considered stale. Format: date-time	false

QuantityLedger.status.reservations[index].objectRef

Object that this reservation is intended to create/update.

Name	Type	Description	Required
apiVersion	string	APIVersion of the tracked object, for example “v1”.	true
kind	string	Kind of the tracked object, for example “Pod”.	true
apiGroup	string	APIGroup of the tracked object.	false
name	string	Name of the tracked object.	false
namespace	string	Namespace of the tracked object.	false
uid	string	UID of the tracked object.	false

QuantityLedger.status.resourceQuota

ResourceQuota contains coordination state for GlobalResourceQuota. It is unset for CustomQuota and GlobalCustomQuota ledgers.

Name	Type	Description	Required
allocated	map[string]int or string	Allocated is Used plus all active reservations.	false
initialized	boolean	Initialized is true after every selected namespace has reported ResourceQuota status for this quota.	false
namespaces	[]string	Namespaces is the selected namespace set represented by Used.	false
observedGeneration	integer	ObservedGeneration is the GlobalResourceQuota generation represented by this ledger state. Format: int64	false
reservations	[]object	Reservations contains inflight admission operations.	false
reserved	map[string]int or string	Reserved is derived from Reservations.	false
used	map[string]int or string	Used is the usage observed from ResourceQuota status across all selected namespaces.	false

QuantityLedger.status.resourceQuota.reservations[index]

QuantityLedgerResourceQuotaReservation is an atomic reservation against all resources tracked by a GlobalResourceQuota.

Name	Type	Description	Required
createdAt	string	Format: date-time	true
id	string	Unique reservation identifier.	true
objectRef	object	Object that this reservation is intended to create/update.	true
updatedAt	string	Format: date-time	true
delta	map[string]int or string	Delta is the positive amount held while ResourceQuota status catches up.	false
expiresAt	string	Format: date-time	false
usage	map[string]int or string	Usage is the calculated usage of the admitted object.	false

QuantityLedger.status.resourceQuota.reservations[index].objectRef

Object that this reservation is intended to create/update.

Name	Type	Description	Required
apiVersion	string	APIVersion of the tracked object, for example “v1”.	true
kind	string	Kind of the tracked object, for example “Pod”.	true
apiGroup	string	APIGroup of the tracked object.	false
name	string	Name of the tracked object.	false
namespace	string	Namespace of the tracked object.	false
uid	string	UID of the tracked object.	false

ResourcePoolClaim

ResourcePoolClaim is the Schema for the resourcepoolclaims API.

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta2	true
kind	string	ResourcePoolClaim	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object		true
status	object	ResourceQuotaClaimStatus defines the observed state of ResourceQuotaClaim.	false

ResourcePoolClaim.spec

Name	Type	Description	Required
claim	map[string]int or string	Amount which should be claimed for the resourcequota	true
pool	string	If there’s the possability to claim from multiple global Quotas You must be specific about which one you want to claim resources from Once bound to a ResourcePool, this field is immutable	true

ResourcePoolClaim.status

ResourceQuotaClaimStatus defines the observed state of ResourceQuotaClaim.

Name	Type	Description	Required
conditions	[]object	Conditions for the resource claim	true
allocation	object	Tracks the Usage from Claimed from this claim and available resources	false
condition	object	Deprecated: Use Conditions	false
observedGeneration	integer	ObservedGeneration is the most recent generation the controller has observed. Format: int64	false
pool	object	Reference to the GlobalQuota being claimed from	false

ResourcePoolClaim.status.conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

ResourcePoolClaim.status.allocation

Tracks the Usage from Claimed from this claim and available resources

Name	Type	Description	Required
available	map[string]int or string	Used to track the usage of the resource in the pool (diff hard - claimed). May be used for further automation	false
hard	map[string]int or string	Hard is the set of enforced hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/	false
used	map[string]int or string	Used is the current observed total usage of the resource in the namespace.	false

ResourcePoolClaim.status.condition

Deprecated: Use Conditions

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

ResourcePoolClaim.status.pool

Reference to the GlobalQuota being claimed from

Name	Type	Description	Required
name	string	Name of the referent.	true
uid	string	UID of the tracked Tenant to pin point tracking	true

ResourcePool

Resourcepools allows you to define a set of resources as known from ResoureQuotas. The Resourcepools are defined at cluster-scope an should be administrated by cluster-administrators. However they create an interface, where cluster-administrators can define from which namespaces resources from a Resourcepool can be claimed. The claiming is done via a namespaced CRD called ResourcePoolClaim. Then it’s up the group of users within these namespaces, to manage the resources they consume per namespace. Each Resourcepool provisions a ResourceQuotainto all the selected namespaces. Then essentially the ResourcePoolClaims, when they can be assigned to the ResourcePool stack resources on top of that ResourceQuota based on the namspace, where the ResourcePoolClaim was made from.

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta2	true
kind	string	ResourcePool	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	ResourcePoolSpec.	true
status	object	GlobalResourceQuotaStatus defines the observed state of GlobalResourceQuota.	false

ResourcePool.spec

ResourcePoolSpec.

Name	Type	Description	Required
quota	object	Define the resourcequota served by this resourcepool.	true
config	object	Additional Configuration Default: map[]	false
defaults	map[string]int or string	The Defaults given for each namespace, the default is not counted towards the total allocation When you use claims it’s recommended to provision Defaults as the prevent the scheduling of any resources	false
selectors	[]object	Selector to match the namespaces that should be managed by the GlobalResourceQuota	false

ResourcePool.spec.quota

Define the resourcequota served by this resourcepool.

Name	Type	Description	Required
hard	map[string]int or string	hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/	false
scopeSelector	object	scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.	false
scopes	[]string	A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.	false

ResourcePool.spec.quota.scopeSelector

Name	Type	Description	Required
matchExpressions	[]object	A list of scope selector requirements by scope of the resources.	false

ResourcePool.spec.quota.scopeSelector.matchExpressions[index]

A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.

Name	Type	Description	Required
operator	string	Represents a scope’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.	true
scopeName	string	The name of the scope that the selector applies to.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

ResourcePool.spec.config

Additional Configuration

Name	Type	Description	Required
defaultsZero	boolean	With this option all resources which can be allocated are set to 0 for the resourcequota defaults. (Default false) Default: false	false
deleteBoundResources	boolean	When a resourcepool is deleted, the resourceclaims bound to it are disassociated from the resourcepool but not deleted. By Enabling this option, the resourceclaims will be deleted when the resourcepool is deleted, if they are in bound state. (Default false) Default: false	false
orderedQueue	boolean	Claims are queued whenever they are allocated to a pool. A pool tries to allocate claims in order based on their creation date. But no matter their creation time, if a claim is requesting too much resources it’s put into the queue but if a lower priority claim still has enough space in the available resources, it will be able to claim them. Eventough it’s priority was lower Enabling this option respects to Order. Meaning the Creationtimestamp matters and if a resource is put into the queue, no other claim can claim the same resources with lower priority. (Default false) Default: false	false

ResourcePool.spec.selectors[index]

Selector for resources and their labels or selecting origin namespaces

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

ResourcePool.spec.selectors[index].matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

ResourcePool.status

GlobalResourceQuotaStatus defines the observed state of GlobalResourceQuota.

Name	Type	Description	Required
conditions	[]object	Conditions for the resource claim	true
allocation	object	Tracks the Usage from Claimed against what has been granted from the pool	false
claimCount	integer	Amount of claims Default: 0	false
claims	map[string][]object	Tracks the quotas for the Resource.	false
exhaustions	map[string]object	Exhaustions from claims associated with the pool	false
namespaceCount	integer	How many namespaces are considered Default: 0	false
namespaces	[]string	Namespaces which are considered for claims	false
observedGeneration	integer	ObservedGeneration is the most recent generation the controller has observed. Format: int64	false

ResourcePool.status.conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

ResourcePool.status.allocation

Tracks the Usage from Claimed against what has been granted from the pool

Name	Type	Description	Required
available	map[string]int or string	Used to track the usage of the resource in the pool (diff hard - claimed). May be used for further automation	false
hard	map[string]int or string	Hard is the set of enforced hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/	false
used	map[string]int or string	Used is the current observed total usage of the resource in the namespace.	false

ResourcePool.status.claims[key][index]

ResourceQuotaClaimStatus defines the observed state of ResourceQuotaClaim.

Name	Type	Description	Required
name	string	Name of the referent.	true
namespace	string	Namespace of the referent.	true
uid	string	UID of the tracked Tenant to pin point tracking	true
claims	map[string]int or string	Claimed resources	false

ResourcePool.status.exhaustions[key]

Name	Type	Description	Required
available	int or string	Available Resources to be claimed	false
requesting	int or string	Requesting Resources	false

RuleStatus

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta2	true
kind	string	RuleStatus	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	[]object		false
status	object	RuleStatus contains the accumulated rules applying to namespace it’s deployed in.	false

RuleStatus.spec[index]

For future implementation where users might manage RuleStatus CRs themselves

Name	Type	Description	Required
audience	[]object	Audience limits this rule to matching request subjects. An empty audience matches every request.	false
enforce	object	Enforcement for given rule	false
mutate	[]object	Mutate applies ordered typed mutations before enforcement. It shares the rule’s namespace selection and audience. Workload mutations apply on Pod creation.	false
quota	[]object	Quota contains native Kubernetes ResourceQuota specifications shared by all namespaces selected by this rule. Unlike Enforce, quota accounting is independent of the request audience.	false

RuleStatus.spec[index].audience[index]

Name	Type	Description	Required
kind	enum	Enum: User, Group, ServiceAccount, Custom	true
name	string		true

RuleStatus.spec[index].enforce

Enforcement for given rule

Name	Type	Description	Required
action	enum	Declare the action being performed on the enforcement rule: deny: On match, deny admission request allow: On match, allowed admission request audit: On match, audit (post event) of admission request Enum: allow, deny, audit Default: deny	false
conditions	[]object	Conditions gate this entire enforcement rule, including workloads, services, metadata, ingress, network and storage. All conditions must be true; empty means apply. Conditions run during admission; managed metadata in a conditional rule is applied on matching requests only and is not reconciled in the background.	false
ingress	object	Enforcement for Ingress and Gateway API resource hostnames.	false
metadata	[]object	Enforcement for object metadata on namespaced resources.	false
network	object	Network configures network enforcement for namespace resources.	false
services	object	Enforcement for Services.	false
storage	object	Additional access to PersistentVolumes without a tenant ownership label.	false
workloads	object	Enforcement for native workload kinds and Pod properties.	false

RuleStatus.spec[index].enforce.conditions[index]

AdmissionCondition is a Boolean CEL gate for a mutation entry or enforcement rule. It can inspect object and request metadata, but cannot generate mutation values. During PVC volume access evaluation, volume contains the referenced PV; otherwise volume is null. Conditions never modify the PVC or PV.

Name	Type	Description	Required
expression	string	Expression must evaluate to bool. Any false condition skips this block. An evaluation error rejects the request unless another condition is false.	true
name	string	Name identifies a condition in admission errors. Names must be unique within a block.	false

RuleStatus.spec[index].enforce.ingress

Enforcement for Ingress and Gateway API resource hostnames.

Name	Type	Description	Required
hostnames	[]object	Hostnames defines allowed, denied, or audited hostname expressions. A resource targeted by an allow or deny rule must declare non-empty values in all hostname fields. Audit-only rules record missing hostnames without denying them.	false
types	[]enum	Types defines the resource kinds to which hostname enforcement applies. Enum: Ingress, Route, ListenerSet, HTTPRoute, Gateway, TLSRoute, GRPCRoute	false

RuleStatus.spec[index].enforce.ingress.hostnames[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.metadata[index]

MetadataRule defines metadata constraints for namespaced resources.

Name	Type	Description	Required
kinds	[]string	Kinds of the referents. Use “*” to match all kinds.	true
annotations	map[string]object	Annotations defines metadata policies by annotation key.	false
apiGroups	[]string	API groups or API group/version selectors of the referents. Empty or omitted APIGroups means the core Kubernetes API version “v1”. Use “” to match all API groups and versions. Examples: - [] or [""] means core “v1”. - [“v1”] means core “v1”. - [“apps”] means any version in the “apps” API group. - [“apps/v1”] means only “apps/v1”. - [“apps”, “batch/v1”] means any “apps” version and “batch/v1”. - [""] means all API groups and versions.	false
labels	map[string]object	Labels defines metadata policies by label key.	false

RuleStatus.spec[index].enforce.metadata[index].annotations[key]

Name	Type	Description	Required
default	string	Default is applied by admission mutation when the concrete metadata key is absent. It is not reconciled after admission.	false
managed	string	Managed is enforced by admission mutation and reconciled by the RuleStatus controller using server-side apply when the rule configuration changes. Present metadata matching the effective managed value is exempt from metadata value validation, including overlapping deny rules. The last applicable managed value for each concrete key wins. During admission, only rules matching the request’s audience contribute to the effective managed value.	false
required	boolean	Required enforces that the metadata key must be present. This is only meaningful with action=allow. Deny and audit rules do not require missing metadata to exist. Default: false	false
values	[]object	Values defines allowed, denied, or audited values for the metadata key. With action=allow and no values, only Required is enforced. With action=deny or action=audit and no values, any present value matches, including an empty string.	false

RuleStatus.spec[index].enforce.metadata[index].annotations[key].values[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.metadata[index].labels[key]

Name	Type	Description	Required
default	string	Default is applied by admission mutation when the concrete metadata key is absent. It is not reconciled after admission.	false
managed	string	Managed is enforced by admission mutation and reconciled by the RuleStatus controller using server-side apply when the rule configuration changes. Present metadata matching the effective managed value is exempt from metadata value validation, including overlapping deny rules. The last applicable managed value for each concrete key wins. During admission, only rules matching the request’s audience contribute to the effective managed value.	false
required	boolean	Required enforces that the metadata key must be present. This is only meaningful with action=allow. Deny and audit rules do not require missing metadata to exist. Default: false	false
values	[]object	Values defines allowed, denied, or audited values for the metadata key. With action=allow and no values, only Required is enforced. With action=deny or action=audit and no values, any present value matches, including an empty string.	false

RuleStatus.spec[index].enforce.metadata[index].labels[key].values[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.network

Network configures network enforcement for namespace resources.

Name	Type	Description	Required
policies	object	Policies constrains native NetworkPolicies.	false

RuleStatus.spec[index].enforce.network.policies

Policies constrains native NetworkPolicies.

Name	Type	Description	Required
egress	object	Egress constrains destination address grants. Selector-based peers are unaffected. No constraints are applied when omitted.	false
ingress	object	Ingress constrains source address grants. Selector-based peers are unaffected. No constraints are applied when omitted.	false

RuleStatus.spec[index].enforce.network.policies.egress

Egress constrains destination address grants. Selector-based peers are unaffected. No constraints are applied when omitted.

Name	Type	Description	Required
cidrs	[]string	CIDRs matches addresses granted by ipBlock.cidr after subtracting except. Omitted peers on an ingress or egress rule grant both IPv4 and IPv6 address space. An empty NetworkPolicy ingress or egress list has no grants in that direction to validate. Each direction is evaluated independently. An empty CIDRs list imposes no constraint. Ordered allow/deny decisions apply to every granted address: deny rejects overlapping grants, allow requires complete coverage, and audit reports overlaps. A later allow cannot authorize addresses outside its CIDRs.	false

RuleStatus.spec[index].enforce.network.policies.ingress

Ingress constrains source address grants. Selector-based peers are unaffected. No constraints are applied when omitted.

Name	Type	Description	Required
cidrs	[]string	CIDRs matches addresses granted by ipBlock.cidr after subtracting except. Omitted peers on an ingress or egress rule grant both IPv4 and IPv6 address space. An empty NetworkPolicy ingress or egress list has no grants in that direction to validate. Each direction is evaluated independently. An empty CIDRs list imposes no constraint. Ordered allow/deny decisions apply to every granted address: deny rejects overlapping grants, allow requires complete coverage, and audit reports overlaps. A later allow cannot authorize addresses outside its CIDRs.	false

RuleStatus.spec[index].enforce.services

Enforcement for Services.

Name	Type	Description	Required
externalIPs	object	ExternalIPs defines constraints for spec.externalIPs.	false
externalNames	object	ExternalNames defines additional constraints for Services of type ExternalName.	false
loadBalancers	object	LoadBalancers defines additional constraints for Services of type LoadBalancer.	false
nodePorts	object	NodePorts defines additional constraints for nodePort values.	false
types	[]enum	Types defines the Service types matched by this rule. Supported values: - ClusterIP - NodePort - LoadBalancer - ExternalName Enum: ClusterIP, NodePort, LoadBalancer, ExternalName	false

RuleStatus.spec[index].enforce.services.externalIPs

ExternalIPs defines constraints for spec.externalIPs.

Name	Type	Description	Required
cidrs	[]string	CIDRs restricts spec.externalIPs. Individual IP addresses are treated as host CIDRs (/32 for IPv4 and /128 for IPv6). For deny rules, empty means all external IPs are denied. For allow and audit rules, empty means no external IP restriction.	false

RuleStatus.spec[index].enforce.services.externalNames

ExternalNames defines additional constraints for Services of type ExternalName.

Name	Type	Description	Required
hostnames	[]object	Hostnames restricts spec.externalName. Empty means no additional hostname restriction once ExternalName is allowed by types.	false

RuleStatus.spec[index].enforce.services.externalNames.hostnames[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.services.loadBalancers

LoadBalancers defines additional constraints for Services of type LoadBalancer.

Name	Type	Description	Required
cidrs	[]string	CIDRs restricts spec.loadBalancerIP and spec.loadBalancerSourceRanges. Empty means no additional CIDR restriction once LoadBalancer is allowed by types.	false

RuleStatus.spec[index].enforce.services.nodePorts

NodePorts defines additional constraints for nodePort values.

Name	Type	Description	Required
ports	[]object	Ports restricts explicitly requested nodePort values. Empty means no additional port restriction once NodePort is allowed by types.	false

RuleStatus.spec[index].enforce.services.nodePorts.ports[index]

Name	Type	Description	Required
from	integer	Format: int32 Minimum: 1 Maximum: 65535	true
to	integer	Format: int32 Minimum: 1 Maximum: 65535	true

RuleStatus.spec[index].enforce.storage

Additional access to PersistentVolumes without a tenant ownership label.

Name	Type	Description	Required
volumes	[]object	Volumes matches additional PersistentVolumes. Entries are ORed. Conditions on the enclosing enforcement rule must also match. The last matching allow/deny decides the exception; audit never grants access.	false

RuleStatus.spec[index].enforce.storage.volumes[index]

PersistentVolumeMatch matches labels on the referenced PersistentVolume.

Name	Type	Description	Required
selector	object	Selector matches existing PV labels, independently of PVC.spec.selector. An explicit empty selector matches all PVs. Capsule’s tenant ownership label cannot be overridden by a selector or an allow decision.	true
name	string	Name identifies this match in admission and audit messages.	false

RuleStatus.spec[index].enforce.storage.volumes[index].selector

Selector matches existing PV labels, independently of PVC.spec.selector. An explicit empty selector matches all PVs. Capsule’s tenant ownership label cannot be overridden by a selector or an allow decision.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.spec[index].enforce.storage.volumes[index].selector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].enforce.workloads

Enforcement for native workload kinds and Pod properties.

Name	Type	Description	Required
disruptionBudgets	object	DisruptionBudgets constrains PDB coverage of selected Pods and controller templates. Only whole-workload targets apply; omitted targets select Pods.	false
placement	object	Placement matches the Pod scheduler and scheduling constraints.	false
qosClasses	[]string	Define Pod QoS classes matched by this enforcement rule. Supported values are Guaranteed, Burstable and BestEffort.	false
registries	[]object	Define registries which are allowed to be used within this tenant The rules are aggregated, since you can use Regular Expressions the match registry endpoints	false
resources	object	Resources defines mutation and enforcement policies for Pod and container resource requests and limits. The workload targets select where the policies apply. With no targets, resource policies apply to all compatible locations: Pod-level resources, regular containers, and init containers. Resource names unsupported at Pod level still apply to compatible container locations. Mutation is applied when a Pod is created, or when an explicitly targeted controller is created or updated (to its Pod template). Remove and MatchRequest manage explicit values, Default fills an absent value, and Ratio fills an absent limit from its request. An explicit Ratio violation is then handled by the enclosing allow, deny, or audit action.	false
schedulers	[]object	Schedulers defines additional schedulerName matchers for selected Pods and Pod templates. These are combined with placement.schedulers under the same rule action; a match in either field counts as a match. Deprecated: use Placement.Schedulers instead.	false
security	object	Security matches effective Pod and container security profiles.	false
targets	[]string	Targets selects native workloads and, optionally, parts of their Pod specs. With no workload policies, the action matches the selected kinds themselves. With policies, targets scopes those policies; it does not also match the kind. Omitted targets preserve Pod-only defaults. Controller targets are opt-in. Whole-controller targets include every compatible location in the Pod template. Existing pod and pod/* part targets retain their established policy scope.	false

RuleStatus.spec[index].enforce.workloads.disruptionBudgets

DisruptionBudgets constrains PDB coverage of selected Pods and controller templates. Only whole-workload targets apply; omitted targets select Pods.

Name	Type	Description	Required
allowOverlap	boolean	AllowOverlap permits multiple PDBs to select the same Pod or selected controller template. False rejects overlap for allow/deny actions and reports violations for audit. True permits overlap in an allow rule; omitted does not participate in evaluation. Rule ordering is preserved. Checks run on PDB selector changes and selected Pod/template label changes. Conditions and audience apply to the admission request, including PDB writes. Cross-resource admission reads are not an atomic transaction.	false
evictableReplicas	object	EvictableReplicas bounds the configured number of evictable replicas of each selected Deployment, StatefulSet, ReplicaSet or ReplicationController. Uses desired spec.replicas and Kubernetes’ upward percentage rounding; zero replicas are exempt. Checks controller writes, /scale, and PDB writes. Bounds are inclusive nonnegative integers; omitted bounds are unrestricted. Allow requires compliance; deny/audit match violations, like resource constraints. Other targets do not have a desired replica count and skip this property. At least one supported controller target must be explicitly selected.	false
unhealthyPodEvictionPolicies	[]enum	UnhealthyPodEvictionPolicies matches the effective PDB policy. Omission in a PDB means IfHealthyBudget. Allow accepts listed values; deny/audit match listed values, like other enum lists. Empty imposes no restriction. Enum: IfHealthyBudget, AlwaysAllow	false

RuleStatus.spec[index].enforce.workloads.disruptionBudgets.evictableReplicas

EvictableReplicas bounds the configured number of evictable replicas of each selected Deployment, StatefulSet, ReplicaSet or ReplicationController. Uses desired spec.replicas and Kubernetes’ upward percentage rounding; zero replicas are exempt. Checks controller writes, /scale, and PDB writes. Bounds are inclusive nonnegative integers; omitted bounds are unrestricted. Allow requires compliance; deny/audit match violations, like resource constraints. Other targets do not have a desired replica count and skip this property. At least one supported controller target must be explicitly selected.

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.spec[index].enforce.workloads.placement

Placement matches the Pod scheduler and scheduling constraints.

Name	Type	Description	Required
affinity	[]object	Affinity matches each complete required or preferred affinity term.	false
nodeSelector	[]object	NodeSelector matches each node selector entry. Empty matchers match any entry. Placement rules apply to the pod target; allowing an entry does not require it.	false
schedulers	[]object	Schedulers defines schedulerName matchers for selected Pods and Pod templates. The rule is evaluated against pod.spec.schedulerName. Empty schedulerName is ignored and is not normalized to default-scheduler.	false
tolerations	[]object	Tolerations matches each toleration, including injected and wildcard tolerations.	false
topologySpreadConstraints	[]object	TopologySpreadConstraints matches each complete spread constraint.	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index]

WorkloadAffinityMatch matches an entire affinity term. Fields are ANDed; entries in enforce.workloads.placement.affinity are alternatives. {} matches any term.

Name	Type	Description	Required
fieldRequirements	[]object	FieldRequirements constrains node matchFields. When Requirements is set, matchFields must be explicitly permitted here to avoid an unchecked path.	false
labelSelector	object	PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.	false
modes	[]enum	Modes defaults to both scheduling modes; it does not require their presence. Enum: required, preferred	false
namespaceScope	enum	SameNamespace requires no namespaceSelector and only the Pod’s namespace in namespaces (or an omitted namespaces list). Any imposes no restriction. Enum: SameNamespace, Any	false
namespaceSelector	object	PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.	false
namespaces	object	Namespaces constrains each explicitly supplied namespace.	false
requirements	[]object	Requirements constrains node matchExpressions.	false
topologyKey	object	TopologyKey applies to Pod affinity and anti-affinity.	false
types	[]enum	Types defaults to all types. Type-specific constraints only match the types on which they are meaningful. Enum: nodeAffinity, podAffinity, podAntiAffinity	false
weight	object	Weight requires modes: [preferred].	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].fieldRequirements[index]

PlacementRequirementMatch matches one selector requirement. Every supplied value must match Values. Operators that have no values remain valid when explicitly permitted. Node selectors additionally support Gt and Lt.

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].fieldRequirements[index].key

PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].fieldRequirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].labelSelector

PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.

Name	Type	Description	Required
required	boolean	Required requires at least one effective selector requirement.	false
requirements	[]object	Requirements is an allowlist within this matcher. If empty, requirements are unrestricted. Each actual requirement must match one complete entry.	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].labelSelector.requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].labelSelector.requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].labelSelector.requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].namespaceSelector

Name	Type	Description	Required
required	boolean	Required requires at least one effective selector requirement.	false
requirements	[]object	Requirements is an allowlist within this matcher. If empty, requirements are unrestricted. Each actual requirement must match one complete entry.	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].namespaceSelector.requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].namespaceSelector.requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].namespaceSelector.requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].namespaces

Namespaces constrains each explicitly supplied namespace.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].topologyKey

TopologyKey applies to Pod affinity and anti-affinity.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.affinity[index].weight

Weight requires modes: [preferred].

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.spec[index].enforce.workloads.placement.nodeSelector[index]

WorkloadNodeSelectorMatch matches a nodeSelector key/value pair. Omitted fields are unrestricted, so {} matches every entry, including an empty label value.

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.spec[index].enforce.workloads.placement.nodeSelector[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.nodeSelector[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.schedulers[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.tolerations[index]

Name	Type	Description	Required
effects	[]enum	Effects matches the literal effect. An empty effect on a Pod tolerates all effects and does not match an allowlist of individual effects. Enum: NoSchedule, PreferNoSchedule, NoExecute,	false
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Operators matches Equal (including an omitted operator) or Exists. Enum: Equal, Exists	false
tolerationSeconds	object	TolerationDurationMatch treats an absent tolerationSeconds as unlimited.	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.spec[index].enforce.workloads.placement.tolerations[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.tolerations[index].tolerationSeconds

TolerationDurationMatch treats an absent tolerationSeconds as unlimited.

Name	Type	Description	Required
allowUnlimited	boolean	AllowUnlimited defaults to true. Set false to require a finite duration.	false
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.spec[index].enforce.workloads.placement.tolerations[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.topologySpreadConstraints[index]

Name	Type	Description	Required
labelSelector	object	PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.	false
maxSkew	object	PlacementRange defines inclusive bounds. An omitted bound is unrestricted.	false
minDomains	object	MinDomains uses 1 when the Pod omits minDomains.	false
nodeAffinityPolicy	[]enum	NodeAffinityPolicy uses Honor when the Pod omits the field. Enum: Honor, Ignore	false
nodeTaintsPolicy	[]enum	NodeTaintsPolicy uses Ignore when the Pod omits the field. Enum: Honor, Ignore	false
topologyKey	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
whenUnsatisfiable	[]enum	Enum: DoNotSchedule, ScheduleAnyway	false

RuleStatus.spec[index].enforce.workloads.placement.topologySpreadConstraints[index].labelSelector

Name	Type	Description	Required
required	boolean	Required requires at least one effective selector requirement.	false
requirements	[]object	Requirements is an allowlist within this matcher. If empty, requirements are unrestricted. Each actual requirement must match one complete entry.	false

RuleStatus.spec[index].enforce.workloads.placement.topologySpreadConstraints[index].labelSelector.requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.spec[index].enforce.workloads.placement.topologySpreadConstraints[index].labelSelector.requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.topologySpreadConstraints[index].labelSelector.requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.placement.topologySpreadConstraints[index].maxSkew

PlacementRange defines inclusive bounds. An omitted bound is unrestricted.

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.spec[index].enforce.workloads.placement.topologySpreadConstraints[index].minDomains

MinDomains uses 1 when the Pod omits minDomains.

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.spec[index].enforce.workloads.placement.topologySpreadConstraints[index].topologyKey

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.registries[index]

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false
policy	[]string	Allowed PullPolicy for the given registry. Supplying no value allows all policies.	false

RuleStatus.spec[index].enforce.workloads.resources

Resources defines mutation and enforcement policies for Pod and container resource requests and limits. The workload targets select where the policies apply. With no targets, resource policies apply to all compatible locations: Pod-level resources, regular containers, and init containers. Resource names unsupported at Pod level still apply to compatible container locations. Mutation is applied when a Pod is created, or when an explicitly targeted controller is created or updated (to its Pod template). Remove and MatchRequest manage explicit values, Default fills an absent value, and Ratio fills an absent limit from its request. An explicit Ratio violation is then handled by the enclosing allow, deny, or audit action.

Name	Type	Description	Required
limits	map[string]object	Limits defines policies for resource limits.	false
requests	map[string]object	Requests defines policies for resource requests.	false

RuleStatus.spec[index].enforce.workloads.resources.limits[key]

WorkloadResourceLimitPolicy defines how a resource limit is mutated and enforced.

Name	Type	Description	Required
policy	enum	Policy selects how the limit is handled: Preserve leaves it unchanged, Default fills an absent limit, Remove deletes it, MatchRequest manages it to equal the request, and Ratio defaults an absent limit and enforces the maximum multiplier against explicitly supplied limits. Enum: Preserve, Default, Remove, MatchRequest, Ratio	true
value	int or string	Value is the quantity applied by Default or the maximum limit-to-request multiplier applied by Ratio.	false

RuleStatus.spec[index].enforce.workloads.resources.requests[key]

WorkloadResourceRequestPolicy defines how a resource request is mutated.

Name	Type	Description	Required
policy	enum	Policy selects how the request is handled: Preserve leaves it unchanged, Default fills an absent request, and Remove deletes it. Enum: Preserve, Default, Remove	true
value	int or string	Value is the quantity applied by the Default policy.	false

RuleStatus.spec[index].enforce.workloads.schedulers[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.security

Security matches effective Pod and container security profiles.

Name	Type	Description	Required
appArmorProfiles	[]object	AppArmorProfiles matches effective Linux container profiles, including legacy AppArmor annotations before Pod defaults. It uses the same target and missing-profile semantics as SeccompProfiles. Privileged containers are Unconfined. Matching a Localhost name does not verify its installation.	false
seccompProfiles	[]object	SeccompProfiles matches effective Linux container profiles, resolving container overrides before Pod defaults. Privileged containers are Unconfined. Missing profiles do not match any type, so an allow-list rejects them. Omitted targets check regular, init and ephemeral containers; pod explicitly selects only the Pod default. Controller targets check their Pod templates.	false

RuleStatus.spec[index].enforce.workloads.security.appArmorProfiles[index]

WorkloadSecurityProfileMatch matches a profile type and optionally its local name/path. Entries are alternatives; localhostProfiles constrains only Localhost.

Name	Type	Description	Required
types	[]enum	Types selects profile types. Missing profiles never match. Enum: RuntimeDefault, Localhost, Unconfined	true
localhostProfiles	[]object	LocalhostProfiles matches seccomp paths relative to the kubelet seccomp directory, or loaded AppArmor profile names. Omitted permits any Localhost profile. Requires Localhost in types. Expressions use exact, exp and negate.	false

RuleStatus.spec[index].enforce.workloads.security.appArmorProfiles[index].localhostProfiles[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].enforce.workloads.security.seccompProfiles[index]

WorkloadSecurityProfileMatch matches a profile type and optionally its local name/path. Entries are alternatives; localhostProfiles constrains only Localhost.

Name	Type	Description	Required
types	[]enum	Types selects profile types. Missing profiles never match. Enum: RuntimeDefault, Localhost, Unconfined	true
localhostProfiles	[]object	LocalhostProfiles matches seccomp paths relative to the kubelet seccomp directory, or loaded AppArmor profile names. Omitted permits any Localhost profile. Requires Localhost in types. Expressions use exact, exp and negate.	false

RuleStatus.spec[index].enforce.workloads.security.seccompProfiles[index].localhostProfiles[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.spec[index].mutate[index]

NamespaceRuleMutation applies typed mutations independently of enforce.action. Mutated values remain subject to all applicable enforcement rules.

Name	Type	Description	Required
action	enum	Action chooses how explicitly supplied properties are applied. Merge fills an empty schedulerName and absent security profiles, sets hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, and map keys, adds missing imagePullSecrets by name, upserts lists, and conjoins required affinity. Replace replaces each supplied property in full: scheduler, hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, nodeSelector, registries.imagePullSecrets, tolerations, topologySpreadConstraints, affinity, or security profiles. Omitted properties are retained. Supplying affinity replaces all its branches, including omitted ones. Enum: merge, replace Default: merge	false
conditions	[]object	Conditions gate this entire mutation entry and inspect the object after preceding mutations. All conditions must be true; empty means apply.	false
workloads	object	WorkloadMutation contains typed native Pod values. Empty maps/lists are preserved so replace can clear a property; nil means the property is omitted. It applies on Pod creation. Security.ReadOnlyRootFilesystem and Registries.ImagePullPolicy also apply to newly added ephemeral containers on subresource updates. Existing containers are never reconciled. On merge, later entries override hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, matching map keys, tolerations and spread constraints. On merge, required affinity restrictions from applicable entries are ANDed.	false

RuleStatus.spec[index].mutate[index].conditions[index]

Name	Type	Description	Required
expression	string	Expression must evaluate to bool. Any false condition skips this block. An evaluation error rejects the request unless another condition is false.	true
name	string	Name identifies a condition in admission errors. Names must be unique within a block.	false

RuleStatus.spec[index].mutate[index].workloads

WorkloadMutation contains typed native Pod values. Empty maps/lists are preserved so replace can clear a property; nil means the property is omitted. It applies on Pod creation. Security.ReadOnlyRootFilesystem and Registries.ImagePullPolicy also apply to newly added ephemeral containers on subresource updates. Existing containers are never reconciled. On merge, later entries override hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, matching map keys, tolerations and spread constraints. On merge, required affinity restrictions from applicable entries are ANDed.

Name	Type	Description	Required
placement	object	Placement configures the Pod scheduler and scheduling constraints.	false
registries	object	Registries configures Pod image pull secrets and selected containers’ pull policies.	false
security	object	Security configures Pod and container security settings.	false
targets	[]enum	Targets selects compatible Pod locations. Omitted or empty selects all compatible locations. The pod target includes Pod-level properties and all container groups; pod/containers, pod/initcontainers and pod/ephemeralcontainers narrow selection to one group. Controller templates and volumes are not supported. Enum: pod, pod/containers, pod/initcontainers, pod/ephemeralcontainers	false

RuleStatus.spec[index].mutate[index].workloads.placement

Placement configures the Pod scheduler and scheduling constraints.

Name	Type	Description	Required
affinity	object	Affinity on merge conjoins required restrictions and upserts preferred terms. Preferred terms match by their complete term, excluding weight and normalized ordering. A different term is added; a matching term gets the supplied weight. Required node affinity is distributed over existing OR alternatives, with at most 256 resulting alternatives. Empty node selector terms match no nodes. Replace replaces all affinity, including any branches omitted from the rule.	false
nodeSelector	map[string]string	NodeSelector sets configured keys on merge, or replaces the map on replace.	false
scheduler	string	Scheduler sets spec.schedulerName on Pod creation. Merge fills only an empty schedulerName, preserving all non-empty names, including default-scheduler. Kubernetes defaults omitted schedulerName before admission. Use replace with a condition to override default-scheduler while preserving custom schedulers. Replace always overwrites schedulerName when the entry’s conditions match. Omitted or null leaves the Pod value unchanged.	false
tolerations	[]object	Tolerations merges by key, operator (default Equal), value and effect. Changing any identity field adds another toleration, retaining the old one. A matching toleration’s duration is replaced; omitting it makes it unlimited. Replace replaces the entire list, including entries with other identities.	false
topologySpreadConstraints	[]object	TopologySpreadConstraints merges by topologyKey and whenUnsatisfiable. The entire matching constraint is replaced, including its selector and optional fields; other constraints remain. Replace replaces the entire list.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity

Affinity on merge conjoins required restrictions and upserts preferred terms. Preferred terms match by their complete term, excluding weight and normalized ordering. A different term is added; a matching term gets the supplied weight. Required node affinity is distributed over existing OR alternatives, with at most 256 resulting alternatives. Empty node selector terms match no nodes. Replace replaces all affinity, including any branches omitted from the rule.

Name	Type	Description	Required
nodeAffinity	object	Describes node affinity scheduling rules for the pod.	false
podAffinity	object	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).	false
podAntiAffinity	object	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.nodeAffinity

Describes node affinity scheduling rules for the pod.

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding “weight” to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it’s a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).

Name	Type	Description	Required
preference	object	A node selector term, associated with the corresponding weight.	true
weight	integer	Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. Format: int32	true

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference

A node selector term, associated with the corresponding weight.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node’s labels.	false
matchFields	[]object	A list of node selector requirements by node’s fields.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchExpressions[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchFields[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution

If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.

Name	Type	Description	Required
nodeSelectorTerms	[]object	Required. A list of node selector terms. The terms are ORed.	true

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index]

A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node’s labels.	false
matchFields	[]object	A list of node selector requirements by node’s fields.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchExpressions[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchFields[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAffinity

Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding “weight” to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAntiAffinity

Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting “weight” from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.spec[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.placement.tolerations[index]

The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator .

Name	Type	Description	Required
effect	string	Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.	false
key	string	Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.	false
operator	string	Operator represents a key’s relationship to the value. Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).	false
tolerationSeconds	integer	TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. Format: int64	false
value	string	Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.	false

RuleStatus.spec[index].mutate[index].workloads.placement.topologySpreadConstraints[index]

TopologySpreadConstraint specifies how to spread matching pods among the given topology.

Name	Type	Description	Required
maxSkew	integer	MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1.	zone1
topologyKey	string	TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a “bucket”, and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is “kubernetes.io/hostname”, each Node is a domain of that topology. And, if TopologyKey is “topology.kubernetes.io/zone”, each zone is a domain of that topology. It’s a required field.	true
whenUnsatisfiable	string	WhenUnsatisfiable indicates how to deal with a pod if it doesn’t satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered “Unsatisfiable” for an incoming pod if and only if every possible node assignment for that pod would violate “MaxSkew” on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1:	zone1
labelSelector	object	LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn’t set. Keys that don’t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).	false
minDomains	integer	MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats “global minimum” as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won’t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2:	zone1
nodeAffinityPolicy	string	NodeAffinityPolicy indicates how we will treat Pod’s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy.	false
nodeTaintsPolicy	string	NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy.	false

RuleStatus.spec[index].mutate[index].workloads.placement.topologySpreadConstraints[index].labelSelector

LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.spec[index].mutate[index].workloads.placement.topologySpreadConstraints[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.spec[index].mutate[index].workloads.registries

Registries configures Pod image pull secrets and selected containers’ pull policies.

Name	Type	Description	Required
imagePullPolicy	enum	ImagePullPolicy sets imagePullPolicy on every selected regular or init container at Pod creation, and newly added ephemeral containers on subresource updates. Both merge and replace overwrite explicit and Kubernetes-defaulted values. Omitted or null preserves the existing policy. Applies to all Pod OSes. Enum: Always, IfNotPresent, Never	false
imagePullSecrets	[]object	ImagePullSecrets sets spec.imagePullSecrets on Pod creation. Merge appends missing names and removes existing duplicates, retaining first-occurrence order. Replace sets the complete list; an explicit empty list clears it. Omitted or null preserves it. Requires the pod target or omitted/empty targets. References always use the Pod’s namespace; Capsule does not create, copy, or check the referenced Secrets.	false

RuleStatus.spec[index].mutate[index].workloads.registries.imagePullSecrets[index]

LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.

Name	Type	Description	Required
name	string	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default:	false

RuleStatus.spec[index].mutate[index].workloads.security

Security configures Pod and container security settings.

Name	Type	Description	Required
appArmorProfile	object	AppArmorProfile supplies the Pod-level securityContext.appArmorProfile on Linux Pod creation. Merge fills an absent profile; replace replaces the complete profile. Explicit container profiles are preserved. Nil omits it. AppArmor and any Localhost profile must be available on eligible nodes.	false
hostUsers	boolean	HostUsers sets spec.hostUsers on both merge and replace. False requests a separate user namespace; true uses the host user namespace. Omitted or null leaves the Pod value unchanged. Requires Kubernetes/runtime support.	false
readOnlyRootFilesystem	boolean	ReadOnlyRootFilesystem sets securityContext.readOnlyRootFilesystem on every selected regular or init container at Pod creation, and newly added ephemeral containers on subresource updates. Both merge and replace overwrite the value. False is an explicit setting; nil preserves it. Windows Pods are skipped.	false
seccompProfile	object	SeccompProfile supplies the Pod-level securityContext.seccompProfile on Linux Pod creation. Merge fills an absent profile; replace replaces the complete profile. Explicit container profiles are preserved. Nil omits it.	false

RuleStatus.spec[index].mutate[index].workloads.security.appArmorProfile

AppArmorProfile supplies the Pod-level securityContext.appArmorProfile on Linux Pod creation. Merge fills an absent profile; replace replaces the complete profile. Explicit container profiles are preserved. Nil omits it. AppArmor and any Localhost profile must be available on eligible nodes.

Name	Type	Description	Required
type	string	type indicates which kind of AppArmor profile will be applied. Valid options are: Localhost - a profile pre-loaded on the node. RuntimeDefault - the container runtime’s default profile. Unconfined - no AppArmor enforcement.	true
localhostProfile	string	localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is “Localhost”.	false

RuleStatus.spec[index].mutate[index].workloads.security.seccompProfile

SeccompProfile supplies the Pod-level securityContext.seccompProfile on Linux Pod creation. Merge fills an absent profile; replace replaces the complete profile. Explicit container profiles are preserved. Nil omits it.

Name	Type	Description	Required
type	string	type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.	true
localhostProfile	string	localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet’s configured seccomp profile location. Must be set if type is “Localhost”. Must NOT be set for any other type.	false

RuleStatus.spec[index].quota[index]

ResourceQuotaRule defines a named ResourceQuota specification generated by a Tenant rule. Name is the durable identity of the generated GlobalResourceQuota and must be unique across all rules of a Tenant.

Name	Type	Description	Required
name	string	Name is the stable identity of this quota within the Tenant. Changing the name replaces the generated GlobalResourceQuota; changing the quota or its namespace selector updates the existing object.	true
hard	map[string]int or string	hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/	false
scopeSelector	object	scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.	false
scopes	[]string	A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.	false

RuleStatus.spec[index].quota[index].scopeSelector

Name	Type	Description	Required
matchExpressions	[]object	A list of scope selector requirements by scope of the resources.	false

RuleStatus.spec[index].quota[index].scopeSelector.matchExpressions[index]

A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.

Name	Type	Description	Required
operator	string	Represents a scope’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.	true
scopeName	string	The name of the scope that the selector applies to.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status

RuleStatus contains the accumulated rules applying to namespace it’s deployed in.

Name	Type	Description	Required
conditions	[]object	Conditions	true
observedGeneration	integer	ObservedGeneration is the most recent generation the controller has observed. Format: int64	false
rule	object	Deprecated: use Rules. Rule contains a legacy flattened view and cannot fully represent action-aware rules.	false
rules	[]object	Rules contains the effective namespace rules after tenant rule selection. Order is preserved from the originating Tenant rules.	false

RuleStatus.status.conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

RuleStatus.status.rule

Deprecated: use Rules. Rule contains a legacy flattened view and cannot fully represent action-aware rules.

Name	Type	Description	Required
audience	[]object	Audience limits this rule to matching request subjects. An empty audience matches every request.	false
enforce	object	Enforcement for given rule	false
mutate	[]object	Mutate applies ordered typed mutations before enforcement. It shares the rule’s namespace selection and audience. Workload mutations apply on Pod creation.	false
quota	[]object	Quota contains native Kubernetes ResourceQuota specifications shared by all namespaces selected by this rule. Unlike Enforce, quota accounting is independent of the request audience.	false

RuleStatus.status.rule.audience[index]

Name	Type	Description	Required
kind	enum	Enum: User, Group, ServiceAccount, Custom	true
name	string		true

RuleStatus.status.rule.enforce

Enforcement for given rule

Name	Type	Description	Required
action	enum	Declare the action being performed on the enforcement rule: deny: On match, deny admission request allow: On match, allowed admission request audit: On match, audit (post event) of admission request Enum: allow, deny, audit Default: deny	false
conditions	[]object	Conditions gate this entire enforcement rule, including workloads, services, metadata, ingress, network and storage. All conditions must be true; empty means apply. Conditions run during admission; managed metadata in a conditional rule is applied on matching requests only and is not reconciled in the background.	false
ingress	object	Enforcement for Ingress and Gateway API resource hostnames.	false
metadata	[]object	Enforcement for object metadata on namespaced resources.	false
network	object	Network configures network enforcement for namespace resources.	false
services	object	Enforcement for Services.	false
storage	object	Additional access to PersistentVolumes without a tenant ownership label.	false
workloads	object	Enforcement for native workload kinds and Pod properties.	false

RuleStatus.status.rule.enforce.conditions[index]

Name	Type	Description	Required
expression	string	Expression must evaluate to bool. Any false condition skips this block. An evaluation error rejects the request unless another condition is false.	true
name	string	Name identifies a condition in admission errors. Names must be unique within a block.	false

RuleStatus.status.rule.enforce.ingress

Enforcement for Ingress and Gateway API resource hostnames.

Name	Type	Description	Required
hostnames	[]object	Hostnames defines allowed, denied, or audited hostname expressions. A resource targeted by an allow or deny rule must declare non-empty values in all hostname fields. Audit-only rules record missing hostnames without denying them.	false
types	[]enum	Types defines the resource kinds to which hostname enforcement applies. Enum: Ingress, Route, ListenerSet, HTTPRoute, Gateway, TLSRoute, GRPCRoute	false

RuleStatus.status.rule.enforce.ingress.hostnames[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.metadata[index]

MetadataRule defines metadata constraints for namespaced resources.

Name	Type	Description	Required
kinds	[]string	Kinds of the referents. Use “*” to match all kinds.	true
annotations	map[string]object	Annotations defines metadata policies by annotation key.	false
apiGroups	[]string	API groups or API group/version selectors of the referents. Empty or omitted APIGroups means the core Kubernetes API version “v1”. Use “” to match all API groups and versions. Examples: - [] or [""] means core “v1”. - [“v1”] means core “v1”. - [“apps”] means any version in the “apps” API group. - [“apps/v1”] means only “apps/v1”. - [“apps”, “batch/v1”] means any “apps” version and “batch/v1”. - [""] means all API groups and versions.	false
labels	map[string]object	Labels defines metadata policies by label key.	false

RuleStatus.status.rule.enforce.metadata[index].annotations[key]

Name	Type	Description	Required
default	string	Default is applied by admission mutation when the concrete metadata key is absent. It is not reconciled after admission.	false
managed	string	Managed is enforced by admission mutation and reconciled by the RuleStatus controller using server-side apply when the rule configuration changes. Present metadata matching the effective managed value is exempt from metadata value validation, including overlapping deny rules. The last applicable managed value for each concrete key wins. During admission, only rules matching the request’s audience contribute to the effective managed value.	false
required	boolean	Required enforces that the metadata key must be present. This is only meaningful with action=allow. Deny and audit rules do not require missing metadata to exist. Default: false	false
values	[]object	Values defines allowed, denied, or audited values for the metadata key. With action=allow and no values, only Required is enforced. With action=deny or action=audit and no values, any present value matches, including an empty string.	false

RuleStatus.status.rule.enforce.metadata[index].annotations[key].values[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.metadata[index].labels[key]

Name	Type	Description	Required
default	string	Default is applied by admission mutation when the concrete metadata key is absent. It is not reconciled after admission.	false
managed	string	Managed is enforced by admission mutation and reconciled by the RuleStatus controller using server-side apply when the rule configuration changes. Present metadata matching the effective managed value is exempt from metadata value validation, including overlapping deny rules. The last applicable managed value for each concrete key wins. During admission, only rules matching the request’s audience contribute to the effective managed value.	false
required	boolean	Required enforces that the metadata key must be present. This is only meaningful with action=allow. Deny and audit rules do not require missing metadata to exist. Default: false	false
values	[]object	Values defines allowed, denied, or audited values for the metadata key. With action=allow and no values, only Required is enforced. With action=deny or action=audit and no values, any present value matches, including an empty string.	false

RuleStatus.status.rule.enforce.metadata[index].labels[key].values[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.network

Network configures network enforcement for namespace resources.

Name	Type	Description	Required
policies	object	Policies constrains native NetworkPolicies.	false

RuleStatus.status.rule.enforce.network.policies

Policies constrains native NetworkPolicies.

Name	Type	Description	Required
egress	object	Egress constrains destination address grants. Selector-based peers are unaffected. No constraints are applied when omitted.	false
ingress	object	Ingress constrains source address grants. Selector-based peers are unaffected. No constraints are applied when omitted.	false

RuleStatus.status.rule.enforce.network.policies.egress

Egress constrains destination address grants. Selector-based peers are unaffected. No constraints are applied when omitted.

Name	Type	Description	Required
cidrs	[]string	CIDRs matches addresses granted by ipBlock.cidr after subtracting except. Omitted peers on an ingress or egress rule grant both IPv4 and IPv6 address space. An empty NetworkPolicy ingress or egress list has no grants in that direction to validate. Each direction is evaluated independently. An empty CIDRs list imposes no constraint. Ordered allow/deny decisions apply to every granted address: deny rejects overlapping grants, allow requires complete coverage, and audit reports overlaps. A later allow cannot authorize addresses outside its CIDRs.	false

RuleStatus.status.rule.enforce.network.policies.ingress

Ingress constrains source address grants. Selector-based peers are unaffected. No constraints are applied when omitted.

Name	Type	Description	Required
cidrs	[]string	CIDRs matches addresses granted by ipBlock.cidr after subtracting except. Omitted peers on an ingress or egress rule grant both IPv4 and IPv6 address space. An empty NetworkPolicy ingress or egress list has no grants in that direction to validate. Each direction is evaluated independently. An empty CIDRs list imposes no constraint. Ordered allow/deny decisions apply to every granted address: deny rejects overlapping grants, allow requires complete coverage, and audit reports overlaps. A later allow cannot authorize addresses outside its CIDRs.	false

RuleStatus.status.rule.enforce.services

Enforcement for Services.

Name	Type	Description	Required
externalIPs	object	ExternalIPs defines constraints for spec.externalIPs.	false
externalNames	object	ExternalNames defines additional constraints for Services of type ExternalName.	false
loadBalancers	object	LoadBalancers defines additional constraints for Services of type LoadBalancer.	false
nodePorts	object	NodePorts defines additional constraints for nodePort values.	false
types	[]enum	Types defines the Service types matched by this rule. Supported values: - ClusterIP - NodePort - LoadBalancer - ExternalName Enum: ClusterIP, NodePort, LoadBalancer, ExternalName	false

RuleStatus.status.rule.enforce.services.externalIPs

ExternalIPs defines constraints for spec.externalIPs.

Name	Type	Description	Required
cidrs	[]string	CIDRs restricts spec.externalIPs. Individual IP addresses are treated as host CIDRs (/32 for IPv4 and /128 for IPv6). For deny rules, empty means all external IPs are denied. For allow and audit rules, empty means no external IP restriction.	false

RuleStatus.status.rule.enforce.services.externalNames

ExternalNames defines additional constraints for Services of type ExternalName.

Name	Type	Description	Required
hostnames	[]object	Hostnames restricts spec.externalName. Empty means no additional hostname restriction once ExternalName is allowed by types.	false

RuleStatus.status.rule.enforce.services.externalNames.hostnames[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.services.loadBalancers

LoadBalancers defines additional constraints for Services of type LoadBalancer.

Name	Type	Description	Required
cidrs	[]string	CIDRs restricts spec.loadBalancerIP and spec.loadBalancerSourceRanges. Empty means no additional CIDR restriction once LoadBalancer is allowed by types.	false

RuleStatus.status.rule.enforce.services.nodePorts

NodePorts defines additional constraints for nodePort values.

Name	Type	Description	Required
ports	[]object	Ports restricts explicitly requested nodePort values. Empty means no additional port restriction once NodePort is allowed by types.	false

RuleStatus.status.rule.enforce.services.nodePorts.ports[index]

Name	Type	Description	Required
from	integer	Format: int32 Minimum: 1 Maximum: 65535	true
to	integer	Format: int32 Minimum: 1 Maximum: 65535	true

RuleStatus.status.rule.enforce.storage

Additional access to PersistentVolumes without a tenant ownership label.

Name	Type	Description	Required
volumes	[]object	Volumes matches additional PersistentVolumes. Entries are ORed. Conditions on the enclosing enforcement rule must also match. The last matching allow/deny decides the exception; audit never grants access.	false

RuleStatus.status.rule.enforce.storage.volumes[index]

PersistentVolumeMatch matches labels on the referenced PersistentVolume.

Name	Type	Description	Required
selector	object	Selector matches existing PV labels, independently of PVC.spec.selector. An explicit empty selector matches all PVs. Capsule’s tenant ownership label cannot be overridden by a selector or an allow decision.	true
name	string	Name identifies this match in admission and audit messages.	false

RuleStatus.status.rule.enforce.storage.volumes[index].selector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rule.enforce.storage.volumes[index].selector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.enforce.workloads

Enforcement for native workload kinds and Pod properties.

Name	Type	Description	Required
disruptionBudgets	object	DisruptionBudgets constrains PDB coverage of selected Pods and controller templates. Only whole-workload targets apply; omitted targets select Pods.	false
placement	object	Placement matches the Pod scheduler and scheduling constraints.	false
qosClasses	[]string	Define Pod QoS classes matched by this enforcement rule. Supported values are Guaranteed, Burstable and BestEffort.	false
registries	[]object	Define registries which are allowed to be used within this tenant The rules are aggregated, since you can use Regular Expressions the match registry endpoints	false
resources	object	Resources defines mutation and enforcement policies for Pod and container resource requests and limits. The workload targets select where the policies apply. With no targets, resource policies apply to all compatible locations: Pod-level resources, regular containers, and init containers. Resource names unsupported at Pod level still apply to compatible container locations. Mutation is applied when a Pod is created, or when an explicitly targeted controller is created or updated (to its Pod template). Remove and MatchRequest manage explicit values, Default fills an absent value, and Ratio fills an absent limit from its request. An explicit Ratio violation is then handled by the enclosing allow, deny, or audit action.	false
schedulers	[]object	Schedulers defines additional schedulerName matchers for selected Pods and Pod templates. These are combined with placement.schedulers under the same rule action; a match in either field counts as a match. Deprecated: use Placement.Schedulers instead.	false
security	object	Security matches effective Pod and container security profiles.	false
targets	[]string	Targets selects native workloads and, optionally, parts of their Pod specs. With no workload policies, the action matches the selected kinds themselves. With policies, targets scopes those policies; it does not also match the kind. Omitted targets preserve Pod-only defaults. Controller targets are opt-in. Whole-controller targets include every compatible location in the Pod template. Existing pod and pod/* part targets retain their established policy scope.	false

RuleStatus.status.rule.enforce.workloads.disruptionBudgets

DisruptionBudgets constrains PDB coverage of selected Pods and controller templates. Only whole-workload targets apply; omitted targets select Pods.

Name	Type	Description	Required
allowOverlap	boolean	AllowOverlap permits multiple PDBs to select the same Pod or selected controller template. False rejects overlap for allow/deny actions and reports violations for audit. True permits overlap in an allow rule; omitted does not participate in evaluation. Rule ordering is preserved. Checks run on PDB selector changes and selected Pod/template label changes. Conditions and audience apply to the admission request, including PDB writes. Cross-resource admission reads are not an atomic transaction.	false
evictableReplicas	object	EvictableReplicas bounds the configured number of evictable replicas of each selected Deployment, StatefulSet, ReplicaSet or ReplicationController. Uses desired spec.replicas and Kubernetes’ upward percentage rounding; zero replicas are exempt. Checks controller writes, /scale, and PDB writes. Bounds are inclusive nonnegative integers; omitted bounds are unrestricted. Allow requires compliance; deny/audit match violations, like resource constraints. Other targets do not have a desired replica count and skip this property. At least one supported controller target must be explicitly selected.	false
unhealthyPodEvictionPolicies	[]enum	UnhealthyPodEvictionPolicies matches the effective PDB policy. Omission in a PDB means IfHealthyBudget. Allow accepts listed values; deny/audit match listed values, like other enum lists. Empty imposes no restriction. Enum: IfHealthyBudget, AlwaysAllow	false

RuleStatus.status.rule.enforce.workloads.disruptionBudgets.evictableReplicas

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.status.rule.enforce.workloads.placement

Placement matches the Pod scheduler and scheduling constraints.

Name	Type	Description	Required
affinity	[]object	Affinity matches each complete required or preferred affinity term.	false
nodeSelector	[]object	NodeSelector matches each node selector entry. Empty matchers match any entry. Placement rules apply to the pod target; allowing an entry does not require it.	false
schedulers	[]object	Schedulers defines schedulerName matchers for selected Pods and Pod templates. The rule is evaluated against pod.spec.schedulerName. Empty schedulerName is ignored and is not normalized to default-scheduler.	false
tolerations	[]object	Tolerations matches each toleration, including injected and wildcard tolerations.	false
topologySpreadConstraints	[]object	TopologySpreadConstraints matches each complete spread constraint.	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index]

WorkloadAffinityMatch matches an entire affinity term. Fields are ANDed; entries in enforce.workloads.placement.affinity are alternatives. {} matches any term.

Name	Type	Description	Required
fieldRequirements	[]object	FieldRequirements constrains node matchFields. When Requirements is set, matchFields must be explicitly permitted here to avoid an unchecked path.	false
labelSelector	object	PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.	false
modes	[]enum	Modes defaults to both scheduling modes; it does not require their presence. Enum: required, preferred	false
namespaceScope	enum	SameNamespace requires no namespaceSelector and only the Pod’s namespace in namespaces (or an omitted namespaces list). Any imposes no restriction. Enum: SameNamespace, Any	false
namespaceSelector	object	PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.	false
namespaces	object	Namespaces constrains each explicitly supplied namespace.	false
requirements	[]object	Requirements constrains node matchExpressions.	false
topologyKey	object	TopologyKey applies to Pod affinity and anti-affinity.	false
types	[]enum	Types defaults to all types. Type-specific constraints only match the types on which they are meaningful. Enum: nodeAffinity, podAffinity, podAntiAffinity	false
weight	object	Weight requires modes: [preferred].	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].fieldRequirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].fieldRequirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].fieldRequirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].labelSelector

Name	Type	Description	Required
required	boolean	Required requires at least one effective selector requirement.	false
requirements	[]object	Requirements is an allowlist within this matcher. If empty, requirements are unrestricted. Each actual requirement must match one complete entry.	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].labelSelector.requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].labelSelector.requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].labelSelector.requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].namespaceSelector

Name	Type	Description	Required
required	boolean	Required requires at least one effective selector requirement.	false
requirements	[]object	Requirements is an allowlist within this matcher. If empty, requirements are unrestricted. Each actual requirement must match one complete entry.	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].namespaceSelector.requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].namespaceSelector.requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].namespaceSelector.requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].namespaces

Namespaces constrains each explicitly supplied namespace.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].topologyKey

TopologyKey applies to Pod affinity and anti-affinity.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.affinity[index].weight

Weight requires modes: [preferred].

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.status.rule.enforce.workloads.placement.nodeSelector[index]

WorkloadNodeSelectorMatch matches a nodeSelector key/value pair. Omitted fields are unrestricted, so {} matches every entry, including an empty label value.

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rule.enforce.workloads.placement.nodeSelector[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.nodeSelector[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.schedulers[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.tolerations[index]

Name	Type	Description	Required
effects	[]enum	Effects matches the literal effect. An empty effect on a Pod tolerates all effects and does not match an allowlist of individual effects. Enum: NoSchedule, PreferNoSchedule, NoExecute,	false
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Operators matches Equal (including an omitted operator) or Exists. Enum: Equal, Exists	false
tolerationSeconds	object	TolerationDurationMatch treats an absent tolerationSeconds as unlimited.	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rule.enforce.workloads.placement.tolerations[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.tolerations[index].tolerationSeconds

TolerationDurationMatch treats an absent tolerationSeconds as unlimited.

Name	Type	Description	Required
allowUnlimited	boolean	AllowUnlimited defaults to true. Set false to require a finite duration.	false
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.status.rule.enforce.workloads.placement.tolerations[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.topologySpreadConstraints[index]

Name	Type	Description	Required
labelSelector	object	PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.	false
maxSkew	object	PlacementRange defines inclusive bounds. An omitted bound is unrestricted.	false
minDomains	object	MinDomains uses 1 when the Pod omits minDomains.	false
nodeAffinityPolicy	[]enum	NodeAffinityPolicy uses Honor when the Pod omits the field. Enum: Honor, Ignore	false
nodeTaintsPolicy	[]enum	NodeTaintsPolicy uses Ignore when the Pod omits the field. Enum: Honor, Ignore	false
topologyKey	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
whenUnsatisfiable	[]enum	Enum: DoNotSchedule, ScheduleAnyway	false

RuleStatus.status.rule.enforce.workloads.placement.topologySpreadConstraints[index].labelSelector

Name	Type	Description	Required
required	boolean	Required requires at least one effective selector requirement.	false
requirements	[]object	Requirements is an allowlist within this matcher. If empty, requirements are unrestricted. Each actual requirement must match one complete entry.	false

RuleStatus.status.rule.enforce.workloads.placement.topologySpreadConstraints[index].labelSelector.requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rule.enforce.workloads.placement.topologySpreadConstraints[index].labelSelector.requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.topologySpreadConstraints[index].labelSelector.requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.placement.topologySpreadConstraints[index].maxSkew

PlacementRange defines inclusive bounds. An omitted bound is unrestricted.

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.status.rule.enforce.workloads.placement.topologySpreadConstraints[index].minDomains

MinDomains uses 1 when the Pod omits minDomains.

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.status.rule.enforce.workloads.placement.topologySpreadConstraints[index].topologyKey

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.registries[index]

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false
policy	[]string	Allowed PullPolicy for the given registry. Supplying no value allows all policies.	false

RuleStatus.status.rule.enforce.workloads.resources

Name	Type	Description	Required
limits	map[string]object	Limits defines policies for resource limits.	false
requests	map[string]object	Requests defines policies for resource requests.	false

RuleStatus.status.rule.enforce.workloads.resources.limits[key]

WorkloadResourceLimitPolicy defines how a resource limit is mutated and enforced.

Name	Type	Description	Required
policy	enum	Policy selects how the limit is handled: Preserve leaves it unchanged, Default fills an absent limit, Remove deletes it, MatchRequest manages it to equal the request, and Ratio defaults an absent limit and enforces the maximum multiplier against explicitly supplied limits. Enum: Preserve, Default, Remove, MatchRequest, Ratio	true
value	int or string	Value is the quantity applied by Default or the maximum limit-to-request multiplier applied by Ratio.	false

RuleStatus.status.rule.enforce.workloads.resources.requests[key]

WorkloadResourceRequestPolicy defines how a resource request is mutated.

Name	Type	Description	Required
policy	enum	Policy selects how the request is handled: Preserve leaves it unchanged, Default fills an absent request, and Remove deletes it. Enum: Preserve, Default, Remove	true
value	int or string	Value is the quantity applied by the Default policy.	false

RuleStatus.status.rule.enforce.workloads.schedulers[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.security

Security matches effective Pod and container security profiles.

Name	Type	Description	Required
appArmorProfiles	[]object	AppArmorProfiles matches effective Linux container profiles, including legacy AppArmor annotations before Pod defaults. It uses the same target and missing-profile semantics as SeccompProfiles. Privileged containers are Unconfined. Matching a Localhost name does not verify its installation.	false
seccompProfiles	[]object	SeccompProfiles matches effective Linux container profiles, resolving container overrides before Pod defaults. Privileged containers are Unconfined. Missing profiles do not match any type, so an allow-list rejects them. Omitted targets check regular, init and ephemeral containers; pod explicitly selects only the Pod default. Controller targets check their Pod templates.	false

RuleStatus.status.rule.enforce.workloads.security.appArmorProfiles[index]

WorkloadSecurityProfileMatch matches a profile type and optionally its local name/path. Entries are alternatives; localhostProfiles constrains only Localhost.

Name	Type	Description	Required
types	[]enum	Types selects profile types. Missing profiles never match. Enum: RuntimeDefault, Localhost, Unconfined	true
localhostProfiles	[]object	LocalhostProfiles matches seccomp paths relative to the kubelet seccomp directory, or loaded AppArmor profile names. Omitted permits any Localhost profile. Requires Localhost in types. Expressions use exact, exp and negate.	false

RuleStatus.status.rule.enforce.workloads.security.appArmorProfiles[index].localhostProfiles[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.enforce.workloads.security.seccompProfiles[index]

WorkloadSecurityProfileMatch matches a profile type and optionally its local name/path. Entries are alternatives; localhostProfiles constrains only Localhost.

Name	Type	Description	Required
types	[]enum	Types selects profile types. Missing profiles never match. Enum: RuntimeDefault, Localhost, Unconfined	true
localhostProfiles	[]object	LocalhostProfiles matches seccomp paths relative to the kubelet seccomp directory, or loaded AppArmor profile names. Omitted permits any Localhost profile. Requires Localhost in types. Expressions use exact, exp and negate.	false

RuleStatus.status.rule.enforce.workloads.security.seccompProfiles[index].localhostProfiles[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rule.mutate[index]

NamespaceRuleMutation applies typed mutations independently of enforce.action. Mutated values remain subject to all applicable enforcement rules.

Name	Type	Description	Required
action	enum	Action chooses how explicitly supplied properties are applied. Merge fills an empty schedulerName and absent security profiles, sets hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, and map keys, adds missing imagePullSecrets by name, upserts lists, and conjoins required affinity. Replace replaces each supplied property in full: scheduler, hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, nodeSelector, registries.imagePullSecrets, tolerations, topologySpreadConstraints, affinity, or security profiles. Omitted properties are retained. Supplying affinity replaces all its branches, including omitted ones. Enum: merge, replace Default: merge	false
conditions	[]object	Conditions gate this entire mutation entry and inspect the object after preceding mutations. All conditions must be true; empty means apply.	false
workloads	object	WorkloadMutation contains typed native Pod values. Empty maps/lists are preserved so replace can clear a property; nil means the property is omitted. It applies on Pod creation. Security.ReadOnlyRootFilesystem and Registries.ImagePullPolicy also apply to newly added ephemeral containers on subresource updates. Existing containers are never reconciled. On merge, later entries override hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, matching map keys, tolerations and spread constraints. On merge, required affinity restrictions from applicable entries are ANDed.	false

RuleStatus.status.rule.mutate[index].conditions[index]

Name	Type	Description	Required
expression	string	Expression must evaluate to bool. Any false condition skips this block. An evaluation error rejects the request unless another condition is false.	true
name	string	Name identifies a condition in admission errors. Names must be unique within a block.	false

RuleStatus.status.rule.mutate[index].workloads

Name	Type	Description	Required
placement	object	Placement configures the Pod scheduler and scheduling constraints.	false
registries	object	Registries configures Pod image pull secrets and selected containers’ pull policies.	false
security	object	Security configures Pod and container security settings.	false
targets	[]enum	Targets selects compatible Pod locations. Omitted or empty selects all compatible locations. The pod target includes Pod-level properties and all container groups; pod/containers, pod/initcontainers and pod/ephemeralcontainers narrow selection to one group. Controller templates and volumes are not supported. Enum: pod, pod/containers, pod/initcontainers, pod/ephemeralcontainers	false

RuleStatus.status.rule.mutate[index].workloads.placement

Placement configures the Pod scheduler and scheduling constraints.

Name	Type	Description	Required
affinity	object	Affinity on merge conjoins required restrictions and upserts preferred terms. Preferred terms match by their complete term, excluding weight and normalized ordering. A different term is added; a matching term gets the supplied weight. Required node affinity is distributed over existing OR alternatives, with at most 256 resulting alternatives. Empty node selector terms match no nodes. Replace replaces all affinity, including any branches omitted from the rule.	false
nodeSelector	map[string]string	NodeSelector sets configured keys on merge, or replaces the map on replace.	false
scheduler	string	Scheduler sets spec.schedulerName on Pod creation. Merge fills only an empty schedulerName, preserving all non-empty names, including default-scheduler. Kubernetes defaults omitted schedulerName before admission. Use replace with a condition to override default-scheduler while preserving custom schedulers. Replace always overwrites schedulerName when the entry’s conditions match. Omitted or null leaves the Pod value unchanged.	false
tolerations	[]object	Tolerations merges by key, operator (default Equal), value and effect. Changing any identity field adds another toleration, retaining the old one. A matching toleration’s duration is replaced; omitting it makes it unlimited. Replace replaces the entire list, including entries with other identities.	false
topologySpreadConstraints	[]object	TopologySpreadConstraints merges by topologyKey and whenUnsatisfiable. The entire matching constraint is replaced, including its selector and optional fields; other constraints remain. Replace replaces the entire list.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity

Name	Type	Description	Required
nodeAffinity	object	Describes node affinity scheduling rules for the pod.	false
podAffinity	object	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).	false
podAntiAffinity	object	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.nodeAffinity

Describes node affinity scheduling rules for the pod.

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding “weight” to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it’s a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).

Name	Type	Description	Required
preference	object	A node selector term, associated with the corresponding weight.	true
weight	integer	Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. Format: int32	true

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference

A node selector term, associated with the corresponding weight.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node’s labels.	false
matchFields	[]object	A list of node selector requirements by node’s fields.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchExpressions[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchFields[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution

Name	Type	Description	Required
nodeSelectorTerms	[]object	Required. A list of node selector terms. The terms are ORed.	true

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index]

A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node’s labels.	false
matchFields	[]object	A list of node selector requirements by node’s fields.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchExpressions[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchFields[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAffinity

Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding “weight” to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAntiAffinity

Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting “weight” from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rule.mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.placement.tolerations[index]

The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator .

Name	Type	Description	Required
effect	string	Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.	false
key	string	Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.	false
operator	string	Operator represents a key’s relationship to the value. Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).	false
tolerationSeconds	integer	TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. Format: int64	false
value	string	Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.	false

RuleStatus.status.rule.mutate[index].workloads.placement.topologySpreadConstraints[index]

TopologySpreadConstraint specifies how to spread matching pods among the given topology.

Name	Type	Description	Required
maxSkew	integer	MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1.	zone1
topologyKey	string	TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a “bucket”, and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is “kubernetes.io/hostname”, each Node is a domain of that topology. And, if TopologyKey is “topology.kubernetes.io/zone”, each zone is a domain of that topology. It’s a required field.	true
whenUnsatisfiable	string	WhenUnsatisfiable indicates how to deal with a pod if it doesn’t satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered “Unsatisfiable” for an incoming pod if and only if every possible node assignment for that pod would violate “MaxSkew” on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1:	zone1
labelSelector	object	LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn’t set. Keys that don’t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).	false
minDomains	integer	MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats “global minimum” as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won’t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2:	zone1
nodeAffinityPolicy	string	NodeAffinityPolicy indicates how we will treat Pod’s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy.	false
nodeTaintsPolicy	string	NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy.	false

RuleStatus.status.rule.mutate[index].workloads.placement.topologySpreadConstraints[index].labelSelector

LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rule.mutate[index].workloads.placement.topologySpreadConstraints[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rule.mutate[index].workloads.registries

Registries configures Pod image pull secrets and selected containers’ pull policies.

Name	Type	Description	Required
imagePullPolicy	enum	ImagePullPolicy sets imagePullPolicy on every selected regular or init container at Pod creation, and newly added ephemeral containers on subresource updates. Both merge and replace overwrite explicit and Kubernetes-defaulted values. Omitted or null preserves the existing policy. Applies to all Pod OSes. Enum: Always, IfNotPresent, Never	false
imagePullSecrets	[]object	ImagePullSecrets sets spec.imagePullSecrets on Pod creation. Merge appends missing names and removes existing duplicates, retaining first-occurrence order. Replace sets the complete list; an explicit empty list clears it. Omitted or null preserves it. Requires the pod target or omitted/empty targets. References always use the Pod’s namespace; Capsule does not create, copy, or check the referenced Secrets.	false

RuleStatus.status.rule.mutate[index].workloads.registries.imagePullSecrets[index]

LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.

Name	Type	Description	Required
name	string	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default:	false

RuleStatus.status.rule.mutate[index].workloads.security

Security configures Pod and container security settings.

Name	Type	Description	Required
appArmorProfile	object	AppArmorProfile supplies the Pod-level securityContext.appArmorProfile on Linux Pod creation. Merge fills an absent profile; replace replaces the complete profile. Explicit container profiles are preserved. Nil omits it. AppArmor and any Localhost profile must be available on eligible nodes.	false
hostUsers	boolean	HostUsers sets spec.hostUsers on both merge and replace. False requests a separate user namespace; true uses the host user namespace. Omitted or null leaves the Pod value unchanged. Requires Kubernetes/runtime support.	false
readOnlyRootFilesystem	boolean	ReadOnlyRootFilesystem sets securityContext.readOnlyRootFilesystem on every selected regular or init container at Pod creation, and newly added ephemeral containers on subresource updates. Both merge and replace overwrite the value. False is an explicit setting; nil preserves it. Windows Pods are skipped.	false
seccompProfile	object	SeccompProfile supplies the Pod-level securityContext.seccompProfile on Linux Pod creation. Merge fills an absent profile; replace replaces the complete profile. Explicit container profiles are preserved. Nil omits it.	false

RuleStatus.status.rule.mutate[index].workloads.security.appArmorProfile

Name	Type	Description	Required
type	string	type indicates which kind of AppArmor profile will be applied. Valid options are: Localhost - a profile pre-loaded on the node. RuntimeDefault - the container runtime’s default profile. Unconfined - no AppArmor enforcement.	true
localhostProfile	string	localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is “Localhost”.	false

RuleStatus.status.rule.mutate[index].workloads.security.seccompProfile

Name	Type	Description	Required
type	string	type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.	true
localhostProfile	string	localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet’s configured seccomp profile location. Must be set if type is “Localhost”. Must NOT be set for any other type.	false

RuleStatus.status.rule.quota[index]

Name	Type	Description	Required
name	string	Name is the stable identity of this quota within the Tenant. Changing the name replaces the generated GlobalResourceQuota; changing the quota or its namespace selector updates the existing object.	true
hard	map[string]int or string	hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/	false
scopeSelector	object	scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.	false
scopes	[]string	A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.	false

RuleStatus.status.rule.quota[index].scopeSelector

Name	Type	Description	Required
matchExpressions	[]object	A list of scope selector requirements by scope of the resources.	false

RuleStatus.status.rule.quota[index].scopeSelector.matchExpressions[index]

A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.

Name	Type	Description	Required
operator	string	Represents a scope’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.	true
scopeName	string	The name of the scope that the selector applies to.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index]

For future implementation where users might manage RuleStatus CRs themselves

Name	Type	Description	Required
audience	[]object	Audience limits this rule to matching request subjects. An empty audience matches every request.	false
enforce	object	Enforcement for given rule	false
mutate	[]object	Mutate applies ordered typed mutations before enforcement. It shares the rule’s namespace selection and audience. Workload mutations apply on Pod creation.	false
quota	[]object	Quota contains native Kubernetes ResourceQuota specifications shared by all namespaces selected by this rule. Unlike Enforce, quota accounting is independent of the request audience.	false

RuleStatus.status.rules[index].audience[index]

Name	Type	Description	Required
kind	enum	Enum: User, Group, ServiceAccount, Custom	true
name	string		true

RuleStatus.status.rules[index].enforce

Enforcement for given rule

Name	Type	Description	Required
action	enum	Declare the action being performed on the enforcement rule: deny: On match, deny admission request allow: On match, allowed admission request audit: On match, audit (post event) of admission request Enum: allow, deny, audit Default: deny	false
conditions	[]object	Conditions gate this entire enforcement rule, including workloads, services, metadata, ingress, network and storage. All conditions must be true; empty means apply. Conditions run during admission; managed metadata in a conditional rule is applied on matching requests only and is not reconciled in the background.	false
ingress	object	Enforcement for Ingress and Gateway API resource hostnames.	false
metadata	[]object	Enforcement for object metadata on namespaced resources.	false
network	object	Network configures network enforcement for namespace resources.	false
services	object	Enforcement for Services.	false
storage	object	Additional access to PersistentVolumes without a tenant ownership label.	false
workloads	object	Enforcement for native workload kinds and Pod properties.	false

RuleStatus.status.rules[index].enforce.conditions[index]

Name	Type	Description	Required
expression	string	Expression must evaluate to bool. Any false condition skips this block. An evaluation error rejects the request unless another condition is false.	true
name	string	Name identifies a condition in admission errors. Names must be unique within a block.	false

RuleStatus.status.rules[index].enforce.ingress

Enforcement for Ingress and Gateway API resource hostnames.

Name	Type	Description	Required
hostnames	[]object	Hostnames defines allowed, denied, or audited hostname expressions. A resource targeted by an allow or deny rule must declare non-empty values in all hostname fields. Audit-only rules record missing hostnames without denying them.	false
types	[]enum	Types defines the resource kinds to which hostname enforcement applies. Enum: Ingress, Route, ListenerSet, HTTPRoute, Gateway, TLSRoute, GRPCRoute	false

RuleStatus.status.rules[index].enforce.ingress.hostnames[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.metadata[index]

MetadataRule defines metadata constraints for namespaced resources.

Name	Type	Description	Required
kinds	[]string	Kinds of the referents. Use “*” to match all kinds.	true
annotations	map[string]object	Annotations defines metadata policies by annotation key.	false
apiGroups	[]string	API groups or API group/version selectors of the referents. Empty or omitted APIGroups means the core Kubernetes API version “v1”. Use “” to match all API groups and versions. Examples: - [] or [""] means core “v1”. - [“v1”] means core “v1”. - [“apps”] means any version in the “apps” API group. - [“apps/v1”] means only “apps/v1”. - [“apps”, “batch/v1”] means any “apps” version and “batch/v1”. - [""] means all API groups and versions.	false
labels	map[string]object	Labels defines metadata policies by label key.	false

RuleStatus.status.rules[index].enforce.metadata[index].annotations[key]

Name	Type	Description	Required
default	string	Default is applied by admission mutation when the concrete metadata key is absent. It is not reconciled after admission.	false
managed	string	Managed is enforced by admission mutation and reconciled by the RuleStatus controller using server-side apply when the rule configuration changes. Present metadata matching the effective managed value is exempt from metadata value validation, including overlapping deny rules. The last applicable managed value for each concrete key wins. During admission, only rules matching the request’s audience contribute to the effective managed value.	false
required	boolean	Required enforces that the metadata key must be present. This is only meaningful with action=allow. Deny and audit rules do not require missing metadata to exist. Default: false	false
values	[]object	Values defines allowed, denied, or audited values for the metadata key. With action=allow and no values, only Required is enforced. With action=deny or action=audit and no values, any present value matches, including an empty string.	false

RuleStatus.status.rules[index].enforce.metadata[index].annotations[key].values[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.metadata[index].labels[key]

Name	Type	Description	Required
default	string	Default is applied by admission mutation when the concrete metadata key is absent. It is not reconciled after admission.	false
managed	string	Managed is enforced by admission mutation and reconciled by the RuleStatus controller using server-side apply when the rule configuration changes. Present metadata matching the effective managed value is exempt from metadata value validation, including overlapping deny rules. The last applicable managed value for each concrete key wins. During admission, only rules matching the request’s audience contribute to the effective managed value.	false
required	boolean	Required enforces that the metadata key must be present. This is only meaningful with action=allow. Deny and audit rules do not require missing metadata to exist. Default: false	false
values	[]object	Values defines allowed, denied, or audited values for the metadata key. With action=allow and no values, only Required is enforced. With action=deny or action=audit and no values, any present value matches, including an empty string.	false

RuleStatus.status.rules[index].enforce.metadata[index].labels[key].values[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.network

Network configures network enforcement for namespace resources.

Name	Type	Description	Required
policies	object	Policies constrains native NetworkPolicies.	false

RuleStatus.status.rules[index].enforce.network.policies

Policies constrains native NetworkPolicies.

Name	Type	Description	Required
egress	object	Egress constrains destination address grants. Selector-based peers are unaffected. No constraints are applied when omitted.	false
ingress	object	Ingress constrains source address grants. Selector-based peers are unaffected. No constraints are applied when omitted.	false

RuleStatus.status.rules[index].enforce.network.policies.egress

Egress constrains destination address grants. Selector-based peers are unaffected. No constraints are applied when omitted.

Name	Type	Description	Required
cidrs	[]string	CIDRs matches addresses granted by ipBlock.cidr after subtracting except. Omitted peers on an ingress or egress rule grant both IPv4 and IPv6 address space. An empty NetworkPolicy ingress or egress list has no grants in that direction to validate. Each direction is evaluated independently. An empty CIDRs list imposes no constraint. Ordered allow/deny decisions apply to every granted address: deny rejects overlapping grants, allow requires complete coverage, and audit reports overlaps. A later allow cannot authorize addresses outside its CIDRs.	false

RuleStatus.status.rules[index].enforce.network.policies.ingress

Ingress constrains source address grants. Selector-based peers are unaffected. No constraints are applied when omitted.

Name	Type	Description	Required
cidrs	[]string	CIDRs matches addresses granted by ipBlock.cidr after subtracting except. Omitted peers on an ingress or egress rule grant both IPv4 and IPv6 address space. An empty NetworkPolicy ingress or egress list has no grants in that direction to validate. Each direction is evaluated independently. An empty CIDRs list imposes no constraint. Ordered allow/deny decisions apply to every granted address: deny rejects overlapping grants, allow requires complete coverage, and audit reports overlaps. A later allow cannot authorize addresses outside its CIDRs.	false

RuleStatus.status.rules[index].enforce.services

Enforcement for Services.

Name	Type	Description	Required
externalIPs	object	ExternalIPs defines constraints for spec.externalIPs.	false
externalNames	object	ExternalNames defines additional constraints for Services of type ExternalName.	false
loadBalancers	object	LoadBalancers defines additional constraints for Services of type LoadBalancer.	false
nodePorts	object	NodePorts defines additional constraints for nodePort values.	false
types	[]enum	Types defines the Service types matched by this rule. Supported values: - ClusterIP - NodePort - LoadBalancer - ExternalName Enum: ClusterIP, NodePort, LoadBalancer, ExternalName	false

RuleStatus.status.rules[index].enforce.services.externalIPs

ExternalIPs defines constraints for spec.externalIPs.

Name	Type	Description	Required
cidrs	[]string	CIDRs restricts spec.externalIPs. Individual IP addresses are treated as host CIDRs (/32 for IPv4 and /128 for IPv6). For deny rules, empty means all external IPs are denied. For allow and audit rules, empty means no external IP restriction.	false

RuleStatus.status.rules[index].enforce.services.externalNames

ExternalNames defines additional constraints for Services of type ExternalName.

Name	Type	Description	Required
hostnames	[]object	Hostnames restricts spec.externalName. Empty means no additional hostname restriction once ExternalName is allowed by types.	false

RuleStatus.status.rules[index].enforce.services.externalNames.hostnames[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.services.loadBalancers

LoadBalancers defines additional constraints for Services of type LoadBalancer.

Name	Type	Description	Required
cidrs	[]string	CIDRs restricts spec.loadBalancerIP and spec.loadBalancerSourceRanges. Empty means no additional CIDR restriction once LoadBalancer is allowed by types.	false

RuleStatus.status.rules[index].enforce.services.nodePorts

NodePorts defines additional constraints for nodePort values.

Name	Type	Description	Required
ports	[]object	Ports restricts explicitly requested nodePort values. Empty means no additional port restriction once NodePort is allowed by types.	false

RuleStatus.status.rules[index].enforce.services.nodePorts.ports[index]

Name	Type	Description	Required
from	integer	Format: int32 Minimum: 1 Maximum: 65535	true
to	integer	Format: int32 Minimum: 1 Maximum: 65535	true

RuleStatus.status.rules[index].enforce.storage

Additional access to PersistentVolumes without a tenant ownership label.

Name	Type	Description	Required
volumes	[]object	Volumes matches additional PersistentVolumes. Entries are ORed. Conditions on the enclosing enforcement rule must also match. The last matching allow/deny decides the exception; audit never grants access.	false

RuleStatus.status.rules[index].enforce.storage.volumes[index]

PersistentVolumeMatch matches labels on the referenced PersistentVolume.

Name	Type	Description	Required
selector	object	Selector matches existing PV labels, independently of PVC.spec.selector. An explicit empty selector matches all PVs. Capsule’s tenant ownership label cannot be overridden by a selector or an allow decision.	true
name	string	Name identifies this match in admission and audit messages.	false

RuleStatus.status.rules[index].enforce.storage.volumes[index].selector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rules[index].enforce.storage.volumes[index].selector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].enforce.workloads

Enforcement for native workload kinds and Pod properties.

Name	Type	Description	Required
disruptionBudgets	object	DisruptionBudgets constrains PDB coverage of selected Pods and controller templates. Only whole-workload targets apply; omitted targets select Pods.	false
placement	object	Placement matches the Pod scheduler and scheduling constraints.	false
qosClasses	[]string	Define Pod QoS classes matched by this enforcement rule. Supported values are Guaranteed, Burstable and BestEffort.	false
registries	[]object	Define registries which are allowed to be used within this tenant The rules are aggregated, since you can use Regular Expressions the match registry endpoints	false
resources	object	Resources defines mutation and enforcement policies for Pod and container resource requests and limits. The workload targets select where the policies apply. With no targets, resource policies apply to all compatible locations: Pod-level resources, regular containers, and init containers. Resource names unsupported at Pod level still apply to compatible container locations. Mutation is applied when a Pod is created, or when an explicitly targeted controller is created or updated (to its Pod template). Remove and MatchRequest manage explicit values, Default fills an absent value, and Ratio fills an absent limit from its request. An explicit Ratio violation is then handled by the enclosing allow, deny, or audit action.	false
schedulers	[]object	Schedulers defines additional schedulerName matchers for selected Pods and Pod templates. These are combined with placement.schedulers under the same rule action; a match in either field counts as a match. Deprecated: use Placement.Schedulers instead.	false
security	object	Security matches effective Pod and container security profiles.	false
targets	[]string	Targets selects native workloads and, optionally, parts of their Pod specs. With no workload policies, the action matches the selected kinds themselves. With policies, targets scopes those policies; it does not also match the kind. Omitted targets preserve Pod-only defaults. Controller targets are opt-in. Whole-controller targets include every compatible location in the Pod template. Existing pod and pod/* part targets retain their established policy scope.	false

RuleStatus.status.rules[index].enforce.workloads.disruptionBudgets

DisruptionBudgets constrains PDB coverage of selected Pods and controller templates. Only whole-workload targets apply; omitted targets select Pods.

Name	Type	Description	Required
allowOverlap	boolean	AllowOverlap permits multiple PDBs to select the same Pod or selected controller template. False rejects overlap for allow/deny actions and reports violations for audit. True permits overlap in an allow rule; omitted does not participate in evaluation. Rule ordering is preserved. Checks run on PDB selector changes and selected Pod/template label changes. Conditions and audience apply to the admission request, including PDB writes. Cross-resource admission reads are not an atomic transaction.	false
evictableReplicas	object	EvictableReplicas bounds the configured number of evictable replicas of each selected Deployment, StatefulSet, ReplicaSet or ReplicationController. Uses desired spec.replicas and Kubernetes’ upward percentage rounding; zero replicas are exempt. Checks controller writes, /scale, and PDB writes. Bounds are inclusive nonnegative integers; omitted bounds are unrestricted. Allow requires compliance; deny/audit match violations, like resource constraints. Other targets do not have a desired replica count and skip this property. At least one supported controller target must be explicitly selected.	false
unhealthyPodEvictionPolicies	[]enum	UnhealthyPodEvictionPolicies matches the effective PDB policy. Omission in a PDB means IfHealthyBudget. Allow accepts listed values; deny/audit match listed values, like other enum lists. Empty imposes no restriction. Enum: IfHealthyBudget, AlwaysAllow	false

RuleStatus.status.rules[index].enforce.workloads.disruptionBudgets.evictableReplicas

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.status.rules[index].enforce.workloads.placement

Placement matches the Pod scheduler and scheduling constraints.

Name	Type	Description	Required
affinity	[]object	Affinity matches each complete required or preferred affinity term.	false
nodeSelector	[]object	NodeSelector matches each node selector entry. Empty matchers match any entry. Placement rules apply to the pod target; allowing an entry does not require it.	false
schedulers	[]object	Schedulers defines schedulerName matchers for selected Pods and Pod templates. The rule is evaluated against pod.spec.schedulerName. Empty schedulerName is ignored and is not normalized to default-scheduler.	false
tolerations	[]object	Tolerations matches each toleration, including injected and wildcard tolerations.	false
topologySpreadConstraints	[]object	TopologySpreadConstraints matches each complete spread constraint.	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index]

WorkloadAffinityMatch matches an entire affinity term. Fields are ANDed; entries in enforce.workloads.placement.affinity are alternatives. {} matches any term.

Name	Type	Description	Required
fieldRequirements	[]object	FieldRequirements constrains node matchFields. When Requirements is set, matchFields must be explicitly permitted here to avoid an unchecked path.	false
labelSelector	object	PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.	false
modes	[]enum	Modes defaults to both scheduling modes; it does not require their presence. Enum: required, preferred	false
namespaceScope	enum	SameNamespace requires no namespaceSelector and only the Pod’s namespace in namespaces (or an omitted namespaces list). Any imposes no restriction. Enum: SameNamespace, Any	false
namespaceSelector	object	PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.	false
namespaces	object	Namespaces constrains each explicitly supplied namespace.	false
requirements	[]object	Requirements constrains node matchExpressions.	false
topologyKey	object	TopologyKey applies to Pod affinity and anti-affinity.	false
types	[]enum	Types defaults to all types. Type-specific constraints only match the types on which they are meaningful. Enum: nodeAffinity, podAffinity, podAntiAffinity	false
weight	object	Weight requires modes: [preferred].	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].fieldRequirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].fieldRequirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].fieldRequirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].labelSelector

Name	Type	Description	Required
required	boolean	Required requires at least one effective selector requirement.	false
requirements	[]object	Requirements is an allowlist within this matcher. If empty, requirements are unrestricted. Each actual requirement must match one complete entry.	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].labelSelector.requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].labelSelector.requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].labelSelector.requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].namespaceSelector

Name	Type	Description	Required
required	boolean	Required requires at least one effective selector requirement.	false
requirements	[]object	Requirements is an allowlist within this matcher. If empty, requirements are unrestricted. Each actual requirement must match one complete entry.	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].namespaceSelector.requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].namespaceSelector.requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].namespaceSelector.requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].namespaces

Namespaces constrains each explicitly supplied namespace.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].topologyKey

TopologyKey applies to Pod affinity and anti-affinity.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.affinity[index].weight

Weight requires modes: [preferred].

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.status.rules[index].enforce.workloads.placement.nodeSelector[index]

WorkloadNodeSelectorMatch matches a nodeSelector key/value pair. Omitted fields are unrestricted, so {} matches every entry, including an empty label value.

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rules[index].enforce.workloads.placement.nodeSelector[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.nodeSelector[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.schedulers[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.tolerations[index]

Name	Type	Description	Required
effects	[]enum	Effects matches the literal effect. An empty effect on a Pod tolerates all effects and does not match an allowlist of individual effects. Enum: NoSchedule, PreferNoSchedule, NoExecute,	false
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Operators matches Equal (including an omitted operator) or Exists. Enum: Equal, Exists	false
tolerationSeconds	object	TolerationDurationMatch treats an absent tolerationSeconds as unlimited.	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rules[index].enforce.workloads.placement.tolerations[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.tolerations[index].tolerationSeconds

TolerationDurationMatch treats an absent tolerationSeconds as unlimited.

Name	Type	Description	Required
allowUnlimited	boolean	AllowUnlimited defaults to true. Set false to require a finite duration.	false
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.status.rules[index].enforce.workloads.placement.tolerations[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.topologySpreadConstraints[index]

Name	Type	Description	Required
labelSelector	object	PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.	false
maxSkew	object	PlacementRange defines inclusive bounds. An omitted bound is unrestricted.	false
minDomains	object	MinDomains uses 1 when the Pod omits minDomains.	false
nodeAffinityPolicy	[]enum	NodeAffinityPolicy uses Honor when the Pod omits the field. Enum: Honor, Ignore	false
nodeTaintsPolicy	[]enum	NodeTaintsPolicy uses Ignore when the Pod omits the field. Enum: Honor, Ignore	false
topologyKey	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
whenUnsatisfiable	[]enum	Enum: DoNotSchedule, ScheduleAnyway	false

RuleStatus.status.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].labelSelector

Name	Type	Description	Required
required	boolean	Required requires at least one effective selector requirement.	false
requirements	[]object	Requirements is an allowlist within this matcher. If empty, requirements are unrestricted. Each actual requirement must match one complete entry.	false

RuleStatus.status.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].labelSelector.requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

RuleStatus.status.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].labelSelector.requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].labelSelector.requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].maxSkew

PlacementRange defines inclusive bounds. An omitted bound is unrestricted.

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.status.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].minDomains

MinDomains uses 1 when the Pod omits minDomains.

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

RuleStatus.status.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].topologyKey

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.registries[index]

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false
policy	[]string	Allowed PullPolicy for the given registry. Supplying no value allows all policies.	false

RuleStatus.status.rules[index].enforce.workloads.resources

Name	Type	Description	Required
limits	map[string]object	Limits defines policies for resource limits.	false
requests	map[string]object	Requests defines policies for resource requests.	false

RuleStatus.status.rules[index].enforce.workloads.resources.limits[key]

WorkloadResourceLimitPolicy defines how a resource limit is mutated and enforced.

Name	Type	Description	Required
policy	enum	Policy selects how the limit is handled: Preserve leaves it unchanged, Default fills an absent limit, Remove deletes it, MatchRequest manages it to equal the request, and Ratio defaults an absent limit and enforces the maximum multiplier against explicitly supplied limits. Enum: Preserve, Default, Remove, MatchRequest, Ratio	true
value	int or string	Value is the quantity applied by Default or the maximum limit-to-request multiplier applied by Ratio.	false

RuleStatus.status.rules[index].enforce.workloads.resources.requests[key]

WorkloadResourceRequestPolicy defines how a resource request is mutated.

Name	Type	Description	Required
policy	enum	Policy selects how the request is handled: Preserve leaves it unchanged, Default fills an absent request, and Remove deletes it. Enum: Preserve, Default, Remove	true
value	int or string	Value is the quantity applied by the Default policy.	false

RuleStatus.status.rules[index].enforce.workloads.schedulers[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.security

Security matches effective Pod and container security profiles.

Name	Type	Description	Required
appArmorProfiles	[]object	AppArmorProfiles matches effective Linux container profiles, including legacy AppArmor annotations before Pod defaults. It uses the same target and missing-profile semantics as SeccompProfiles. Privileged containers are Unconfined. Matching a Localhost name does not verify its installation.	false
seccompProfiles	[]object	SeccompProfiles matches effective Linux container profiles, resolving container overrides before Pod defaults. Privileged containers are Unconfined. Missing profiles do not match any type, so an allow-list rejects them. Omitted targets check regular, init and ephemeral containers; pod explicitly selects only the Pod default. Controller targets check their Pod templates.	false

RuleStatus.status.rules[index].enforce.workloads.security.appArmorProfiles[index]

WorkloadSecurityProfileMatch matches a profile type and optionally its local name/path. Entries are alternatives; localhostProfiles constrains only Localhost.

Name	Type	Description	Required
types	[]enum	Types selects profile types. Missing profiles never match. Enum: RuntimeDefault, Localhost, Unconfined	true
localhostProfiles	[]object	LocalhostProfiles matches seccomp paths relative to the kubelet seccomp directory, or loaded AppArmor profile names. Omitted permits any Localhost profile. Requires Localhost in types. Expressions use exact, exp and negate.	false

RuleStatus.status.rules[index].enforce.workloads.security.appArmorProfiles[index].localhostProfiles[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].enforce.workloads.security.seccompProfiles[index]

WorkloadSecurityProfileMatch matches a profile type and optionally its local name/path. Entries are alternatives; localhostProfiles constrains only Localhost.

Name	Type	Description	Required
types	[]enum	Types selects profile types. Missing profiles never match. Enum: RuntimeDefault, Localhost, Unconfined	true
localhostProfiles	[]object	LocalhostProfiles matches seccomp paths relative to the kubelet seccomp directory, or loaded AppArmor profile names. Omitted permits any Localhost profile. Requires Localhost in types. Expressions use exact, exp and negate.	false

RuleStatus.status.rules[index].enforce.workloads.security.seccompProfiles[index].localhostProfiles[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

RuleStatus.status.rules[index].mutate[index]

NamespaceRuleMutation applies typed mutations independently of enforce.action. Mutated values remain subject to all applicable enforcement rules.

Name	Type	Description	Required
action	enum	Action chooses how explicitly supplied properties are applied. Merge fills an empty schedulerName and absent security profiles, sets hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, and map keys, adds missing imagePullSecrets by name, upserts lists, and conjoins required affinity. Replace replaces each supplied property in full: scheduler, hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, nodeSelector, registries.imagePullSecrets, tolerations, topologySpreadConstraints, affinity, or security profiles. Omitted properties are retained. Supplying affinity replaces all its branches, including omitted ones. Enum: merge, replace Default: merge	false
conditions	[]object	Conditions gate this entire mutation entry and inspect the object after preceding mutations. All conditions must be true; empty means apply.	false
workloads	object	WorkloadMutation contains typed native Pod values. Empty maps/lists are preserved so replace can clear a property; nil means the property is omitted. It applies on Pod creation. Security.ReadOnlyRootFilesystem and Registries.ImagePullPolicy also apply to newly added ephemeral containers on subresource updates. Existing containers are never reconciled. On merge, later entries override hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, matching map keys, tolerations and spread constraints. On merge, required affinity restrictions from applicable entries are ANDed.	false

RuleStatus.status.rules[index].mutate[index].conditions[index]

Name	Type	Description	Required
expression	string	Expression must evaluate to bool. Any false condition skips this block. An evaluation error rejects the request unless another condition is false.	true
name	string	Name identifies a condition in admission errors. Names must be unique within a block.	false

RuleStatus.status.rules[index].mutate[index].workloads

Name	Type	Description	Required
placement	object	Placement configures the Pod scheduler and scheduling constraints.	false
registries	object	Registries configures Pod image pull secrets and selected containers’ pull policies.	false
security	object	Security configures Pod and container security settings.	false
targets	[]enum	Targets selects compatible Pod locations. Omitted or empty selects all compatible locations. The pod target includes Pod-level properties and all container groups; pod/containers, pod/initcontainers and pod/ephemeralcontainers narrow selection to one group. Controller templates and volumes are not supported. Enum: pod, pod/containers, pod/initcontainers, pod/ephemeralcontainers	false

RuleStatus.status.rules[index].mutate[index].workloads.placement

Placement configures the Pod scheduler and scheduling constraints.

Name	Type	Description	Required
affinity	object	Affinity on merge conjoins required restrictions and upserts preferred terms. Preferred terms match by their complete term, excluding weight and normalized ordering. A different term is added; a matching term gets the supplied weight. Required node affinity is distributed over existing OR alternatives, with at most 256 resulting alternatives. Empty node selector terms match no nodes. Replace replaces all affinity, including any branches omitted from the rule.	false
nodeSelector	map[string]string	NodeSelector sets configured keys on merge, or replaces the map on replace.	false
scheduler	string	Scheduler sets spec.schedulerName on Pod creation. Merge fills only an empty schedulerName, preserving all non-empty names, including default-scheduler. Kubernetes defaults omitted schedulerName before admission. Use replace with a condition to override default-scheduler while preserving custom schedulers. Replace always overwrites schedulerName when the entry’s conditions match. Omitted or null leaves the Pod value unchanged.	false
tolerations	[]object	Tolerations merges by key, operator (default Equal), value and effect. Changing any identity field adds another toleration, retaining the old one. A matching toleration’s duration is replaced; omitting it makes it unlimited. Replace replaces the entire list, including entries with other identities.	false
topologySpreadConstraints	[]object	TopologySpreadConstraints merges by topologyKey and whenUnsatisfiable. The entire matching constraint is replaced, including its selector and optional fields; other constraints remain. Replace replaces the entire list.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity

Name	Type	Description	Required
nodeAffinity	object	Describes node affinity scheduling rules for the pod.	false
podAffinity	object	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).	false
podAntiAffinity	object	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity

Describes node affinity scheduling rules for the pod.

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding “weight” to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it’s a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).

Name	Type	Description	Required
preference	object	A node selector term, associated with the corresponding weight.	true
weight	integer	Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. Format: int32	true

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference

A node selector term, associated with the corresponding weight.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node’s labels.	false
matchFields	[]object	A list of node selector requirements by node’s fields.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchExpressions[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchFields[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution

Name	Type	Description	Required
nodeSelectorTerms	[]object	Required. A list of node selector terms. The terms are ORed.	true

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index]

A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node’s labels.	false
matchFields	[]object	A list of node selector requirements by node’s fields.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchExpressions[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchFields[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAffinity

Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding “weight” to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity

Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting “weight” from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.tolerations[index]

The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator .

Name	Type	Description	Required
effect	string	Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.	false
key	string	Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.	false
operator	string	Operator represents a key’s relationship to the value. Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).	false
tolerationSeconds	integer	TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. Format: int64	false
value	string	Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.topologySpreadConstraints[index]

TopologySpreadConstraint specifies how to spread matching pods among the given topology.

Name	Type	Description	Required
maxSkew	integer	MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1.	zone1
topologyKey	string	TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a “bucket”, and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is “kubernetes.io/hostname”, each Node is a domain of that topology. And, if TopologyKey is “topology.kubernetes.io/zone”, each zone is a domain of that topology. It’s a required field.	true
whenUnsatisfiable	string	WhenUnsatisfiable indicates how to deal with a pod if it doesn’t satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered “Unsatisfiable” for an incoming pod if and only if every possible node assignment for that pod would violate “MaxSkew” on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1:	zone1
labelSelector	object	LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn’t set. Keys that don’t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).	false
minDomains	integer	MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats “global minimum” as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won’t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2:	zone1
nodeAffinityPolicy	string	NodeAffinityPolicy indicates how we will treat Pod’s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy.	false
nodeTaintsPolicy	string	NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.topologySpreadConstraints[index].labelSelector

LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

RuleStatus.status.rules[index].mutate[index].workloads.placement.topologySpreadConstraints[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

RuleStatus.status.rules[index].mutate[index].workloads.registries

Registries configures Pod image pull secrets and selected containers’ pull policies.

Name	Type	Description	Required
imagePullPolicy	enum	ImagePullPolicy sets imagePullPolicy on every selected regular or init container at Pod creation, and newly added ephemeral containers on subresource updates. Both merge and replace overwrite explicit and Kubernetes-defaulted values. Omitted or null preserves the existing policy. Applies to all Pod OSes. Enum: Always, IfNotPresent, Never	false
imagePullSecrets	[]object	ImagePullSecrets sets spec.imagePullSecrets on Pod creation. Merge appends missing names and removes existing duplicates, retaining first-occurrence order. Replace sets the complete list; an explicit empty list clears it. Omitted or null preserves it. Requires the pod target or omitted/empty targets. References always use the Pod’s namespace; Capsule does not create, copy, or check the referenced Secrets.	false

RuleStatus.status.rules[index].mutate[index].workloads.registries.imagePullSecrets[index]

LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.

Name	Type	Description	Required
name	string	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default:	false

RuleStatus.status.rules[index].mutate[index].workloads.security

Security configures Pod and container security settings.

Name	Type	Description	Required
appArmorProfile	object	AppArmorProfile supplies the Pod-level securityContext.appArmorProfile on Linux Pod creation. Merge fills an absent profile; replace replaces the complete profile. Explicit container profiles are preserved. Nil omits it. AppArmor and any Localhost profile must be available on eligible nodes.	false
hostUsers	boolean	HostUsers sets spec.hostUsers on both merge and replace. False requests a separate user namespace; true uses the host user namespace. Omitted or null leaves the Pod value unchanged. Requires Kubernetes/runtime support.	false
readOnlyRootFilesystem	boolean	ReadOnlyRootFilesystem sets securityContext.readOnlyRootFilesystem on every selected regular or init container at Pod creation, and newly added ephemeral containers on subresource updates. Both merge and replace overwrite the value. False is an explicit setting; nil preserves it. Windows Pods are skipped.	false
seccompProfile	object	SeccompProfile supplies the Pod-level securityContext.seccompProfile on Linux Pod creation. Merge fills an absent profile; replace replaces the complete profile. Explicit container profiles are preserved. Nil omits it.	false

RuleStatus.status.rules[index].mutate[index].workloads.security.appArmorProfile

Name	Type	Description	Required
type	string	type indicates which kind of AppArmor profile will be applied. Valid options are: Localhost - a profile pre-loaded on the node. RuntimeDefault - the container runtime’s default profile. Unconfined - no AppArmor enforcement.	true
localhostProfile	string	localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is “Localhost”.	false

RuleStatus.status.rules[index].mutate[index].workloads.security.seccompProfile

Name	Type	Description	Required
type	string	type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.	true
localhostProfile	string	localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet’s configured seccomp profile location. Must be set if type is “Localhost”. Must NOT be set for any other type.	false

RuleStatus.status.rules[index].quota[index]

Name	Type	Description	Required
name	string	Name is the stable identity of this quota within the Tenant. Changing the name replaces the generated GlobalResourceQuota; changing the quota or its namespace selector updates the existing object.	true
hard	map[string]int or string	hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/	false
scopeSelector	object	scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.	false
scopes	[]string	A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.	false

RuleStatus.status.rules[index].quota[index].scopeSelector

Name	Type	Description	Required
matchExpressions	[]object	A list of scope selector requirements by scope of the resources.	false

RuleStatus.status.rules[index].quota[index].scopeSelector.matchExpressions[index]

A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.

Name	Type	Description	Required
operator	string	Represents a scope’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.	true
scopeName	string	The name of the scope that the selector applies to.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantOwner

TenantOwner is the Schema for the tenantowners API.

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta2	true
kind	string	TenantOwner	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	spec defines the desired state of TenantOwner.	true
status	object	status defines the observed state of TenantOwner.	false

TenantOwner.spec

spec defines the desired state of TenantOwner.

Name	Type	Description	Required
kind	enum	Kind of entity. Possible values are “User”, “Group”, and “ServiceAccount” Enum: User, Group, ServiceAccount	true
name	string	Name of the entity.	true
aggregate	boolean	Adds the given subject as capsule user. When enabled this subject does not have to be mentioned in the CapsuleConfiguration as Capsule User. In almost all scenarios Tenant Owners must be Capsule Users. Default: true	false
clusterRoles	[]string	Defines additional cluster-roles for the specific Owner. Default: [admin capsule-namespace-deleter]	false

TenantOwner.status

status defines the observed state of TenantOwner.

Name	Type	Description	Required
conditions	[]object	Conditions contains the reconciliation conditions for this TenantOwner.	false
observedGeneration	integer	ObservedGeneration is the most recent generation the controller has observed. Format: int64	false
tenants	[]string	Tenants lists the names of all Tenants that this TenantOwner is currently matched to via the Tenant’s spec.permissions.matchOwners selectors.	false

TenantOwner.status.conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

TenantResource

TenantResource allows a Tenant Owner, if enabled with proper RBAC, to propagate resources in its Namespace. The object must be deployed in a Tenant Namespace, and cannot reference object living in non-Tenant namespaces. For such cases, the GlobalTenantResource must be used.

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta2	true
kind	string	TenantResource	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	TenantResourceSpec defines the desired state of TenantResource.	true
status	object	TenantResourceStatus defines the observed state of TenantResource.	false

TenantResource.spec

TenantResourceSpec defines the desired state of TenantResource.

Name	Type	Description	Required
resources	[]object	Defines the rules to select targeting Namespace, along with the objects that must be replicated.	true
resyncPeriod	string	Define the period of time upon a second reconciliation must be invoked. Keep in mind that any change to the manifests will trigger a new reconciliation. Default: 60s	true
settings	object	Deprecated: configure resources[].policy instead. Admission converts Settings into policies for blocks without one. Retained as a compatibility fallback for stored resources that have not passed through admission again. Default: map[]	true
cordoned	boolean	When cordoning a replication it will no longer execute any applies or deletions (paused). This is useful for maintenances Default: false	false
dependsOn	[]object	DependsOn may contain a meta.NamespacedObjectReference slice with references to TenantResource resources that must be ready before this TenantResource can be reconciled.	false
pruningOnDelete	boolean	When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted. Disable this to keep replicated resources although the deletion of the replication manifest. Deprecated: use resources[].policy.deletion instead. Retained for blocks without a policy. Default: true	false
serviceAccount	object	Local ServiceAccount which will perform all the actions defined in the TenantResource You must provide permissions accordingly to that ServiceAccount	false

TenantResource.spec.resources[index]

Name	Type	Description	Required
additionalMetadata	object	Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be added to the replicated resources.	false
context	object	Provide additional template context, which can be used throughout all the declared items for the replication	false
generators	[]object	Templates for advanced use cases	false
namespaceSelector	object	Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. In case of nil value, all the Tenant Namespaces are targeted.	false
namespacedItems	[]object	List of the resources already existing in other Namespaces that must be replicated.	false
policy	object	Policy controls creation, admission protection, SSA conflict ownership, and deletion for every raw item, namespaced item, and generator in this block. An explicit policy replaces the deprecated spec.settings for this block. When omitted, admission converts legacy settings and pruningOnDelete into a policy.	false
rawItems	[]object	List of raw resources that must be replicated.	false

TenantResource.spec.resources[index].additionalMetadata

Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be added to the replicated resources.

Name	Type	Description	Required
annotations	map[string]string		false
labels	map[string]string		false

TenantResource.spec.resources[index].context

Provide additional template context, which can be used throughout all the declared items for the replication

Name	Type	Description	Required
resources	[]object		false

TenantResource.spec.resources[index].context.resources[index]

Name	Type	Description	Required
kind	string	Kind of the referent. Use “*” to match all kinds.	true
apiVersion	string	API version, API group, or API group/version selector of the referent. Empty APIVersion means the core Kubernetes API version “v1”. Use “” to explicitly match all API groups and versions. Examples: - "" means core “v1”. - “v1” means core “v1”. - “apps” means any version in the “apps” API group. - “apps/v1” means the “apps/v1” API group/version. - “apps/” means any version in the “apps” API group.	false
index	string	Index to mount the resource in the template context	false
name	string	Name of the values referent. This is useful when you traying to get a specific resource	false
namespace	string	Namespace of the values referent.	false
optional	boolean	Only relevant if name is set. If an item is not optional, there will be an error thrown when it does not exist Default: true	false
selector	object	Selector which allows to get any amount of these resources based on labels	false

TenantResource.spec.resources[index].context.resources[index].selector

Selector which allows to get any amount of these resources based on labels

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

TenantResource.spec.resources[index].context.resources[index].selector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantResource.spec.resources[index].generators[index]

Name	Type	Description	Required
missingKey	enum	Missing Key Option for templating Enum: invalid, zero, error Default: zero	false
template	string	Template contains any amount of yaml which is applied to Kubernetes. This can be a single resource or multiple resources	false

TenantResource.spec.resources[index].namespaceSelector

Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. In case of nil value, all the Tenant Namespaces are targeted.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

TenantResource.spec.resources[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantResource.spec.resources[index].namespacedItems[index]

Reference

Name	Type	Description	Required
kind	string	Kind of the referent. Use “*” to match all kinds.	true
apiVersion	string	API version, API group, or API group/version selector of the referent. Empty APIVersion means the core Kubernetes API version “v1”. Use “” to explicitly match all API groups and versions. Examples: - "" means core “v1”. - “v1” means core “v1”. - “apps” means any version in the “apps” API group. - “apps/v1” means the “apps/v1” API group/version. - “apps/” means any version in the “apps” API group.	false
name	string	Name of the values referent. This is useful when you traying to get a specific resource	false
namespace	string	Namespace of the values referent.	false
optional	boolean	Only relevant if name is set. If an item is not optional, there will be an error thrown when it does not exist Default: true	false
selector	object	Selector which allows to get any amount of these resources based on labels	false

TenantResource.spec.resources[index].namespacedItems[index].selector

Selector which allows to get any amount of these resources based on labels

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

TenantResource.spec.resources[index].namespacedItems[index].selector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantResource.spec.resources[index].policy

Name	Type	Description	Required
condition	string	Condition is an optional CEL boolean expression checked before each target is applied. object is the existing destination object, or null when absent; now is the evaluation timestamp. False skips rendered content without pruning or releasing an already managed object. Policy and protection are still reconciled for managed objects. Evaluation errors prevent writes. Rendering still occurs before evaluation. Omitting Condition preserves the existing apply behavior. Conditions do not affect deletion or orphaning.	false
creation	enum	Creation controls how an existing target is handled. Owner requires the resource to have been created by the applying controller and otherwise returns an error. Merge adopts an existing resource when possible and creates the resource when it does not exist. Enum: Owner, Merge Default: Owner	false
deletion	enum	Deletion controls what happens when the parent stops managing the target. Remove deletes resources created for the parent and relinquishes adopted resources. Orphan keeps the resource and removes Capsule’s lifecycle metadata. Removal is the default. Enum: Remove, Orphan Default: Remove	false
force	boolean	Force allows server-side apply to acquire conflicting field ownership. Default: false	false
protect	boolean	Protect prevents users from changing or deleting the target through admission while it is managed. Protection is enabled by default. Default: true	false

TenantResource.spec.settings

Name	Type	Description	Required
adopt	boolean	Enabling this allows TenanResources to interact with objects which were not created by a TenantResource. In this case on prune no deletion of the entire object is made. Deprecated: use resources[].policy.creation: Merge instead. Default: false	false
force	boolean	Force indicates that in case of conflicts with server-side apply, the client should acquire ownership of the conflicting field. You may create collisions with this. Deprecated: use resources[].policy.force instead. Default: false	false

TenantResource.spec.dependsOn[index]

LocalObjectReference contains enough information to locate the referenced Kubernetes resource object.

Name	Type	Description	Required
name	string	Name of the referent.	true

TenantResource.spec.serviceAccount

Local ServiceAccount which will perform all the actions defined in the TenantResource You must provide permissions accordingly to that ServiceAccount

Name	Type	Description	Required
name	string	Name of the referent.	true

TenantResource.status

TenantResourceStatus defines the observed state of TenantResource.

Name	Type	Description	Required
size	integer	Number of managed resources.	true
conditions	[]object	Condition of the GlobalTenantResource.	false
observedGeneration	integer	ObservedGeneration is the most recent generation the controller has observed. Format: int64	false
processedItems	[]object	List of resources managed by the API object.	false
serviceAccount	object	Serviceaccount used for impersonation	false

TenantResource.status.conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

TenantResource.status.processedItems[index]

Advanced Status Item for pin pointing items in tenants/namespaces.

Name	Type	Required
group	string	false
kind	string	false
name	string	false
namespace	string	false
origin	string	false
status	object	false
tenant	string	false
version	string	false

TenantResource.status.processedItems[index].status

Name	Type	Description	Required
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
clusterScoped	boolean	Indicates whether the referenced resource is cluster-scoped.	false
created	boolean	Indicates wether the resource was created or adopted	false
lastApply	string	An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency Format: date-time	false
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	false
policy	object	Policy is a lifecycle snapshot for protection and cleanup. Conditions are evaluated from the source block and omitted here. Failed updates retain the previous snapshot; a first successful content write records its policy even if metadata reconciliation fails, so cleanup respects explicit retention. An absent policy on an already applied item preserves legacy behavior.	false

TenantResource.status.processedItems[index].status.policy

Name	Type	Description	Required
creation	enum	Creation controls how an existing target is handled. Owner requires the resource to have been created by the applying controller and otherwise returns an error. Merge adopts an existing resource when possible and creates the resource when it does not exist. Enum: Owner, Merge Default: Owner	false
deletion	enum	Deletion controls what happens when the parent stops managing the target. Remove deletes resources created for the parent and relinquishes adopted resources. Orphan keeps the resource and removes Capsule’s lifecycle metadata. Removal is the default. Enum: Remove, Orphan Default: Remove	false
force	boolean	Force allows server-side apply to acquire conflicting field ownership. Default: false	false
protect	boolean	Protect prevents users from changing or deleting the target through admission while it is managed. Protection is enabled by default. Default: true	false

TenantResource.status.serviceAccount

Serviceaccount used for impersonation

Name	Type	Description	Required
name	string	Name of the referent.	true
namespace	string	Namespace of the referent.	true

Tenant

Tenant is the Schema for the tenants API.

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta2	true
kind	string	Tenant	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	TenantSpec defines the desired state of Tenant.	false
status	object	Returns the observed state of the Tenant.	false

Tenant.spec

TenantSpec defines the desired state of Tenant.

Name	Type	Description	Required
additionalRoleBindings	[]object	Specifies additional RoleBindings assigned to the Tenant. Capsule will ensure that all namespaces in the Tenant always contain the RoleBinding for the given ClusterRole. Optional.	false
containerRegistries	object	Deprecated: Use Enforcement.Registries instead Specifies the trusted Image Registries assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed trusted registries. Optional.	false
cordoned	boolean	Toggling the Tenant resources cordoning, when enable resources cannot be deleted. Default: false	false
data	JSON	Specify additional data relating to the tenant. Mainly useable in templating and more accessible than labels/annotations.	false
deviceClasses	object	Specifies options for the DeviceClass resources.	false
forceTenantPrefix	boolean	Use this if you want to disable/enable the Tenant name prefix to specific Tenants, overriding global forceTenantPrefix in CapsuleConfiguration. When set to ’true’, it enforces Namespaces created for this Tenant to be named with the Tenant name prefix, separated by a dash (i.e. for Tenant ‘foo’, namespace names must be prefixed with ‘foo-’), this is useful to avoid Namespace name collision. When set to ‘false’, it allows Namespaces created for this Tenant to be named anything. Overrides CapsuleConfiguration global forceTenantPrefix for the Tenant only. If unset, Tenant uses CapsuleConfiguration’s forceTenantPrefix Optional	false
gatewayOptions	object	Specifies options for the GatewayClass resources.	false
imagePullPolicies	[]enum	Deprecated: Use Enforcement.Registries instead Specify the allowed values for the imagePullPolicies option in Pod resources. Capsule assures that all Pod resources created in the Tenant can use only one of the allowed policy. Optional. Enum: Always, Never, IfNotPresent	false
ingressOptions	object	Specifies options for the Ingress resources, such as allowed hostnames and IngressClass. Optional.	false
limitRanges	object	Deprecated: Use Tenant Replications instead (https://projectcapsule.dev/docs/replications/) Specifies the resource min/max usage restrictions to the Tenant. The assigned values are inherited by any namespace created in the Tenant. Optional.	false
namespaceOptions	object	Specifies options for the Namespaces, such as additional metadata or maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional.	false
networkPolicies	object	Deprecated: Use Tenant Replications instead (https://projectcapsule.dev/docs/replications/) Specifies the NetworkPolicies assigned to the Tenant. The assigned NetworkPolicies are inherited by any namespace created in the Tenant. Optional.	false
nodeSelector	map[string]string	Specifies the label to control the placement of pods on a given pool of worker nodes. All namespaces created within the Tenant will have the node selector annotation. This annotation tells the Kubernetes scheduler to place pods on the nodes having the selector label. Optional.	false
owners	[]object	Specifies the owners of the Tenant. Optional	false
permissions	object	Specify Permissions for the Tenant.	false
podOptions	object	Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/) Specifies options for the Pods deployed in the Tenant namespaces, such as additional metadata.	false
preventDeletion	boolean	Prevent accidental deletion of the Tenant. When enabled, the deletion request will be declined. Default: false	false
priorityClasses	object	Specifies the allowed priorityClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses. A default value can be specified, and all the Pod resources created will inherit the declared class. Optional.	false
resourceQuotas	object	Deprecated: Use Rules Quota (https://projectcapsule.dev/docs/tenants/rules/#quotas) Specifies a list of ResourceQuota resources assigned to the Tenant. The assigned values are inherited by any namespace created in the Tenant. The Capsule operator aggregates ResourceQuota at Tenant level, so that the hard quota is never crossed for the given Tenant. This permits the Tenant owner to consume resources in the Tenant regardless of the namespace. Optional.	false
rules	[]object	Specify enforcement specifications for the scope of the Tenant. We are moving all configuration enforcement. per namespace into a rule construct. It’s currently not final. Read More: https://projectcapsule.dev/docs/tenants/rules/	false
runtimeClasses	object	Specifies the allowed RuntimeClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed RuntimeClasses. Optional.	false
serviceOptions	object	Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/) Specifies options for the Service, such as additional metadata or block of certain type of Services. Optional.	false
storageClasses	object	Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class. Optional.	false

Tenant.spec.additionalRoleBindings[index]

Name	Type	Description	Required
clusterRoleName	string		true
subjects	[]object		true
annotations	map[string]string	Additional Annotations for the synchronized rolebindings	false
labels	map[string]string	Additional Labels for the synchronized rolebindings	false

Tenant.spec.additionalRoleBindings[index].subjects[index]

Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names.

Name	Type	Description	Required
kind	string	Kind of object being referenced. Values defined by this API group are “User”, “Group”, and “ServiceAccount”. If the Authorizer does not recognized the kind value, the Authorizer should report an error.	true
name	string	Name of the object being referenced.	true
apiGroup	string	APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to “rbac.authorization.k8s.io” for User and Group subjects.	false
namespace	string	Namespace of the referenced object. If the object kind is non-namespace, such as “User” or “Group”, and this value is not empty the Authorizer should report an error.	false

Tenant.spec.containerRegistries

Deprecated: Use Enforcement.Registries instead

Specifies the trusted Image Registries assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed trusted registries. Optional.

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false

Tenant.spec.deviceClasses

Specifies options for the DeviceClass resources.

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.deviceClasses.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.gatewayOptions

Specifies options for the GatewayClass resources.

Name	Type	Description	Required
allowedClasses	object		false

Tenant.spec.gatewayOptions.allowedClasses

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false
default	string		false
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.gatewayOptions.allowedClasses.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.ingressOptions

Specifies options for the Ingress resources, such as allowed hostnames and IngressClass. Optional.

Name	Type	Description	Required
allowWildcardHostnames	boolean	Toggles the ability for Ingress resources created in a Tenant to have a hostname wildcard.	false
allowedClasses	object	Specifies the allowed IngressClasses assigned to the Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses. A default value can be specified, and all the Ingress resources created will inherit the declared class. Optional.	false
allowedHostnames	object	Specifies the allowed hostnames in Ingresses for the given Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed hostnames. Optional.	false
hostnameCollisionScope	enum	Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. Optional. Enum: Cluster, Tenant, Namespace, Disabled Default: Disabled	false

Tenant.spec.ingressOptions.allowedClasses

Specifies the allowed IngressClasses assigned to the Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses. A default value can be specified, and all the Ingress resources created will inherit the declared class. Optional.

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false
default	string		false
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.ingressOptions.allowedClasses.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.ingressOptions.allowedHostnames

Specifies the allowed hostnames in Ingresses for the given Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed hostnames. Optional.

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false

Tenant.spec.limitRanges

Deprecated: Use Tenant Replications instead (https://projectcapsule.dev/docs/replications/)

Specifies the resource min/max usage restrictions to the Tenant. The assigned values are inherited by any namespace created in the Tenant. Optional.

Name	Type	Description	Required
items	[]object		false

Tenant.spec.limitRanges.items[index]

LimitRangeSpec defines a min/max usage limit for resources that match on kind.

Name	Type	Description	Required
limits	[]object	Limits is the list of LimitRangeItem objects that are enforced.	true

Tenant.spec.limitRanges.items[index].limits[index]

LimitRangeItem defines a min/max usage limit for any resource that matches on kind.

Name	Type	Description	Required
type	string	Type of resource that this limit applies to.	true
default	map[string]int or string	Default resource requirement limit value by resource name if resource limit is omitted.	false
defaultRequest	map[string]int or string	DefaultRequest is the default resource requirement request value by resource name if resource request is omitted.	false
max	map[string]int or string	Max usage constraints on this kind by resource name.	false
maxLimitRequestRatio	map[string]int or string	MaxLimitRequestRatio if specified, the named resource must have a request and limit that are both non-zero where limit divided by request is less than or equal to the enumerated value; this represents the max burst for the named resource.	false
min	map[string]int or string	Min usage constraints on this kind by resource name.	false

Tenant.spec.namespaceOptions

Specifies options for the Namespaces, such as additional metadata or maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional.

Name	Type	Description	Required
additionalMetadata	object	Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace) Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant. Optional.	false
additionalMetadataList	[]object	Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace) Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant via a list. Optional.	false
forbiddenAnnotations	object	Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace) Define the annotations that a Tenant Owner cannot set for their Namespace resources.	false
forbiddenLabels	object	Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace) Define the labels that a Tenant Owner cannot set for their Namespace resources.	false
managedMetadataOnly	boolean	If enabled only metadata from additionalMetadata is reconciled to the namespaces. Default: false	false
quota	integer	Specifies the maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional. Format: int32 Minimum: 1	false
requiredMetadata	object	Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace) Required Metadata for namespace within this tenant	false

Tenant.spec.namespaceOptions.additionalMetadata

Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)

Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant. Optional.

Name	Type	Description	Required
annotations	map[string]string		false
labels	map[string]string		false

Tenant.spec.namespaceOptions.additionalMetadataList[index]

Name	Type	Description	Required
annotations	map[string]string		false
labels	map[string]string		false
namespaceSelector	object	A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.	false

Tenant.spec.namespaceOptions.additionalMetadataList[index].namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.namespaceOptions.additionalMetadataList[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.namespaceOptions.forbiddenAnnotations

Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)

Define the annotations that a Tenant Owner cannot set for their Namespace resources.

Name	Type	Description	Required
denied	[]string		false
deniedRegex	string		false

Tenant.spec.namespaceOptions.forbiddenLabels

Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)

Define the labels that a Tenant Owner cannot set for their Namespace resources.

Name	Type	Description	Required
denied	[]string		false
deniedRegex	string		false

Tenant.spec.namespaceOptions.requiredMetadata

Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)

Required Metadata for namespace within this tenant

Name	Type	Description	Required
annotations	map[string]string	Annotations that must be defined for each namespace	false
labels	map[string]string	Labels that must be defined for each namespace	false

Tenant.spec.networkPolicies

Deprecated: Use Tenant Replications instead (https://projectcapsule.dev/docs/replications/)

Specifies the NetworkPolicies assigned to the Tenant. The assigned NetworkPolicies are inherited by any namespace created in the Tenant. Optional.

Name	Type	Description	Required
items	[]object		false

Tenant.spec.networkPolicies.items[index]

NetworkPolicySpec provides the specification of a NetworkPolicy

Name	Type	Description	Required
egress	[]object	egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8	false
ingress	[]object	ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod’s local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)	false
podSelector	object	podSelector selects the pods to which this NetworkPolicy object applies. The array of rules is applied to any pods selected by this field. An empty selector matches all pods in the policy’s namespace. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is optional. If it is not specified, it defaults to an empty selector.	false
policyTypes	[]string	policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are [“Ingress”], [“Egress”], or [“Ingress”, “Egress”]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ “Egress” ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include “Egress” (since such a policy would not include an egress section and would otherwise default to just [ “Ingress” ]). This field is beta-level in 1.8	false

Tenant.spec.networkPolicies.items[index].egress[index]

NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec’s podSelector. The traffic must match both ports and to. This type is beta-level in 1.8

Name	Type	Description	Required
ports	[]object	ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.	false
to	[]object	to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.	false

Tenant.spec.networkPolicies.items[index].egress[index].ports[index]

NetworkPolicyPort describes a port to allow traffic on

Name	Type	Description	Required
endPort	integer	endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. Format: int32	false
port	int or string	port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.	false
protocol	string	protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.	false

Tenant.spec.networkPolicies.items[index].egress[index].to[index]

NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed

Name	Type	Description	Required
ipBlock	object	ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.	false
namespaceSelector	object	namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.	false
podSelector	object	podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy’s own namespace.	false

Tenant.spec.networkPolicies.items[index].egress[index].to[index].ipBlock

ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.

Name	Type	Description	Required
cidr	string	cidr is a string representing the IPBlock Valid examples are “192.168.1.0/24” or “2001:db8::/64”	true
except	[]string	except is a slice of CIDRs that should not be included within an IPBlock Valid examples are “192.168.1.0/24” or “2001:db8::/64” Except values will be rejected if they are outside the cidr range	false

Tenant.spec.networkPolicies.items[index].egress[index].to[index].namespaceSelector

namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces.

If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.networkPolicies.items[index].egress[index].to[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.networkPolicies.items[index].egress[index].to[index].podSelector

podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods.

If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy’s own namespace.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.networkPolicies.items[index].egress[index].to[index].podSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.networkPolicies.items[index].ingress[index]

NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec’s podSelector. The traffic must match both ports and from.

Name	Type	Description	Required
from	[]object	from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.	false
ports	[]object	ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.	false

Tenant.spec.networkPolicies.items[index].ingress[index].from[index]

NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed

Name	Type	Description	Required
ipBlock	object	ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.	false
namespaceSelector	object	namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.	false
podSelector	object	podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy’s own namespace.	false

Tenant.spec.networkPolicies.items[index].ingress[index].from[index].ipBlock

ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.

Name	Type	Description	Required
cidr	string	cidr is a string representing the IPBlock Valid examples are “192.168.1.0/24” or “2001:db8::/64”	true
except	[]string	except is a slice of CIDRs that should not be included within an IPBlock Valid examples are “192.168.1.0/24” or “2001:db8::/64” Except values will be rejected if they are outside the cidr range	false

Tenant.spec.networkPolicies.items[index].ingress[index].from[index].namespaceSelector

namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.networkPolicies.items[index].ingress[index].from[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.networkPolicies.items[index].ingress[index].from[index].podSelector

podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.networkPolicies.items[index].ingress[index].from[index].podSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.networkPolicies.items[index].ingress[index].ports[index]

NetworkPolicyPort describes a port to allow traffic on

Name	Type	Description	Required
endPort	integer	endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. Format: int32	false
port	int or string	port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.	false
protocol	string	protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.	false

Tenant.spec.networkPolicies.items[index].podSelector

podSelector selects the pods to which this NetworkPolicy object applies. The array of rules is applied to any pods selected by this field. An empty selector matches all pods in the policy’s namespace. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is optional. If it is not specified, it defaults to an empty selector.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.networkPolicies.items[index].podSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.owners[index]

Name	Type	Description	Required
kind	enum	Kind of entity. Possible values are “User”, “Group”, and “ServiceAccount” Enum: User, Group, ServiceAccount	true
name	string	Name of the entity.	true
annotations	map[string]string	Additional Annotations for the synchronized rolebindings	false
clusterRoles	[]string	Defines additional cluster-roles for the specific Owner. Default: [admin capsule-namespace-deleter]	false
labels	map[string]string	Additional Labels for the synchronized rolebindings	false
proxySettings	[]object	Proxy settings for tenant owner.	false

Tenant.spec.owners[index].proxySettings[index]

Name	Type	Description	Required
kind	enum	Enum: Nodes, StorageClasses, IngressClasses, PriorityClasses, RuntimeClasses, PersistentVolumes	true
operations	[]enum	Enum: List, Update, Delete	true

Tenant.spec.permissions

Specify Permissions for the Tenant.

Name	Type	Description	Required
allowOwnerPromotion	boolean	ClusterRoles granted to the promoted ServiceAccounts across the Tenant Default: true	false
matchOwners	[]object	Matches TenantOwner objects which are promoted to owners of this tenant The elements are OR operations and independent. You can see the resulting Tenant Owners in the Status.Owners specification of the Tenant.	false

Tenant.spec.permissions.matchOwners[index]

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.permissions.matchOwners[index].matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.podOptions

Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/)

Specifies options for the Pods deployed in the Tenant namespaces, such as additional metadata.

Name	Type	Description	Required
additionalMetadata	object	Specifies additional labels and annotations the Capsule operator places on any Pod resource in the Tenant. Optional.	false

Tenant.spec.podOptions.additionalMetadata

Specifies additional labels and annotations the Capsule operator places on any Pod resource in the Tenant. Optional.

Name	Type	Description	Required
annotations	map[string]string		false
labels	map[string]string		false

Tenant.spec.priorityClasses

Specifies the allowed priorityClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses. A default value can be specified, and all the Pod resources created will inherit the declared class. Optional.

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false
default	string		false
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.priorityClasses.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.resourceQuotas

Deprecated: Use Rules Quota (https://projectcapsule.dev/docs/tenants/rules/#quotas)

Specifies a list of ResourceQuota resources assigned to the Tenant. The assigned values are inherited by any namespace created in the Tenant. The Capsule operator aggregates ResourceQuota at Tenant level, so that the hard quota is never crossed for the given Tenant. This permits the Tenant owner to consume resources in the Tenant regardless of the namespace. Optional.

Name	Type	Description	Required
items	[]object		false
scope	enum	Define if the Resource Budget should compute resource across all Namespaces in the Tenant or individually per cluster. Default is Tenant Enum: Tenant, Namespace Default: Tenant	false

Tenant.spec.resourceQuotas.items[index]

ResourceQuotaSpec defines the desired hard limits to enforce for Quota.

Name	Type	Description	Required
hard	map[string]int or string	hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/	false
scopeSelector	object	scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.	false
scopes	[]string	A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.	false

Tenant.spec.resourceQuotas.items[index].scopeSelector

Name	Type	Description	Required
matchExpressions	[]object	A list of scope selector requirements by scope of the resources.	false

Tenant.spec.resourceQuotas.items[index].scopeSelector.matchExpressions[index]

A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.

Name	Type	Description	Required
operator	string	Represents a scope’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.	true
scopeName	string	The name of the scope that the selector applies to.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index]

Rules Distributed via Tenants

Name	Type	Description	Required
audience	[]object	Audience limits this rule to matching request subjects. An empty audience matches every request.	false
enforce	object	Enforcement for given rule	false
mutate	[]object	Mutate applies ordered typed mutations before enforcement. It shares the rule’s namespace selection and audience. Workload mutations apply on Pod creation.	false
namespaceSelector	object	Select namespaces which are going to be targeted with this rule	false
permissions	object	Permissions for given rule	false
quota	[]object	Quota contains native Kubernetes ResourceQuota specifications shared by all namespaces selected by this rule. Unlike Enforce, quota accounting is independent of the request audience.	false

Tenant.spec.rules[index].audience[index]

Name	Type	Description	Required
kind	enum	Enum: User, Group, ServiceAccount, Custom	true
name	string		true

Tenant.spec.rules[index].enforce

Enforcement for given rule

Name	Type	Description	Required
action	enum	Declare the action being performed on the enforcement rule: deny: On match, deny admission request allow: On match, allowed admission request audit: On match, audit (post event) of admission request Enum: allow, deny, audit Default: deny	false
conditions	[]object	Conditions gate this entire enforcement rule, including workloads, services, metadata, ingress, network and storage. All conditions must be true; empty means apply. Conditions run during admission; managed metadata in a conditional rule is applied on matching requests only and is not reconciled in the background.	false
ingress	object	Enforcement for Ingress and Gateway API resource hostnames.	false
metadata	[]object	Enforcement for object metadata on namespaced resources.	false
network	object	Network configures network enforcement for namespace resources.	false
services	object	Enforcement for Services.	false
storage	object	Additional access to PersistentVolumes without a tenant ownership label.	false
workloads	object	Enforcement for native workload kinds and Pod properties.	false

Tenant.spec.rules[index].enforce.conditions[index]

Name	Type	Description	Required
expression	string	Expression must evaluate to bool. Any false condition skips this block. An evaluation error rejects the request unless another condition is false.	true
name	string	Name identifies a condition in admission errors. Names must be unique within a block.	false

Tenant.spec.rules[index].enforce.ingress

Enforcement for Ingress and Gateway API resource hostnames.

Name	Type	Description	Required
hostnames	[]object	Hostnames defines allowed, denied, or audited hostname expressions. A resource targeted by an allow or deny rule must declare non-empty values in all hostname fields. Audit-only rules record missing hostnames without denying them.	false
types	[]enum	Types defines the resource kinds to which hostname enforcement applies. Enum: Ingress, Route, ListenerSet, HTTPRoute, Gateway, TLSRoute, GRPCRoute	false

Tenant.spec.rules[index].enforce.ingress.hostnames[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.metadata[index]

MetadataRule defines metadata constraints for namespaced resources.

Name	Type	Description	Required
kinds	[]string	Kinds of the referents. Use “*” to match all kinds.	true
annotations	map[string]object	Annotations defines metadata policies by annotation key.	false
apiGroups	[]string	API groups or API group/version selectors of the referents. Empty or omitted APIGroups means the core Kubernetes API version “v1”. Use “” to match all API groups and versions. Examples: - [] or [""] means core “v1”. - [“v1”] means core “v1”. - [“apps”] means any version in the “apps” API group. - [“apps/v1”] means only “apps/v1”. - [“apps”, “batch/v1”] means any “apps” version and “batch/v1”. - [""] means all API groups and versions.	false
labels	map[string]object	Labels defines metadata policies by label key.	false

Tenant.spec.rules[index].enforce.metadata[index].annotations[key]

Name	Type	Description	Required
default	string	Default is applied by admission mutation when the concrete metadata key is absent. It is not reconciled after admission.	false
managed	string	Managed is enforced by admission mutation and reconciled by the RuleStatus controller using server-side apply when the rule configuration changes. Present metadata matching the effective managed value is exempt from metadata value validation, including overlapping deny rules. The last applicable managed value for each concrete key wins. During admission, only rules matching the request’s audience contribute to the effective managed value.	false
required	boolean	Required enforces that the metadata key must be present. This is only meaningful with action=allow. Deny and audit rules do not require missing metadata to exist. Default: false	false
values	[]object	Values defines allowed, denied, or audited values for the metadata key. With action=allow and no values, only Required is enforced. With action=deny or action=audit and no values, any present value matches, including an empty string.	false

Tenant.spec.rules[index].enforce.metadata[index].annotations[key].values[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.metadata[index].labels[key]

Name	Type	Description	Required
default	string	Default is applied by admission mutation when the concrete metadata key is absent. It is not reconciled after admission.	false
managed	string	Managed is enforced by admission mutation and reconciled by the RuleStatus controller using server-side apply when the rule configuration changes. Present metadata matching the effective managed value is exempt from metadata value validation, including overlapping deny rules. The last applicable managed value for each concrete key wins. During admission, only rules matching the request’s audience contribute to the effective managed value.	false
required	boolean	Required enforces that the metadata key must be present. This is only meaningful with action=allow. Deny and audit rules do not require missing metadata to exist. Default: false	false
values	[]object	Values defines allowed, denied, or audited values for the metadata key. With action=allow and no values, only Required is enforced. With action=deny or action=audit and no values, any present value matches, including an empty string.	false

Tenant.spec.rules[index].enforce.metadata[index].labels[key].values[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.network

Network configures network enforcement for namespace resources.

Name	Type	Description	Required
policies	object	Policies constrains native NetworkPolicies.	false

Tenant.spec.rules[index].enforce.network.policies

Policies constrains native NetworkPolicies.

Name	Type	Description	Required
egress	object	Egress constrains destination address grants. Selector-based peers are unaffected. No constraints are applied when omitted.	false
ingress	object	Ingress constrains source address grants. Selector-based peers are unaffected. No constraints are applied when omitted.	false

Tenant.spec.rules[index].enforce.network.policies.egress

Egress constrains destination address grants. Selector-based peers are unaffected. No constraints are applied when omitted.

Name	Type	Description	Required
cidrs	[]string	CIDRs matches addresses granted by ipBlock.cidr after subtracting except. Omitted peers on an ingress or egress rule grant both IPv4 and IPv6 address space. An empty NetworkPolicy ingress or egress list has no grants in that direction to validate. Each direction is evaluated independently. An empty CIDRs list imposes no constraint. Ordered allow/deny decisions apply to every granted address: deny rejects overlapping grants, allow requires complete coverage, and audit reports overlaps. A later allow cannot authorize addresses outside its CIDRs.	false

Tenant.spec.rules[index].enforce.network.policies.ingress

Ingress constrains source address grants. Selector-based peers are unaffected. No constraints are applied when omitted.

Name	Type	Description	Required
cidrs	[]string	CIDRs matches addresses granted by ipBlock.cidr after subtracting except. Omitted peers on an ingress or egress rule grant both IPv4 and IPv6 address space. An empty NetworkPolicy ingress or egress list has no grants in that direction to validate. Each direction is evaluated independently. An empty CIDRs list imposes no constraint. Ordered allow/deny decisions apply to every granted address: deny rejects overlapping grants, allow requires complete coverage, and audit reports overlaps. A later allow cannot authorize addresses outside its CIDRs.	false

Tenant.spec.rules[index].enforce.services

Enforcement for Services.

Name	Type	Description	Required
externalIPs	object	ExternalIPs defines constraints for spec.externalIPs.	false
externalNames	object	ExternalNames defines additional constraints for Services of type ExternalName.	false
loadBalancers	object	LoadBalancers defines additional constraints for Services of type LoadBalancer.	false
nodePorts	object	NodePorts defines additional constraints for nodePort values.	false
types	[]enum	Types defines the Service types matched by this rule. Supported values: - ClusterIP - NodePort - LoadBalancer - ExternalName Enum: ClusterIP, NodePort, LoadBalancer, ExternalName	false

Tenant.spec.rules[index].enforce.services.externalIPs

ExternalIPs defines constraints for spec.externalIPs.

Name	Type	Description	Required
cidrs	[]string	CIDRs restricts spec.externalIPs. Individual IP addresses are treated as host CIDRs (/32 for IPv4 and /128 for IPv6). For deny rules, empty means all external IPs are denied. For allow and audit rules, empty means no external IP restriction.	false

Tenant.spec.rules[index].enforce.services.externalNames

ExternalNames defines additional constraints for Services of type ExternalName.

Name	Type	Description	Required
hostnames	[]object	Hostnames restricts spec.externalName. Empty means no additional hostname restriction once ExternalName is allowed by types.	false

Tenant.spec.rules[index].enforce.services.externalNames.hostnames[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.services.loadBalancers

LoadBalancers defines additional constraints for Services of type LoadBalancer.

Name	Type	Description	Required
cidrs	[]string	CIDRs restricts spec.loadBalancerIP and spec.loadBalancerSourceRanges. Empty means no additional CIDR restriction once LoadBalancer is allowed by types.	false

Tenant.spec.rules[index].enforce.services.nodePorts

NodePorts defines additional constraints for nodePort values.

Name	Type	Description	Required
ports	[]object	Ports restricts explicitly requested nodePort values. Empty means no additional port restriction once NodePort is allowed by types.	false

Tenant.spec.rules[index].enforce.services.nodePorts.ports[index]

Name	Type	Description	Required
from	integer	Format: int32 Minimum: 1 Maximum: 65535	true
to	integer	Format: int32 Minimum: 1 Maximum: 65535	true

Tenant.spec.rules[index].enforce.storage

Additional access to PersistentVolumes without a tenant ownership label.

Name	Type	Description	Required
volumes	[]object	Volumes matches additional PersistentVolumes. Entries are ORed. Conditions on the enclosing enforcement rule must also match. The last matching allow/deny decides the exception; audit never grants access.	false

Tenant.spec.rules[index].enforce.storage.volumes[index]

PersistentVolumeMatch matches labels on the referenced PersistentVolume.

Name	Type	Description	Required
selector	object	Selector matches existing PV labels, independently of PVC.spec.selector. An explicit empty selector matches all PVs. Capsule’s tenant ownership label cannot be overridden by a selector or an allow decision.	true
name	string	Name identifies this match in admission and audit messages.	false

Tenant.spec.rules[index].enforce.storage.volumes[index].selector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.rules[index].enforce.storage.volumes[index].selector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].enforce.workloads

Enforcement for native workload kinds and Pod properties.

Name	Type	Description	Required
disruptionBudgets	object	DisruptionBudgets constrains PDB coverage of selected Pods and controller templates. Only whole-workload targets apply; omitted targets select Pods.	false
placement	object	Placement matches the Pod scheduler and scheduling constraints.	false
qosClasses	[]string	Define Pod QoS classes matched by this enforcement rule. Supported values are Guaranteed, Burstable and BestEffort.	false
registries	[]object	Define registries which are allowed to be used within this tenant The rules are aggregated, since you can use Regular Expressions the match registry endpoints	false
resources	object	Resources defines mutation and enforcement policies for Pod and container resource requests and limits. The workload targets select where the policies apply. With no targets, resource policies apply to all compatible locations: Pod-level resources, regular containers, and init containers. Resource names unsupported at Pod level still apply to compatible container locations. Mutation is applied when a Pod is created, or when an explicitly targeted controller is created or updated (to its Pod template). Remove and MatchRequest manage explicit values, Default fills an absent value, and Ratio fills an absent limit from its request. An explicit Ratio violation is then handled by the enclosing allow, deny, or audit action.	false
schedulers	[]object	Schedulers defines additional schedulerName matchers for selected Pods and Pod templates. These are combined with placement.schedulers under the same rule action; a match in either field counts as a match. Deprecated: use Placement.Schedulers instead.	false
security	object	Security matches effective Pod and container security profiles.	false
targets	[]string	Targets selects native workloads and, optionally, parts of their Pod specs. With no workload policies, the action matches the selected kinds themselves. With policies, targets scopes those policies; it does not also match the kind. Omitted targets preserve Pod-only defaults. Controller targets are opt-in. Whole-controller targets include every compatible location in the Pod template. Existing pod and pod/* part targets retain their established policy scope.	false

Tenant.spec.rules[index].enforce.workloads.disruptionBudgets

DisruptionBudgets constrains PDB coverage of selected Pods and controller templates. Only whole-workload targets apply; omitted targets select Pods.

Name	Type	Description	Required
allowOverlap	boolean	AllowOverlap permits multiple PDBs to select the same Pod or selected controller template. False rejects overlap for allow/deny actions and reports violations for audit. True permits overlap in an allow rule; omitted does not participate in evaluation. Rule ordering is preserved. Checks run on PDB selector changes and selected Pod/template label changes. Conditions and audience apply to the admission request, including PDB writes. Cross-resource admission reads are not an atomic transaction.	false
evictableReplicas	object	EvictableReplicas bounds the configured number of evictable replicas of each selected Deployment, StatefulSet, ReplicaSet or ReplicationController. Uses desired spec.replicas and Kubernetes’ upward percentage rounding; zero replicas are exempt. Checks controller writes, /scale, and PDB writes. Bounds are inclusive nonnegative integers; omitted bounds are unrestricted. Allow requires compliance; deny/audit match violations, like resource constraints. Other targets do not have a desired replica count and skip this property. At least one supported controller target must be explicitly selected.	false
unhealthyPodEvictionPolicies	[]enum	UnhealthyPodEvictionPolicies matches the effective PDB policy. Omission in a PDB means IfHealthyBudget. Allow accepts listed values; deny/audit match listed values, like other enum lists. Empty imposes no restriction. Enum: IfHealthyBudget, AlwaysAllow	false

Tenant.spec.rules[index].enforce.workloads.disruptionBudgets.evictableReplicas

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

Tenant.spec.rules[index].enforce.workloads.placement

Placement matches the Pod scheduler and scheduling constraints.

Name	Type	Description	Required
affinity	[]object	Affinity matches each complete required or preferred affinity term.	false
nodeSelector	[]object	NodeSelector matches each node selector entry. Empty matchers match any entry. Placement rules apply to the pod target; allowing an entry does not require it.	false
schedulers	[]object	Schedulers defines schedulerName matchers for selected Pods and Pod templates. The rule is evaluated against pod.spec.schedulerName. Empty schedulerName is ignored and is not normalized to default-scheduler.	false
tolerations	[]object	Tolerations matches each toleration, including injected and wildcard tolerations.	false
topologySpreadConstraints	[]object	TopologySpreadConstraints matches each complete spread constraint.	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index]

WorkloadAffinityMatch matches an entire affinity term. Fields are ANDed; entries in enforce.workloads.placement.affinity are alternatives. {} matches any term.

Name	Type	Description	Required
fieldRequirements	[]object	FieldRequirements constrains node matchFields. When Requirements is set, matchFields must be explicitly permitted here to avoid an unchecked path.	false
labelSelector	object	PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.	false
modes	[]enum	Modes defaults to both scheduling modes; it does not require their presence. Enum: required, preferred	false
namespaceScope	enum	SameNamespace requires no namespaceSelector and only the Pod’s namespace in namespaces (or an omitted namespaces list). Any imposes no restriction. Enum: SameNamespace, Any	false
namespaceSelector	object	PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.	false
namespaces	object	Namespaces constrains each explicitly supplied namespace.	false
requirements	[]object	Requirements constrains node matchExpressions.	false
topologyKey	object	TopologyKey applies to Pod affinity and anti-affinity.	false
types	[]enum	Types defaults to all types. Type-specific constraints only match the types on which they are meaningful. Enum: nodeAffinity, podAffinity, podAntiAffinity	false
weight	object	Weight requires modes: [preferred].	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].fieldRequirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].fieldRequirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].fieldRequirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].labelSelector

Name	Type	Description	Required
required	boolean	Required requires at least one effective selector requirement.	false
requirements	[]object	Requirements is an allowlist within this matcher. If empty, requirements are unrestricted. Each actual requirement must match one complete entry.	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].labelSelector.requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].labelSelector.requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].labelSelector.requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].namespaceSelector

Name	Type	Description	Required
required	boolean	Required requires at least one effective selector requirement.	false
requirements	[]object	Requirements is an allowlist within this matcher. If empty, requirements are unrestricted. Each actual requirement must match one complete entry.	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].namespaceSelector.requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].namespaceSelector.requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].namespaceSelector.requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].namespaces

Namespaces constrains each explicitly supplied namespace.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].topologyKey

TopologyKey applies to Pod affinity and anti-affinity.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.affinity[index].weight

Weight requires modes: [preferred].

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

Tenant.spec.rules[index].enforce.workloads.placement.nodeSelector[index]

WorkloadNodeSelectorMatch matches a nodeSelector key/value pair. Omitted fields are unrestricted, so {} matches every entry, including an empty label value.

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

Tenant.spec.rules[index].enforce.workloads.placement.nodeSelector[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.nodeSelector[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.schedulers[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.tolerations[index]

Name	Type	Description	Required
effects	[]enum	Effects matches the literal effect. An empty effect on a Pod tolerates all effects and does not match an allowlist of individual effects. Enum: NoSchedule, PreferNoSchedule, NoExecute,	false
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Operators matches Equal (including an omitted operator) or Exists. Enum: Equal, Exists	false
tolerationSeconds	object	TolerationDurationMatch treats an absent tolerationSeconds as unlimited.	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

Tenant.spec.rules[index].enforce.workloads.placement.tolerations[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.tolerations[index].tolerationSeconds

TolerationDurationMatch treats an absent tolerationSeconds as unlimited.

Name	Type	Description	Required
allowUnlimited	boolean	AllowUnlimited defaults to true. Set false to require a finite duration.	false
max	integer	Format: int64	false
min	integer	Format: int64	false

Tenant.spec.rules[index].enforce.workloads.placement.tolerations[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.topologySpreadConstraints[index]

Name	Type	Description	Required
labelSelector	object	PlacementLabelSelectorMatch checks every effective selector requirement. matchLabels is normalized to In, and dynamic matchLabelKeys/mismatchLabelKeys are checked as In/NotIn using the incoming Pod’s label values. Missing dynamic labels are ignored, matching Kubernetes semantics.	false
maxSkew	object	PlacementRange defines inclusive bounds. An omitted bound is unrestricted.	false
minDomains	object	MinDomains uses 1 when the Pod omits minDomains.	false
nodeAffinityPolicy	[]enum	NodeAffinityPolicy uses Honor when the Pod omits the field. Enum: Honor, Ignore	false
nodeTaintsPolicy	[]enum	NodeTaintsPolicy uses Ignore when the Pod omits the field. Enum: Honor, Ignore	false
topologyKey	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
whenUnsatisfiable	[]enum	Enum: DoNotSchedule, ScheduleAnyway	false

Tenant.spec.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].labelSelector

Name	Type	Description	Required
required	boolean	Required requires at least one effective selector requirement.	false
requirements	[]object	Requirements is an allowlist within this matcher. If empty, requirements are unrestricted. Each actual requirement must match one complete entry.	false

Tenant.spec.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].labelSelector.requirements[index]

Name	Type	Description	Required
key	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false
operators	[]enum	Enum: In, NotIn, Exists, DoesNotExist, Gt, Lt	false
values	object	PlacementExpressionMatch uses the shared exact/exp/negate matching semantics. The rule admission validator requires exact or exp. Keeping this check out of CEL avoids multiplying its estimated cost across the nested placement lists and the three representations of namespace rules in RuleStatus.	false

Tenant.spec.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].labelSelector.requirements[index].key

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].labelSelector.requirements[index].values

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].maxSkew

PlacementRange defines inclusive bounds. An omitted bound is unrestricted.

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

Tenant.spec.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].minDomains

MinDomains uses 1 when the Pod omits minDomains.

Name	Type	Description	Required
max	integer	Format: int64	false
min	integer	Format: int64	false

Tenant.spec.rules[index].enforce.workloads.placement.topologySpreadConstraints[index].topologyKey

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.registries[index]

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false
policy	[]string	Allowed PullPolicy for the given registry. Supplying no value allows all policies.	false

Tenant.spec.rules[index].enforce.workloads.resources

Name	Type	Description	Required
limits	map[string]object	Limits defines policies for resource limits.	false
requests	map[string]object	Requests defines policies for resource requests.	false

Tenant.spec.rules[index].enforce.workloads.resources.limits[key]

WorkloadResourceLimitPolicy defines how a resource limit is mutated and enforced.

Name	Type	Description	Required
policy	enum	Policy selects how the limit is handled: Preserve leaves it unchanged, Default fills an absent limit, Remove deletes it, MatchRequest manages it to equal the request, and Ratio defaults an absent limit and enforces the maximum multiplier against explicitly supplied limits. Enum: Preserve, Default, Remove, MatchRequest, Ratio	true
value	int or string	Value is the quantity applied by Default or the maximum limit-to-request multiplier applied by Ratio.	false

Tenant.spec.rules[index].enforce.workloads.resources.requests[key]

WorkloadResourceRequestPolicy defines how a resource request is mutated.

Name	Type	Description	Required
policy	enum	Policy selects how the request is handled: Preserve leaves it unchanged, Default fills an absent request, and Remove deletes it. Enum: Preserve, Default, Remove	true
value	int or string	Value is the quantity applied by the Default policy.	false

Tenant.spec.rules[index].enforce.workloads.schedulers[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.security

Security matches effective Pod and container security profiles.

Name	Type	Description	Required
appArmorProfiles	[]object	AppArmorProfiles matches effective Linux container profiles, including legacy AppArmor annotations before Pod defaults. It uses the same target and missing-profile semantics as SeccompProfiles. Privileged containers are Unconfined. Matching a Localhost name does not verify its installation.	false
seccompProfiles	[]object	SeccompProfiles matches effective Linux container profiles, resolving container overrides before Pod defaults. Privileged containers are Unconfined. Missing profiles do not match any type, so an allow-list rejects them. Omitted targets check regular, init and ephemeral containers; pod explicitly selects only the Pod default. Controller targets check their Pod templates.	false

Tenant.spec.rules[index].enforce.workloads.security.appArmorProfiles[index]

WorkloadSecurityProfileMatch matches a profile type and optionally its local name/path. Entries are alternatives; localhostProfiles constrains only Localhost.

Name	Type	Description	Required
types	[]enum	Types selects profile types. Missing profiles never match. Enum: RuntimeDefault, Localhost, Unconfined	true
localhostProfiles	[]object	LocalhostProfiles matches seccomp paths relative to the kubelet seccomp directory, or loaded AppArmor profile names. Omitted permits any Localhost profile. Requires Localhost in types. Expressions use exact, exp and negate.	false

Tenant.spec.rules[index].enforce.workloads.security.appArmorProfiles[index].localhostProfiles[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].enforce.workloads.security.seccompProfiles[index]

WorkloadSecurityProfileMatch matches a profile type and optionally its local name/path. Entries are alternatives; localhostProfiles constrains only Localhost.

Name	Type	Description	Required
types	[]enum	Types selects profile types. Missing profiles never match. Enum: RuntimeDefault, Localhost, Unconfined	true
localhostProfiles	[]object	LocalhostProfiles matches seccomp paths relative to the kubelet seccomp directory, or loaded AppArmor profile names. Omitted permits any Localhost profile. Requires Localhost in types. Expressions use exact, exp and negate.	false

Tenant.spec.rules[index].enforce.workloads.security.seccompProfiles[index].localhostProfiles[index]

At least one of Exact or Exp must be set. Both may be set together.

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false

Tenant.spec.rules[index].mutate[index]

NamespaceRuleMutation applies typed mutations independently of enforce.action. Mutated values remain subject to all applicable enforcement rules.

Name	Type	Description	Required
action	enum	Action chooses how explicitly supplied properties are applied. Merge fills an empty schedulerName and absent security profiles, sets hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, and map keys, adds missing imagePullSecrets by name, upserts lists, and conjoins required affinity. Replace replaces each supplied property in full: scheduler, hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, nodeSelector, registries.imagePullSecrets, tolerations, topologySpreadConstraints, affinity, or security profiles. Omitted properties are retained. Supplying affinity replaces all its branches, including omitted ones. Enum: merge, replace Default: merge	false
conditions	[]object	Conditions gate this entire mutation entry and inspect the object after preceding mutations. All conditions must be true; empty means apply.	false
workloads	object	WorkloadMutation contains typed native Pod values. Empty maps/lists are preserved so replace can clear a property; nil means the property is omitted. It applies on Pod creation. Security.ReadOnlyRootFilesystem and Registries.ImagePullPolicy also apply to newly added ephemeral containers on subresource updates. Existing containers are never reconciled. On merge, later entries override hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, matching map keys, tolerations and spread constraints. On merge, required affinity restrictions from applicable entries are ANDed.	false

Tenant.spec.rules[index].mutate[index].conditions[index]

Name	Type	Description	Required
expression	string	Expression must evaluate to bool. Any false condition skips this block. An evaluation error rejects the request unless another condition is false.	true
name	string	Name identifies a condition in admission errors. Names must be unique within a block.	false

Tenant.spec.rules[index].mutate[index].workloads

Name	Type	Description	Required
placement	object	Placement configures the Pod scheduler and scheduling constraints.	false
registries	object	Registries configures Pod image pull secrets and selected containers’ pull policies.	false
security	object	Security configures Pod and container security settings.	false
targets	[]enum	Targets selects compatible Pod locations. Omitted or empty selects all compatible locations. The pod target includes Pod-level properties and all container groups; pod/containers, pod/initcontainers and pod/ephemeralcontainers narrow selection to one group. Controller templates and volumes are not supported. Enum: pod, pod/containers, pod/initcontainers, pod/ephemeralcontainers	false

Tenant.spec.rules[index].mutate[index].workloads.placement

Placement configures the Pod scheduler and scheduling constraints.

Name	Type	Description	Required
affinity	object	Affinity on merge conjoins required restrictions and upserts preferred terms. Preferred terms match by their complete term, excluding weight and normalized ordering. A different term is added; a matching term gets the supplied weight. Required node affinity is distributed over existing OR alternatives, with at most 256 resulting alternatives. Empty node selector terms match no nodes. Replace replaces all affinity, including any branches omitted from the rule.	false
nodeSelector	map[string]string	NodeSelector sets configured keys on merge, or replaces the map on replace.	false
scheduler	string	Scheduler sets spec.schedulerName on Pod creation. Merge fills only an empty schedulerName, preserving all non-empty names, including default-scheduler. Kubernetes defaults omitted schedulerName before admission. Use replace with a condition to override default-scheduler while preserving custom schedulers. Replace always overwrites schedulerName when the entry’s conditions match. Omitted or null leaves the Pod value unchanged.	false
tolerations	[]object	Tolerations merges by key, operator (default Equal), value and effect. Changing any identity field adds another toleration, retaining the old one. A matching toleration’s duration is replaced; omitting it makes it unlimited. Replace replaces the entire list, including entries with other identities.	false
topologySpreadConstraints	[]object	TopologySpreadConstraints merges by topologyKey and whenUnsatisfiable. The entire matching constraint is replaced, including its selector and optional fields; other constraints remain. Replace replaces the entire list.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity

Name	Type	Description	Required
nodeAffinity	object	Describes node affinity scheduling rules for the pod.	false
podAffinity	object	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).	false
podAntiAffinity	object	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity

Describes node affinity scheduling rules for the pod.

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding “weight” to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it’s a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).

Name	Type	Description	Required
preference	object	A node selector term, associated with the corresponding weight.	true
weight	integer	Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. Format: int32	true

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference

A node selector term, associated with the corresponding weight.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node’s labels.	false
matchFields	[]object	A list of node selector requirements by node’s fields.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchExpressions[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchFields[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution

Name	Type	Description	Required
nodeSelectorTerms	[]object	Required. A list of node selector terms. The terms are ORed.	true

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index]

A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node’s labels.	false
matchFields	[]object	A list of node selector requirements by node’s fields.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchExpressions[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchFields[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAffinity

Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding “weight” to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity

Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting “weight” from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.tolerations[index]

The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator .

Name	Type	Description	Required
effect	string	Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.	false
key	string	Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.	false
operator	string	Operator represents a key’s relationship to the value. Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).	false
tolerationSeconds	integer	TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. Format: int64	false
value	string	Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.topologySpreadConstraints[index]

TopologySpreadConstraint specifies how to spread matching pods among the given topology.

Name	Type	Description	Required
maxSkew	integer	MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1.	zone1
topologyKey	string	TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a “bucket”, and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is “kubernetes.io/hostname”, each Node is a domain of that topology. And, if TopologyKey is “topology.kubernetes.io/zone”, each zone is a domain of that topology. It’s a required field.	true
whenUnsatisfiable	string	WhenUnsatisfiable indicates how to deal with a pod if it doesn’t satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered “Unsatisfiable” for an incoming pod if and only if every possible node assignment for that pod would violate “MaxSkew” on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1:	zone1
labelSelector	object	LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn’t set. Keys that don’t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).	false
minDomains	integer	MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats “global minimum” as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won’t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2:	zone1
nodeAffinityPolicy	string	NodeAffinityPolicy indicates how we will treat Pod’s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy.	false
nodeTaintsPolicy	string	NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.topologySpreadConstraints[index].labelSelector

LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.rules[index].mutate[index].workloads.placement.topologySpreadConstraints[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].mutate[index].workloads.registries

Registries configures Pod image pull secrets and selected containers’ pull policies.

Name	Type	Description	Required
imagePullPolicy	enum	ImagePullPolicy sets imagePullPolicy on every selected regular or init container at Pod creation, and newly added ephemeral containers on subresource updates. Both merge and replace overwrite explicit and Kubernetes-defaulted values. Omitted or null preserves the existing policy. Applies to all Pod OSes. Enum: Always, IfNotPresent, Never	false
imagePullSecrets	[]object	ImagePullSecrets sets spec.imagePullSecrets on Pod creation. Merge appends missing names and removes existing duplicates, retaining first-occurrence order. Replace sets the complete list; an explicit empty list clears it. Omitted or null preserves it. Requires the pod target or omitted/empty targets. References always use the Pod’s namespace; Capsule does not create, copy, or check the referenced Secrets.	false

Tenant.spec.rules[index].mutate[index].workloads.registries.imagePullSecrets[index]

LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.

Name	Type	Description	Required
name	string	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default:	false

Tenant.spec.rules[index].mutate[index].workloads.security

Security configures Pod and container security settings.

Name	Type	Description	Required
appArmorProfile	object	AppArmorProfile supplies the Pod-level securityContext.appArmorProfile on Linux Pod creation. Merge fills an absent profile; replace replaces the complete profile. Explicit container profiles are preserved. Nil omits it. AppArmor and any Localhost profile must be available on eligible nodes.	false
hostUsers	boolean	HostUsers sets spec.hostUsers on both merge and replace. False requests a separate user namespace; true uses the host user namespace. Omitted or null leaves the Pod value unchanged. Requires Kubernetes/runtime support.	false
readOnlyRootFilesystem	boolean	ReadOnlyRootFilesystem sets securityContext.readOnlyRootFilesystem on every selected regular or init container at Pod creation, and newly added ephemeral containers on subresource updates. Both merge and replace overwrite the value. False is an explicit setting; nil preserves it. Windows Pods are skipped.	false
seccompProfile	object	SeccompProfile supplies the Pod-level securityContext.seccompProfile on Linux Pod creation. Merge fills an absent profile; replace replaces the complete profile. Explicit container profiles are preserved. Nil omits it.	false

Tenant.spec.rules[index].mutate[index].workloads.security.appArmorProfile

Name	Type	Description	Required
type	string	type indicates which kind of AppArmor profile will be applied. Valid options are: Localhost - a profile pre-loaded on the node. RuntimeDefault - the container runtime’s default profile. Unconfined - no AppArmor enforcement.	true
localhostProfile	string	localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is “Localhost”.	false

Tenant.spec.rules[index].mutate[index].workloads.security.seccompProfile

Name	Type	Description	Required
type	string	type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.	true
localhostProfile	string	localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet’s configured seccomp profile location. Must be set if type is “Localhost”. Must NOT be set for any other type.	false

Tenant.spec.rules[index].namespaceSelector

Select namespaces which are going to be targeted with this rule

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.rules[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].permissions

Permissions for given rule

Name	Type	Description	Required
bindings	[]object	Bindings defines additional RoleBindings for namespaces selected by this rule.	false
promotions	[]object	Define Promotion Rules which distributed additional ClusterRoles across the Tenant for promoted ServiceAccounts.	false

Tenant.spec.rules[index].permissions.bindings[index]

Name	Type	Description	Required
clusterRoleName	string		true
subjects	[]object		true
annotations	map[string]string	Additional Annotations for the synchronized rolebindings	false
labels	map[string]string	Additional Labels for the synchronized rolebindings	false

Tenant.spec.rules[index].permissions.bindings[index].subjects[index]

Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names.

Name	Type	Description	Required
kind	string	Kind of object being referenced. Values defined by this API group are “User”, “Group”, and “ServiceAccount”. If the Authorizer does not recognized the kind value, the Authorizer should report an error.	true
name	string	Name of the object being referenced.	true
apiGroup	string	APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to “rbac.authorization.k8s.io” for User and Group subjects.	false
namespace	string	Namespace of the referenced object. If the object kind is non-namespace, such as “User” or “Group”, and this value is not empty the Authorizer should report an error.	false

Tenant.spec.rules[index].permissions.promotions[index]

Name	Type	Description	Required
clusterRoles	[]string	ClusterRoles granted to the promoted ServiceAccounts across the Tenant kubebuilder:validation:Minimum=1	false
selector	object	Match ServiceAccounts which are promoted which are granted these additional ClusterRoles across the Tenant	false

Tenant.spec.rules[index].permissions.promotions[index].selector

Match ServiceAccounts which are promoted which are granted these additional ClusterRoles across the Tenant

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.rules[index].permissions.promotions[index].selector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.rules[index].quota[index]

Name	Type	Description	Required
name	string	Name is the stable identity of this quota within the Tenant. Changing the name replaces the generated GlobalResourceQuota; changing the quota or its namespace selector updates the existing object.	true
hard	map[string]int or string	hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/	false
scopeSelector	object	scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.	false
scopes	[]string	A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.	false

Tenant.spec.rules[index].quota[index].scopeSelector

Name	Type	Description	Required
matchExpressions	[]object	A list of scope selector requirements by scope of the resources.	false

Tenant.spec.rules[index].quota[index].scopeSelector.matchExpressions[index]

A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.

Name	Type	Description	Required
operator	string	Represents a scope’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.	true
scopeName	string	The name of the scope that the selector applies to.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.runtimeClasses

Specifies the allowed RuntimeClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed RuntimeClasses. Optional.

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false
default	string		false
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.runtimeClasses.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.serviceOptions

Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/)

Specifies options for the Service, such as additional metadata or block of certain type of Services. Optional.

Name	Type	Description	Required
additionalMetadata	object	Specifies additional labels and annotations the Capsule operator places on any Service resource in the Tenant. Optional.	false
allowedServices	object	Block or deny certain type of Services. Optional.	false
externalIPs	object	Specifies the external IPs that can be used in Services with type ClusterIP. An empty list means no IPs are allowed. Optional.	false
forbiddenAnnotations	object	Define the annotations that a Tenant Owner cannot set for their Service resources.	false
forbiddenLabels	object	Define the labels that a Tenant Owner cannot set for their Service resources.	false

Tenant.spec.serviceOptions.additionalMetadata

Specifies additional labels and annotations the Capsule operator places on any Service resource in the Tenant. Optional.

Name	Type	Description	Required
annotations	map[string]string		false
labels	map[string]string		false

Tenant.spec.serviceOptions.allowedServices

Block or deny certain type of Services. Optional.

Name	Type	Description	Required
externalName	boolean	Specifies if ExternalName service type resources are allowed for the Tenant. Default is true. Optional. Default: true	false
loadBalancer	boolean	Specifies if LoadBalancer service type resources are allowed for the Tenant. Default is true. Optional. Default: true	false
nodePort	boolean	Specifies if NodePort service type resources are allowed for the Tenant. Default is true. Optional. Default: true	false

Tenant.spec.serviceOptions.externalIPs

Specifies the external IPs that can be used in Services with type ClusterIP. An empty list means no IPs are allowed. Optional.

Name	Type	Description	Required
allowed	[]string		true

Tenant.spec.serviceOptions.forbiddenAnnotations

Define the annotations that a Tenant Owner cannot set for their Service resources.

Name	Type	Description	Required
denied	[]string		false
deniedRegex	string		false

Tenant.spec.serviceOptions.forbiddenLabels

Define the labels that a Tenant Owner cannot set for their Service resources.

Name	Type	Description	Required
denied	[]string		false
deniedRegex	string		false

Tenant.spec.storageClasses

Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class. Optional.

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false
default	string		false
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.storageClasses.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.status

Returns the observed state of the Tenant.

Name	Type	Description	Required
conditions	[]object	Tenant Condition	true
size	integer	How many namespaces are assigned to the Tenant.	true
state	enum	The operational state of the Tenant. Possible values are “Active”, “Cordoned” or “Terminating”. Enum: Cordoned, Active, Terminating Default: Active	true
classes	object	Available Class Types within Tenant	false
namespaces	[]string	List of namespaces assigned to the Tenant. (Deprecated)	false
observedGeneration	integer	ObservedGeneration is the most recent generation the controller has observed. Format: int64	false
owners	[]object	Collected owners for this tenant	false
promotions	[]object	Promoted ServiceAccounts across the Tenant	false
spaces	[]object	Tracks state for the namespaces associated with this tenant	false

Tenant.status.conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

Tenant.status.classes

Available Class Types within Tenant

Name	Type	Description	Required
device	[]string	Available DeviceClasses	false
gateway	[]string	Available GatewayClasses	false
priority	[]string	Available PriorityClasses	false
runtime	[]string	Available StorageClasses	false
storage	[]string	Available Storageclasses (Only collected if any matching condition is specified)	false

Tenant.status.owners[index]

Name	Type	Description	Required
kind	enum	Kind of entity. Possible values are “User”, “Group”, and “ServiceAccount” Enum: User, Group, ServiceAccount	true
name	string	Name of the entity.	true
clusterRoles	[]string	Defines additional cluster-roles for the specific Owner. Default: [admin capsule-namespace-deleter]	false

Tenant.status.promotions[index]

Name	Type	Description	Required
kind	enum	Kind of entity. Possible values are “User”, “Group”, and “ServiceAccount” Enum: User, Group, ServiceAccount	true
name	string	Name of the entity.	true
clusterRoles	[]string	Defines additional cluster-roles for the specific Owner. Default: [admin capsule-namespace-deleter]	false
targets	[]string	Defines additional cluster-roles for the specific Owner.	false

Tenant.status.spaces[index]

Name	Type	Description	Required
conditions	[]object	Conditions	true
name	string	Namespace Name	true
enforce	object	Managed Metadata	false
metadata	object	Managed Metadata	false
uid	string	Namespace UID	false

Tenant.status.spaces[index].conditions[index]

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

Tenant.status.spaces[index].enforce

Managed Metadata

Name	Type	Description	Required
registry	[]object	Registries which are allowed within this namespace	false

Tenant.status.spaces[index].enforce.registry[index]

Name	Type	Description	Required
exact	[]string	Exact matches one of the provided values exactly.	false
exp	string	Exp matches regular expression.	false
negate	boolean	Negate regular Expression Default: false	false
policy	[]string	Allowed PullPolicy for the given registry. Supplying no value allows all policies.	false

Tenant.status.spaces[index].metadata

Managed Metadata

Name	Type	Description	Required
annotations	map[string]string	Managed Annotations	false
labels	map[string]string	Managed Labels	false

capsule.clastix.io/v1beta1

Resource Types:

Tenant

Tenant

Tenant is the Schema for the tenants API.

Name	Type	Description	Required
apiVersion	string	capsule.clastix.io/v1beta1	true
kind	string	Tenant	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	TenantSpec defines the desired state of Tenant.	true
status	object	Returns the observed state of the Tenant.	false

Tenant.spec

TenantSpec defines the desired state of Tenant.

Name	Type	Description	Required
owners	[]object	Specifies the owners of the Tenant. Mandatory.	true
additionalRoleBindings	[]object	Specifies additional RoleBindings assigned to the Tenant. Capsule will ensure that all namespaces in the Tenant always contain the RoleBinding for the given ClusterRole. Optional.	false
containerRegistries	object	Specifies the trusted Image Registries assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed trusted registries. Optional.	false
imagePullPolicies	[]enum	Specify the allowed values for the imagePullPolicies option in Pod resources. Capsule assures that all Pod resources created in the Tenant can use only one of the allowed policy. Optional. Enum: Always, Never, IfNotPresent	false
ingressOptions	object	Specifies options for the Ingress resources, such as allowed hostnames and IngressClass. Optional.	false
limitRanges	object	Specifies the resource min/max usage restrictions to the Tenant. The assigned values are inherited by any namespace created in the Tenant. Optional.	false
namespaceOptions	object	Specifies options for the Namespaces, such as additional metadata or maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional.	false
networkPolicies	object	Specifies the NetworkPolicies assigned to the Tenant. The assigned NetworkPolicies are inherited by any namespace created in the Tenant. Optional.	false
nodeSelector	map[string]string	Specifies the label to control the placement of pods on a given pool of worker nodes. All namespaces created within the Tenant will have the node selector annotation. This annotation tells the Kubernetes scheduler to place pods on the nodes having the selector label. Optional.	false
priorityClasses	object	Specifies the allowed priorityClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses. Optional.	false
resourceQuotas	object	Specifies a list of ResourceQuota resources assigned to the Tenant. The assigned values are inherited by any namespace created in the Tenant. The Capsule operator aggregates ResourceQuota at Tenant level, so that the hard quota is never crossed for the given Tenant. This permits the Tenant owner to consume resources in the Tenant regardless of the namespace. Optional.	false
serviceOptions	object	Specifies options for the Service, such as additional metadata or block of certain type of Services. Optional.	false
storageClasses	object	Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. Optional.	false

Tenant.spec.owners[index]

Name	Type	Description	Required
kind	enum	Kind of tenant owner. Possible values are “User”, “Group”, and “ServiceAccount” Enum: User, Group, ServiceAccount	true
name	string	Name of tenant owner.	true
proxySettings	[]object	Proxy settings for tenant owner.	false

Tenant.spec.owners[index].proxySettings[index]

Name	Type	Description	Required
kind	enum	Enum: Nodes, StorageClasses, IngressClasses, PriorityClasses	true
operations	[]enum	Enum: List, Update, Delete	true

Tenant.spec.additionalRoleBindings[index]

Name	Type	Description	Required
clusterRoleName	string		true
subjects	[]object		true
annotations	map[string]string	Additional Annotations for the synchronized rolebindings	false
labels	map[string]string	Additional Labels for the synchronized rolebindings	false

Tenant.spec.additionalRoleBindings[index].subjects[index]

Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names.

Name	Type	Description	Required
kind	string	Kind of object being referenced. Values defined by this API group are “User”, “Group”, and “ServiceAccount”. If the Authorizer does not recognized the kind value, the Authorizer should report an error.	true
name	string	Name of the object being referenced.	true
apiGroup	string	APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to “rbac.authorization.k8s.io” for User and Group subjects.	false
namespace	string	Namespace of the referenced object. If the object kind is non-namespace, such as “User” or “Group”, and this value is not empty the Authorizer should report an error.	false

Tenant.spec.containerRegistries

Specifies the trusted Image Registries assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed trusted registries. Optional.

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false

Tenant.spec.ingressOptions

Specifies options for the Ingress resources, such as allowed hostnames and IngressClass. Optional.

Name	Type	Description	Required
allowedClasses	object	Specifies the allowed IngressClasses assigned to the Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses. Optional.	false
allowedHostnames	object	Specifies the allowed hostnames in Ingresses for the given Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed hostnames. Optional.	false
hostnameCollisionScope	enum	Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. Optional. Enum: Cluster, Tenant, Namespace, Disabled Default: Disabled	false

Tenant.spec.ingressOptions.allowedClasses

Specifies the allowed IngressClasses assigned to the Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses. Optional.

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false

Tenant.spec.ingressOptions.allowedHostnames

Specifies the allowed hostnames in Ingresses for the given Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed hostnames. Optional.

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false

Tenant.spec.limitRanges

Specifies the resource min/max usage restrictions to the Tenant. The assigned values are inherited by any namespace created in the Tenant. Optional.

Name	Type	Description	Required
items	[]object		false

Tenant.spec.limitRanges.items[index]

LimitRangeSpec defines a min/max usage limit for resources that match on kind.

Name	Type	Description	Required
limits	[]object	Limits is the list of LimitRangeItem objects that are enforced.	true

Tenant.spec.limitRanges.items[index].limits[index]

LimitRangeItem defines a min/max usage limit for any resource that matches on kind.

Name	Type	Description	Required
type	string	Type of resource that this limit applies to.	true
default	map[string]int or string	Default resource requirement limit value by resource name if resource limit is omitted.	false
defaultRequest	map[string]int or string	DefaultRequest is the default resource requirement request value by resource name if resource request is omitted.	false
max	map[string]int or string	Max usage constraints on this kind by resource name.	false
maxLimitRequestRatio	map[string]int or string	MaxLimitRequestRatio if specified, the named resource must have a request and limit that are both non-zero where limit divided by request is less than or equal to the enumerated value; this represents the max burst for the named resource.	false
min	map[string]int or string	Min usage constraints on this kind by resource name.	false

Tenant.spec.namespaceOptions

Name	Type	Description	Required
additionalMetadata	object	Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant. Optional.	false
quota	integer	Specifies the maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional. Format: int32 Minimum: 1	false

Tenant.spec.namespaceOptions.additionalMetadata

Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant. Optional.

Name	Type	Description	Required
annotations	map[string]string		false
labels	map[string]string		false

Tenant.spec.networkPolicies

Specifies the NetworkPolicies assigned to the Tenant. The assigned NetworkPolicies are inherited by any namespace created in the Tenant. Optional.

Name	Type	Description	Required
items	[]object		false

Tenant.spec.networkPolicies.items[index]

NetworkPolicySpec provides the specification of a NetworkPolicy

Name	Type	Description	Required
egress	[]object	egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8	false
ingress	[]object	ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod’s local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)	false
podSelector	object	podSelector selects the pods to which this NetworkPolicy object applies. The array of rules is applied to any pods selected by this field. An empty selector matches all pods in the policy’s namespace. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is optional. If it is not specified, it defaults to an empty selector.	false
policyTypes	[]string	policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are [“Ingress”], [“Egress”], or [“Ingress”, “Egress”]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ “Egress” ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include “Egress” (since such a policy would not include an egress section and would otherwise default to just [ “Ingress” ]). This field is beta-level in 1.8	false

Tenant.spec.networkPolicies.items[index].egress[index]

Name	Type	Description	Required
ports	[]object	ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.	false
to	[]object	to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.	false

Tenant.spec.networkPolicies.items[index].egress[index].ports[index]

NetworkPolicyPort describes a port to allow traffic on

Name	Type	Description	Required
endPort	integer	endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. Format: int32	false
port	int or string	port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.	false
protocol	string	protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.	false

Tenant.spec.networkPolicies.items[index].egress[index].to[index]

NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed

Name	Type	Description	Required
ipBlock	object	ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.	false
namespaceSelector	object	namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.	false
podSelector	object	podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy’s own namespace.	false

Tenant.spec.networkPolicies.items[index].egress[index].to[index].ipBlock

ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.

Name	Type	Description	Required
cidr	string	cidr is a string representing the IPBlock Valid examples are “192.168.1.0/24” or “2001:db8::/64”	true
except	[]string	except is a slice of CIDRs that should not be included within an IPBlock Valid examples are “192.168.1.0/24” or “2001:db8::/64” Except values will be rejected if they are outside the cidr range	false

Tenant.spec.networkPolicies.items[index].egress[index].to[index].namespaceSelector

namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.networkPolicies.items[index].egress[index].to[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.networkPolicies.items[index].egress[index].to[index].podSelector

podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.networkPolicies.items[index].egress[index].to[index].podSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.networkPolicies.items[index].ingress[index]

NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec’s podSelector. The traffic must match both ports and from.

Name	Type	Description	Required
from	[]object	from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.	false
ports	[]object	ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.	false

Tenant.spec.networkPolicies.items[index].ingress[index].from[index]

NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed

Name	Type	Description	Required
ipBlock	object	ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.	false
namespaceSelector	object	namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.	false
podSelector	object	podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy’s own namespace.	false

Tenant.spec.networkPolicies.items[index].ingress[index].from[index].ipBlock

ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.

Name	Type	Description	Required
cidr	string	cidr is a string representing the IPBlock Valid examples are “192.168.1.0/24” or “2001:db8::/64”	true
except	[]string	except is a slice of CIDRs that should not be included within an IPBlock Valid examples are “192.168.1.0/24” or “2001:db8::/64” Except values will be rejected if they are outside the cidr range	false

Tenant.spec.networkPolicies.items[index].ingress[index].from[index].namespaceSelector

namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.networkPolicies.items[index].ingress[index].from[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.networkPolicies.items[index].ingress[index].from[index].podSelector

podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.networkPolicies.items[index].ingress[index].from[index].podSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.networkPolicies.items[index].ingress[index].ports[index]

NetworkPolicyPort describes a port to allow traffic on

Name	Type	Description	Required
endPort	integer	endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. Format: int32	false
port	int or string	port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.	false
protocol	string	protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.	false

Tenant.spec.networkPolicies.items[index].podSelector

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.	false

Tenant.spec.networkPolicies.items[index].podSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.priorityClasses

Specifies the allowed priorityClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses. Optional.

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false

Tenant.spec.resourceQuotas

Name	Type	Description	Required
items	[]object		false
scope	enum	Define if the Resource Budget should compute resource across all Namespaces in the Tenant or individually per cluster. Default is Tenant Enum: Tenant, Namespace Default: Tenant	false

Tenant.spec.resourceQuotas.items[index]

ResourceQuotaSpec defines the desired hard limits to enforce for Quota.

Name	Type	Description	Required
hard	map[string]int or string	hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/	false
scopeSelector	object	scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.	false
scopes	[]string	A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.	false

Tenant.spec.resourceQuotas.items[index].scopeSelector

Name	Type	Description	Required
matchExpressions	[]object	A list of scope selector requirements by scope of the resources.	false

Tenant.spec.resourceQuotas.items[index].scopeSelector.matchExpressions[index]

A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.

Name	Type	Description	Required
operator	string	Represents a scope’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.	true
scopeName	string	The name of the scope that the selector applies to.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

Tenant.spec.serviceOptions

Specifies options for the Service, such as additional metadata or block of certain type of Services. Optional.

Name	Type	Description	Required
additionalMetadata	object	Specifies additional labels and annotations the Capsule operator places on any Service resource in the Tenant. Optional.	false
allowedServices	object	Block or deny certain type of Services. Optional.	false
externalIPs	object	Specifies the external IPs that can be used in Services with type ClusterIP. An empty list means no IPs are allowed. Optional.	false
forbiddenAnnotations	object	Define the annotations that a Tenant Owner cannot set for their Service resources.	false
forbiddenLabels	object	Define the labels that a Tenant Owner cannot set for their Service resources.	false

Tenant.spec.serviceOptions.additionalMetadata

Specifies additional labels and annotations the Capsule operator places on any Service resource in the Tenant. Optional.

Name	Type	Description	Required
annotations	map[string]string		false
labels	map[string]string		false

Tenant.spec.serviceOptions.allowedServices

Block or deny certain type of Services. Optional.

Name	Type	Description	Required
externalName	boolean	Specifies if ExternalName service type resources are allowed for the Tenant. Default is true. Optional. Default: true	false
loadBalancer	boolean	Specifies if LoadBalancer service type resources are allowed for the Tenant. Default is true. Optional. Default: true	false
nodePort	boolean	Specifies if NodePort service type resources are allowed for the Tenant. Default is true. Optional. Default: true	false

Tenant.spec.serviceOptions.externalIPs

Specifies the external IPs that can be used in Services with type ClusterIP. An empty list means no IPs are allowed. Optional.

Name	Type	Description	Required
allowed	[]string		true

Tenant.spec.serviceOptions.forbiddenAnnotations

Define the annotations that a Tenant Owner cannot set for their Service resources.

Name	Type	Description	Required
denied	[]string		false
deniedRegex	string		false

Tenant.spec.serviceOptions.forbiddenLabels

Define the labels that a Tenant Owner cannot set for their Service resources.

Name	Type	Description	Required
denied	[]string		false
deniedRegex	string		false

Tenant.spec.storageClasses

Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. Optional.

Name	Type	Description	Required
allowed	[]string	Match exact elements which are allowed as class names within this tenant	false
allowedRegex	string	Deprecated: will be removed in a future release Match elements by regex.	false

Tenant.status

Returns the observed state of the Tenant.

Name	Type	Description	Required
size	integer	How many namespaces are assigned to the Tenant.	true
state	enum	The operational state of the Tenant. Possible values are “Active”, “Cordoned”. Enum: Cordoned, Active Default: Active	true
namespaces	[]string	List of namespaces assigned to the Tenant.	false

Last modified October 12, 2026: feat(docs): publish markdown renditions content negotiation for agents (#159) (e13616c)