--- title: "Tigera Operator API reference" description: "Tigera Operator API reference for Calico Cloud, covering all operator.tigera.io custom resources for installing and managing your connected cluster." product: "Calico Cloud" version: "v24.0.0" section: "Reference" canonical_url: "https://docs.tigera.io/calico-cloud/next/reference/installation/api" --- # Tigera Operator API reference The Tigera Operator installs and manages Calico Cloud by watching the custom resources in the `operator.tigera.io/v1` API group. This page documents the resources in that group that you can configure in Calico Cloud. The `Installation` resource sets cluster-wide options at install time, and other resources, such as `APIServer` and `IntrusionDetection`, configure individual components. You can change most settings on a running cluster by using `kubectl`, and the operator reconciles the cluster to match. This API group is separate from the `projectcalico.org/v3` resources that you use for day-to-day networking and policy. For those, see [Resource definitions](https://docs.tigera.io/calico-cloud/next/reference/resources/overview.md). Packages - [operator.tigera.io/v1](#operatortigeraiov1) ## operator.tigera.io/v1 API Schema definitions for configuring the installation of Calico and Calico Enterprise Package v1 contains API Schema definitions for the operator v1 API group Resource Types - [APIServer](#apiserver) - [ApplicationLayer](#applicationlayer) - [EgressGateway](#egressgateway) - [GatewayAPI](#gatewayapi) - [Goldmane](#goldmane) - [ImageSet](#imageset) - [Installation](#installation) - [IntrusionDetection](#intrusiondetection) - [Istio](#istio) - [LogCollector](#logcollector) - [ManagementClusterConnection](#managementclusterconnection) - [Monitor](#monitor) - [NonClusterHost](#nonclusterhost) - [PacketCaptureAPI](#packetcaptureapi) - [PolicyRecommendation](#policyrecommendation) - [TigeraStatus](#tigerastatus) - [Whisker](#whisker) ### APIServer APIServer installs the Tigera API server and related resources. At most one instance of this resource is supported. It must be named "default" or "tigera-secure". | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `APIServer` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[APIServerSpec](#apiserverspec)* | Specification of the desired state for the Tigera API server. | | `status` *[APIServerStatus](#apiserverstatus)* | Most recently observed status for the Tigera API server. | ### APIServerDeployment APIServerDeployment is the configuration for the API server Deployment. *Appears in:* - [APIServerSpec](#apiserverspec) | Field | Description | | ------------------------------------------------------------ | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[APIServerDeploymentSpec](#apiserverdeploymentspec)* | (Optional) Spec is the specification of the API server Deployment. | ### APIServerDeploymentContainer APIServerDeploymentContainer is an API server Deployment container. *Appears in:* - [APIServerDeploymentPodSpec](#apiserverdeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the API server Deployment container by name. Supported values are: calico-apiserver, tigera-queryserver, calico-l7-admission-controller | | `ports` *[APIServerDeploymentContainerPort](#apiserverdeploymentcontainerport) array* | (Optional) Ports allows customization of container's ports. If specified, this overrides the named APIServer Deployment container's ports. If omitted, the API server Deployment will use its default value for this container's port. | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named API server Deployment container's resources. If omitted, the API server Deployment will use its default value for this container's resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### APIServerDeploymentContainerPort *Appears in:* - [APIServerDeploymentContainer](#apiserverdeploymentcontainer) | Field | Description | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | `name` *string* | Name is an enum which identifies the API server Deployment Container port by name. Supported values are: apiserver, queryserver, l7admctrl | | `containerPort` *integer* | Number of port to expose on the pod's IP address. This must be a valid port number, 0 < x < 65536. | ### APIServerDeploymentInitContainer APIServerDeploymentInitContainer is an API server Deployment init container. *Appears in:* - [APIServerDeploymentPodSpec](#apiserverdeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the API server Deployment init container by name. Supported values are: calico-apiserver-certs-key-cert-provisioner | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named API server Deployment init container's resources. If omitted, the API server Deployment will use its default value for this init container's resources. | ### APIServerDeploymentPodSpec APIServerDeploymentDeploymentPodSpec is the API server Deployment's PodSpec. *Appears in:* - [APIServerDeploymentPodTemplateSpec](#apiserverdeploymentpodtemplatespec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `initContainers` *[APIServerDeploymentInitContainer](#apiserverdeploymentinitcontainer) array* | (Optional) InitContainers is a list of API server init containers. If specified, this overrides the specified API server Deployment init containers. If omitted, the API server Deployment will use its default values for its init containers. | | `containers` *[APIServerDeploymentContainer](#apiserverdeploymentcontainer) array* | (Optional) Containers is a list of API server containers. If specified, this overrides the specified API server Deployment containers. If omitted, the API server Deployment will use its default values for its containers. | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity is a group of affinity scheduling rules for the API server pods. If specified, this overrides any affinity that may be set on the API server Deployment. If omitted, the API server Deployment will use its default value for affinity. WARNING: Please note that this field will override the default API server Deployment affinity. | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector is the API server pod's scheduling constraints. If specified, each of the key/value pairs are added to the API server Deployment nodeSelector provided the key does not already exist in the object's nodeSelector. If used in conjunction with ControlPlaneNodeSelector, that nodeSelector is set on the API server Deployment and each of this field's key/value pairs are added to the API server Deployment nodeSelector provided the key does not already exist in the object's nodeSelector. If omitted, the API server Deployment will use its default value for nodeSelector. WARNING: Please note that this field will modify the default API server Deployment nodeSelector. | | `topologySpreadConstraints` *[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#topologyspreadconstraint-v1-core) array* | (Optional) TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations is the API server pod's tolerations. If specified, this overrides any tolerations that may be set on the API server Deployment. If omitted, the API server Deployment will use its default value for tolerations. WARNING: Please note that this field will override the default API server Deployment tolerations. | | `priorityClassName` *string* | (Optional) PriorityClassName allows to specify a PriorityClass resource to be used. | ### APIServerDeploymentPodTemplateSpec APIServerDeploymentPodTemplateSpec is the API server Deployment's PodTemplateSpec *Appears in:* - [APIServerDeploymentSpec](#apiserverdeploymentspec) | Field | Description | | ------------------------------------------------------------------ | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[APIServerDeploymentPodSpec](#apiserverdeploymentpodspec)* | (Optional) Spec is the API server Deployment's PodSpec. | ### APIServerDeploymentSpec APIServerDeploymentSpec defines configuration for the API server Deployment. *Appears in:* - [APIServerDeployment](#apiserverdeployment) | Field | Description | | -------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `minReadySeconds` *integer* | (Optional) MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the API server Deployment. If omitted, the API server Deployment will use its default value for minReadySeconds. | | `template` *[APIServerDeploymentPodTemplateSpec](#apiserverdeploymentpodtemplatespec)* | (Optional) Template describes the API server Deployment pod that will be created. | ### APIServerLogging *Appears in:* - [APIServerPodLogging](#apiserverpodlogging) | Field | Description | | ------------------------------------------- | ----------------------------------------------------------------- | | `logSeverity` *[LogSeverity](#logseverity)* | (Optional) LogSeverity defines log level for APIServer container. | ### APIServerPodLogging *Appears in:* - [APIServerSpec](#apiserverspec) | Field | Description | | --------------------------------------------------------- | ----------- | | `apiServer` *[APIServerLogging](#apiserverlogging)* | (Optional) | | `queryServer` *[QueryServerLogging](#queryserverlogging)* | (Optional) | ### APIServerSpec APIServerSpec defines the desired state of Tigera API server. *Appears in:* - [APIServer](#apiserver) | Field | Description | | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `logging` *[APIServerPodLogging](#apiserverpodlogging)* | (Optional) | | `apiServerDeployment` *[APIServerDeployment](#apiserverdeployment)* | APIServerDeployment configures the calico-apiserver Deployment. If used in conjunction with ControlPlaneNodeSelector or ControlPlaneTolerations, then these overrides take precedence. | | `calicoWebhooksDeployment` *[CalicoWebhooksDeployment](#calicowebhooksdeployment)* | (Optional) CalicoWebhooksDeployment configures the calico-webhooks Deployment. | ### APIServerStatus APIServerStatus defines the observed state of Tigera API server. *Appears in:* - [APIServer](#apiserver) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `state` *string* | State provides user-readable status. | | `conditions` *[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#condition-v1-meta) array* | (Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types. | ### AWSEgressGateway AWSEgressGateway defines the configurations for deploying EgressGateway in AWS *Appears in:* - [EgressGatewaySpec](#egressgatewayspec) | Field | Description | | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `nativeIP` *[NativeIP](#nativeip)* | (Optional) NativeIP defines if EgressGateway is to use an AWS backed IPPool. Default: Disabled | | `elasticIPs` *string array* | (Optional) ElasticIPs defines the set of elastic IPs that can be used for Egress Gateway pods. NativeIP must be Enabled if elastic IPs are set. | ### AdditionalLogSourceSpec *Appears in:* - [LogCollectorSpec](#logcollectorspec) | Field | Description | | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | `eksCloudwatchLog` *[EksCloudwatchLogsSpec](#ekscloudwatchlogsspec)* | (Optional) If specified with EKS Provider in Installation, enables fetching EKS audit logs. | ### AdditionalLogStoreSpec *Appears in:* - [LogCollectorSpec](#logcollectorspec) | Field | Description | | ---------------------------------------------- | --------------------------------------------------------------------------------------------- | | `s3` *[S3StoreSpec](#s3storespec)* | (Optional) If specified, enables exporting of flow, audit, and DNS logs to Amazon S3 storage. | | `syslog` *[SyslogStoreSpec](#syslogstorespec)* | (Optional) If specified, enables exporting of flow, audit, and DNS logs to syslog. | | `splunk` *[SplunkStoreSpec](#splunkstorespec)* | (Optional) If specified, enables exporting of flow, audit, and DNS logs to splunk. | ### Alertmanager *Appears in:* - [MonitorSpec](#monitorspec) | Field | Description | | ---------------------------------------------- | --------------------------------------------------------- | | `spec` *[AlertmanagerSpec](#alertmanagerspec)* | (Optional) Spec is the specification of the Alertmanager. | ### AlertmanagerSpec *Appears in:* - [Alertmanager](#alertmanager) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | `replicas` *integer* | (Optional) Replicas defines the number of Alertmanager replicas. When set to 0, Alertmanager is not rendered. Default: 0 | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | Define resources requests and limits for single Pods. | ### AnomalyDetectionSpec *Appears in:* - [IntrusionDetectionSpec](#intrusiondetectionspec) | Field | Description | | --------------------------- | -------------------------------------------------------------------------------- | | `storageClassName` *string* | (Optional) StorageClassName is now deprecated, and configuring it has no effect. | ### ApplicationLayer ApplicationLayer is the Schema for the applicationlayers API | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `ApplicationLayer` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[ApplicationLayerSpec](#applicationlayerspec)* | | | `status` *[ApplicationLayerStatus](#applicationlayerstatus)* | | ### ApplicationLayerPolicyStatusType *Underlying type:* *string* *Validation:* - Enum: \[Enabled Disabled] *Appears in:* - [ApplicationLayerSpec](#applicationlayerspec) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### ApplicationLayerSpec ApplicationLayerSpec defines the desired state of ApplicationLayer *Appears in:* - [ApplicationLayer](#applicationlayer) | Field | Description | | ------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `webApplicationFirewall` *[WAFStatusType](#wafstatustype)* | WebApplicationFirewall controls whether or not ModSecurity enforcement is enabled for the cluster. When enabled, Services may opt-in to having ingress traffic examed by ModSecurity. | | `logCollection` *[LogCollectionSpec](#logcollectionspec)* | Specification for application layer (L7) log collection. | | `applicationLayerPolicy` *[ApplicationLayerPolicyStatusType](#applicationlayerpolicystatustype)* | Application Layer Policy controls whether or not ALP enforcement is enabled for the cluster. When enabled, NetworkPolicies with HTTP Match rules may be defined to opt-in workloads for traffic enforcement on the application layer. | | `envoy` *[EnvoySettings](#envoysettings)* | User-configurable settings for the Envoy proxy. | | `l7LogCollectorDaemonSet` *[L7LogCollectorDaemonSet](#l7logcollectordaemonset)* | (Optional) L7LogCollectorDaemonSet configures the L7LogCollector DaemonSet. | | `sidecarInjection` *[SidecarStatusType](#sidecarstatustype)* | (Optional) SidecarInjection controls whether or not sidecar injection is enabled for the cluster. When enabled, pods with the label "applicationlayer.projectcalico.org/sidecar"="true" will have their L7 functionality such as WAF and ALP implemented using an injected sidecar instead of a per-host proxy. The per-host proxy will continue to be used for pods without this label. | ### ApplicationLayerStatus ApplicationLayerStatus defines the observed state of ApplicationLayer *Appears in:* - [ApplicationLayer](#applicationlayer) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `state` *string* | State provides user-readable status. | | `sidecarWebhook` *[SidecarWebhookStateType](#sidecarwebhookstatetype)* | SidecarWebhook provides the state of sidecar injection mutatinwebhookconfiguration | | `conditions` *[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#condition-v1-meta) array* | (Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types. | ### AssignmentMode *Underlying type:* *string* *Appears in:* - [IPPool](#ippool) | Value | Description | | ----------- | ----------- | | `Automatic` | | | `Manual` | | ### Azure *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `policyMode` *[PolicyMode](#policymode)* | (Optional) PolicyMode determines whether the "control-plane" label is applied to namespaces. It offers two options: Default and Manual. The Default option adds the "control-plane" label to the required namespaces. The Manual option does not apply the "control-plane" label to any namespace. Default: Default | ### BGPOption *Underlying type:* *string* BGPOption describes the mode of BGP to use. One of: Enabled, Disabled *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### BPFNetworkBootstrapType *Underlying type:* *string* BPFNetworkBootstrapType defines how the initial networking configuration is executed. *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### CAType *Underlying type:* *string* CAType specifies which verification method the tunnel client should use to verify the tunnel server's identity. One of: Tigera, Public *Appears in:* - [ManagementClusterTLS](#managementclustertls) | Value | Description | | -------- | ----------- | | `Tigera` | | | `Public` | | ### CNIInstallMode *Underlying type:* *string* CNIInstallMode controls which CNI plugin binaries the operator installs onto the host. *Appears in:* - [CNISpec](#cnispec) | Value | Description | | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `All` | CNIInstallModeAll installs Calico's own CNI binaries plus the upstream plugin set (host-local, portmap, loopback, tuning, flannel) via a dedicated init container. | | `CalicoOnly` | CNIInstallModeCalicoOnly installs only Calico's own CNI binaries; the host is expected to provide any required upstream plugins. | ### CNILogging *Appears in:* - [Logging](#logging) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | | `logSeverity` *[LogLevel](#loglevel)* | (Optional) Default: Info | | `logFileMaxSize` *[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#quantity-resource-api)* | (Optional) Default: 100Mi | | `logFileMaxAgeDays` *integer* | (Optional) Default: 30 (days) | | `logFileMaxCount` *integer* | (Optional) Default: 10 | ### CNIPluginType *Underlying type:* *string* CNIPluginType describes the type of CNI plugin used. One of: Calico, GKE, AmazonVPC, AzureVNET *Appears in:* - [CNISpec](#cnispec) | Value | Description | | ----------- | ----------- | | `Calico` | | | `GKE` | | | `AmazonVPC` | | | `AzureVNET` | | ### CNISpec CNISpec contains configuration for the CNI plugin. *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `type` *[CNIPluginType](#cniplugintype)* | Specifies the CNI plugin that will be used in the Calico or Calico Enterprise installation. \* For KubernetesProvider GKE, this field defaults to GKE. \* For KubernetesProvider AKS, this field defaults to AzureVNET. \* For KubernetesProvider EKS, this field defaults to AmazonVPC. \* If aws-node daemonset exists in kube-system when the Installation resource is created, this field defaults to AmazonVPC. \* For all other cases this field defaults to Calico. For the value Calico, the CNI plugin binaries and CNI config will be installed as part of deployment, for all other values the CNI plugin binaries and CNI config is a dependency that is expected to be installed separately. Default: Calico | | `ipam` *[IPAMSpec](#ipamspec)* | (Optional) IPAM specifies the pod IP address management that will be used in the Calico or Calico Enterprise installation. | | `binDir` *string* | (Optional) BinDir is the path to the CNI binaries directory. If you have changed the installation directory for CNI binaries in the container runtime configuration, please ensure that this field points to the same directory as specified in the container runtime settings. Default directory depends on the KubernetesProvider. \* For KubernetesProvider GKE, this field defaults to "/home/kubernetes/bin". \* For KubernetesProvider OpenShift, this field defaults to "/var/lib/cni/bin". \* Otherwise, this field defaults to "/opt/cni/bin". | | `confDir` *string* | (Optional) ConfDir is the path to the CNI config directory. If you have changed the installation directory for CNI configuration in the container runtime configuration, please ensure that this field points to the same directory as specified in the container runtime settings. Default directory depends on the KubernetesProvider. \* For KubernetesProvider GKE, this field defaults to "/etc/cni/net.d". \* For KubernetesProvider OpenShift, this field defaults to "/var/run/multus/cni/net.d". \* Otherwise, this field defaults to "/etc/cni/net.d". | | `installMode` *[CNIInstallMode](#cniinstallmode)* | (Optional) InstallMode controls which CNI plugin binaries the operator installs onto each node when CNI.Type is Calico. \* All (default): the operator runs a cni-plugins init container that stages upstream CNI plugin binaries (host-local, portmap, loopback, tuning, flannel) into a shared volume, and the install-cni init container copies them onto the host alongside Calico's own binaries. \* CalicoOnly: skip the cni-plugins init container. Only Calico's own binaries are installed. Use this when the host already provides the upstream plugins (e.g. kind, certain managed node images). Default: All | ### CRDManagement *Underlying type:* *string* *Validation:* - Enum: \[Reconcile PreferExisting] *Appears in:* - [GatewayAPISpec](#gatewayapispec) | Value | Description | | ---------------- | ----------- | | `Reconcile` | | | `PreferExisting` | | ### CSINodeDriverDaemonSet CSINodeDriverDaemonSet is the configuration for the csi-node-driver DaemonSet. *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | ------------------------------------------------------------------ | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[CSINodeDriverDaemonSetSpec](#csinodedriverdaemonsetspec)* | (Optional) Spec is the specification of the csi-node-driver DaemonSet. | ### CSINodeDriverDaemonSetContainer CSINodeDriverDaemonSetContainer is a csi-node-driver DaemonSet container. *Appears in:* - [CSINodeDriverDaemonSetPodSpec](#csinodedriverdaemonsetpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the csi-node-driver DaemonSet container by name. Supported values are: calico-csi, csi-node-driver-registrar. | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named csi-node-driver DaemonSet container's resources. If omitted, the csi-node-driver DaemonSet will use its default value for this container's resources. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### CSINodeDriverDaemonSetPodSpec CSINodeDriverDaemonSetPodSpec is the csi-node-driver DaemonSet's PodSpec. *Appears in:* - [CSINodeDriverDaemonSetPodTemplateSpec](#csinodedriverdaemonsetpodtemplatespec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `containers` *[CSINodeDriverDaemonSetContainer](#csinodedriverdaemonsetcontainer) array* | (Optional) Containers is a list of csi-node-driver containers. If specified, this overrides the specified csi-node-driver DaemonSet containers. If omitted, the csi-node-driver DaemonSet will use its default values for its containers. | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity is a group of affinity scheduling rules for the csi-node-driver pods. If specified, this overrides any affinity that may be set on the csi-node-driver DaemonSet. If omitted, the csi-node-driver DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default csi-node-driver DaemonSet affinity. | | `nodeSelector` *object (keys:string, values:string)* | (Optional) NodeSelector is the csi-node-driver pod's scheduling constraints. If specified, each of the key/value pairs are added to the csi-node-driver DaemonSet nodeSelector provided the key does not already exist in the object's nodeSelector. If omitted, the csi-node-driver DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default csi-node-driver DaemonSet nodeSelector. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations is the csi-node-driver pod's tolerations. If specified, this overrides any tolerations that may be set on the csi-node-driver DaemonSet. If omitted, the csi-node-driver DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default csi-node-driver DaemonSet tolerations. | ### CSINodeDriverDaemonSetPodTemplateSpec CSINodeDriverDaemonSetPodTemplateSpec is the csi-node-driver DaemonSet's PodTemplateSpec *Appears in:* - [CSINodeDriverDaemonSetSpec](#csinodedriverdaemonsetspec) | Field | Description | | ------------------------------------------------------------------------ | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[CSINodeDriverDaemonSetPodSpec](#csinodedriverdaemonsetpodspec)* | (Optional) Spec is the csi-node-driver DaemonSet's PodSpec. | ### CSINodeDriverDaemonSetSpec CSINodeDriverDaemonSetSpec defines configuration for the csi-node-driver DaemonSet. *Appears in:* - [CSINodeDriverDaemonSet](#csinodedriverdaemonset) | Field | Description | | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `minReadySeconds` *integer* | (Optional) MinReadySeconds is the minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the csi-node-driver DaemonSet. If omitted, the csi-node-driver DaemonSet will use its default value for minReadySeconds. | | `template` *[CSINodeDriverDaemonSetPodTemplateSpec](#csinodedriverdaemonsetpodtemplatespec)* | (Optional) Template describes the csi-node-driver DaemonSet pod that will be created. | ### CalicoKubeControllersDeployment CalicoKubeControllersDeployment is the configuration for the calico-kube-controllers Deployment. *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[CalicoKubeControllersDeploymentSpec](#calicokubecontrollersdeploymentspec)* | (Optional) Spec is the specification of the calico-kube-controllers Deployment. | ### CalicoKubeControllersDeploymentContainer CalicoKubeControllersDeploymentContainer is a calico-kube-controllers Deployment container. *Appears in:* - [CalicoKubeControllersDeploymentPodSpec](#calicokubecontrollersdeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `name` *string* | Name is an enum which identifies the calico-kube-controllers Deployment container by name. Supported values are: calico-kube-controllers, es-calico-kube-controllers | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-kube-controllers Deployment container's resources. If omitted, the calico-kube-controllers Deployment will use its default value for this container's resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### CalicoKubeControllersDeploymentPodSpec CalicoKubeControllersDeploymentPodSpec is the calico-kube-controller Deployment's PodSpec. *Appears in:* - [CalicoKubeControllersDeploymentPodTemplateSpec](#calicokubecontrollersdeploymentpodtemplatespec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `containers` *[CalicoKubeControllersDeploymentContainer](#calicokubecontrollersdeploymentcontainer) array* | (Optional) Containers is a list of calico-kube-controllers containers. If specified, this overrides the specified calico-kube-controllers Deployment containers. If omitted, the calico-kube-controllers Deployment will use its default values for its containers. | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity is a group of affinity scheduling rules for the calico-kube-controllers pods. If specified, this overrides any affinity that may be set on the calico-kube-controllers Deployment. If omitted, the calico-kube-controllers Deployment will use its default value for affinity. WARNING: Please note that this field will override the default calico-kube-controllers Deployment affinity. | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector is the calico-kube-controllers pod's scheduling constraints. If specified, each of the key/value pairs are added to the calico-kube-controllers Deployment nodeSelector provided the key does not already exist in the object's nodeSelector. If used in conjunction with ControlPlaneNodeSelector, that nodeSelector is set on the calico-kube-controllers Deployment and each of this field's key/value pairs are added to the calico-kube-controllers Deployment nodeSelector provided the key does not already exist in the object's nodeSelector. If omitted, the calico-kube-controllers Deployment will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-kube-controllers Deployment nodeSelector. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations is the calico-kube-controllers pod's tolerations. If specified, this overrides any tolerations that may be set on the calico-kube-controllers Deployment. If omitted, the calico-kube-controllers Deployment will use its default value for tolerations. WARNING: Please note that this field will override the default calico-kube-controllers Deployment tolerations. | ### CalicoKubeControllersDeploymentPodTemplateSpec CalicoKubeControllersDeploymentPodTemplateSpec is the calico-kube-controllers Deployment's PodTemplateSpec *Appears in:* - [CalicoKubeControllersDeploymentSpec](#calicokubecontrollersdeploymentspec) | Field | Description | | ------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[CalicoKubeControllersDeploymentPodSpec](#calicokubecontrollersdeploymentpodspec)* | (Optional) Spec is the calico-kube-controllers Deployment's PodSpec. | ### CalicoKubeControllersDeploymentSpec CalicoKubeControllersDeploymentSpec defines configuration for the calico-kube-controllers Deployment. *Appears in:* - [CalicoKubeControllersDeployment](#calicokubecontrollersdeployment) | Field | Description | | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `minReadySeconds` *integer* | (Optional) MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-kube-controllers Deployment. If omitted, the calico-kube-controllers Deployment will use its default value for minReadySeconds. | | `template` *[CalicoKubeControllersDeploymentPodTemplateSpec](#calicokubecontrollersdeploymentpodtemplatespec)* | (Optional) Template describes the calico-kube-controllers Deployment pod that will be created. | ### CalicoNetworkSpec CalicoNetworkSpec specifies configuration options for Calico provided pod networking. *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | ------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `linuxDataplane` *[LinuxDataplaneOption](#linuxdataplaneoption)* | (Optional) LinuxDataplane is used to select the dataplane used for Linux nodes. In particular, it causes the operator to add required mounts and environment variables for the particular dataplane. If not specified, iptables mode is used. Default: Iptables | | `windowsDataplane` *[WindowsDataplaneOption](#windowsdataplaneoption)* | (Optional) WindowsDataplane is used to select the dataplane used for Windows nodes. In particular, it causes the operator to add required mounts and environment variables for the particular dataplane. If not specified, it is disabled and the operator will not render the Calico Windows nodes daemonset. Default: Disabled | | `bpfNetworkBootstrap` *[BPFNetworkBootstrapType](#bpfnetworkbootstraptype)* | (Optional) BPFNetworkBootstrap manages the initial networking setup required to configure the BPF dataplane. When enabled, the operator tries to bootstraps access to the Kubernetes API Server by using the Kubernetes service and its associated endpoints. This field should be enabled only if linuxDataplane is set to "BPF". If another dataplane is selected, this field must be omitted or explicitly set to Disabled. When disabled and linuxDataplane is BPF, you must manually provide the Kubernetes API Server information via the "kubernetes-service-endpoint" ConfigMap. It is invalid to use both the ConfigMap and have this field set to true at the same time. Default: Disabled | | `kubeProxyManagement` *[KubeProxyManagementType](#kubeproxymanagementtype)* | (Optional) KubeProxyManagement controls whether the operator manages the kube-proxy DaemonSet. When enabled, the operator will manage the DaemonSet by patching it: it disables kube-proxy if the dataplane is BPF, or enables it otherwise. Default: Disabled | | `bgp` *[BGPOption](#bgpoption)* | (Optional) BGP configures whether or not to enable Calico's BGP capabilities. | | `clusterRoutingMode` *[ClusterRoutingMode](#clusterroutingmode)* | (Optional) ClusterRoutingMode controls how nodes get a route to a workload on another node, when that workload's IP comes from an IP Pool with vxlanMode: Never. When ClusterRoutingMode is BIRD, confd and BIRD program that route. When ClusterRoutingMode is Felix, it is expected that Felix will program that route. Felix always programs such routes for IP Pools with vxlanMode: Always or vxlanMode: CrossSubnet. \[Default: BIRD] | | `ipPools` *[IPPool](#ippool) array* | (Optional) IPPools contains a list of IP pools to manage. If nil, a single IPv4 IP pool will be created by the operator. If an empty list is provided, the operator will not create any IP pools and will instead wait for IP pools to be created out-of-band. IP pools in this list will be reconciled by the operator and should not be modified out-of-band. | | `mtu` *integer* | (Optional) MTU specifies the maximum transmission unit to use on the pod network. If not specified, Calico will perform MTU auto-detection based on the cluster network. | | `nodeAddressAutodetectionV4` *[NodeAddressAutodetection](#nodeaddressautodetection)* | (Optional) NodeAddressAutodetectionV4 specifies an approach to automatically detect node IPv4 addresses. If not specified, will use default auto-detection settings to acquire an IPv4 address for each node. | | `nodeAddressAutodetectionV6` *[NodeAddressAutodetection](#nodeaddressautodetection)* | (Optional) NodeAddressAutodetectionV6 specifies an approach to automatically detect node IPv6 addresses. If not specified, IPv6 addresses will not be auto-detected. | | `hostPorts` *[HostPortsType](#hostportstype)* | (Optional) HostPorts configures whether or not Calico will support Kubernetes HostPorts. Valid only when using the Calico CNI plugin. Default: Enabled | | `multiInterfaceMode` *[MultiInterfaceMode](#multiinterfacemode)* | (Optional) MultiInterfaceMode configures what will configure multiple interface per pod. Only valid for Calico Enterprise installations using the Calico CNI plugin. Default: None | | `containerIPForwarding` *[ContainerIPForwardingType](#containeripforwardingtype)* | (Optional) ContainerIPForwarding configures whether ip forwarding will be enabled for containers in the CNI configuration. Default: Disabled | | `linuxPodInterfaceType` *[LinuxPodInterfaceType](#linuxpodinterfacetype)* | (Optional) LinuxPodInterfaceType selects the virtual device type the Calico CNI plugin creates for each pod's interface on Linux nodes. When set to Netkit, the CNI plugin creates a netkit L2 pair on kernels that support it (Linux 6.7+) and falls back to a veth pair on older kernels. Netkit is recommended for the BPF dataplane, where it allows BPF programs to attach via BPF\_NETKIT\_PRIMARY for improved throughput and tail-latency under contention; for non-BPF dataplanes it is functionally equivalent to veth. Only valid when using the Calico CNI plugin. Default: Veth | | `sysctl` *[Sysctl](#sysctl) array* | (Optional) Sysctl configures sysctl parameters for tuning plugin | | `linuxPolicySetupTimeoutSeconds` *integer* | (Optional) LinuxPolicySetupTimeoutSeconds delays new pods from running containers until their policy has been programmed in the dataplane. The specified delay defines the maximum amount of time that the Calico CNI plugin will wait for policy to be programmed. Only applies to pods created on Linux nodes. \* A value of 0 disables pod startup delays. Default: 0 | ### CalicoNodeDaemonSet CalicoNodeDaemonSet is the configuration for the calico-node DaemonSet. *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | ------------------------------------------------------------ | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[CalicoNodeDaemonSetSpec](#caliconodedaemonsetspec)* | (Optional) Spec is the specification of the calico-node DaemonSet. | ### CalicoNodeDaemonSetContainer CalicoNodeDaemonSetContainer is a calico-node DaemonSet container. *Appears in:* - [CalicoNodeDaemonSetPodSpec](#caliconodedaemonsetpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the calico-node DaemonSet container by name. Supported values are: calico-node | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node DaemonSet container's resources. If omitted, the calico-node DaemonSet will use its default value for this container's resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### CalicoNodeDaemonSetInitContainer CalicoNodeDaemonSetInitContainer is a calico-node DaemonSet init container. *Appears in:* - [CalicoNodeDaemonSetPodSpec](#caliconodedaemonsetpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the calico-node DaemonSet init container by name. Supported values are: install-cni, cni-plugins, hostpath-init, flexvol-driver, ebpf-bootstrap, node-certs-key-cert-provisioner, calico-node-prometheus-server-tls-key-cert-provisioner, mount-bpffs (deprecated, replaced by ebpf-bootstrap) | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node DaemonSet init container's resources. If omitted, the calico-node DaemonSet will use its default value for this container's resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence. | ### CalicoNodeDaemonSetPodSpec CalicoNodeDaemonSetPodSpec is the calico-node DaemonSet's PodSpec. *Appears in:* - [CalicoNodeDaemonSetPodTemplateSpec](#caliconodedaemonsetpodtemplatespec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `initContainers` *[CalicoNodeDaemonSetInitContainer](#caliconodedaemonsetinitcontainer) array* | (Optional) InitContainers is a list of calico-node init containers. If specified, this overrides the specified calico-node DaemonSet init containers. If omitted, the calico-node DaemonSet will use its default values for its init containers. | | `containers` *[CalicoNodeDaemonSetContainer](#caliconodedaemonsetcontainer) array* | (Optional) Containers is a list of calico-node containers. If specified, this overrides the specified calico-node DaemonSet containers. If omitted, the calico-node DaemonSet will use its default values for its containers. | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity is a group of affinity scheduling rules for the calico-node pods. If specified, this overrides any affinity that may be set on the calico-node DaemonSet. If omitted, the calico-node DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default calico-node DaemonSet affinity. | | `nodeSelector` *object (keys:string, values:string)* | (Optional) NodeSelector is the calico-node pod's scheduling constraints. If specified, each of the key/value pairs are added to the calico-node DaemonSet nodeSelector provided the key does not already exist in the object's nodeSelector. If omitted, the calico-node DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-node DaemonSet nodeSelector. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations is the calico-node pod's tolerations. If specified, this overrides any tolerations that may be set on the calico-node DaemonSet. If omitted, the calico-node DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default calico-node DaemonSet tolerations. | | `dnsPolicy` *[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#dnspolicy-v1-core)* | (Optional) DNSPolicy is the DNS policy for the calico-node pods. | | `dnsConfig` *[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#poddnsconfig-v1-core)* | (Optional) DNSConfig allows customization of the DNS configuration for the calico-node pods. | ### CalicoNodeDaemonSetPodTemplateSpec CalicoNodeDaemonSetPodTemplateSpec is the calico-node DaemonSet's PodTemplateSpec *Appears in:* - [CalicoNodeDaemonSetSpec](#caliconodedaemonsetspec) | Field | Description | | ------------------------------------------------------------------ | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[CalicoNodeDaemonSetPodSpec](#caliconodedaemonsetpodspec)* | (Optional) Spec is the calico-node DaemonSet's PodSpec. | ### CalicoNodeDaemonSetSpec CalicoNodeDaemonSetSpec defines configuration for the calico-node DaemonSet. *Appears in:* - [CalicoNodeDaemonSet](#caliconodedaemonset) | Field | Description | | -------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `minReadySeconds` *integer* | (Optional) MinReadySeconds is the minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-node DaemonSet. If omitted, the calico-node DaemonSet will use its default value for minReadySeconds. | | `template` *[CalicoNodeDaemonSetPodTemplateSpec](#caliconodedaemonsetpodtemplatespec)* | (Optional) Template describes the calico-node DaemonSet pod that will be created. | ### CalicoNodeWindowsDaemonSet CalicoNodeWindowsDaemonSet is the configuration for the calico-node-windows DaemonSet. *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | -------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[CalicoNodeWindowsDaemonSetSpec](#caliconodewindowsdaemonsetspec)* | (Optional) Spec is the specification of the calico-node-windows DaemonSet. | ### CalicoNodeWindowsDaemonSetContainer CalicoNodeWindowsDaemonSetContainer is a calico-node-windows DaemonSet container. *Appears in:* - [CalicoNodeWindowsDaemonSetPodSpec](#caliconodewindowsdaemonsetpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the calico-node-windows DaemonSet container by name. Supported values are: node, felix, confd calico-node-windows is allowed because it was previously allowed. | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named DaemonSet container's resources. If omitted, the DaemonSet will use its default value for this container's resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### CalicoNodeWindowsDaemonSetInitContainer CalicoNodeWindowsDaemonSetInitContainer is a calico-node-windows DaemonSet init container. *Appears in:* - [CalicoNodeWindowsDaemonSetPodSpec](#caliconodewindowsdaemonsetpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the calico-node-windows DaemonSet init container by name. Supported values are: install-cni;hostpath-init, flexvol-driver, node-certs-key-cert-provisioner, calico-node-windows-prometheus-server-tls-key-cert-provisioner | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-node-windows DaemonSet init container's resources. If omitted, the calico-node-windows DaemonSet will use its default value for this container's resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence. | ### CalicoNodeWindowsDaemonSetPodSpec CalicoNodeWindowsDaemonSetPodSpec is the calico-node-windows DaemonSet's PodSpec. *Appears in:* - [CalicoNodeWindowsDaemonSetPodTemplateSpec](#caliconodewindowsdaemonsetpodtemplatespec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `initContainers` *[CalicoNodeWindowsDaemonSetInitContainer](#caliconodewindowsdaemonsetinitcontainer) array* | (Optional) InitContainers is a list of calico-node-windows init containers. If specified, this overrides the specified calico-node-windows DaemonSet init containers. If omitted, the calico-node-windows DaemonSet will use its default values for its init containers. | | `containers` *[CalicoNodeWindowsDaemonSetContainer](#caliconodewindowsdaemonsetcontainer) array* | (Optional) Containers is a list of calico-node-windows containers. If specified, this overrides the specified calico-node-windows DaemonSet containers. If omitted, the calico-node-windows DaemonSet will use its default values for its containers. | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity is a group of affinity scheduling rules for the calico-node-windows pods. If specified, this overrides any affinity that may be set on the calico-node-windows DaemonSet. If omitted, the calico-node-windows DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default calico-node-windows DaemonSet affinity. | | `nodeSelector` *object (keys:string, values:string)* | (Optional) NodeSelector is the calico-node-windows pod's scheduling constraints. If specified, each of the key/value pairs are added to the calico-node-windows DaemonSet nodeSelector provided the key does not already exist in the object's nodeSelector. If omitted, the calico-node-windows DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-node-windows DaemonSet nodeSelector. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations is the calico-node-windows pod's tolerations. If specified, this overrides any tolerations that may be set on the calico-node-windows DaemonSet. If omitted, the calico-node-windows DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default calico-node-windows DaemonSet tolerations. | ### CalicoNodeWindowsDaemonSetPodTemplateSpec CalicoNodeWindowsDaemonSetPodTemplateSpec is the calico-node-windows DaemonSet's PodTemplateSpec *Appears in:* - [CalicoNodeWindowsDaemonSetSpec](#caliconodewindowsdaemonsetspec) | Field | Description | | -------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[CalicoNodeWindowsDaemonSetPodSpec](#caliconodewindowsdaemonsetpodspec)* | (Optional) Spec is the calico-node-windows DaemonSet's PodSpec. | ### CalicoNodeWindowsDaemonSetSpec CalicoNodeWindowsDaemonSetSpec defines configuration for the calico-node-windows DaemonSet. *Appears in:* - [CalicoNodeWindowsDaemonSet](#caliconodewindowsdaemonset) | Field | Description | | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `minReadySeconds` *integer* | (Optional) MinReadySeconds is the minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-node-windows DaemonSet. If omitted, the calico-node-windows DaemonSet will use its default value for minReadySeconds. | | `template` *[CalicoNodeWindowsDaemonSetPodTemplateSpec](#caliconodewindowsdaemonsetpodtemplatespec)* | (Optional) Template describes the calico-node-windows DaemonSet pod that will be created. | ### CalicoWebhooksDeployment CalicoWebhooksDeployment is the configuration for the calico-webhooks Deployment. *Appears in:* - [APIServerSpec](#apiserverspec) | Field | Description | | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[CalicoWebhooksDeploymentSpec](#calicowebhooksdeploymentspec)* | (Optional) Spec is the specification of the calico-webhooks Deployment. | ### CalicoWebhooksDeploymentContainer CalicoWebhooksDeploymentContainer is a calico-webhooks Deployment container. *Appears in:* - [CalicoWebhooksDeploymentPodSpec](#calicowebhooksdeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the calico-webhooks Deployment container by name. Supported values are: calico-webhooks | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-webhooks Deployment container's resources. If omitted, the calico-webhooks Deployment will use its default value for this container's resources. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `ports` *[CalicoWebhooksDeploymentContainerPort](#calicowebhooksdeploymentcontainerport) array* | (Optional) Ports allows customization of the calico-webhooks container's ports. If specified, this overrides the default container port configuration. If omitted, the calico-webhooks Deployment will use its default port (6443). | ### CalicoWebhooksDeploymentContainerPort CalicoWebhooksDeploymentContainerPort defines a port override for a calico-webhooks container. *Appears in:* - [CalicoWebhooksDeploymentContainer](#calicowebhooksdeploymentcontainer) | Field | Description | | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the calico-webhooks Deployment container port by name. Supported values are: calico-webhooks | | `containerPort` *integer* | Number of port to expose on the pod's IP address. This must be a valid port number, 0 < x < 65536. | ### CalicoWebhooksDeploymentPodSpec CalicoWebhooksDeploymentPodSpec is the calico-webhooks Deployment's PodSpec. *Appears in:* - [CalicoWebhooksDeploymentPodTemplateSpec](#calicowebhooksdeploymentpodtemplatespec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `containers` *[CalicoWebhooksDeploymentContainer](#calicowebhooksdeploymentcontainer) array* | (Optional) Containers is a list of calico-webhooks containers. If specified, this overrides the specified calico-webhooks Deployment containers. If omitted, the calico-webhooks Deployment will use its default values for its containers. | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity is a group of affinity scheduling rules for the calico-webhooks pods. If specified, this overrides any affinity that may be set on the calico-webhooks Deployment. If omitted, the calico-webhooks Deployment will use its default value for affinity. WARNING: Please note that this field will override the default calico-webhooks Deployment affinity. | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector is the calico-webhooks pod's scheduling constraints. If specified, each of the key/value pairs are added to the calico-webhooks Deployment nodeSelector provided the key does not already exist in the object's nodeSelector. If used in conjunction with ControlPlaneNodeSelector, that nodeSelector is set on the calico-webhooks Deployment and each of this field's key/value pairs are added to the calico-webhooks Deployment nodeSelector provided the key does not already exist in the object's nodeSelector. If omitted, the calico-webhooks Deployment will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-webhooks Deployment nodeSelector. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations is the calico-webhooks pod's tolerations. If specified, this overrides any tolerations that may be set on the calico-webhooks Deployment. If omitted, the calico-webhooks Deployment will use its default value for tolerations. WARNING: Please note that this field will override the default calico-webhooks Deployment tolerations. | | `hostNetwork` *boolean* | (Optional) HostNetwork forces the webhook pod to use the host's network namespace. When true, the webhook pod will run with hostNetwork=true and DNSPolicy=ClusterFirstWithHostNet. When nil or omitted, the operator auto-detects whether host networking is required (e.g., for EKS/TKG with Calico CNI). | ### CalicoWebhooksDeploymentPodTemplateSpec CalicoWebhooksDeploymentPodTemplateSpec is the calico-webhooks Deployment's PodTemplateSpec *Appears in:* - [CalicoWebhooksDeploymentSpec](#calicowebhooksdeploymentspec) | Field | Description | | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[CalicoWebhooksDeploymentPodSpec](#calicowebhooksdeploymentpodspec)* | (Optional) Spec is the calico-webhooks Deployment's PodSpec. | ### CalicoWebhooksDeploymentSpec CalicoWebhooksDeploymentSpec defines configuration for the calico-webhooks Deployment. *Appears in:* - [CalicoWebhooksDeployment](#calicowebhooksdeployment) | Field | Description | | ------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `minReadySeconds` *integer* | (Optional) MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-webhooks Deployment. If omitted, the calico-webhooks Deployment will use its default value for minReadySeconds. | | `template` *[CalicoWebhooksDeploymentPodTemplateSpec](#calicowebhooksdeploymentpodtemplatespec)* | (Optional) Template describes the calico-webhooks Deployment pod that will be created. | ### CalicoWindowsUpgradeDaemonSet Deprecated. The CalicoWindowsUpgradeDaemonSet is deprecated and will be removed from the API in the future. CalicoWindowsUpgradeDaemonSet is the configuration for the calico-windows-upgrade DaemonSet. *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[CalicoWindowsUpgradeDaemonSetSpec](#calicowindowsupgradedaemonsetspec)* | (Optional) Spec is the specification of the calico-windows-upgrade DaemonSet. | ### CalicoWindowsUpgradeDaemonSetContainer CalicoWindowsUpgradeDaemonSetContainer is a calico-windows-upgrade DaemonSet container. *Appears in:* - [CalicoWindowsUpgradeDaemonSetPodSpec](#calicowindowsupgradedaemonsetpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the calico-windows-upgrade DaemonSet container by name. | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named calico-windows-upgrade DaemonSet container's resources. If omitted, the calico-windows-upgrade DaemonSet will use its default value for this container's resources. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### CalicoWindowsUpgradeDaemonSetPodSpec CalicoWindowsUpgradeDaemonSetPodSpec is the calico-windows-upgrade DaemonSet's PodSpec. *Appears in:* - [CalicoWindowsUpgradeDaemonSetPodTemplateSpec](#calicowindowsupgradedaemonsetpodtemplatespec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `containers` *[CalicoWindowsUpgradeDaemonSetContainer](#calicowindowsupgradedaemonsetcontainer) array* | (Optional) Containers is a list of calico-windows-upgrade containers. If specified, this overrides the specified calico-windows-upgrade DaemonSet containers. If omitted, the calico-windows-upgrade DaemonSet will use its default values for its containers. | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity is a group of affinity scheduling rules for the calico-windows-upgrade pods. If specified, this overrides any affinity that may be set on the calico-windows-upgrade DaemonSet. If omitted, the calico-windows-upgrade DaemonSet will use its default value for affinity. WARNING: Please note that this field will override the default calico-windows-upgrade DaemonSet affinity. | | `nodeSelector` *object (keys:string, values:string)* | (Optional) NodeSelector is the calico-windows-upgrade pod's scheduling constraints. If specified, each of the key/value pairs are added to the calico-windows-upgrade DaemonSet nodeSelector provided the key does not already exist in the object's nodeSelector. If omitted, the calico-windows-upgrade DaemonSet will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-windows-upgrade DaemonSet nodeSelector. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations is the calico-windows-upgrade pod's tolerations. If specified, this overrides any tolerations that may be set on the calico-windows-upgrade DaemonSet. If omitted, the calico-windows-upgrade DaemonSet will use its default value for tolerations. WARNING: Please note that this field will override the default calico-windows-upgrade DaemonSet tolerations. | ### CalicoWindowsUpgradeDaemonSetPodTemplateSpec CalicoWindowsUpgradeDaemonSetPodTemplateSpec is the calico-windows-upgrade DaemonSet's PodTemplateSpec *Appears in:* - [CalicoWindowsUpgradeDaemonSetSpec](#calicowindowsupgradedaemonsetspec) | Field | Description | | -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[CalicoWindowsUpgradeDaemonSetPodSpec](#calicowindowsupgradedaemonsetpodspec)* | (Optional) Spec is the calico-windows-upgrade DaemonSet's PodSpec. | ### CalicoWindowsUpgradeDaemonSetSpec CalicoWindowsUpgradeDaemonSetSpec defines configuration for the calico-windows-upgrade DaemonSet. *Appears in:* - [CalicoWindowsUpgradeDaemonSet](#calicowindowsupgradedaemonset) | Field | Description | | ---------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `minReadySeconds` *integer* | (Optional) MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the calico-windows-upgrade DaemonSet. If omitted, the calico-windows-upgrade DaemonSet will use its default value for minReadySeconds. | | `template` *[CalicoWindowsUpgradeDaemonSetPodTemplateSpec](#calicowindowsupgradedaemonsetpodtemplatespec)* | (Optional) Template describes the calico-windows-upgrade DaemonSet pod that will be created. | ### CertificateManagement CertificateManagement configures pods to submit a CertificateSigningRequest to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates. This feature requires that you bring your own CSR signing and approval process, otherwise pods will be stuck during initialization. *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `caCert` *integer array* | Certificate of the authority that signs the CertificateSigningRequests in PEM format. | | `signerName` *string* | When a CSR is issued to the certificates.k8s.io API, the signerName is added to the request in order to accommodate for clusters with multiple signers. Must be formatted as: `/`. | | `keyAlgorithm` *string* | (Optional) Specify the algorithm used by pods to generate a key pair that is associated with the X.509 certificate request. Default: RSAWithSize2048 | | `signatureAlgorithm` *string* | (Optional) Specify the algorithm used for the signature of the X.509 certificate request. Default: SHA256WithRSA | ### ClusterRoutingMode *Underlying type:* *string* ClusterRoutingMode describes the mode of cluster routing. *Validation:* - Enum: \[BIRD Felix] *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Value | Description | | ------- | ----------- | | `BIRD` | | | `Felix` | | ### CollectProcessPathOption *Underlying type:* *string* *Appears in:* - [LogCollectorSpec](#logcollectorspec) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### CommonPrometheusFields *Appears in:* - [PrometheusSpec](#prometheusspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `containers` *[PrometheusContainer](#prometheuscontainer) array* | (Optional) Containers is a list of Prometheus containers. If specified, this overrides the specified Prometheus Deployment containers. If omitted, the Prometheus Deployment will use its default values for its containers. | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | Define resources requests and limits for single Pods. | ### ComponentName *Underlying type:* *string* ComponentName represents a single component. One of: Node, Typha, KubeControllers *Appears in:* - [ComponentResource](#componentresource) | Value | Description | | ----------------- | ----------- | | `Node` | | | `NodeWindows` | | | `FelixWindows` | | | `ConfdWindows` | | | `Typha` | | | `KubeControllers` | | ### ComponentResource Deprecated. Please use component resource config fields in Installation.Spec instead. The ComponentResource struct associates a ResourceRequirements with a component by name *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | -------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | | `componentName` *[ComponentName](#componentname)* | ComponentName is an enum which identifies the component | | `resourceRequirements` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | ResourceRequirements allows customization of limits and requests for compute resources such as cpu and memory. | ### ConditionStatus *Underlying type:* *string* ConditionStatus represents the status of a particular condition. A condition may be one of: True, False, Unknown. *Appears in:* - [TigeraStatusCondition](#tigerastatuscondition) | Value | Description | | --------- | ----------- | | `True` | | | `False` | | | `Unknown` | | ### ContainerIPForwardingType *Underlying type:* *string* ContainerIPForwardingType specifies whether the CNI config for container ip forwarding is enabled. *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### DPIDaemonsetInitContainer *Appears in:* - [DPIDaemonsetTemplateSpec](#dpidaemonsettemplatespec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum that identifies the init container by its name. | | `image` *string* | Image name for the init container | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the init container's resources. If omitted, the default values will be used for the init container's resources. | ### DPIDaemonsetSpec *Appears in:* - [DeepPacketInspectionDaemonset](#deeppacketinspectiondaemonset) | Field | Description | | ---------------------------------------------------------- | ---------------------------------------------------- | | `template` *[DPIDaemonsetTemplate](#dpidaemonsettemplate)* | (Optional) Template specifies DPI Daemonset Template | ### DPIDaemonsetTemplate *Appears in:* - [DPIDaemonsetSpec](#dpidaemonsetspec) | Field | Description | | -------------------------------------------------------------- | ----------------------------------------------------- | | `spec` *[DPIDaemonsetTemplateSpec](#dpidaemonsettemplatespec)* | (Optional) Spec specifies DPI Daemonset Template Spec | ### DPIDaemonsetTemplateSpec *Appears in:* - [DPIDaemonsetTemplate](#dpidaemonsettemplate) | Field | Description | | -------------------------------------------------------------------------------- | ------------------------------------------------- | | `initContainers` *[DPIDaemonsetInitContainer](#dpidaemonsetinitcontainer) array* | List of DPI Daemonset Init containers definitions | ### DeepPacketInspectionDaemonset *Appears in:* - [IntrusionDetectionSpec](#intrusiondetectionspec) | Field | Description | | ---------------------------------------------- | -------------------------------------------------------- | | `spec` *[DPIDaemonsetSpec](#dpidaemonsetspec)* | (Optional) DPIDaemonsetSpec configures the DPI Daemonset | ### EGWDeploymentContainer EGWDeploymentContainer is a Egress Gateway Deployment container. *Appears in:* - [EgressGatewayDeploymentPodSpec](#egressgatewaydeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the EGW Deployment container by name. Supported values are: egress-gateway | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named EGW Deployment container's resources. If omitted, the EGW Deployment will use its default value for this container's resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### EGWDeploymentInitContainer EGWDeploymentInitContainer is a Egress Gateway Deployment init container. *Appears in:* - [EgressGatewayDeploymentPodSpec](#egressgatewaydeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `name` *string* | Name is an enum which identifies the EGW Deployment init container by name. Supported values are: egress-gateway-init | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named EGW Deployment init container's resources. If omitted, the EGW Deployment will use its default value for this init container's resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence. | ### EKSLogForwarderDeployment EKSLogForwarderDeployment is the configuration for the EKSLogForwarder Deployment. *Appears in:* - [LogCollectorSpec](#logcollectorspec) | Field | Description | | ------------------------------------------------------------------------ | ----------------------------------------------------------------------- | | `spec` *[EKSLogForwarderDeploymentSpec](#ekslogforwarderdeploymentspec)* | (Optional) Spec is the specification of the EKSLogForwarder Deployment. | ### EKSLogForwarderDeploymentContainer EKSLogForwarderDeploymentContainer is a EKSLogForwarder Deployment container. *Appears in:* - [EKSLogForwarderDeploymentPodSpec](#ekslogforwarderdeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the EKSLogForwarder Deployment container by name. Supported values are: eks-log-forwarder | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named EKSLogForwarder Deployment container's resources. If omitted, the EKSLogForwarder Deployment will use its default value for this container's resources. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### EKSLogForwarderDeploymentInitContainer EKSLogForwarderDeploymentInitContainer is a EKSLogForwarder Deployment init container. *Appears in:* - [EKSLogForwarderDeploymentPodSpec](#ekslogforwarderdeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the EKSLogForwarder Deployment init container by name. Supported values are: eks-log-forwarder-startup | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named EKSLogForwarder Deployment init container's resources. If omitted, the EKSLogForwarder Deployment will use its default value for this init container's resources. | ### EKSLogForwarderDeploymentPodSpec EKSLogForwarderDeploymentPodSpec is the EKSLogForwarder Deployment's PodSpec. *Appears in:* - [EKSLogForwarderDeploymentPodTemplateSpec](#ekslogforwarderdeploymentpodtemplatespec) | Field | Description | | ---------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `initContainers` *[EKSLogForwarderDeploymentInitContainer](#ekslogforwarderdeploymentinitcontainer) array* | (Optional) InitContainers is a list of EKSLogForwarder init containers. If specified, this overrides the specified EKSLogForwarder Deployment init containers. If omitted, the EKSLogForwarder Deployment will use its default values for its init containers. | | `containers` *[EKSLogForwarderDeploymentContainer](#ekslogforwarderdeploymentcontainer) array* | (Optional) Containers is a list of EKSLogForwarder containers. If specified, this overrides the specified EKSLogForwarder Deployment containers. If omitted, the EKSLogForwarder Deployment will use its default values for its containers. | ### EKSLogForwarderDeploymentPodTemplateSpec EKSLogForwarderDeploymentPodTemplateSpec is the EKSLogForwarder Deployment's PodTemplateSpec *Appears in:* - [EKSLogForwarderDeploymentSpec](#ekslogforwarderdeploymentspec) | Field | Description | | ------------------------------------------------------------------------------ | ------------------------------------------------------------ | | `spec` *[EKSLogForwarderDeploymentPodSpec](#ekslogforwarderdeploymentpodspec)* | (Optional) Spec is the EKSLogForwarder Deployment's PodSpec. | ### EKSLogForwarderDeploymentSpec EKSLogForwarderDeploymentSpec defines configuration for the EKSLogForwarder Deployment. *Appears in:* - [EKSLogForwarderDeployment](#ekslogforwarderdeployment) | Field | Description | | -------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | | `template` *[EKSLogForwarderDeploymentPodTemplateSpec](#ekslogforwarderdeploymentpodtemplatespec)* | (Optional) Template describes the EKSLogForwarder Deployment pod that will be created. | ### EgressGateway EgressGateway is the Schema for the egressgateways API | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `EgressGateway` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[EgressGatewaySpec](#egressgatewayspec)* | | | `status` *[EgressGatewayStatus](#egressgatewaystatus)* | | ### EgressGatewayDeploymentPodSpec EgressGatewayDeploymentPodSpec is the Egress Gateway Deployment's PodSpec. *Appears in:* - [EgressGatewayDeploymentPodTemplateSpec](#egressgatewaydeploymentpodtemplatespec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `initContainers` *[EGWDeploymentInitContainer](#egwdeploymentinitcontainer) array* | (Optional) InitContainers is a list of EGW init containers. If specified, this overrides the specified EGW Deployment init containers. If omitted, the EGW Deployment will use its default values for its init containers. | | `containers` *[EGWDeploymentContainer](#egwdeploymentcontainer) array* | (Optional) Containers is a list of EGW containers. If specified, this overrides the specified EGW Deployment containers. If omitted, the EGW Deployment will use its default values for its containers. | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity is a group of affinity scheduling rules for the EGW pods. | | `nodeSelector` *object (keys:string, values:string)* | (Optional) NodeSelector gives more control over the nodes where the Egress Gateway pods will run on. | | `terminationGracePeriodSeconds` *integer* | (Optional) TerminationGracePeriodSeconds defines the termination grace period of the Egress Gateway pods in seconds. | | `topologySpreadConstraints` *[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#topologyspreadconstraint-v1-core) array* | (Optional) TopologySpreadConstraints defines how the Egress Gateway pods should be spread across different AZs. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations is the egress gateway pod's tolerations. If specified, this overrides any tolerations that may be set on the EGW Deployment. If omitted, the EGW Deployment will use its default value for tolerations. | | `priorityClassName` *string* | (Optional) PriorityClassName allows to specify a PriorityClass resource to be used. | ### EgressGatewayDeploymentPodTemplateSpec EgressGatewayDeploymentPodTemplateSpec is the EGW Deployment's PodTemplateSpec *Appears in:* - [EgressGatewaySpec](#egressgatewayspec) | Field | Description | | -------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[EgressGatewayMetadata](#egressgatewaymetadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[EgressGatewayDeploymentPodSpec](#egressgatewaydeploymentpodspec)* | (Optional) Spec is the EGW Deployment's PodSpec. | ### EgressGatewayFailureDetection EgressGatewayFailureDetection defines the fields the needed for determining Egress Gateway readiness. *Appears in:* - [EgressGatewaySpec](#egressgatewayspec) | Field | Description | | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `healthTimeoutDataStoreSeconds` *integer* | (Optional) HealthTimeoutDataStoreSeconds defines how long Egress Gateway can fail to connect to the datastore before reporting not ready. This value must be greater than 0. Default: 90 | | `icmpProbe` *[ICMPProbe](#icmpprobe)* | (Optional) ICMPProbe define outgoing ICMP probes that Egress Gateway will use to verify its upstream connection. Egress Gateway will report not ready if all fail. Timeout must be greater than interval. | | `httpProbe` *[HTTPProbe](#httpprobe)* | (Optional) HTTPProbe define outgoing HTTP probes that Egress Gateway will use to verify its upsteam connection. Egress Gateway will report not ready if all fail. Timeout must be greater than interval. | ### EgressGatewayIPPool *Appears in:* - [EgressGatewaySpec](#egressgatewayspec) | Field | Description | | --------------- | --------------------------------------------------------------------------- | | `name` *string* | (Optional) Name is the name of the IPPool that the Egress Gateways can use. | | `cidr` *string* | (Optional) CIDR is the IPPool CIDR that the Egress Gateways can use. | ### EgressGatewayMetadata EgressGatewayMetadata contains the standard Kubernetes labels and annotations fields. *Appears in:* - [EgressGatewayDeploymentPodTemplateSpec](#egressgatewaydeploymentpodtemplatespec) | Field | Description | | --------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `labels` *object (keys:string, values:string)* | (Optional) Labels is a map of string keys and values that may match replica set and service selectors. Each of these key/value pairs are added to the object's labels provided the key does not already exist in the object's labels. If not specified will default to projectcalico.org/egw:\[name], where \[name] is the name of the Egress Gateway resource. | | `annotations` *object (keys:string, values:string)* | (Optional) Annotations is a map of arbitrary non-identifying metadata. Each of these key/value pairs are added to the object's annotations provided the key does not already exist in the object's annotations. | ### EgressGatewaySpec EgressGatewaySpec defines the desired state of EgressGateway *Appears in:* - [EgressGateway](#egressgateway) | Field | Description | | ------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `replicas` *integer* | (Optional) Replicas defines how many instances of the Egress Gateway pod will run. | | `ipPools` *[EgressGatewayIPPool](#egressgatewayippool) array* | IPPools defines the IP Pools that the Egress Gateway pods should be using. Either name or CIDR must be specified. IPPools must match existing IPPools. | | `externalNetworks` *string array* | (Optional) ExternalNetworks defines the external network names this Egress Gateway is associated with. ExternalNetworks must match existing external networks. | | `logSeverity` *[LogSeverity](#logseverity)* | (Optional) LogSeverity defines the logging level of the Egress Gateway. | | `template` *[EgressGatewayDeploymentPodTemplateSpec](#egressgatewaydeploymentpodtemplatespec)* | (Optional) Template describes the EGW Deployment pod that will be created. | | `egressGatewayFailureDetection` *[EgressGatewayFailureDetection](#egressgatewayfailuredetection)* | (Optional) EgressGatewayFailureDetection is used to configure how Egress Gateway determines readiness. If both ICMP, HTTP probes are defined, one ICMP probe and one HTTP probe should succeed for Egress Gateways to become ready. Otherwise one of ICMP or HTTP probe should succeed for Egress gateways to become ready if configured. | | `aws` *[AWSEgressGateway](#awsegressgateway)* | (Optional) AWS defines the additional configuration options for Egress Gateways on AWS. | ### EgressGatewayStatus EgressGatewayStatus defines the observed state of EgressGateway *Appears in:* - [EgressGateway](#egressgateway) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `state` *string* | State provides user-readable status. | | `conditions` *[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#condition-v1-meta) array* | (Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types. | ### EksCloudwatchLogsSpec EksConfigSpec defines configuration for fetching EKS audit logs. *Appears in:* - [AdditionalLogSourceSpec](#additionallogsourcespec) | Field | Description | | ------------------------- | --------------------------------------------------------------------------------------------------------------------- | | `region` *string* | AWS Region EKS cluster is hosted in. | | `groupName` *string* | Cloudwatch log-group name containing EKS audit logs. | | `streamPrefix` *string* | (Optional) Prefix of Cloudwatch log stream containing EKS audit logs in the log-group. Default: kube-apiserver-audit- | | `fetchInterval` *integer* | (Optional) Cloudwatch audit logs fetching interval in seconds. Default: 60 | ### EncapsulationType *Underlying type:* *string* EncapsulationType is the type of encapsulation to use on an IP pool. One of: IPIP, VXLAN, IPIPCrossSubnet, VXLANCrossSubnet, None *Appears in:* - [IPPool](#ippool) | Value | Description | | ------------------ | ----------- | | `IPIPCrossSubnet` | | | `IPIP` | | | `VXLAN` | | | `VXLANCrossSubnet` | | | `None` | | ### EncryptionOption *Underlying type:* *string* EncryptionOption specifies the traffic encryption mode when connecting to a Syslog server. One of: None, TLS *Appears in:* - [SyslogStoreSpec](#syslogstorespec) | Value | Description | | ------ | ----------- | | `None` | | | `TLS` | | ### Endpoint Endpoint contains a subset of relevant fields from the Prometheus Endpoint struct. *Appears in:* - [ServiceMonitor](#servicemonitor) | Field | Description | | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `params` *object (keys:string, values:string array)* | Optional HTTP URL parameters Default: scrape all metrics. | | `bearerTokenSecret` *[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#secretkeyselector-v1-core)* | Secret to mount to read bearer token for scraping targets. Recommended: when unset, the operator will create a Secret, a ClusterRole and a ClusterRoleBinding. | | `interval` *[Duration](#duration)* | Interval at which metrics should be scraped. If not specified Prometheus' global scrape interval is used. | | `scrapeTimeout` *[Duration](#duration)* | Timeout after which the scrape is ended. If not specified, the Prometheus global scrape timeout is used unless it is less than `Interval` in which the latter is used. | | `honorLabels` *boolean* | HonorLabels chooses the metric's labels on collisions with target labels. | | `honorTimestamps` *boolean* | HonorTimestamps controls whether Prometheus respects the timestamps present in scraped data. | | `metricRelabelings` *RelabelConfig array* | MetricRelabelConfigs to apply to samples before ingestion. | | `relabelings` *RelabelConfig array* | RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds relabelings for a few standard Kubernetes fields. The original scrape job's name is available via the `__tmp_prometheus_job_name` label. More info: [https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel\_config](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) | ### EnvoySettings *Appears in:* - [ApplicationLayerSpec](#applicationlayerspec) | Field | Description | | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `xffNumTrustedHops` *integer* | (Optional) The number of additional ingress proxy hops from the right side of the x-forwarded-for HTTP header to trust when determining the origin client’s IP address. 0 is permitted, but >=1 is the typical setting. | | `useRemoteAddress` *boolean* | (Optional) If set to true, the Envoy connection manager will use the real remote address of the client connection when determining internal versus external origin and manipulating various headers. | ### ExternalPrometheus *Appears in:* - [MonitorSpec](#monitorspec) | Field | Description | | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `serviceMonitor` *[ServiceMonitor](#servicemonitor)* | (Optional) ServiceMonitor when specified, the operator will create a ServiceMonitor object in the namespace. It is recommended that you configure labels if you want your prometheus instance to pick up the configuration automatically. The operator will configure 1 endpoint by default: - Params to scrape all metrics available in Calico Enterprise. - BearerTokenSecret (If not overridden, the operator will also create corresponding RBAC that allows authz to the metrics.) - TLSConfig, containing the caFile and serverName. | | `namespace` *string* | Namespace is the namespace where the operator will create resources for your Prometheus instance. The namespace must be created before the operator will create Prometheus resources. | ### FIPSMode *Underlying type:* *string* *Appears in:* - [InstallationSpec](#installationspec) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### FluentdDaemonSet FluentdDaemonSet is the configuration for the Fluentd DaemonSet. *Appears in:* - [LogCollectorSpec](#logcollectorspec) | Field | Description | | ------------------------------------------------------ | -------------------------------------------------------------- | | `spec` *[FluentdDaemonSetSpec](#fluentddaemonsetspec)* | (Optional) Spec is the specification of the Fluentd DaemonSet. | ### FluentdDaemonSetContainer FluentdDaemonSetContainer is a Fluentd DaemonSet container. *Appears in:* - [FluentdDaemonSetPodSpec](#fluentddaemonsetpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the Fluentd DaemonSet container by name. Supported values are: fluentd | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Fluentd DaemonSet container's resources. If omitted, the Fluentd DaemonSet will use its default value for this container's resources. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### FluentdDaemonSetInitContainer FluentdDaemonSetInitContainer is a Fluentd DaemonSet init container. *Appears in:* - [FluentdDaemonSetPodSpec](#fluentddaemonsetpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the Fluentd DaemonSet init container by name. Supported values are: tigera-fluentd-prometheus-tls-key-cert-provisioner | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Fluentd DaemonSet init container's resources. If omitted, the Fluentd DaemonSet will use its default value for this init container's resources. | ### FluentdDaemonSetPodSpec FluentdDaemonSetPodSpec is the Fluentd DaemonSet's PodSpec. *Appears in:* - [FluentdDaemonSetPodTemplateSpec](#fluentddaemonsetpodtemplatespec) | Field | Description | | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `initContainers` *[FluentdDaemonSetInitContainer](#fluentddaemonsetinitcontainer) array* | (Optional) InitContainers is a list of Fluentd DaemonSet init containers. If specified, this overrides the specified Fluentd DaemonSet init containers. If omitted, the Fluentd DaemonSet will use its default values for its init containers. | | `containers` *[FluentdDaemonSetContainer](#fluentddaemonsetcontainer) array* | (Optional) Containers is a list of Fluentd DaemonSet containers. If specified, this overrides the specified Fluentd DaemonSet containers. If omitted, the Fluentd DaemonSet will use its default values for its containers. | ### FluentdDaemonSetPodTemplateSpec FluentdDaemonSetPodTemplateSpec is the Fluentd DaemonSet's PodTemplateSpec *Appears in:* - [FluentdDaemonSetSpec](#fluentddaemonsetspec) | Field | Description | | ------------------------------------------------------------ | --------------------------------------------------- | | `spec` *[FluentdDaemonSetPodSpec](#fluentddaemonsetpodspec)* | (Optional) Spec is the Fluentd DaemonSet's PodSpec. | ### FluentdDaemonSetSpec FluentdDaemonSetSpec defines configuration for the Fluentd DaemonSet. *Appears in:* - [FluentdDaemonSet](#fluentddaemonset) | Field | Description | | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | | `template` *[FluentdDaemonSetPodTemplateSpec](#fluentddaemonsetpodtemplatespec)* | (Optional) Template describes the Fluentd DaemonSet pod that will be created. | ### GatewayAPI | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `GatewayAPI` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[GatewayAPISpec](#gatewayapispec)* | | ### GatewayAPIExtensions GatewayAPIExtensions enables and configures Tigera-built Gateway API add-ons. *Appears in:* - [GatewayAPISpec](#gatewayapispec) | Field | Description | | --------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `waf` *[WAFExtensionSpec](#wafextensionspec)* | (Optional) WAF enables and configures the Tigera Web Application Firewall (Coraza WASM when WAF.State is nil, and when WAF.State is "Disabled", the operator does not render the WAF env vars or RBAC on calico-kube-controllers. Set WAF.State = "Enabled" to turn the feature on. See design `tigera/designs#25` (PMREQ-384) for the full surface. | ### GatewayAPISpec GatewayAPISpec has fields that can be used to customize our GatewayAPI support. *Appears in:* - [GatewayAPI](#gatewayapi) | Field | Description | | ------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `envoyGatewayConfigRef` *[NamespacedName](#namespacedname)* | (Optional) Reference to a custom EnvoyGateway YAML to use as the base EnvoyGateway configuration for the gateway controller. When specified, must identify a ConfigMap resource with an "envoy-gateway.yaml" key whose value is the desired EnvoyGateway YAML (i.e. following the same pattern as the default `envoy-gateway-config` ConfigMap). When not specified, the Tigera operator uses the `envoy-gateway-config` from the Envoy Gateway helm chart as its base. Starting from that base, the Tigera operator copies and modifies the EnvoyGateway resource as follows: 1. If not already specified, it sets the ControllerName to "gateway.envoyproxy.io/gatewayclass-controller". 2. It configures the `tigera/envoy-gateway` and `tigera/envoy-ratelimit` images that will be used (according to the current Calico version, private registry and image set settings) and any pull secrets that are needed to pull those images. 3. It enables use of the Backend API. The resulting EnvoyGateway is provisioned as the `envoy-gateway-config` ConfigMap (which the gateway controller then uses as its config). | | `gatewayClasses` *[GatewayClassSpec](#gatewayclassspec) array* | (Optional) Configures the GatewayClasses that will be available; please see GatewayClassSpec for more detail. If GatewayClasses is nil, the Tigera operator defaults to provisioning a single GatewayClass named "tigera-gateway-class", without any of the detailed customizations that are allowed within GatewayClassSpec. | | `gatewayControllerDeployment` *[GatewayControllerDeployment](#gatewaycontrollerdeployment)* | (Optional) Allows customization of the gateway controller deployment. | | `gatewayCertgenJob` *[GatewayCertgenJob](#gatewaycertgenjob)* | (Optional) Allows customization of the gateway certgen job. | | `crdManagement` *[CRDManagement](#crdmanagement)* | (Optional) Configures how to manage and update Gateway API CRDs. The default behaviour - which is used when this field is not set, or is set to "PreferExisting" - is that the Tigera operator will create the Gateway API CRDs if they do not already exist, but will not overwrite any existing Gateway API CRDs. This setting may be preferable if the customer is using other implementations of the Gateway API concurrently with the Gateway API support in Calico Enterprise. It is then the customer's responsibility to ensure that CRDs are installed that meet the needs of all the Gateway API implementations in their cluster. Alternatively, if this field is set to "Reconcile", the Tigera operator will keep the cluster's Gateway API CRDs aligned with those that it would install on a cluster that does not yet have any version of those CRDs. | | `extensions` *[GatewayAPIExtensions](#gatewayapiextensions)* | (Optional) Extensions enables and configures Tigera-built add-ons that sit on top of the Gateway API data plane. Each add-on is opt-in: an unset Extensions, an unset add-on field, and an empty add-on object all leave the add-on disabled. | ### GatewayCertgenJob GatewayCertgenJob allows customization of the gateway certgen job. *Appears in:* - [GatewayAPISpec](#gatewayapispec) | Field | Description | | -------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[GatewayCertgenJobSpec](#gatewaycertgenjobspec)* | (Optional) | ### GatewayCertgenJobContainer GatewayCertgenJobContainer allows customization of the gateway certgen job's resource requirements. *Appears in:* - [GatewayCertgenJobPodSpec](#gatewaycertgenjobpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) If non-nil, Resources sets the ResourceRequirements of the job's "envoy-gateway-certgen" container. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### GatewayCertgenJobPodSpec GatewayCertgenJobPodSpec allows customization of the gateway certgen job's pod spec. *Appears in:* - [GatewayCertgenJobPodTemplate](#gatewaycertgenjobpodtemplate) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) If non-nil, Affinity sets the affinity field of the job's pod template. | | `containers` *[GatewayCertgenJobContainer](#gatewaycertgenjobcontainer) array* | (Optional) | | `nodeSelector` *object (keys:string, values:string)* | (Optional) If non-nil, NodeSelector sets the node selector for where job pods may be scheduled. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) If non-nil, Tolerations sets the tolerations field of the job's pod template. | ### GatewayCertgenJobPodTemplate GatewayCertgenJobPodTemplate allows customization of the gateway certgen job's pod template. *Appears in:* - [GatewayCertgenJobSpec](#gatewaycertgenjobspec) | Field | Description | | -------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[GatewayCertgenJobPodSpec](#gatewaycertgenjobpodspec)* | (Optional) | ### GatewayCertgenJobSpec GatewayCertgenJobSpec allows customization of the gateway certgen job spec. *Appears in:* - [GatewayCertgenJob](#gatewaycertgenjob) | Field | Description | | -------------------------------------------------------------------------- | ----------- | | `template` *[GatewayCertgenJobPodTemplate](#gatewaycertgenjobpodtemplate)* | (Optional) | ### GatewayClassSpec *Appears in:* - [GatewayAPISpec](#gatewayapispec) | Field | Description | | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | The name of this GatewayClass. | | `envoyProxyRef` *[NamespacedName](#namespacedname)* | (Optional) Reference to a custom EnvoyProxy resource to use as the base EnvoyProxy configuration for this GatewayClass. When specified, must identify an EnvoyProxy resource. When not specified, the Tigera operator uses an empty EnvoyProxy resource as its base. Starting from that base, the Tigera operator copies and modifies the EnvoyProxy resource as follows, in the order described: 1. It configures the `tigera/envoy-proxy` image that will be used (according to the current Calico version, private registry and image set settings) and any pull secrets that are needed to pull that image. 2. It applies customizations as specified by the following `GatewayKind`, `GatewayDeployment`, `GatewayDaemonSet` and `GatewayService` fields. The resulting EnvoyProxy is provisioned in the `tigera-gateway` namespace, together with a GatewayClass that references it. If a custom EnvoyProxy resource is specified and uses `EnvoyDaemonSet` instead of the default `EnvoyDeployment`, deployment-related customizations will be applied within `EnvoyDaemonSet` instead of within `EnvoyDeployment`. | | `gatewayKind` *[GatewayKind](#gatewaykind)* | (Optional) Specifies whether Gateways in this class are deployed as Deployments (default) or as DaemonSets. It is an error for GatewayKind to specify a choice that is incompatible with the custom EnvoyProxy, when EnvoyProxyRef is also specified. | | `gatewayDeployment` *[GatewayDeployment](#gatewaydeployment)* | (Optional) Allows customization of Gateways when deployed as Kubernetes Deployments, for Gateways in this GatewayClass. | | `gatewayDaemonSet` *[GatewayDaemonSet](#gatewaydaemonset)* | (Optional) Allows customization of Gateways when deployed as Kubernetes DaemonSets, for Gateways in this GatewayClass. | | `gatewayService` *[GatewayService](#gatewayservice)* | (Optional) Allows customization of gateway services, for Gateways in this GatewayClass. | ### GatewayControllerDeployment GatewayControllerDeployment allows customization of the gateway controller deployment. *Appears in:* - [GatewayAPISpec](#gatewayapispec) | Field | Description | | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[GatewayControllerDeploymentSpec](#gatewaycontrollerdeploymentspec)* | (Optional) | ### GatewayControllerDeploymentContainer GatewayControllerDeploymentContainer allows customization of the gateway controller's resource requirements. *Appears in:* - [GatewayControllerDeploymentPodSpec](#gatewaycontrollerdeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) If non-nil, Resources sets the ResourceRequirements of the controller's "envoy-gateway" container. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### GatewayControllerDeploymentPodSpec GatewayControllerDeploymentPodSpec allows customization of the gateway controller deployment pod spec. *Appears in:* - [GatewayControllerDeploymentPodTemplate](#gatewaycontrollerdeploymentpodtemplate) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) If non-nil, Affinity sets the affinity field of the deployment's pod template. | | `containers` *[GatewayControllerDeploymentContainer](#gatewaycontrollerdeploymentcontainer) array* | (Optional) | | `nodeSelector` *object (keys:string, values:string)* | (Optional) If non-nil, NodeSelector sets the node selector for where deployment pods may be scheduled. | | `topologySpreadConstraints` *[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#topologyspreadconstraint-v1-core) array* | (Optional) If non-nil, TopologySpreadConstraints sets the topology spread constraints of the deployment's pod template. TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) If non-nil, Tolerations sets the tolerations field of the deployment's pod template. | ### GatewayControllerDeploymentPodTemplate GatewayControllerDeploymentPodTemplate allows customization of the gateway controller deployment pod template. *Appears in:* - [GatewayControllerDeploymentSpec](#gatewaycontrollerdeploymentspec) | Field | Description | | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[GatewayControllerDeploymentPodSpec](#gatewaycontrollerdeploymentpodspec)* | (Optional) | ### GatewayControllerDeploymentSpec GatewayControllerDeploymentSpec allows customization of the gateway controller deployment spec. *Appears in:* - [GatewayControllerDeployment](#gatewaycontrollerdeployment) | Field | Description | | ---------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | | `replicas` *integer* | (Optional) If non-nil, Replicas sets the number of replicas for the deployment. | | `minReadySeconds` *integer* | (Optional) If non-nil, MinReadySeconds sets the minReadySeconds field for the deployment. | | `template` *[GatewayControllerDeploymentPodTemplate](#gatewaycontrollerdeploymentpodtemplate)* | (Optional) | ### GatewayDaemonSet GatewayDeployment allows customization of Gateways when deployed as Kubernetes DaemonSets. *Appears in:* - [GatewayClassSpec](#gatewayclassspec) | Field | Description | | ------------------------------------------------------ | ----------- | | `spec` *[GatewayDaemonSetSpec](#gatewaydaemonsetspec)* | (Optional) | ### GatewayDaemonSetContainer GatewayDaemonSetContainer allows customization of the resource requirements of gateway daemonsets. *Appears in:* - [GatewayDaemonSetPodSpec](#gatewaydaemonsetpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) container. | ### GatewayDaemonSetPodSpec GatewayDaemonSetPodSpec allows customization of the pod spec of gateway daemonsets. *Appears in:* - [GatewayDaemonSetPodTemplate](#gatewaydaemonsetpodtemplate) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) If non-nil, Affinity sets the affinity field of the daemonset's pod template. | | `containers` *[GatewayDaemonSetContainer](#gatewaydaemonsetcontainer) array* | (Optional) | | `nodeSelector` *object (keys:string, values:string)* | (Optional) If non-nil, NodeSelector sets the node selector for where daemonset pods may be scheduled. | | `topologySpreadConstraints` *[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#topologyspreadconstraint-v1-core) array* | (Optional) If non-nil, TopologySpreadConstraints sets the topology spread constraints of the daemonset's pod template. TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) If non-nil, Tolerations sets the tolerations field of the daemonset's pod template. | ### GatewayDaemonSetPodTemplate GatewayDeploymentPodTemplate allows customization of the pod template of gateway daemonsets. *Appears in:* - [GatewayDaemonSetSpec](#gatewaydaemonsetspec) | Field | Description | | ------------------------------------------------------------ | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[GatewayDaemonSetPodSpec](#gatewaydaemonsetpodspec)* | (Optional) | ### GatewayDaemonSetSpec GatewayDeploymentSpec allows customization of the spec of gateway daemonsets. *Appears in:* - [GatewayDaemonSet](#gatewaydaemonset) | Field | Description | | ------------------------------------------------------------------------ | ----------- | | `template` *[GatewayDaemonSetPodTemplate](#gatewaydaemonsetpodtemplate)* | (Optional) | ### GatewayDeployment GatewayDeployment allows customization of Gateways when deployed as Kubernetes Deployments. *Appears in:* - [GatewayClassSpec](#gatewayclassspec) | Field | Description | | -------------------------------------------------------- | ----------- | | `spec` *[GatewayDeploymentSpec](#gatewaydeploymentspec)* | (Optional) | ### GatewayDeploymentContainer GatewayDeploymentContainer allows customization of the resource requirements of gateway deployments. *Appears in:* - [GatewayDeploymentPodSpec](#gatewaydeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) If non-nil, Resources sets the ResourceRequirements of the deployment's "envoy" container. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### GatewayDeploymentPodSpec GatewayDeploymentPodSpec allows customization of the pod spec of gateway deployments. *Appears in:* - [GatewayDeploymentPodTemplate](#gatewaydeploymentpodtemplate) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) If non-nil, Affinity sets the affinity field of the deployment's pod template. | | `containers` *[GatewayDeploymentContainer](#gatewaydeploymentcontainer) array* | (Optional) | | `nodeSelector` *object (keys:string, values:string)* | (Optional) If non-nil, NodeSelector sets the node selector for where deployment pods may be scheduled. | | `topologySpreadConstraints` *[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#topologyspreadconstraint-v1-core) array* | (Optional) If non-nil, TopologySpreadConstraints sets the topology spread constraints of the deployment's pod template. TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) If non-nil, Tolerations sets the tolerations field of the deployment's pod template. | ### GatewayDeploymentPodTemplate GatewayDeploymentPodTemplate allows customization of the pod template of gateway deployments. *Appears in:* - [GatewayDeploymentSpec](#gatewaydeploymentspec) | Field | Description | | -------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[GatewayDeploymentPodSpec](#gatewaydeploymentpodspec)* | (Optional) | ### GatewayDeploymentSpec GatewayDeploymentSpec allows customization of the spec of gateway deployments. *Appears in:* - [GatewayDeployment](#gatewaydeployment) | Field | Description | | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | | `replicas` *integer* | (Optional) If non-nil, Replicas sets the number of replicas for the deployment. | | `template` *[GatewayDeploymentPodTemplate](#gatewaydeploymentpodtemplate)* | (Optional) | | `strategy` *[GatewayDeploymentStrategy](#gatewaydeploymentstrategy)* | (Optional) The deployment strategy to use to replace existing pods with new ones. | ### GatewayDeploymentStrategy GatewayDeploymentStrategy allows customization of the deployment strategy for gateway deployments. If GatewayDeployment.Spec.Strategy is non-nil, gateway deployments are set to use a rolling update strategy, with the parameters specified in GatewayDeployment.Spec.Strategy. Only RollingUpdate is supported at this time so the Type field is not exposed. *Appears in:* - [GatewayDeploymentSpec](#gatewaydeploymentspec) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | | `rollingUpdate` *[RollingUpdateDeployment](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#rollingupdatedeployment-v1-apps)* | (Optional) | ### GatewayKind *Underlying type:* *string* *Validation:* - Enum: \[Deployment DaemonSet] *Appears in:* - [GatewayClassSpec](#gatewayclassspec) | Value | Description | | ------------ | ----------- | | `Deployment` | | | `DaemonSet` | | ### GatewayService GatewayService allows customization of the Services that front Gateways. *Appears in:* - [GatewayClassSpec](#gatewayclassspec) | Field | Description | | -------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[GatewayServiceSpec](#gatewayservicespec)* | (Optional) | ### GatewayServiceSpec GatewayServiceSpec allows customization of the services that front gateway deployments. The LoadBalancer fields allow customization of the corresponding fields in the Kubernetes ServiceSpec. These can be used for some cloud-independent control of the external load balancer that is provisioned for each Gateway. For finer-grained cloud-specific control please use the Metadata.Annotations field in GatewayService. *Appears in:* - [GatewayService](#gatewayservice) | Field | Description | | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `loadBalancerClass` *string* | (Optional) | | `allocateLoadBalancerNodePorts` *boolean* | (Optional) | | `loadBalancerSourceRanges` *string array* | (Optional) | | `loadBalancerIP` *string* | (Optional) | | `patch` *[KubernetesPatchSpec](#kubernetespatchspec)* | (Optional) Patch allows the Service for a gateway to be patched in ways that aren't more explicitly supported by the fields above. For example, the following YAML could be used to set the Service's healthCheckNodePort: patch: type: StrategicMerge value: spec: healthCheckNodePort: 12345 | ### Goldmane | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `Goldmane` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[GoldmaneSpec](#goldmanespec)* | | | `status` *[GoldmaneStatus](#goldmanestatus)* | | ### GoldmaneDeployment GoldmaneDeployment is the configuration for the goldmane Deployment. *Appears in:* - [GoldmaneSpec](#goldmanespec) | Field | Description | | ---------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[GoldmaneDeploymentSpec](#goldmanedeploymentspec)* | (Optional) Spec is the specification of the goldmane Deployment. | ### GoldmaneDeploymentContainer *Appears in:* - [GoldmaneDeploymentPodSpec](#goldmanedeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### GoldmaneDeploymentPodSpec GoldmaneDeploymentPodSpec is the goldmane Deployment's PodSpec. *Appears in:* - [GoldmaneDeploymentPodTemplateSpec](#goldmanedeploymentpodtemplatespec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity is a group of affinity scheduling rules for the goldmane pods. | | `containers` *[GoldmaneDeploymentContainer](#goldmanedeploymentcontainer) array* | (Optional) Containers is a list of goldmane containers. If specified, this overrides the specified EGW Deployment containers. If omitted, the goldmane Deployment will use its default values for its containers. | | `nodeSelector` *object (keys:string, values:string)* | (Optional) NodeSelector gives more control over the nodes where the goldmane pods will run on. | | `terminationGracePeriodSeconds` *integer* | (Optional) TerminationGracePeriodSeconds defines the termination grace period of the goldmane pods in seconds. | | `topologySpreadConstraints` *[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#topologyspreadconstraint-v1-core) array* | (Optional) TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations is the goldmane pod's tolerations. If specified, this overrides any tolerations that may be set on the goldmane Deployment. If omitted, the goldmane Deployment will use its default value for tolerations. | | `priorityClassName` *string* | (Optional) PriorityClassName allows to specify a PriorityClass resource to be used. | ### GoldmaneDeploymentPodTemplateSpec GoldmaneDeploymentPodTemplateSpec is the goldmane Deployment's PodTemplateSpec *Appears in:* - [GoldmaneDeploymentSpec](#goldmanedeploymentspec) | Field | Description | | ---------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[GoldmaneDeploymentPodSpec](#goldmanedeploymentpodspec)* | (Optional) Spec is the goldmane Deployment's PodSpec. | ### GoldmaneDeploymentSpec GoldmaneDeploymentSpec defines configuration for the goldmane Deployment. *Appears in:* - [GoldmaneDeployment](#goldmanedeployment) | Field | Description | | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `minReadySeconds` *integer* | (Optional) MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the goldmane Deployment. If omitted, the goldmane Deployment will use its default value for minReadySeconds. | | `template` *[GoldmaneDeploymentPodTemplateSpec](#goldmanedeploymentpodtemplatespec)* | (Optional) Template describes the goldmane Deployment pod that will be created. | | `strategy` *[GoldmaneDeploymentStrategy](#goldmanedeploymentstrategy)* | (Optional) The deployment strategy to use to replace existing pods with new ones. | ### GoldmaneDeploymentStrategy *Appears in:* - [GoldmaneDeploymentSpec](#goldmanedeploymentspec) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | | `rollingUpdate` *[RollingUpdateDeployment](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#rollingupdatedeployment-v1-apps)* | (Optional) Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate. to be. | ### GoldmaneSpec *Appears in:* - [Goldmane](#goldmane) | Field | Description | | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `goldmaneDeployment` *[GoldmaneDeployment](#goldmanedeployment)* | | | `metricsPort` *integer* | (Optional) MetricsPort configures the port that Goldmane uses to serve Prometheus metrics. When set to a non-zero value, Goldmane will expose a /metrics endpoint on the given port. Set to zero to disable metrics. If omitted, metrics are disabled. | ### GoldmaneStatus GoldmaneStatus defines the observed state of Goldmane *Appears in:* - [Goldmane](#goldmane) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `conditions` *[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#condition-v1-meta) array* | (Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types. | ### GuardianDeployment GuardianDeployment is the configuration for the guardian Deployment. *Appears in:* - [ManagementClusterConnectionSpec](#managementclusterconnectionspec) | Field | Description | | ---------------------------------------------------------- | ---------------------------------------------------------------- | | `spec` *[GuardianDeploymentSpec](#guardiandeploymentspec)* | (Optional) Spec is the specification of the guardian Deployment. | ### GuardianDeploymentContainer GuardianDeploymentContainer is a guardian Deployment container. *Appears in:* - [GuardianDeploymentPodSpec](#guardiandeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the guardian Deployment container by name. Supported values are: tigera-guardian | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named guardian Deployment container's resources. If omitted, the guardian Deployment will use its default value for this container's resources. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### GuardianDeploymentInitContainer GuardianDeploymentInitContainer is a guardian Deployment init container. *Appears in:* - [GuardianDeploymentPodSpec](#guardiandeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the guardian Deployment init container by name. | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named guardian Deployment init container's resources. If omitted, the guardian Deployment will use its default value for this init container's resources. | ### GuardianDeploymentPodSpec GuardianDeploymentPodSpec is the guardian Deployment's PodSpec. *Appears in:* - [GuardianDeploymentPodTemplateSpec](#guardiandeploymentpodtemplatespec) | Field | Description | | -------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `initContainers` *[GuardianDeploymentInitContainer](#guardiandeploymentinitcontainer) array* | (Optional) InitContainers is a list of guardian init containers. If specified, this overrides the specified guardian Deployment init containers. If omitted, the guardian Deployment will use its default values for its init containers. | | `containers` *[GuardianDeploymentContainer](#guardiandeploymentcontainer) array* | (Optional) Containers is a list of guardian containers. If specified, this overrides the specified guardian Deployment containers. If omitted, the guardian Deployment will use its default values for its containers. | ### GuardianDeploymentPodTemplateSpec GuardianDeploymentPodTemplateSpec is the guardian Deployment's PodTemplateSpec *Appears in:* - [GuardianDeploymentSpec](#guardiandeploymentspec) | Field | Description | | ---------------------------------------------------------------- | ----------------------------------------------------- | | `spec` *[GuardianDeploymentPodSpec](#guardiandeploymentpodspec)* | (Optional) Spec is the guardian Deployment's PodSpec. | ### GuardianDeploymentSpec GuardianDeploymentSpec defines configuration for the guardian Deployment. *Appears in:* - [GuardianDeployment](#guardiandeployment) | Field | Description | | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------- | | `template` *[GuardianDeploymentPodTemplateSpec](#guardiandeploymentpodtemplatespec)* | (Optional) Template describes the guardian Deployment pod that will be created. | ### HTTPProbe HTTPProbe defines the HTTP probe configuration for Egress Gateway. *Appears in:* - [EgressGatewayFailureDetection](#egressgatewayfailuredetection) | Field | Description | | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | `urls` *string array* | URLs define the list of HTTP probe URLs. Egress Gateway will probe each URL periodically.If all probes fail, Egress Gateway will report non-ready. | | `intervalSeconds` *integer* | (Optional) IntervalSeconds defines the interval of HTTP probes. Used when URLs is non-empty. Default: 10 | | `timeoutSeconds` *integer* | (Optional) TimeoutSeconds defines the timeout value of HTTP probes. Used when URLs is non-empty. Default: 30 | ### HostPortsType *Underlying type:* *string* HostPortsType specifies host port support. One of: Enabled, Disabled *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### HostScope *Underlying type:* *string* HostScope determines the set of hosts that forward logs to a given store. *Validation:* - Enum: \[All NonClusterOnly] *Appears in:* - [S3StoreSpec](#s3storespec) - [SplunkStoreSpec](#splunkstorespec) - [SyslogStoreSpec](#syslogstorespec) | Value | Description | | ---------------- | ----------- | | `All` | | | `NonClusterOnly` | | ### ICMPProbe ICMPProbe defines the ICMP probe configuration for Egress Gateway. *Appears in:* - [EgressGatewayFailureDetection](#egressgatewayfailuredetection) | Field | Description | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | | `ips` *string array* | IPs define the list of ICMP probe IPs. Egress Gateway will probe each IP periodically. If all probes fail, Egress Gateway will report non-ready. | | `intervalSeconds` *integer* | (Optional) IntervalSeconds defines the interval of ICMP probes. Used when IPs is non-empty. Default: 5 | | `timeoutSeconds` *integer* | (Optional) TimeoutSeconds defines the timeout value of ICMP probes. Used when IPs is non-empty. Default: 15 | ### IPAMPluginType *Underlying type:* *string* *Appears in:* - [IPAMSpec](#ipamspec) | Value | Description | | ----------- | ----------- | | `Calico` | | | `HostLocal` | | | `AmazonVPC` | | | `AzureVNET` | | ### IPAMSpec IPAMSpec contains configuration for pod IP address management. *Appears in:* - [CNISpec](#cnispec) | Field | Description | | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `type` *[IPAMPluginType](#ipamplugintype)* | Specifies the IPAM plugin that will be used in the Calico or Calico Enterprise installation. \* For CNI Plugin Calico, this field defaults to Calico. \* For CNI Plugin GKE, this field defaults to HostLocal. \* For CNI Plugin AzureVNET, this field defaults to AzureVNET. \* For CNI Plugin AmazonVPC, this field defaults to AmazonVPC. The IPAM plugin is installed and configured only if the CNI plugin is set to Calico, for all other values of the CNI plugin the plugin binaries and CNI config is a dependency that is expected to be installed separately. Default: Calico | ### IPPool *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Field | Description | | ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is the name of the IP pool. If omitted, this will be generated. | | `cidr` *string* | CIDR contains the address range for the IP Pool in classless inter-domain routing format. | | `encapsulation` *[EncapsulationType](#encapsulationtype)* | (Optional) Encapsulation specifies the encapsulation type that will be used with the IP Pool. Default: IPIP | | `natOutgoing` *[NATOutgoingType](#natoutgoingtype)* | (Optional) NATOutgoing specifies if NAT will be enabled or disabled for outgoing traffic. Default: Enabled | | `nodeSelector` *string* | (Optional) NodeSelector specifies the node selector that will be set for the IP Pool. Default: 'all()' | | `blockSize` *integer* | (Optional) BlockSize specifies the CIDR prefex length to use when allocating per-node IP blocks from the main IP pool CIDR. Default: 26 (IPv4), 122 (IPv6) | | `disableBGPExport` *boolean* | (Optional) DisableBGPExport specifies whether routes from this IP pool's CIDR are exported over BGP. Default: false | | `disableNewAllocations` *boolean* | DisableNewAllocations specifies whether or not new IP allocations are allowed from this pool. This is useful when you want to prevent new pods from receiving IP addresses from this pool, without impacting any existing pods that have already been assigned addresses from this pool. | | `allowedUses` *[IPPoolAllowedUse](#ippoolalloweduse) array* | AllowedUse controls what the IP pool will be used for. If not specified or empty, defaults to \["Tunnel", "Workload"] for back-compatibility | | `assignmentMode` *[AssignmentMode](#assignmentmode)* | AssignmentMode determines if IP addresses from this pool should be assigned automatically or on request only | ### IPPoolAllowedUse *Underlying type:* *string* *Appears in:* - [IPPool](#ippool) | Value | Description | | -------------- | ----------- | | `Workload` | | | `Tunnel` | | | `LoadBalancer` | | ### Image *Appears in:* - [ImageSetSpec](#imagesetspec) | Field | Description | | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `image` *string* | Image is an image that the operator deploys and instead of using the built in tag the operator will use the Digest for the image identifier. The value should be the *original* image name without registry or tag or digest. For the image `docker.io/calico/node:v3.17.1` it should be represented as `calico/node` The "Installation" spec allows defining custom image registries, paths or prefixes. Even for custom images such as example.com/custompath/customprefix-calico-node:v3.17.1, this value should still be `calico/node`. | | `digest` *string* | Digest is the image identifier that will be used for the Image. The field should not include a leading `@` and must be prefixed with `sha256:`. | ### ImageSet ImageSet is used to specify image digests for the images that the operator deploys. The name of the ImageSet is expected to be in the format `-`. The `variant` used is `enterprise` if the InstallationSpec Variant is `CalicoEnterprise` or `TigeraSecureEnterprise`, otherwise it is `calico`. The `release` must match the version of the variant that the operator is built to deploy, this version can be obtained by passing the `--version` flag to the operator binary. | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `ImageSet` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[ImageSetSpec](#imagesetspec)* | | ### ImageSetSpec ImageSetSpec defines the desired state of ImageSet. *Appears in:* - [ImageSet](#imageset) | Field | Description | | -------------------------------- | -------------------------------------------------------------------------------------------------------- | | `images` *[Image](#image) array* | Images is the list of images to use digests. All images that the operator will deploy must be specified. | ### Impersonation Impersonation defines the rules for allowing impersonation. *Appears in:* - [ManagementClusterConnectionSpec](#managementclusterconnectionspec) | Field | Description | | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `users` *string array* | (Optional) Users is a list of users that can be impersonated. An empty list infers all users can be impersonated, a null value means none. | | `groups` *string array* | (Optional) Groups is a list of group names that can be impersonated. An empty list infers all groups can be impersonated, a null values means none. | | `serviceAccounts` *string array* | (Optional) ServiceAccounts is a list of service account names that can be impersonated. An empty list infers all service accounts can be impersonated, a null values means none. | ### Installation Installation configures an installation of Calico or Calico Enterprise. At most one instance of this resource is supported. It must be named "default". The Installation API installs core networking and network policy components, and provides general install-time configuration. | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------ | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `Installation` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[InstallationSpec](#installationspec)* | Specification of the desired state for the Calico or Calico Enterprise installation. | | `status` *[InstallationStatus](#installationstatus)* | Most recently observed state for the Calico or Calico Enterprise installation. | ### InstallationSpec InstallationSpec defines configuration for a Calico or Calico Enterprise installation. *Appears in:* - [Installation](#installation) - [InstallationStatus](#installationstatus) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `variant` *[ProductVariant](#productvariant)* | (Optional) Variant is the product to install - one of Calico or CalicoEnterprise. TigeraSecureEnterprise is also accepted as a deprecated alias for CalicoEnterprise. Default: Calico | | `registry` *string* | (Optional) Registry is the default Docker registry used for component Docker images. If specified then the given value must end with a slash character (`/`) and all images will be pulled from this registry. If not specified then the default registries will be used. A special case value, UseDefault, is supported to explicitly specify the default registries will be used. Image format: `/:` This option allows configuring the `` portion of the above format. | | `imagePath` *string* | (Optional) ImagePath allows for the path part of an image to be specified. If specified then the specified value will be used as the image path for each image. If not specified or empty, the default for each image will be used. A special case value, UseDefault, is supported to explicitly specify the default image path will be used for each image. Image format: `/:` This option allows configuring the `` portion of the above format. | | `imagePrefix` *string* | (Optional) ImagePrefix allows for the prefix part of an image to be specified. If specified then the given value will be used as a prefix on each image. If not specified or empty, no prefix will be used. A special case value, UseDefault, is supported to explicitly specify the default image prefix will be used for each image. Image format: `/:` This option allows configuring the `` portion of the above format. | | `imagePullSecrets` *[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#localobjectreference-v1-core) array* | (Optional) ImagePullSecrets is an array of references to container registry pull secrets to use. These are applied to all images to be pulled. | | `imagePullPolicy` *[PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#pullpolicy-v1-core)* | (Optional) ImagePullPolicy is the pull policy applied to containers in pods rendered by the operator that do not explicitly set their own pull policy. If unset, defaults to IfNotPresent. This is useful in air-gapped environments where images are pre-loaded onto nodes and must not be re-pulled from a remote registry. | | `kubernetesProvider` *[Provider](#provider)* | (Optional) KubernetesProvider specifies a particular provider of the Kubernetes platform and enables provider-specific configuration. If the specified value is empty, the Operator will attempt to automatically determine the current provider. If the specified value is not empty, the Operator will still attempt auto-detection, but will additionally compare the auto-detected value to the specified value to confirm they match. | | `cni` *[CNISpec](#cnispec)* | (Optional) CNI specifies the CNI that will be used by this installation. | | `calicoNetwork` *[CalicoNetworkSpec](#caliconetworkspec)* | (Optional) CalicoNetwork specifies networking configuration options for Calico. | | `typhaAffinity` *[TyphaAffinity](#typhaaffinity)* | (Optional) Deprecated. Please use Installation.Spec.TyphaDeployment instead. TyphaAffinity allows configuration of node affinity characteristics for Typha pods. | | `controlPlaneNodeSelector` *object (keys:string, values:string)* | (Optional) ControlPlaneNodeSelector is used to select control plane nodes on which to run Calico components. This is globally applied to all resources created by the operator excluding daemonsets. | | `controlPlaneTolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) ControlPlaneTolerations specify tolerations which are then globally applied to all resources created by the operator. | | `controlPlaneReplicas` *integer* | (Optional) ControlPlaneReplicas defines how many replicas of the control plane core components will be deployed. This field applies to all control plane components that support High Availability. Defaults to 2. | | `nodeMetricsPort` *integer* | (Optional) NodeMetricsPort specifies which port calico/node serves prometheus metrics on. By default, metrics are not enabled. If specified, this overrides any FelixConfiguration resources which may exist. If omitted, then prometheus metrics may still be configured through FelixConfiguration. | | `typhaMetricsPort` *integer* | (Optional) TyphaMetricsPort specifies which port calico/typha serves prometheus metrics on. By default, metrics are not enabled. | | `flexVolumePath` *string* | (Optional) FlexVolumePath optionally specifies a custom path for FlexVolume. If not specified, FlexVolume will be enabled by default. If set to 'None', FlexVolume will be disabled. The default is based on the kubernetesProvider. | | `kubeletVolumePluginPath` *string* | (Optional) KubeletVolumePluginPath optionally specifies enablement of Calico CSI plugin. If not specified, CSI will be enabled by default. If set to 'None', CSI will be disabled. Default: /var/lib/kubelet | | `nodeUpdateStrategy` *[DaemonSetUpdateStrategy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#daemonsetupdatestrategy-v1-apps)* | (Optional) NodeUpdateStrategy can be used to customize the desired update strategy, such as the MaxUnavailable field. | | `componentResources` *[ComponentResource](#componentresource) array* | (Optional) Deprecated. Please use CalicoNodeDaemonSet, TyphaDeployment, and KubeControllersDeployment. ComponentResources can be used to customize the resource requirements for each component. Node, Typha, and KubeControllers are supported for installations. | | `certificateManagement` *[CertificateManagement](#certificatemanagement)* | (Optional) CertificateManagement configures pods to submit a CertificateSigningRequest to the certificates.k8s.io/v1 API in order to obtain TLS certificates. This feature requires that you bring your own CSR signing and approval process, otherwise pods will be stuck during initialization. | | `tlsCipherSuites` *[TLSCipherSuites](#tlsciphersuites)* | (Optional) TLSCipherSuites defines the cipher suite list that the TLS protocol should use during secure communication. | | `nonPrivileged` *[NonPrivilegedType](#nonprivilegedtype)* | (Optional) Deprecated. NonPrivileged is deprecated and will be removed from the API in a future release. Enabling this field is not supported and will cause errors. NonPrivileged configures Calico to be run in non-privileged containers as non-root users where possible. | | `calicoNodeDaemonSet` *[CalicoNodeDaemonSet](#caliconodedaemonset)* | (Optional) CalicoNodeDaemonSet configures the calico-node DaemonSet. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence. | | `csiNodeDriverDaemonSet` *[CSINodeDriverDaemonSet](#csinodedriverdaemonset)* | (Optional) CSINodeDriverDaemonSet configures the csi-node-driver DaemonSet. | | `calicoKubeControllersDeployment` *[CalicoKubeControllersDeployment](#calicokubecontrollersdeployment)* | (Optional) CalicoKubeControllersDeployment configures the calico-kube-controllers Deployment. If used in conjunction with the deprecated ComponentResources, then these overrides take precedence. | | `typhaDeployment` *[TyphaDeployment](#typhadeployment)* | (Optional) TyphaDeployment configures the typha Deployment. If used in conjunction with the deprecated ComponentResources or TyphaAffinity, then these overrides take precedence. | | `typhaPodDisruptionBudget` *[PodDisruptionBudgetOverride](#poddisruptionbudgetoverride)* | (Optional) TyphaPodDisruptionBudget configures the PodDisruptionBudget for the calico-typha Deployment. Fields left unset fall back to the operator's defaults. The PDB's selector is managed by the operator and cannot be overridden. | | `calicoWindowsUpgradeDaemonSet` *[CalicoWindowsUpgradeDaemonSet](#calicowindowsupgradedaemonset)* | Deprecated. The CalicoWindowsUpgradeDaemonSet is deprecated and will be removed from the API in the future. CalicoWindowsUpgradeDaemonSet configures the calico-windows-upgrade DaemonSet. | | `calicoNodeWindowsDaemonSet` *[CalicoNodeWindowsDaemonSet](#caliconodewindowsdaemonset)* | CalicoNodeWindowsDaemonSet configures the calico-node-windows DaemonSet. | | `fipsMode` *[FIPSMode](#fipsmode)* | (Optional) Deprecated. FIPS mode is no longer supported. Setting fipsMode to Enabled marks the installation degraded. | | `logging` *[Logging](#logging)* | (Optional) Logging Configuration for Components | | `windowsNodes` *[WindowsNodeSpec](#windowsnodespec)* | (Optional) Windows Configuration | | `serviceCIDRs` *string array* | (Optional) Kubernetes Service CIDRs. Specifying this is required when using Calico for Windows. | | `azure` *[Azure](#azure)* | (Optional) Azure is used to configure azure provider specific options. | | `proxy` *[Proxy](#proxy)* | (Optional) Proxy is used to configure the HTTP(S) proxy settings that will be applied to Tigera containers that connect to destinations outside the cluster. It is expected that NO\_PROXY is configured such that destinations within the cluster (including the API server) are exempt from proxying. | | `networkPolicy` *[NetworkPolicySpec](#networkpolicyspec)* | (Optional) NetworkPolicy configures how the operator manages the NetworkPolicies and GlobalNetworkPolicies it installs to protect the Calico components it manages. | ### InstallationStatus InstallationStatus defines the observed state of the Calico or Calico Enterprise installation. *Appears in:* - [Installation](#installation) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `variant` *[ProductVariant](#productvariant)* | Variant is the most recently observed installed variant - one of Calico or CalicoEnterprise. TigeraSecureEnterprise is a deprecated alias for CalicoEnterprise. | | `mtu` *integer* | MTU is the most recently observed value for pod network MTU. This may be an explicitly configured value, or based on Calico's native auto-detetion. | | `imageSet` *string* | (Optional) ImageSet is the name of the ImageSet being used, if there is an ImageSet that is being used. If an ImageSet is not being used then this will not be set. | | `computed` *[InstallationSpec](#installationspec)* | (Optional) Computed is the final installation including overlaid resources. | | `calicoVersion` *string* | CalicoVersion shows the current running version of calico. CalicoVersion along with Variant is needed to know the exact version deployed. | | `conditions` *[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#condition-v1-meta) array* | (Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types. | ### IntrusionDetection IntrusionDetection installs the components required for Tigera intrusion detection. At most one instance of this resource is supported. It must be named "tigera-secure". | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `IntrusionDetection` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[IntrusionDetectionSpec](#intrusiondetectionspec)* | Specification of the desired state for Tigera intrusion detection. | | `status` *[IntrusionDetectionStatus](#intrusiondetectionstatus)* | Most recently observed state for Tigera intrusion detection. | ### IntrusionDetectionComponentName *Underlying type:* *string* *Appears in:* - [IntrusionDetectionComponentResource](#intrusiondetectioncomponentresource) | Value | Description | | ---------------------- | ----------- | | `DeepPacketInspection` | | ### IntrusionDetectionComponentResource The ComponentResource struct associates a ResourceRequirements with a component by name *Appears in:* - [IntrusionDetectionSpec](#intrusiondetectionspec) | Field | Description | | -------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | | `componentName` *[IntrusionDetectionComponentName](#intrusiondetectioncomponentname)* | ComponentName is an enum which identifies the component | | `resourceRequirements` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | ResourceRequirements allows customization of limits and requests for compute resources such as cpu and memory. | ### IntrusionDetectionControllerDeployment IntrusionDetectionControllerDeployment is the configuration for the IntrusionDetectionController Deployment. *Appears in:* - [IntrusionDetectionSpec](#intrusiondetectionspec) | Field | Description | | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | | `spec` *[IntrusionDetectionControllerDeploymentSpec](#intrusiondetectioncontrollerdeploymentspec)* | (Optional) Spec is the specification of the IntrusionDetectionController Deployment. | ### IntrusionDetectionControllerDeploymentContainer IntrusionDetectionControllerDeploymentContainer is a IntrusionDetectionController Deployment container. *Appears in:* - [IntrusionDetectionControllerDeploymentPodSpec](#intrusiondetectioncontrollerdeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the IntrusionDetectionController Deployment container by name. Supported values are: controller, webhooks-processor | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named IntrusionDetectionController Deployment container's resources. If omitted, the IntrusionDetection Deployment will use its default value for this container's resources. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### IntrusionDetectionControllerDeploymentInitContainer IntrusionDetectionControllerDeploymentInitContainer is a IntrusionDetectionController Deployment init container. *Appears in:* - [IntrusionDetectionControllerDeploymentPodSpec](#intrusiondetectioncontrollerdeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the IntrusionDetectionController Deployment init container by name. Supported values are: intrusion-detection-tls-key-cert-provisioner | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named IntrusionDetectionController Deployment init container's resources. If omitted, the IntrusionDetectionController Deployment will use its default value for this init container's resources. | ### IntrusionDetectionControllerDeploymentPodSpec IntrusionDetectionControllerDeploymentPodSpec is the IntrusionDetectionController Deployment's PodSpec. *Appears in:* - [IntrusionDetectionControllerDeploymentPodTemplateSpec](#intrusiondetectioncontrollerdeploymentpodtemplatespec) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `initContainers` *[IntrusionDetectionControllerDeploymentInitContainer](#intrusiondetectioncontrollerdeploymentinitcontainer) array* | (Optional) InitContainers is a list of IntrusionDetectionController init containers. If specified, this overrides the specified IntrusionDetectionController Deployment init containers. If omitted, the IntrusionDetectionController Deployment will use its default values for its init containers. | | `containers` *[IntrusionDetectionControllerDeploymentContainer](#intrusiondetectioncontrollerdeploymentcontainer) array* | (Optional) Containers is a list of IntrusionDetectionController containers. If specified, this overrides the specified IntrusionDetectionController Deployment containers. If omitted, the IntrusionDetectionController Deployment will use its default values for its containers. | ### IntrusionDetectionControllerDeploymentPodTemplateSpec IntrusionDetectionControllerDeploymentPodTemplateSpec is the IntrusionDetectionController Deployment's PodTemplateSpec *Appears in:* - [IntrusionDetectionControllerDeploymentSpec](#intrusiondetectioncontrollerdeploymentspec) | Field | Description | | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | | `spec` *[IntrusionDetectionControllerDeploymentPodSpec](#intrusiondetectioncontrollerdeploymentpodspec)* | (Optional) Spec is the IntrusionDetectionController Deployment's PodSpec. | ### IntrusionDetectionControllerDeploymentSpec IntrusionDetectionControllerDeploymentSpec defines configuration for the IntrusionDetectionController Deployment. *Appears in:* - [IntrusionDetectionControllerDeployment](#intrusiondetectioncontrollerdeployment) | Field | Description | | ---------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | `template` *[IntrusionDetectionControllerDeploymentPodTemplateSpec](#intrusiondetectioncontrollerdeploymentpodtemplatespec)* | (Optional) Template describes the IntrusionDetectionController Deployment pod that will be created. | ### IntrusionDetectionSpec IntrusionDetectionSpec defines the desired state of Tigera intrusion detection capabilities. *Appears in:* - [IntrusionDetection](#intrusiondetection) | Field | Description | | ---------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | `componentResources` *[IntrusionDetectionComponentResource](#intrusiondetectioncomponentresource) array* | (Optional) ComponentResources can be used to customize the resource requirements for each component. Only DeepPacketInspection is supported for this spec. | | `anomalyDetection` *[AnomalyDetectionSpec](#anomalydetectionspec)* | (Optional) AnomalyDetection is now deprecated, and configuring it has no effect. | | `intrusionDetectionControllerDeployment` *[IntrusionDetectionControllerDeployment](#intrusiondetectioncontrollerdeployment)* | (Optional) IntrusionDetectionControllerDeployment configures the IntrusionDetection Controller Deployment. | | `deepPacketInspectionDaemonset` *[DeepPacketInspectionDaemonset](#deeppacketinspectiondaemonset)* | (Optional) DeepPacketInspectionDaemonset configures the DPI Daemonset | ### IntrusionDetectionStatus IntrusionDetectionStatus defines the observed state of Tigera intrusion detection capabilities. *Appears in:* - [IntrusionDetection](#intrusiondetection) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `state` *string* | State provides user-readable status. | | `conditions` *[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#condition-v1-meta) array* | (Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types. | ### Istio Istio is the Schema for the istios API | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `Istio` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[IstioSpec](#istiospec)* | | | `status` *[IstioStatus](#istiostatus)* | | ### IstioCNIDaemonset IstioCNIDaemonset defines customized settings for the Istio CNI plugin. *Appears in:* - [IstioSpec](#istiospec) | Field | Description | | -------------------------------------------------------- | ---------------------------------------------------------------------------------- | | `spec` *[IstioCNIDaemonsetSpec](#istiocnidaemonsetspec)* | (Optional) Spec allows users to specify custom fields for the Istio CNI Daemonset. | ### IstioCNIDaemonsetPodSpec IstioCNIDaemonsetPodSpec defines the pod spec for customizing the Istio CNI Daemonset. *Appears in:* - [IstioCNIDaemonsetSpecTemplate](#istiocnidaemonsetspectemplate) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity specifies the affinity for the deployment. | | `nodeSelector` *object (keys:string, values:string)* | (Optional) NodeSelector specifies the node affinity for the deployment. | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources specifies the compute resources required for the deployment. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations specifies the tolerations for the deployment. | ### IstioCNIDaemonsetSpec IstioCNIDaemonsetSpec defines the spec for customizing the Istio CNI Daemonset. *Appears in:* - [IstioCNIDaemonset](#istiocnidaemonset) | Field | Description | | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | | `template` *[IstioCNIDaemonsetSpecTemplate](#istiocnidaemonsetspectemplate)* | (Optional) Template allows users to specify custom fields for the Istio CNI Daemonset. | ### IstioCNIDaemonsetSpecTemplate IstioCNIDaemonsetSpecTemplate defines the template for customizing the Istio CNI Daemonset. *Appears in:* - [IstioCNIDaemonsetSpec](#istiocnidaemonsetspec) | Field | Description | | -------------------------------------------------------------- | ---------------------------------------------------------------------------------- | | `spec` *[IstioCNIDaemonsetPodSpec](#istiocnidaemonsetpodspec)* | (Optional) Spec allows users to specify custom fields for the Istio CNI Daemonset. | ### IstioSpec IstioSpec defines the desired state of Istio *Appears in:* - [Istio](#istio) | Field | Description | | ----------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `istiod` *[IstiodDeployment](#istioddeployment)* | (Optional) IstiodDeployment defines the resource requirements and node selector for the Istio deployment. | | `istioCNI` *[IstioCNIDaemonset](#istiocnidaemonset)* | (Optional) IstioCNIDaemonset defines the resource requirements for the Istio CNI plugin. | | `ztunnel` *[ZTunnelDaemonset](#ztunneldaemonset)* | (Optional) ZTunnelDaemonset defines the resource requirements for the ZTunnelDaemonset component. | | `waypointLogging` *[LogCollectionStatusType](#logcollectionstatustype)* | (Optional) WaypointLogging controls whether L7 logging is enabled on every Gateway using the istio-waypoint GatewayClass. When Enabled (the default), the operator injects an l7-collector sidecar into each waypoint pod via class-level defaults. When Disabled, no sidecar is injected and the associated EnvoyFilters are not created. Allowed values are Enabled or Disabled. | | `dscpMark` *[DSCP](#dscp)* | (Optional) DSCPMark define the value of the DSCP mark done by Felix and recognised by Istio CNI for Transparent NetworkPolicies. | ### IstioStatus IstioStatus defines the observed state of Istio *Appears in:* - [Istio](#istio) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `conditions` *[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#condition-v1-meta) array* | Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types. | ### IstiodDeployment IstiodDeployment defines customized settings for the Istio deployment. *Appears in:* - [IstioSpec](#istiospec) | Field | Description | | ------------------------------------------------------ | -------------------------------------------------------------------------------- | | `spec` *[IstiodDeploymentSpec](#istioddeploymentspec)* | (Optional) Spec allows users to specify custom fields for the Istiod Deployment. | ### IstiodDeploymentPodSpec IstiodDeploymentPodSpec defines the pod spec for customizing the Istiod Deployment. *Appears in:* - [IstiodDeploymentSpecTemplate](#istioddeploymentspectemplate) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity specifies the affinity for the deployment. | | `nodeSelector` *object (keys:string, values:string)* | (Optional) NodeSelector specifies the node affinity for the deployment. | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources specifies the compute resources required for the deployment. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations specifies the tolerations for the deployment. | ### IstiodDeploymentSpec IstiodDeploymentSpec defines the spec for customizing the Istiod Deployment. *Appears in:* - [IstiodDeployment](#istioddeployment) | Field | Description | | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | | `template` *[IstiodDeploymentSpecTemplate](#istioddeploymentspectemplate)* | (Optional) Template allows users to specify custom fields for the Istiod Deployment. | ### IstiodDeploymentSpecTemplate IstiodDeploymentSpecTemplate defines the template for customizing the Istiod Deployment. *Appears in:* - [IstiodDeploymentSpec](#istioddeploymentspec) | Field | Description | | ------------------------------------------------------------ | -------------------------------------------------------------------------------- | | `spec` *[IstiodDeploymentPodSpec](#istioddeploymentpodspec)* | (Optional) Spec allows users to specify custom fields for the Istiod Deployment. | ### KubeProxyManagementType *Underlying type:* *string* KubeProxyManagementType specifies whether kube-proxy management is enabled. *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### KubernetesAutodetectionMethod *Underlying type:* *string* KubernetesAutodetectionMethod is a method of detecting an IP address based on the Kubernetes API. One of: NodeInternalIP *Appears in:* - [NodeAddressAutodetection](#nodeaddressautodetection) | Value | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | `NodeInternalIP` | NodeInternalIP detects a node IP using the first status.Addresses entry of the relevant IP family with type NodeInternalIP on the Kubernetes nodes API. | ### L7LogCollectorDaemonSet L7LogCollectorDaemonSet is the configuration for the L7LogCollector DaemonSet. *Appears in:* - [ApplicationLayerSpec](#applicationlayerspec) | Field | Description | | -------------------------------------------------------------------- | --------------------------------------------------------------------- | | `spec` *[L7LogCollectorDaemonSetSpec](#l7logcollectordaemonsetspec)* | (Optional) Spec is the specification of the L7LogCollector DaemonSet. | ### L7LogCollectorDaemonSetContainer L7LogCollectorDaemonSetContainer is a L7LogCollector DaemonSet container. *Appears in:* - [L7LogCollectorDaemonSetPodSpec](#l7logcollectordaemonsetpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the L7LogCollector DaemonSet container by name. Supported values are: l7-collector, envoy-proxy, dikastes | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named L7LogCollector DaemonSet container's resources. If omitted, the L7LogCollector DaemonSet will use its default value for this container's resources. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### L7LogCollectorDaemonSetInitContainer L7LogCollectorDaemonSetInitContainer is a L7LogCollector DaemonSet init container. *Appears in:* - [L7LogCollectorDaemonSetPodSpec](#l7logcollectordaemonsetpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the L7LogCollector DaemonSet init container by name. | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named L7LogCollector DaemonSet init container's resources. If omitted, the L7LogCollector DaemonSet will use its default value for this init container's resources. | ### L7LogCollectorDaemonSetPodSpec L7LogCollectorDaemonSetPodSpec is the L7LogCollector DaemonSet's PodSpec. *Appears in:* - [L7LogCollectorDaemonSetPodTemplateSpec](#l7logcollectordaemonsetpodtemplatespec) | Field | Description | | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `initContainers` *[L7LogCollectorDaemonSetInitContainer](#l7logcollectordaemonsetinitcontainer) array* | (Optional) InitContainers is a list of L7LogCollector DaemonSet init containers. If specified, this overrides the specified L7LogCollector DaemonSet init containers. If omitted, the L7LogCollector DaemonSet will use its default values for its init containers. | | `containers` *[L7LogCollectorDaemonSetContainer](#l7logcollectordaemonsetcontainer) array* | (Optional) Containers is a list of L7LogCollector DaemonSet containers. If specified, this overrides the specified L7LogCollector DaemonSet containers. If omitted, the L7LogCollector DaemonSet will use its default values for its containers. | ### L7LogCollectorDaemonSetPodTemplateSpec L7LogCollectorDaemonSetPodTemplateSpec is the L7LogCollector DaemonSet's PodTemplateSpec *Appears in:* - [L7LogCollectorDaemonSetSpec](#l7logcollectordaemonsetspec) | Field | Description | | -------------------------------------------------------------------------- | ---------------------------------------------------------- | | `spec` *[L7LogCollectorDaemonSetPodSpec](#l7logcollectordaemonsetpodspec)* | (Optional) Spec is the L7LogCollector DaemonSet's PodSpec. | ### L7LogCollectorDaemonSetSpec L7LogCollectorDaemonSetSpec defines configuration for the L7LogCollector DaemonSet. *Appears in:* - [L7LogCollectorDaemonSet](#l7logcollectordaemonset) | Field | Description | | ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | | `template` *[L7LogCollectorDaemonSetPodTemplateSpec](#l7logcollectordaemonsetpodtemplatespec)* | (Optional) Template describes the L7LogCollector DaemonSet pod that will be created. | ### LinuxDataplaneOption *Underlying type:* *string* LinuxDataplaneOption controls which dataplane is to be used on Linux nodes. One of: Iptables, BPF, VPP, Nftables *Validation:* - Enum: \[Iptables BPF VPP Nftables] *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Value | Description | | ---------- | ----------- | | `Iptables` | | | `BPF` | | | `VPP` | | | `Nftables` | | ### LinuxPodInterfaceType *Underlying type:* *string* LinuxPodInterfaceType specifies the type of virtual device the Calico CNI plugin creates for the pod-side interface on Linux nodes. One of: Veth, Netkit *Validation:* - Enum: \[Veth Netkit] *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Value | Description | | -------- | ----------- | | `Veth` | | | `Netkit` | | ### LogCollectionSpec *Appears in:* - [ApplicationLayerSpec](#applicationlayerspec) | Field | Description | | ------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `collectLogs` *[LogCollectionStatusType](#logcollectionstatustype)* | (Optional) This setting enables or disable log collection. Allowed values are Enabled or Disabled. | | `logIntervalSeconds` *integer* | (Optional) Interval in seconds for sending L7 log information for processing. Default: 5 sec | | `logRequestsPerInterval` *integer* | (Optional) Maximum number of unique L7 logs that are sent LogIntervalSeconds. Adjust this to limit the number of L7 logs sent per LogIntervalSeconds to felix for further processing, use negative number to ignore limits. Default: -1 | ### LogCollectionStatusType *Underlying type:* *string* *Validation:* - Enum: \[Enabled Disabled] *Appears in:* - [IstioSpec](#istiospec) - [LogCollectionSpec](#logcollectionspec) | Value | Description | | ---------- | ----------- | | `Disabled` | | | `Enabled` | | ### LogCollector LogCollector installs the components required for Tigera flow and DNS log collection. At most one instance of this resource is supported. It must be named "tigera-secure". When created, this installs fluentd on all nodes configured to collect Tigera log data and export it to Tigera's Elasticsearch cluster as well as any additionally configured destinations. | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `LogCollector` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[LogCollectorSpec](#logcollectorspec)* | Specification of the desired state for Tigera log collection. | | `status` *[LogCollectorStatus](#logcollectorstatus)* | Most recently observed state for Tigera log collection. | ### LogCollectorSpec LogCollectorSpec defines the desired state of Tigera flow, audit, and DNS log collection. *Appears in:* - [LogCollector](#logcollector) | Field | Description | | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `additionalStores` *[AdditionalLogStoreSpec](#additionallogstorespec)* | (Optional) Configuration for exporting flow, audit, and DNS logs to external storage. | | `additionalSources` *[AdditionalLogSourceSpec](#additionallogsourcespec)* | (Optional) Configuration for importing audit logs from managed kubernetes cluster log sources. | | `collectProcessPath` *[CollectProcessPathOption](#collectprocesspathoption)* | (Optional) Configuration for enabling/disabling process path collection in flowlogs. If Enabled, this feature sets hostPID to true in order to read process cmdline. Default: Enabled | | `multiTenantManagementClusterNamespace` *string* | (Optional) If running as a multi-tenant management cluster, the namespace in which the management cluster's tenant services are running. | | `fluentdDaemonSet` *[FluentdDaemonSet](#fluentddaemonset)* | FluentdDaemonSet configures the Fluentd DaemonSet. | | `eksLogForwarderDeployment` *[EKSLogForwarderDeployment](#ekslogforwarderdeployment)* | (Optional) EKSLogForwarderDeployment configures the EKSLogForwarderDeployment Deployment. | ### LogCollectorStatus LogCollectorStatus defines the observed state of Tigera flow and DNS log collection *Appears in:* - [LogCollector](#logcollector) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `state` *string* | State provides user-readable status. | | `conditions` *[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#condition-v1-meta) array* | (Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types. | ### LogLevel *Underlying type:* *string* *Validation:* - Enum: \[Error Warning Info Debug] *Appears in:* - [CNILogging](#cnilogging) | Value | Description | | ------- | ----------- | | `Error` | | | `Warn` | | | `Info` | | | `Debug` | | ### LogSeverity *Underlying type:* *string* *Validation:* - Enum: \[Fatal Error Warn Info Debug Trace] *Appears in:* - [APIServerLogging](#apiserverlogging) - [EgressGatewaySpec](#egressgatewayspec) - [QueryServerLogging](#queryserverlogging) | Value | Description | | ------- | ----------- | | `Fatal` | | | `Error` | | | `Warn` | | | `Info` | | | `Debug` | | | `Trace` | | ### Logging *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | --------------------------------- | ----------------------------------------------------------------- | | `cni` *[CNILogging](#cnilogging)* | (Optional) Customized logging specification for calico-cni plugin | ### ManagementClusterConnection ManagementClusterConnection represents a link between a managed cluster and a management cluster. At most one instance of this resource is supported. It must be named "tigera-secure". | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `ManagementClusterConnection` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[ManagementClusterConnectionSpec](#managementclusterconnectionspec)* | | | `status` *[ManagementClusterConnectionStatus](#managementclusterconnectionstatus)* | | ### ManagementClusterConnectionSpec ManagementClusterConnectionSpec defines the desired state of ManagementClusterConnection *Appears in:* - [ManagementClusterConnection](#managementclusterconnection) | Field | Description | | ---------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `managementClusterAddr` *string* | (Optional) Specify where the managed cluster can reach the management cluster. Ex.: "10.128.0.10:30449". A managed cluster should be able to access this address. This field is used by managed clusters only. | | `tls` *[ManagementClusterTLS](#managementclustertls)* | (Optional) TLS provides options for configuring how Managed Clusters can establish an mTLS connection with the Management Cluster. | | `guardianDeployment` *[GuardianDeployment](#guardiandeployment)* | GuardianDeployment configures the guardian Deployment. | | `impersonation` *[Impersonation](#impersonation)* | (Optional) Impersonation configures the RBAC impersonation permissions for the guardian deployment. This field is not applicable to installation variant Calico as no impersonation is ever used. Otherwise, if this field is left nil, a default set of permissions will be applied. WARNING: If this field is specified, it completely replaces the default permissions. For example, providing an empty `impersonation: \{\}` block will result in guardian having NO impersonation permissions. Similarly, if you specify `users` but omit `groups`, guardian will lose its default permissions to impersonate groups. | ### ManagementClusterConnectionStatus ManagementClusterConnectionStatus defines the observed state of ManagementClusterConnection *Appears in:* - [ManagementClusterConnection](#managementclusterconnection) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `conditions` *[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#condition-v1-meta) array* | (Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types. | ### ManagementClusterTLS *Appears in:* - [ManagementClusterConnectionSpec](#managementclusterconnectionspec) | Field | Description | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `ca` *[CAType](#catype)* | CA indicates which verification method the tunnel client should use to verify the tunnel server's identity. When left blank or set to 'Tigera', the tunnel client will expect a self-signed cert to be included in the certificate bundle and will expect the cert to have a Common Name (CN) of 'voltron'. When set to 'Public', the tunnel client will use its installed system certs and will use the managementClusterAddr to verify the tunnel server's identity. Default: Tigera | ### Metadata Metadata contains the standard Kubernetes labels and annotations fields. *Appears in:* - [APIServerDeployment](#apiserverdeployment) - [APIServerDeploymentPodTemplateSpec](#apiserverdeploymentpodtemplatespec) - [CSINodeDriverDaemonSet](#csinodedriverdaemonset) - [CSINodeDriverDaemonSetPodTemplateSpec](#csinodedriverdaemonsetpodtemplatespec) - [CalicoKubeControllersDeployment](#calicokubecontrollersdeployment) - [CalicoKubeControllersDeploymentPodTemplateSpec](#calicokubecontrollersdeploymentpodtemplatespec) - [CalicoNodeDaemonSet](#caliconodedaemonset) - [CalicoNodeDaemonSetPodTemplateSpec](#caliconodedaemonsetpodtemplatespec) - [CalicoNodeWindowsDaemonSet](#caliconodewindowsdaemonset) - [CalicoNodeWindowsDaemonSetPodTemplateSpec](#caliconodewindowsdaemonsetpodtemplatespec) - [CalicoWebhooksDeployment](#calicowebhooksdeployment) - [CalicoWebhooksDeploymentPodTemplateSpec](#calicowebhooksdeploymentpodtemplatespec) - [CalicoWindowsUpgradeDaemonSet](#calicowindowsupgradedaemonset) - [CalicoWindowsUpgradeDaemonSetPodTemplateSpec](#calicowindowsupgradedaemonsetpodtemplatespec) - [GatewayCertgenJob](#gatewaycertgenjob) - [GatewayCertgenJobPodTemplate](#gatewaycertgenjobpodtemplate) - [GatewayControllerDeployment](#gatewaycontrollerdeployment) - [GatewayControllerDeploymentPodTemplate](#gatewaycontrollerdeploymentpodtemplate) - [GatewayDaemonSetPodTemplate](#gatewaydaemonsetpodtemplate) - [GatewayDeploymentPodTemplate](#gatewaydeploymentpodtemplate) - [GatewayService](#gatewayservice) - [GoldmaneDeployment](#goldmanedeployment) - [GoldmaneDeploymentPodTemplateSpec](#goldmanedeploymentpodtemplatespec) - [PodDisruptionBudgetOverride](#poddisruptionbudgetoverride) - [TyphaDeployment](#typhadeployment) - [TyphaDeploymentPodTemplateSpec](#typhadeploymentpodtemplatespec) - [WhiskerDeployment](#whiskerdeployment) - [WhiskerDeploymentPodTemplateSpec](#whiskerdeploymentpodtemplatespec) | Field | Description | | --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `labels` *object (keys:string, values:string)* | (Optional) Labels is a map of string keys and values that may match replicaset and service selectors. Each of these key/value pairs are added to the object's labels provided the key does not already exist in the object's labels. | | `annotations` *object (keys:string, values:string)* | (Optional) Annotations is a map of arbitrary non-identifying metadata. Each of these key/value pairs are added to the object's annotations provided the key does not already exist in the object's annotations. | ### Monitor Monitor is the Schema for the monitor API. At most one instance of this resource is supported. It must be named "tigera-secure". | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `Monitor` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[MonitorSpec](#monitorspec)* | | | `status` *[MonitorStatus](#monitorstatus)* | | ### MonitorSpec MonitorSpec defines the desired state of Tigera monitor. *Appears in:* - [Monitor](#monitor) | Field | Description | | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `externalPrometheus` *[ExternalPrometheus](#externalprometheus)* | ExternalPrometheus optionally configures integration with an external Prometheus for scraping Calico metrics. When specified, the operator will render resources in the defined namespace. This option can be useful for configuring scraping from git-ops tools without the need of post-installation steps. | | `prometheus` *[Prometheus](#prometheus)* | (Optional) Prometheus is the configuration for the Prometheus. | | `alertManager` *[Alertmanager](#alertmanager)* | (Optional) Alertmanager is the configuration for the Alertmanager. | ### MonitorStatus MonitorStatus defines the observed state of Tigera monitor. *Appears in:* - [Monitor](#monitor) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `state` *string* | State provides user-readable status. | | `conditions` *[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#condition-v1-meta) array* | (Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types. | ### MultiInterfaceMode *Underlying type:* *string* MultiInterfaceMode describes the method of providing multiple pod interfaces. One of: None, Multus *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Value | Description | | -------- | ----------- | | `None` | | | `Multus` | | ### NATOutgoingType *Underlying type:* *string* NATOutgoingType describe the type of outgoing NAT to use. One of: Enabled, Disabled *Appears in:* - [IPPool](#ippool) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### NamespacedName NamespacedName references an object of a known type in any namespace. *Appears in:* - [GatewayAPISpec](#gatewayapispec) - [GatewayClassSpec](#gatewayclassspec) | Field | Description | | -------------------- | ----------- | | `namespace` *string* | | | `name` *string* | | ### NativeIP *Underlying type:* *string* NativeIP defines if Egress Gateway pods should have AWS IPs. When NativeIP is enabled, the IPPools should be backed by AWS subnet. *Appears in:* - [AWSEgressGateway](#awsegressgateway) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### NetworkPolicyManagement *Underlying type:* *string* NetworkPolicyManagement specifies whether the operator manages the NetworkPolicies it installs to protect the Calico components it manages. *Validation:* - Enum: \[Enabled Disabled] *Appears in:* - [NetworkPolicySpec](#networkpolicyspec) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### NetworkPolicySpec NetworkPolicySpec configures how the operator manages the NetworkPolicies it installs. *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `managePolicies` *[NetworkPolicyManagement](#networkpolicymanagement)* | (Optional) ManagePolicies controls whether the operator creates and reconciles the NetworkPolicies and GlobalNetworkPolicies it uses to protect the Calico components it installs. When set to Disabled, the operator stops creating or updating these policies and deletes any it has already created, leaving policy management to the user. Defaults to Enabled. | ### NodeAddressAutodetection NodeAddressAutodetection provides configuration options for auto-detecting node addresses. At most one option can be used. If no detection option is specified, then IP auto detection will be disabled for this address family and IPs must be specified directly on the Node resource. *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Field | Description | | ------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `firstFound` *boolean* | (Optional) FirstFound uses default interface matching parameters to select an interface, performing best-effort filtering based on well-known interface names. | | `kubernetes` *[KubernetesAutodetectionMethod](#kubernetesautodetectionmethod)* | (Optional) Kubernetes configures Calico to detect node addresses based on the Kubernetes API. | | `interface` *string* | (Optional) Interface enables IP auto-detection based on interfaces that match the given regex. | | `skipInterface` *string* | (Optional) SkipInterface enables IP auto-detection based on interfaces that do not match the given regex. | | `canReach` *string* | (Optional) CanReach enables IP auto-detection based on which source address on the node is used to reach the specified IP or domain. | | `cidrs` *string array* | CIDRS enables IP auto-detection based on which addresses on the nodes are within one of the provided CIDRs. | ### NodeAffinity NodeAffinity is similar to \*v1.NodeAffinity, but allows us to limit available schedulers. *Appears in:* - [TyphaAffinity](#typhaaffinity) | Field | Description | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `preferredDuringSchedulingIgnoredDuringExecution` *[PreferredSchedulingTerm](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#preferredschedulingterm-v1-core) array* | (Optional) The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. | | `requiredDuringSchedulingIgnoredDuringExecution` *[NodeSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#nodeselector-v1-core)* | (Optional) WARNING: Please note that if the affinity requirements specified by this field are not met at scheduling time, the pod will NOT be scheduled onto the node. There is no fallback to another affinity rules with this setting. This may cause networking disruption or even catastrophic failure! PreferredDuringSchedulingIgnoredDuringExecution should be used for affinity unless there is a specific well understood reason to use RequiredDuringSchedulingIgnoredDuringExecution and you can guarantee that the RequiredDuringSchedulingIgnoredDuringExecution will always have sufficient nodes to satisfy the requirement. NOTE: RequiredDuringSchedulingIgnoredDuringExecution is set by default for AKS nodes, to avoid scheduling Typhas on virtual-nodes. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. | ### NonClusterHost NonClusterHost installs the components required for non-cluster host log collection. At most one instance of this resource is supported. It must be named "tigera-secure". | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `NonClusterHost` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[NonClusterHostSpec](#nonclusterhostspec)* | Specification of the desired state for non-cluster host log collection. | ### NonClusterHostSpec NonClusterHostSpec enables non-cluster hosts to connect to a cluster. *Appears in:* - [NonClusterHost](#nonclusterhost) | Field | Description | | ------------------------ | ------------------------------------------------------------------------------------------------------------------ | | `endpoint` *string* | Location of the log ingestion point for non-cluster hosts. For example: [https://1.2.3.4:443](https://1.2.3.4:443) | | `typhaEndpoint` *string* | Location of the Typha endpoint for non-cluster host Felix and Typha communication. For example: 5.6.7.8:5473 | ### NonPrivilegedType *Underlying type:* *string* NonPrivilegedType specifies whether Calico runs as permissioned or not One of: Enabled, Disabled *Appears in:* - [InstallationSpec](#installationspec) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### NotificationMode *Underlying type:* *string* *Appears in:* - [WhiskerSpec](#whiskerspec) | Value | Description | | ---------- | ----------- | | `Disabled` | | | `Enabled` | | ### PacketCaptureAPI PacketCaptureAPI is used to configure the resource requirement for PacketCaptureAPI deployment. It must be named "tigera-secure". | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `PacketCaptureAPI` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[PacketCaptureAPISpec](#packetcaptureapispec)* | Specification of the desired state for the PacketCaptureAPI. | | `status` *[PacketCaptureAPIStatus](#packetcaptureapistatus)* | Most recently observed state for the PacketCaptureAPI. | ### PacketCaptureAPIDeployment PacketCaptureAPIDeployment is the configuration for the PacketCaptureAPI Deployment. *Appears in:* - [PacketCaptureAPISpec](#packetcaptureapispec) | Field | Description | | -------------------------------------------------------------------------- | ------------------------------------------------------------------------ | | `spec` *[PacketCaptureAPIDeploymentSpec](#packetcaptureapideploymentspec)* | (Optional) Spec is the specification of the PacketCaptureAPI Deployment. | ### PacketCaptureAPIDeploymentContainer PacketCaptureAPIDeploymentContainer is a PacketCaptureAPI Deployment container. *Appears in:* - [PacketCaptureAPIDeploymentPodSpec](#packetcaptureapideploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the PacketCaptureAPI Deployment container by name. Supported values are: tigera-packetcapture-server | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named PacketCaptureAPI Deployment container's resources. If omitted, the PacketCaptureAPI Deployment will use its default value for this container's resources. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### PacketCaptureAPIDeploymentInitContainer PacketCaptureAPIDeploymentInitContainer is a PacketCaptureAPI Deployment init container. *Appears in:* - [PacketCaptureAPIDeploymentPodSpec](#packetcaptureapideploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the PacketCaptureAPI Deployment init container by name. Supported values are: tigera-packetcapture-server-tls-key-cert-provisioner | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named PacketCaptureAPI Deployment init container's resources. If omitted, the PacketCaptureAPI Deployment will use its default value for this init container's resources. | ### PacketCaptureAPIDeploymentPodSpec PacketCaptureAPIDeploymentPodSpec is the PacketCaptureAPI Deployment's PodSpec. *Appears in:* - [PacketCaptureAPIDeploymentPodTemplateSpec](#packetcaptureapideploymentpodtemplatespec) | Field | Description | | ------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `initContainers` *[PacketCaptureAPIDeploymentInitContainer](#packetcaptureapideploymentinitcontainer) array* | (Optional) InitContainers is a list of PacketCaptureAPI init containers. If specified, this overrides the specified PacketCaptureAPI Deployment init containers. If omitted, the PacketCaptureAPI Deployment will use its default values for its init containers. | | `containers` *[PacketCaptureAPIDeploymentContainer](#packetcaptureapideploymentcontainer) array* | (Optional) Containers is a list of PacketCaptureAPI containers. If specified, this overrides the specified PacketCaptureAPI Deployment containers. If omitted, the PacketCaptureAPI Deployment will use its default values for its containers. | ### PacketCaptureAPIDeploymentPodTemplateSpec PacketCaptureAPIDeploymentPodTemplateSpec is the PacketCaptureAPI Deployment's PodTemplateSpec *Appears in:* - [PacketCaptureAPIDeploymentSpec](#packetcaptureapideploymentspec) | Field | Description | | -------------------------------------------------------------------------------- | ------------------------------------------------------------- | | `spec` *[PacketCaptureAPIDeploymentPodSpec](#packetcaptureapideploymentpodspec)* | (Optional) Spec is the PacketCaptureAPI Deployment's PodSpec. | ### PacketCaptureAPIDeploymentSpec PacketCaptureAPIDeploymentSpec defines configuration for the PacketCaptureAPI Deployment. *Appears in:* - [PacketCaptureAPIDeployment](#packetcaptureapideployment) | Field | Description | | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | | `template` *[PacketCaptureAPIDeploymentPodTemplateSpec](#packetcaptureapideploymentpodtemplatespec)* | (Optional) Template describes the PacketCaptureAPI Deployment pod that will be created. | ### PacketCaptureAPISpec PacketCaptureAPISpec defines configuration for the Packet Capture API. *Appears in:* - [PacketCaptureAPI](#packetcaptureapi) | Field | Description | | ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | | `packetCaptureAPIDeployment` *[PacketCaptureAPIDeployment](#packetcaptureapideployment)* | (Optional) PacketCaptureAPIDeployment configures the PacketCaptureAPI Deployment. | ### PacketCaptureAPIStatus PacketCaptureAPIStatus defines the observed state of the Packet Capture API. *Appears in:* - [PacketCaptureAPI](#packetcaptureapi) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `state` *string* | State provides user-readable status. | | `conditions` *[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#condition-v1-meta) array* | (Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types. | ### PathMatch *Appears in:* - [TLSTerminatedRouteSpec](#tlsterminatedroutespec) | Field | Description | | ---------------------- | ----------------------------------------------------------------------------- | | `path` *string* | Path is the path portion of the URL based on which we proxy. | | `pathRegexp` *string* | (Optional) PathRegexp, if not nil, checks if Regexp matches the path. | | `pathReplace` *string* | (Optional) PathReplace if not nil will be used to replace PathRegexp matches. | ### PodDisruptionBudgetOverride PodDisruptionBudgetOverride allows overriding select fields on an operator-managed PodDisruptionBudget. The PDB's selector, name, and namespace are managed by the operator and cannot be overridden. *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[PodDisruptionBudgetOverrideSpec](#poddisruptionbudgetoverridespec)* | (Optional) Spec is the specification of the PodDisruptionBudget. | ### PodDisruptionBudgetOverrideSpec PodDisruptionBudgetOverrideSpec defines the desired state of an operator-managed PodDisruptionBudget. *Appears in:* - [PodDisruptionBudgetOverride](#poddisruptionbudgetoverride) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `minAvailable` *[IntOrString](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#intorstring-intstr-util)* | (Optional) MinAvailable is the minimum number of pods (as an integer or percentage) that must remain available during a disruption. Mutually exclusive with MaxUnavailable. | | `maxUnavailable` *[IntOrString](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#intorstring-intstr-util)* | (Optional) MaxUnavailable is the maximum number of pods (as an integer or percentage) that can be unavailable during a disruption. Mutually exclusive with MinAvailable. If neither MinAvailable nor MaxUnavailable is set, the operator applies its default (MaxUnavailable=1 for calico-typha). | | `unhealthyPodEvictionPolicy` *[UnhealthyPodEvictionPolicyType](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#unhealthypodevictionpolicytype-v1-policy)* | (Optional) UnhealthyPodEvictionPolicy defines when unhealthy pods should be considered for eviction. Defaults to IfHealthyBudget (the Kubernetes default) when unset. See [https://kubernetes.io/docs/tasks/run-application/configure-pdb/#unhealthy-pod-eviction-policy](https://kubernetes.io/docs/tasks/run-application/configure-pdb/#unhealthy-pod-eviction-policy). | ### PolicyMode *Underlying type:* *string* *Appears in:* - [Azure](#azure) | Value | Description | | --------- | ----------- | | `Default` | | | `Manual` | | ### PolicyRecommendation PolicyRecommendation is the Schema for the policy recommendation API. At most one instance of this resource is supported. It must be named "tigera-secure". | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `PolicyRecommendation` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[PolicyRecommendationSpec](#policyrecommendationspec)* | | | `status` *[PolicyRecommendationStatus](#policyrecommendationstatus)* | | ### PolicyRecommendationDeployment PolicyRecommendationDeployment is the configuration for the PolicyRecommendation Deployment. *Appears in:* - [PolicyRecommendationSpec](#policyrecommendationspec) | Field | Description | | ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | | `spec` *[PolicyRecommendationDeploymentSpec](#policyrecommendationdeploymentspec)* | (Optional) Spec is the specification of the PolicyRecommendation Deployment. | ### PolicyRecommendationDeploymentContainer PolicyRecommendationDeploymentContainer is a PolicyRecommendation Deployment container. *Appears in:* - [PolicyRecommendationDeploymentPodSpec](#policyrecommendationdeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the PolicyRecommendation Deployment container by name. Supported values are: policy-recommendation-controller | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named PolicyRecommendation Deployment container's resources. If omitted, the PolicyRecommendation Deployment will use its default value for this container's resources. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### PolicyRecommendationDeploymentInitContainer PolicyRecommendationDeploymentInitContainer is a PolicyRecommendation Deployment init container. *Appears in:* - [PolicyRecommendationDeploymentPodSpec](#policyrecommendationdeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the PolicyRecommendation Deployment init container by name. | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named PolicyRecommendation Deployment init container's resources. If omitted, the PolicyRecommendation Deployment will use its default value for this init container's resources. | ### PolicyRecommendationDeploymentPodSpec PolicyRecommendationDeploymentPodSpec is the PolicyRecommendation Deployment's PodSpec. *Appears in:* - [PolicyRecommendationDeploymentPodTemplateSpec](#policyrecommendationdeploymentpodtemplatespec) | Field | Description | | -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `initContainers` *[PolicyRecommendationDeploymentInitContainer](#policyrecommendationdeploymentinitcontainer) array* | (Optional) InitContainers is a list of PolicyRecommendation init containers. If specified, this overrides the specified PolicyRecommendation Deployment init containers. If omitted, the PolicyRecommendation Deployment will use its default values for its init containers. | | `containers` *[PolicyRecommendationDeploymentContainer](#policyrecommendationdeploymentcontainer) array* | (Optional) Containers is a list of PolicyRecommendation containers. If specified, this overrides the specified PolicyRecommendation Deployment containers. If omitted, the PolicyRecommendation Deployment will use its default values for its containers. | ### PolicyRecommendationDeploymentPodTemplateSpec PolicyRecommendationDeploymentPodTemplateSpec is the PolicyRecommendation Deployment's PodTemplateSpec *Appears in:* - [PolicyRecommendationDeploymentSpec](#policyrecommendationdeploymentspec) | Field | Description | | ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | | `spec` *[PolicyRecommendationDeploymentPodSpec](#policyrecommendationdeploymentpodspec)* | (Optional) Spec is the PolicyRecommendation Deployment's PodSpec. | ### PolicyRecommendationDeploymentSpec PolicyRecommendationDeploymentSpec defines configuration for the PolicyRecommendation Deployment. *Appears in:* - [PolicyRecommendationDeployment](#policyrecommendationdeployment) | Field | Description | | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------- | | `template` *[PolicyRecommendationDeploymentPodTemplateSpec](#policyrecommendationdeploymentpodtemplatespec)* | (Optional) Template describes the PolicyRecommendation Deployment pod that will be created. | ### PolicyRecommendationSpec PolicyRecommendationSpec defines configuration for the Calico Enterprise Policy Recommendation service. *Appears in:* - [PolicyRecommendation](#policyrecommendation) | Field | Description | | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | | `policyRecommendationDeployment` *[PolicyRecommendationDeployment](#policyrecommendationdeployment)* | (Optional) PolicyRecommendation configures the PolicyRecommendation Deployment. | ### PolicyRecommendationStatus PolicyRecommendationStatus defines the observed state of Tigera policy recommendation. *Appears in:* - [PolicyRecommendation](#policyrecommendation) | Field | Description | | ---------------- | ------------------------------------ | | `state` *string* | State provides user-readable status. | ### ProbeOverride ProbeOverride allows customization of probe timing parameters without changing the probe handler itself (which the operator controls). *Appears in:* - [APIServerDeploymentContainer](#apiserverdeploymentcontainer) - [CSINodeDriverDaemonSetContainer](#csinodedriverdaemonsetcontainer) - [CalicoKubeControllersDeploymentContainer](#calicokubecontrollersdeploymentcontainer) - [CalicoNodeDaemonSetContainer](#caliconodedaemonsetcontainer) - [CalicoNodeWindowsDaemonSetContainer](#caliconodewindowsdaemonsetcontainer) - [CalicoWebhooksDeploymentContainer](#calicowebhooksdeploymentcontainer) - [CalicoWindowsUpgradeDaemonSetContainer](#calicowindowsupgradedaemonsetcontainer) - [EGWDeploymentContainer](#egwdeploymentcontainer) - [EKSLogForwarderDeploymentContainer](#ekslogforwarderdeploymentcontainer) - [FluentdDaemonSetContainer](#fluentddaemonsetcontainer) - [GatewayCertgenJobContainer](#gatewaycertgenjobcontainer) - [GatewayControllerDeploymentContainer](#gatewaycontrollerdeploymentcontainer) - [GatewayDaemonSetContainer](#gatewaydaemonsetcontainer) - [GatewayDeploymentContainer](#gatewaydeploymentcontainer) - [GoldmaneDeploymentContainer](#goldmanedeploymentcontainer) - [GuardianDeploymentContainer](#guardiandeploymentcontainer) - [IntrusionDetectionControllerDeploymentContainer](#intrusiondetectioncontrollerdeploymentcontainer) - [L7LogCollectorDaemonSetContainer](#l7logcollectordaemonsetcontainer) - [PacketCaptureAPIDeploymentContainer](#packetcaptureapideploymentcontainer) - [PolicyRecommendationDeploymentContainer](#policyrecommendationdeploymentcontainer) - [PrometheusContainer](#prometheuscontainer) - [TyphaDeploymentContainer](#typhadeploymentcontainer) - [WhiskerDeploymentContainer](#whiskerdeploymentcontainer) | Field | Description | | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | | `periodSeconds` *integer* | (Optional) PeriodSeconds is how often (in seconds) to perform the probe. | | `timeoutSeconds` *integer* | (Optional) TimeoutSeconds is the number of seconds after which the probe times out. | | `failureThreshold` *integer* | (Optional) FailureThreshold is the minimum consecutive failures for the probe to be considered failed after having succeeded. | | `initialDelaySeconds` *integer* | (Optional) InitialDelaySeconds is the number of seconds after the container starts before the probe is initiated. | ### ProductVariant *Underlying type:* *string* ProductVariant represents the variant of the product. One of: Calico, CalicoEnterprise. TigeraSecureEnterprise is a deprecated alias for CalicoEnterprise. *Appears in:* - [InstallationSpec](#installationspec) - [InstallationStatus](#installationstatus) ### Prometheus *Appears in:* - [MonitorSpec](#monitorspec) | Field | Description | | ------------------------------------------ | ------------------------------------------------------- | | `spec` *[PrometheusSpec](#prometheusspec)* | (Optional) Spec is the specification of the Prometheus. | ### PrometheusContainer PrometheusContainer is a Prometheus container. *Appears in:* - [CommonPrometheusFields](#commonprometheusfields) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the Prometheus Deployment container by name. Supported values are: authn-proxy | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named Prometheus container's resources. If omitted, the Prometheus will use its default value for this container's resources. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### PrometheusSpec *Appears in:* - [Prometheus](#prometheus) | Field | Description | | ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | | `commonPrometheusFields` *[CommonPrometheusFields](#commonprometheusfields)* | CommonPrometheusFields are the options available to both the Prometheus server and agent. | ### Provider *Underlying type:* *string* Provider represents a particular provider or flavor of Kubernetes. Valid options are: EKS, GKE, AKS, RKE2, OpenShift, DockerEnterprise, TKG, Kind. *Appears in:* - [InstallationSpec](#installationspec) ### Proxy *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `httpProxy` *string* | (Optional) HTTPProxy defines the value of the HTTP\_PROXY environment variable that will be set on Tigera containers that connect to destinations outside the cluster. | | `httpsProxy` *string* | (Optional) HTTPSProxy defines the value of the HTTPS\_PROXY environment variable that will be set on Tigera containers that connect to destinations outside the cluster. | | `noProxy` *string* | (Optional) NoProxy defines the value of the NO\_PROXY environment variable that will be set on Tigera containers that connect to destinations outside the cluster. This value must be set such that destinations within the scope of the cluster, including the Kubernetes API server, are exempt from being proxied. | ### QueryServerLogging *Appears in:* - [APIServerPodLogging](#apiserverpodlogging) | Field | Description | | ------------------------------------------- | ------------------------------------------------------------------- | | `logSeverity` *[LogSeverity](#logseverity)* | (Optional) LogSeverity defines log level for QueryServer container. | ### S3StoreSpec S3StoreSpec defines configuration for exporting logs to Amazon S3. *Appears in:* - [AdditionalLogStoreSpec](#additionallogstorespec) | Field | Description | | ------------------------------------- | ----------------------------------------------------------------------- | | `region` *string* | AWS Region of the S3 bucket | | `bucketName` *string* | Name of the S3 bucket to send logs | | `bucketPath` *string* | Path in the S3 bucket where to send logs | | `hostScope` *[HostScope](#hostscope)* | (Optional) The set of hosts that will forward their logs to this store. | ### SNIMatch *Appears in:* - [TLSPassThroughRouteSpec](#tlspassthroughroutespec) | Field | Description | | --------------------- | ------------------------------------------------------------ | | `serverName` *string* | ServerName is used to match the server name for the request. | ### ServiceMonitor *Appears in:* - [ExternalPrometheus](#externalprometheus) | Field | Description | | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `labels` *object (keys:string, values:string)* | Labels are the metadata.labels of the ServiceMonitor. When combined with spec.serviceMonitorSelector.matchLabels on your prometheus instance, the service monitor will automatically be picked up. Default: k8s-app=tigera-prometheus | | `endpoints` *[Endpoint](#endpoint) array* | The endpoints to scrape. This struct contains a subset of the Endpoint as defined in the prometheus docs. Fields related to connecting to our Prometheus server are automatically set by the operator. | ### SidecarStatusType *Underlying type:* *string* *Validation:* - Enum: \[Enabled Disabled] *Appears in:* - [ApplicationLayerSpec](#applicationlayerspec) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### SidecarWebhookStateType *Underlying type:* *string* *Validation:* - Enum: \[Enabled Disabled] *Appears in:* - [ApplicationLayerStatus](#applicationlayerstatus) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### SplunkStoreSpec SplunkStoreSpec defines configuration for exporting logs to splunk. *Appears in:* - [AdditionalLogStoreSpec](#additionallogstorespec) | Field | Description | | ------------------------------------- | ------------------------------------------------------------------------------------ | | `endpoint` *string* | Location for splunk's http event collector end point. example `https://1.2.3.4:8088` | | `hostScope` *[HostScope](#hostscope)* | (Optional) The set of hosts that will forward their logs to this store | ### StatusConditionType *Underlying type:* *string* StatusConditionType is a type of condition that may apply to a particular component. *Appears in:* - [TigeraStatusCondition](#tigerastatuscondition) | Value | Description | | ------------- | --------------------------------------------------------------------------------------------------------------------------- | | `Available` | Available indicates that the component is healthy. | | `Progressing` | Progressing means that the component is in the process of being installed or upgraded. | | `Degraded` | Degraded means the component is not operating as desired and user action is required. | | `Ready` | Ready indicates that the component is healthy and ready.it is identical to Available and used in Status conditions for CRs. | ### Sysctl *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Field | Description | | ---------------- | ----------- | | `key` *string* | | | `value` *string* | | ### SyslogLogType *Underlying type:* *string* SyslogLogType represents the allowable log types for syslog. Allowable values are Audit, DNS, Flows and IDSEvents. - Audit corresponds to audit logs for both Kubernetes resources and Enterprise custom resources. - DNS corresponds to DNS logs generated by Calico node. - Flows corresponds to flow logs generated by Calico node. - IDSEvents corresponds to event logs for the intrusion detection system (anomaly detection, suspicious IPs, suspicious domains and global alerts). *Validation:* - Enum: \[Audit DNS Flows IDSEvents] *Appears in:* - [SyslogStoreSpec](#syslogstorespec) | Value | Description | | ----------- | ----------- | | `Audit` | | | `DNS` | | | `Flows` | | | `L7` | | | `IDSEvents` | | ### SyslogStoreSpec SyslogStoreSpec defines configuration for exporting logs to syslog. *Appears in:* - [AdditionalLogStoreSpec](#additionallogstorespec) | Field | Description | | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `endpoint` *string* | Location of the syslog server. example: tcp\://1.2.3.4:601 | | `packetSize` *integer* | (Optional) PacketSize defines the maximum size of packets to send to syslog. In general this is only needed if you notice long logs being truncated. Default: 1024 | | `logTypes` *[SyslogLogType](#sysloglogtype) array* | If no values are provided, the list will be updated to include log types Audit, DNS and Flows. Default: Audit, DNS, Flows | | `encryption` *[EncryptionOption](#encryptionoption)* | (Optional) Encryption configures traffic encryption to the Syslog server. Default: None | | `hostScope` *[HostScope](#hostscope)* | (Optional) The set of hosts that will forward their logs to this store. | ### TLSCipher *Underlying type:* *string* *Validation:* - Enum: \[TLS\_AES\_256\_GCM\_SHA384 TLS\_CHACHA20\_POLY1305\_SHA256 TLS\_AES\_128\_GCM\_SHA256 TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384 TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 TLS\_ECDHE\_RSA\_WITH\_CHACHA20\_POLY1305\_SHA256 TLS\_ECDHE\_ECDSA\_WITH\_CHACHA20\_POLY1305\_SHA256 TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256 TLS\_RSA\_WITH\_AES\_256\_GCM\_SHA384 TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256 TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA] *Appears in:* - [TLSCipherSuite](#tlsciphersuite) | Value | Description | | ----------------------------------------------- | ----------- | | `TLS_AES_256_GCM_SHA384` | TLS 1.3 | | `TLS_CHACHA20_POLY1305_SHA256` | | | `TLS_AES_128_GCM_SHA256` | | | `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384` | TLS 1.2 | | `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` | | | `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256` | | | `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256` | | | `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256` | | | `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256` | | | `TLS_RSA_WITH_AES_256_GCM_SHA384` | | | `TLS_RSA_WITH_AES_128_GCM_SHA256` | | | `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA` | | | `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA` | | | `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA` | | ### TLSCipherSuite *Appears in:* - [TLSCipherSuites](#tlsciphersuites) | Field | Description | | -------------------------------- | -------------------------------------------------------- | | `name` *[TLSCipher](#tlscipher)* | (Optional) This should be a valid TLS cipher suite name. | ### TLSCipherSuites *Underlying type:* *[TLSCipherSuite](#tlsciphersuite)* *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | -------------------------------- | -------------------------------------------------------- | | `name` *[TLSCipher](#tlscipher)* | (Optional) This should be a valid TLS cipher suite name. | ### TLSPassThroughRouteSpec *Appears in:* - [TLSPassThroughRoute](#tlspassthroughroute) | Field | Description | | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | `target` *[TargetType](#targettype)* | | | `sniMatch` *[SNIMatch](#snimatch)* | SNIMatch is used to match requests based on the server name for the intended destination server. Matching requests will be proxied to the Destination. | | `destination` *string* | Destination is the destination url to proxy the request to. | ### TLSTerminatedRouteSpec *Appears in:* - [TLSTerminatedRoute](#tlsterminatedroute) | Field | Description | | -------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `target` *[TargetType](#targettype)* | | | `pathMatch` *[PathMatch](#pathmatch)* | PathMatch is used to match requests based on what's in the path. Matching requests will be proxied to the Destination defined in this structure. | | `destination` *string* | Destination is the destination URL where matching traffic is routed to. | | `caBundle` *[ConfigMapKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#configmapkeyselector-v1-core)* | CABundle is where we read the CA bundle from to authenticate the destination (if non-empty) | | `mtlsCert` *[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#secretkeyselector-v1-core)* | (Optional) ForwardingMTLSCert is the certificate used for mTLS between voltron and the destination. Either both ForwardingMTLSCert and ForwardingMTLSKey must be specified, or neither can be specified. | | `mtlsKey` *[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#secretkeyselector-v1-core)* | (Optional) ForwardingMTLSKey is the key used for mTLS between voltron and the destination. Either both ForwardingMTLSCert and ForwardingMTLSKey must be specified, or neither can be specified. | | `unauthenticated` *boolean* | (Optional) Unauthenticated says whether the request should go through authentication. This is only applicable if the Target is UI. | ### TargetType *Underlying type:* *string* *Appears in:* - [TLSPassThroughRouteSpec](#tlspassthroughroutespec) - [TLSTerminatedRouteSpec](#tlsterminatedroutespec) | Value | Description | | ---------------- | ----------- | | `UpstreamTunnel` | | | `UI` | | ### TigeraStatus TigeraStatus represents the most recently observed status for Calico or a Calico Enterprise functional area. | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `TigeraStatus` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[TigeraStatusSpec](#tigerastatusspec)* | | | `status` *[TigeraStatusStatus](#tigerastatusstatus)* | | ### TigeraStatusCondition TigeraStatusCondition represents a condition attached to a particular component. *Appears in:* - [TigeraStatusStatus](#tigerastatusstatus) | Field | Description | | ---------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `type` *[StatusConditionType](#statusconditiontype)* | The type of condition. May be Available, Progressing, or Degraded. | | `status` *[ConditionStatus](#conditionstatus)* | The status of the condition. May be True, False, or Unknown. | | `lastTransitionTime` *[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#time-v1-meta)* | The timestamp representing the start time for the current status. | | `reason` *string* | A brief reason explaining the condition. | | `message` *string* | Optionally, a detailed message providing additional context. | | `observedGeneration` *integer* | (Optional) observedGeneration represents the generation that the condition was set based upon. For instance, if generation is currently 12, but the .status.conditions\[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. | ### TigeraStatusSpec TigeraStatusSpec defines the desired state of TigeraStatus *Appears in:* - [TigeraStatus](#tigerastatus) ### TigeraStatusStatus TigeraStatusStatus defines the observed state of TigeraStatus *Appears in:* - [TigeraStatus](#tigerastatus) | Field | Description | | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | `conditions` *[TigeraStatusCondition](#tigerastatuscondition) array* | Conditions represents the latest observed set of conditions for this component. A component may be one or more of Available, Progressing, or Degraded. | ### TyphaAffinity Deprecated. Please use TyphaDeployment instead. TyphaAffinity allows configuration of node affinity characteristics for Typha pods. *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | ---------------------------------------------- | --------------------------------------------------------------------------- | | `nodeAffinity` *[NodeAffinity](#nodeaffinity)* | (Optional) NodeAffinity describes node affinity scheduling rules for typha. | ### TyphaDeployment TyphaDeployment is the configuration for the typha Deployment. *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | ---------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[TyphaDeploymentSpec](#typhadeploymentspec)* | (Optional) Spec is the specification of the typha Deployment. | ### TyphaDeploymentContainer TyphaDeploymentContainer is a typha Deployment container. *Appears in:* - [TyphaDeploymentPodSpec](#typhadeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `name` *string* | Name is an enum which identifies the typha Deployment container by name. Supported values are: calico-typha | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named typha Deployment container's resources. If omitted, the typha Deployment will use its default value for this container's resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence. | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### TyphaDeploymentInitContainer TyphaDeploymentInitContainer is a typha Deployment init container. *Appears in:* - [TyphaDeploymentPodSpec](#typhadeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | Name is an enum which identifies the typha Deployment init container by name. Supported values are: typha-certs-key-cert-provisioner | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources allows customization of limits and requests for compute resources such as cpu and memory. If specified, this overrides the named typha Deployment init container's resources. If omitted, the typha Deployment will use its default value for this init container's resources. If used in conjunction with the deprecated ComponentResources, then this value takes precedence. | ### TyphaDeploymentPodSpec TyphaDeploymentPodSpec is the typha Deployment's PodSpec. *Appears in:* - [TyphaDeploymentPodTemplateSpec](#typhadeploymentpodtemplatespec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `initContainers` *[TyphaDeploymentInitContainer](#typhadeploymentinitcontainer) array* | (Optional) InitContainers is a list of typha init containers. If specified, this overrides the specified typha Deployment init containers. If omitted, the typha Deployment will use its default values for its init containers. | | `containers` *[TyphaDeploymentContainer](#typhadeploymentcontainer) array* | (Optional) Containers is a list of typha containers. If specified, this overrides the specified typha Deployment containers. If omitted, the typha Deployment will use its default values for its containers. | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity is a group of affinity scheduling rules for the typha pods. If specified, this overrides any affinity that may be set on the typha Deployment. If omitted, the typha Deployment will use its default value for affinity. If used in conjunction with the deprecated TyphaAffinity, then this value takes precedence. WARNING: Please note that this field will override the default calico-typha Deployment affinity. | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector is the calico-typha pod's scheduling constraints. If specified, each of the key/value pairs are added to the calico-typha Deployment nodeSelector provided the key does not already exist in the object's nodeSelector. If omitted, the calico-typha Deployment will use its default value for nodeSelector. WARNING: Please note that this field will modify the default calico-typha Deployment nodeSelector. | | `terminationGracePeriodSeconds` *integer* | (Optional) Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). If this value is nil, the default grace period will be used instead. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. Defaults to 30 seconds. | | `topologySpreadConstraints` *[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#topologyspreadconstraint-v1-core) array* | (Optional) TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations is the typha pod's tolerations. If specified, this overrides any tolerations that may be set on the typha Deployment. If omitted, the typha Deployment will use its default value for tolerations. WARNING: Please note that this field will override the default calico-typha Deployment tolerations. | ### TyphaDeploymentPodTemplateSpec TyphaDeploymentPodTemplateSpec is the typha Deployment's PodTemplateSpec *Appears in:* - [TyphaDeploymentSpec](#typhadeploymentspec) | Field | Description | | ---------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[TyphaDeploymentPodSpec](#typhadeploymentpodspec)* | (Optional) Spec is the typha Deployment's PodSpec. | ### TyphaDeploymentSpec TyphaDeploymentSpec defines configuration for the typha Deployment. *Appears in:* - [TyphaDeployment](#typhadeployment) | Field | Description | | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `minReadySeconds` *integer* | (Optional) MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the typha Deployment. If omitted, the typha Deployment will use its default value for minReadySeconds. | | `template` *[TyphaDeploymentPodTemplateSpec](#typhadeploymentpodtemplatespec)* | (Optional) Template describes the typha Deployment pod that will be created. | | `strategy` *[TyphaDeploymentStrategy](#typhadeploymentstrategy)* | (Optional) The deployment strategy to use to replace existing pods with new ones. | ### TyphaDeploymentStrategy TyphaDeploymentStrategy describes how to replace existing pods with new ones. Only RollingUpdate is supported at this time so the Type field is not exposed. *Appears in:* - [TyphaDeploymentSpec](#typhadeploymentspec) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | | `rollingUpdate` *[RollingUpdateDeployment](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#rollingupdatedeployment-v1-apps)* | (Optional) Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate. to be. | ### WAFExtensionSpec WAFExtensionSpec configures the WAF Gateway API add-on. *Appears in:* - [GatewayAPIExtensions](#gatewayapiextensions) | Field | Description | | ------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `state` *[WAFExtensionState](#wafextensionstate)* | (Optional) State turns the WAF Gateway API add-on on or off. Default (nil or "Disabled") means the operator does not render the WAF surface on calico-kube-controllers. Set to "Enabled" to opt in. | ### WAFExtensionState *Underlying type:* *string* WAFExtensionState is the on/off enum for the WAF Gateway API add-on. *Validation:* - Enum: \[Enabled Disabled] *Appears in:* - [WAFExtensionSpec](#wafextensionspec) | Value | Description | | ---------- | ----------- | | `Enabled` | | | `Disabled` | | ### WAFStatusType *Underlying type:* *string* *Validation:* - Enum: \[Enabled Disabled] *Appears in:* - [ApplicationLayerSpec](#applicationlayerspec) | Value | Description | | ---------- | ----------- | | `Disabled` | | | `Enabled` | | ### Whisker | Field | Description | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | `apiVersion` *string* | `operator.tigera.io/v1` | | `kind` *string* | `Whisker` | | `metadata` *[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[WhiskerSpec](#whiskerspec)* | | | `status` *[WhiskerStatus](#whiskerstatus)* | | ### WhiskerDeployment WhiskerDeployment is the configuration for the whisker Deployment. *Appears in:* - [WhiskerSpec](#whiskerspec) | Field | Description | | -------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[WhiskerDeploymentSpec](#whiskerdeploymentspec)* | (Optional) Spec is the specification of the whisker Deployment. | ### WhiskerDeploymentContainer *Appears in:* - [WhiskerDeploymentPodSpec](#whiskerdeploymentpodspec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` *string* | | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) | | `readinessProbe` *[ProbeOverride](#probeoverride)* | (Optional) ReadinessProbe allows customization of the readiness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | | `livenessProbe` *[ProbeOverride](#probeoverride)* | (Optional) LivenessProbe allows customization of the liveness probe timing parameters. The probe handler is set by the operator and cannot be overridden. | ### WhiskerDeploymentPodSpec WhiskerDeploymentPodSpec is the whisker Deployment's PodSpec. *Appears in:* - [WhiskerDeploymentPodTemplateSpec](#whiskerdeploymentpodtemplatespec) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity is a group of affinity scheduling rules for the whisker pods. | | `containers` *[WhiskerDeploymentContainer](#whiskerdeploymentcontainer) array* | (Optional) Containers is a list of whisker containers. If specified, this overrides the specified EGW Deployment containers. If omitted, the whisker Deployment will use its default values for its containers. | | `nodeSelector` *object (keys:string, values:string)* | (Optional) NodeSelector gives more control over the nodes where the whisker pods will run on. | | `terminationGracePeriodSeconds` *integer* | (Optional) TerminationGracePeriodSeconds defines the termination grace period of the whisker pods in seconds. | | `topologySpreadConstraints` *[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#topologyspreadconstraint-v1-core) array* | (Optional) TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations is the whisker pod's tolerations. If specified, this overrides any tolerations that may be set on the whisker Deployment. If omitted, the whisker Deployment will use its default value for tolerations. | | `priorityClassName` *string* | (Optional) PriorityClassName allows to specify a PriorityClass resource to be used. | ### WhiskerDeploymentPodTemplateSpec WhiskerDeploymentPodTemplateSpec is the whisker Deployment's PodTemplateSpec *Appears in:* - [WhiskerDeploymentSpec](#whiskerdeploymentspec) | Field | Description | | -------------------------------------------------------------- | -------------------------------------------------------------------------- | | `metadata` *[Metadata](#metadata)* | (Optional) Refer to Kubernetes API documentation for fields of `metadata`. | | `spec` *[WhiskerDeploymentPodSpec](#whiskerdeploymentpodspec)* | (Optional) Spec is the whisker Deployment's PodSpec. | ### WhiskerDeploymentSpec WhiskerDeploymentSpec defines configuration for the whisker Deployment. *Appears in:* - [WhiskerDeployment](#whiskerdeployment) | Field | Description | | ---------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `minReadySeconds` *integer* | (Optional) MinReadySeconds is the minimum number of seconds for which a newly created Deployment pod should be ready without any of its container crashing, for it to be considered available. If specified, this overrides any minReadySeconds value that may be set on the whisker Deployment. If omitted, the whisker Deployment will use its default value for minReadySeconds. | | `template` *[WhiskerDeploymentPodTemplateSpec](#whiskerdeploymentpodtemplatespec)* | (Optional) Template describes the whisker Deployment pod that will be created. | | `strategy` *[WhiskerDeploymentStrategy](#whiskerdeploymentstrategy)* | (Optional) The deployment strategy to use to replace existing pods with new ones. | ### WhiskerDeploymentStrategy *Appears in:* - [WhiskerDeploymentSpec](#whiskerdeploymentspec) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | | `rollingUpdate` *[RollingUpdateDeployment](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#rollingupdatedeployment-v1-apps)* | (Optional) Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate. to be. | ### WhiskerSpec *Appears in:* - [Whisker](#whisker) | Field | Description | | ------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `whiskerDeployment` *[WhiskerDeployment](#whiskerdeployment)* | | | `notifications` *[NotificationMode](#notificationmode)* | (Optional) Default: Enabled This setting enables calls to an external API to retrieve notification banner text in the Whisker UI. Allowed values are Enabled or Disabled. Defaults to Enabled. | ### WhiskerStatus WhiskerStatus defines the observed state of Whisker *Appears in:* - [Whisker](#whisker) | Field | Description | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `conditions` *[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#condition-v1-meta) array* | (Optional) Conditions represents the latest observed set of conditions for the component. A component may be one or more of Ready, Progressing, Degraded or other customer types. | ### WindowsDataplaneOption *Underlying type:* *string* *Validation:* - Enum: \[HNS Disabled] *Appears in:* - [CalicoNetworkSpec](#caliconetworkspec) | Value | Description | | ---------- | ----------- | | `Disabled` | | | `HNS` | | ### WindowsNodeSpec *Appears in:* - [InstallationSpec](#installationspec) | Field | Description | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `cniBinDir` *string* | (Optional) CNIBinDir is the path to the CNI binaries directory on Windows, it must match what is used as 'bin\_dir' under \[plugins] \[plugins."io.containerd.grpc.v1.cri"] \[plugins."io.containerd.grpc.v1.cri".cni] on the containerd 'config.toml' file on the Windows nodes. | | `cniConfigDir` *string* | (Optional) CNIConfigDir is the path to the CNI configuration directory on Windows, it must match what is used as 'conf\_dir' under \[plugins] \[plugins."io.containerd.grpc.v1.cri"] \[plugins."io.containerd.grpc.v1.cri".cni] on the containerd 'config.toml' file on the Windows nodes. | | `cniLogDir` *string* | (Optional) CNILogDir is the path to the Calico CNI logs directory on Windows. | | `vxlanMACPrefix` *string* | (Optional) VXLANMACPrefix is the prefix used when generating MAC addresses for virtual NICs | | `vxlanAdapter` *string* | (Optional) VXLANAdapter is the Network Adapter used for VXLAN, leave blank for primary NIC | ### ZTunnelDaemonset ZTunnelDaemonset defines customized settings for the ZTunnelDaemonset component. *Appears in:* - [IstioSpec](#istiospec) | Field | Description | | ------------------------------------------------------ | -------------------------------------------------------------------------------- | | `spec` *[ZTunnelDaemonsetSpec](#ztunneldaemonsetspec)* | (Optional) Spec allows users to specify custom fields for the ZTunnel Daemonset. | ### ZTunnelDaemonsetPodSpec ZTunnelDaemonsetPodSpec defines the pod spec for customizing the ZTunnel Daemonset. *Appears in:* - [ZTunnelDaemonsetSpecTemplate](#ztunneldaemonsetspectemplate) | Field | Description | | --------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | | `affinity` *[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#affinity-v1-core)* | (Optional) Affinity specifies the affinity for the deployment. | | `nodeSelector` *object (keys:string, values:string)* | (Optional) NodeSelector specifies the node affinity for the deployment. | | `resources` *[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#resourcerequirements-v1-core)* | (Optional) Resources specifies the compute resources required for the deployment. | | `tolerations` *[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#toleration-v1-core) array* | (Optional) Tolerations specifies the tolerations for the deployment. | ### ZTunnelDaemonsetSpec ZTunnelDaemonsetSpec defines the spec for customizing the ZTunnel Daemonset. *Appears in:* - [ZTunnelDaemonset](#ztunneldaemonset) | Field | Description | | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | | `template` *[ZTunnelDaemonsetSpecTemplate](#ztunneldaemonsetspectemplate)* | (Optional) Template allows users to specify custom fields for the ZTunnel Daemonset. | ### ZTunnelDaemonsetSpecTemplate ZTunnelDaemonsetSpecTemplate defines the template for customizing the ZTunnel Daemonset. *Appears in:* - [ZTunnelDaemonsetSpec](#ztunneldaemonsetspec) | Field | Description | | ------------------------------------------------------------ | -------------------------------------------------------------------------------- | | `spec` *[ZTunnelDaemonsetPodSpec](#ztunneldaemonsetpodspec)* | (Optional) Spec allows users to specify custom fields for the ZTunnel Daemonset. |