@pulumiverse/cpln
Version:
A Pulumi package for creating and managing Control Plane (cpln) resources.
1,780 lines (1,779 loc) • 97.7 kB
TypeScript
import * as outputs from "../types/output";
export interface CloudAccountAws {
/**
* Amazon Resource Name (ARN) Role.
*/
roleArn?: string;
}
export interface CloudAccountAzure {
/**
* Full link to an Azure secret. (e.g., /org/ORG_NAME/secret/AZURE_SECRET).
*/
secretLink?: string;
}
export interface CloudAccountGcp {
/**
* GCP project ID. Obtained from the GCP cloud console.
*/
projectId?: string;
}
export interface CloudAccountNgs {
/**
* Full link to a NATS Account Secret secret. (e.g., /org/ORG_NAME/secret/NATS_ACCOUNT_SECRET).
*/
secretLink?: string;
}
export interface DomainRouteHeaders {
/**
* Manipulates HTTP headers.
*/
request?: outputs.DomainRouteHeadersRequest;
}
export interface DomainRouteHeadersRequest {
/**
* Sets or overrides headers to all http requests for this route.
*/
set?: {
[key: string]: string;
};
}
export interface DomainSpec {
/**
* Allows domain to accept wildcards. The associated GVC must have dedicated load balancing enabled.
*/
acceptAllHosts: boolean;
/**
* In `cname` dnsMode, Control Plane will configure workloads to accept traffic for the domain but will not manage DNS records for the domain. End users must configure CNAME records in their own DNS pointed to the canonical workload endpoint. Currently `cname` dnsMode requires that a TLS server certificate be configured when subdomain based routing is used. In `ns` dnsMode, Control Plane will manage the subdomains and create all necessary DNS records. End users configure NS records to forward DNS requests to the Control Plane managed DNS servers. Valid values: `cname`, `ns`. Default: `cname`.
*/
dnsMode: string;
/**
* This value is set to a target GVC (using a full link) for use by subdomain based routing. Each workload in the GVC will receive a subdomain in the form ${workload.name}.${domain.name}. **Do not include if path based routing is used.**
*/
gvcLink?: string;
/**
* Domain port specifications.
*/
ports?: outputs.DomainSpecPort[];
}
export interface DomainSpecPort {
/**
* A security feature implemented by web browsers to allow resources on a web page to be requested from another domain outside the domain from which the resource originated.
*/
cors?: outputs.DomainSpecPortCors;
/**
* Sets or overrides headers to all http requests for this route.
*/
number: number;
/**
* Allowed protocol. Valid values: `http`, `http2`, `tcp`. Default: `http2`.
*/
protocol: string;
/**
* Used for TLS connections for this Domain. End users are responsible for certificate updates.
*/
tls?: outputs.DomainSpecPortTls;
}
export interface DomainSpecPortCors {
/**
* Determines whether the client-side code (typically running in a web browser) is allowed to include credentials (such as cookies, HTTP authentication, or client-side SSL certificates) in cross-origin requests.
*/
allowCredentials: boolean;
/**
* Specifies the custom HTTP headers that are allowed in a cross-origin request to a specific resource.
*/
allowHeaders?: string[];
/**
* Specifies the HTTP methods (such as `GET`, `POST`, `PUT`, `DELETE`, etc.) that are allowed for a cross-origin request to a specific resource.
*/
allowMethods?: string[];
/**
* Determines which origins are allowed to access a particular resource on a server from a web browser.
*/
allowOrigins?: outputs.DomainSpecPortCorsAllowOrigin[];
/**
* The HTTP headers that a server allows to be exposed to the client in response to a cross-origin request. These headers provide additional information about the server's capabilities or requirements, aiding in proper handling of the request by the client's browser or application.
*/
exposeHeaders?: string[];
/**
* Maximum amount of time that a preflight request result can be cached by the client browser. Input is expected as a duration string (i.e, 24h, 20m, etc.).
*/
maxAge: string;
}
export interface DomainSpecPortCorsAllowOrigin {
/**
* Value of allowed origin.
*/
exact?: string;
regex?: string;
}
export interface DomainSpecPortTls {
/**
* Allowed cipher suites. Refer to the [Domain Reference](https://docs.controlplane.com/reference/domain#cipher-suites) for details.
*/
cipherSuites: string[];
/**
* The certificate authority PEM, stored as a TLS Secret, used to verify the authority of the client certificate. The only verification performed checks that the CN of the PEM matches the Domain (i.e., CN=*.DOMAIN).
*/
clientCertificate?: outputs.DomainSpecPortTlsClientCertificate;
/**
* Minimum TLS version to accept. Minimum is `1.0`. Default: `1.2`.
*/
minProtocolVersion: string;
/**
* Configure an optional custom server certificate for the domain. When the port number is 443 and this is not supplied, a certificate is provisioned automatically.
*/
serverCertificate?: outputs.DomainSpecPortTlsServerCertificate;
}
export interface DomainSpecPortTlsClientCertificate {
/**
* The secret will include a client certificate authority cert in PEM format used to verify requests which include client certificates. The key subject must match the domain and the key usage properties must be configured for client certificate authorization. The secret type must be keypair.
*/
secretLink?: string;
}
export interface DomainSpecPortTlsServerCertificate {
/**
* When provided, this is used as the server certificate authority. The secret type must be keypair and the content must be PEM encoded.
*/
secretLink?: string;
}
export interface DomainStatus {
/**
* List of required DNS record entries.
*/
dnsConfigs: outputs.DomainStatusDnsConfig[];
/**
* List of configured domain endpoints.
*/
endpoints: outputs.DomainStatusEndpoint[];
fingerprint: string;
/**
* Contains the cloud provider name, region, and certificate status.
*/
locations: outputs.DomainStatusLocation[];
/**
* Status of Domain. Possible values: `initializing`, `ready`, `pendingDnsConfig`, `pendingCertificate`, `usedByGvc`.
*/
status: string;
/**
* Warning message.
*/
warning: string;
}
export interface DomainStatusDnsConfig {
/**
* The host in DNS terminology refers to the domain or subdomain that the DNS record is associated with. It's essentially the name that is being queried or managed. For example, in a DNS record for `www.example.com`, `www` is a host in the domain `example.com`.
*/
host: string;
/**
* Time to live (TTL) is a value that signifies how long (in seconds) a DNS record should be cached by a resolver or a browser before a new request should be sent to refresh the data. Lower TTL values mean records are updated more frequently, which is beneficial for dynamic DNS configurations or during DNS migrations. Higher TTL values reduce the load on DNS servers and improve the speed of name resolution for end users by relying on cached data.
*/
ttl: number;
/**
* The DNS record type specifies the type of data the DNS record contains. Valid values: `CNAME`, `NS`, `TXT`.
*/
type: string;
/**
* The value of a DNS record contains the data the record is meant to convey, based on the type of the record.
*/
value: string;
}
export interface DomainStatusEndpoint {
/**
* URL of endpoint.
*/
url: string;
/**
* Full link to associated workload.
*/
workloadLink: string;
}
export interface DomainStatusLocation {
/**
* The current validity or status of the SSL/TLS certificate.
*/
certificateStatus: string;
/**
* The name of the location.
*/
name: string;
}
export interface GetGvcControlplaneTracing {
/**
* Key-value map of custom tags.
*/
customTags?: {
[key: string]: string;
};
/**
* Determines what percentage of requests should be traced.
*/
sampling: number;
}
export interface GetGvcLightstepTracing {
/**
* Full link to referenced Opaque Secret.
*/
credentials?: string;
/**
* Key-value map of custom tags.
*/
customTags?: {
[key: string]: string;
};
/**
* Tracing Endpoint Workload. Either the canonical endpoint or internal endpoint.
*/
endpoint: string;
/**
* Determines what percentage of requests should be traced.
*/
sampling: number;
}
export interface GetGvcLoadBalancer {
/**
* Creates a dedicated load balancer in each location and enables additional Domain features: custom ports, protocols and wildcard hostnames. Charges apply for each location.
*/
dedicated?: boolean;
/**
* The link or the name of the IP Set that will be used for this load balancer.
*/
ipset?: string;
multiZone?: outputs.GetGvcLoadBalancerMultiZone;
/**
* Specify the url to be redirected to for different http status codes.
*/
redirect?: outputs.GetGvcLoadBalancerRedirect;
/**
* Controls the address used for request logging and for setting the X-Envoy-External-Address header. If set to 1, then the last address in an existing X-Forwarded-For header will be used in place of the source client IP address. If set to 2, then the second to last address in an existing X-Forwarded-For header will be used in place of the source client IP address. If the XFF header does not have at least two addresses or does not exist then the source client IP address will be used instead.
*/
trustedProxies: number;
}
export interface GetGvcLoadBalancerMultiZone {
enabled: boolean;
}
export interface GetGvcLoadBalancerRedirect {
/**
* Specify the redirect url for all status codes in a class.
*/
class?: outputs.GetGvcLoadBalancerRedirectClass;
}
export interface GetGvcLoadBalancerRedirectClass {
/**
* An optional url redirect for 401 responses. Supports envoy format strings to include request information. E.g. https://your-oauth-server/oauth2/authorize?return_to=%REQ(:path)%&client_id=your-client-id
*/
status401?: string;
/**
* Specify the redirect url for any 500 level status code.
*/
status5xx?: string;
}
export interface GetGvcOtelTracing {
/**
* Key-value map of custom tags.
*/
customTags?: {
[key: string]: string;
};
/**
* Tracing Endpoint Workload. Either the canonical endpoint or internal endpoint.
*/
endpoint: string;
/**
* Determines what percentage of requests should be traced.
*/
sampling: number;
}
export interface GetGvcSidecar {
envoy: string;
}
export interface GetImageManifest {
/**
* The config is a JSON blob that contains the image configuration data which includes environment variables, default command to run, and other settings necessary to run the container based on this image.
*/
configs: outputs.GetImageManifestConfig[];
/**
* Layers lists the digests of the image's layers. These layers are filesystem changes or additions made in each step of the Docker image's creation process. The layers are stored separately and pulled as needed, which allows for efficient storage and transfer of images. Each layer is represented by a SHA256 digest, ensuring the integrity and authenticity of the image.
*/
layers: outputs.GetImageManifestLayer[];
/**
* Specifies the type of the content represented in the manifest, allowing Docker clients and registries to understand how to handle the document correctly.
*/
mediaType: string;
/**
* The version of the Docker Image Manifest format.
*/
schemaVersion: number;
}
export interface GetImageManifestConfig {
/**
* A unique SHA256 hash used to identify a specific image version within the image registry.
*/
digest: string;
/**
* Specifies the type of the content represented in the manifest, allowing Docker clients and registries to understand how to handle the document correctly.
*/
mediaType: string;
/**
* The size of the image or layer in bytes. This helps in estimating the space required and the download time.
*/
size: number;
}
export interface GetImageManifestLayer {
/**
* A unique SHA256 hash used to identify a specific image version within the image registry.
*/
digest: string;
/**
* Specifies the type of the content represented in the manifest, allowing Docker clients and registries to understand how to handle the document correctly.
*/
mediaType: string;
/**
* The size of the image or layer in bytes. This helps in estimating the space required and the download time.
*/
size: number;
}
export interface GetImagesImage {
/**
* The ID, in GUID format, of the image.
*/
cplnId: string;
/**
* A unique SHA256 hash used to identify a specific image version within the image registry.
*/
digest: string;
/**
* The manifest provides configuration and layers information about the image. It plays a crucial role in the Docker image distribution system, enabling image creation, verification, and replication in a consistent and secure manner.
*/
manifests: outputs.GetImagesImageManifest[];
/**
* Name of the image.
*/
name: string;
/**
* Respository name of the image.
*/
repository: string;
/**
* Full link to this resource. Can be referenced by other resources.
*/
selfLink: string;
/**
* Tag of the image.
*/
tag: string;
/**
* Key-value map of resource tags.
*/
tags: {
[key: string]: string;
};
}
export interface GetImagesImageManifest {
/**
* The config is a JSON blob that contains the image configuration data which includes environment variables, default command to run, and other settings necessary to run the container based on this image.
*/
configs: outputs.GetImagesImageManifestConfig[];
/**
* Layers lists the digests of the image's layers. These layers are filesystem changes or additions made in each step of the Docker image's creation process. The layers are stored separately and pulled as needed, which allows for efficient storage and transfer of images. Each layer is represented by a SHA256 digest, ensuring the integrity and authenticity of the image.
*/
layers: outputs.GetImagesImageManifestLayer[];
/**
* Specifies the type of the content represented in the manifest, allowing Docker clients and registries to understand how to handle the document correctly.
*/
mediaType: string;
/**
* The version of the Docker Image Manifest format.
*/
schemaVersion: number;
}
export interface GetImagesImageManifestConfig {
/**
* A unique SHA256 hash used to identify a specific image version within the image registry.
*/
digest: string;
/**
* Specifies the type of the content represented in the manifest, allowing Docker clients and registries to understand how to handle the document correctly.
*/
mediaType: string;
/**
* The size of the image or layer in bytes. This helps in estimating the space required and the download time.
*/
size: number;
}
export interface GetImagesImageManifestLayer {
/**
* A unique SHA256 hash used to identify a specific image version within the image registry.
*/
digest: string;
/**
* Specifies the type of the content represented in the manifest, allowing Docker clients and registries to understand how to handle the document correctly.
*/
mediaType: string;
/**
* The size of the image or layer in bytes. This helps in estimating the space required and the download time.
*/
size: number;
}
export interface GetImagesQuery {
/**
* Type of fetch. Specify either: `links` or `items`. Default: `items`.
*/
fetch: string;
/**
* The specification of the query.
*/
spec?: outputs.GetImagesQuerySpec;
}
export interface GetImagesQuerySpec {
/**
* Type of match. Available values: `all`, `any`, `none`. Default: `all`.
*/
match: string;
/**
* Terms can only contain one of the following attributes: `property`, `rel`, `tag`.
*/
terms?: outputs.GetImagesQuerySpecTerm[];
}
export interface GetImagesQuerySpecTerm {
/**
* Type of query operation. Available values: `=`, `>`, `>=`, `<`, `<=`, `!=`, `exists`, `!exists`. Default: `=`.
*/
op: string;
/**
* Property to use for query evaluation.
*/
property?: string;
/**
* Relation to use for query evaluation.
*/
rel?: string;
/**
* Tag key to use for query evaluation.
*/
tag?: string;
/**
* Testing value for query evaluation.
*/
value?: string;
}
export interface GetLocationGeo {
/**
* City of the location.
*/
city: string;
/**
* Continent of the location.
*/
continent: string;
/**
* Country of the location.
*/
country: string;
/**
* Latitude of the location.
*/
lat: number;
/**
* Longitude of the location.
*/
lon: number;
/**
* State of the location.
*/
state: string;
}
export interface GetLocationsLocation {
/**
* Cloud Provider of the location.
*/
cloudProvider: string;
/**
* The ID, in GUID format, of the location.
*/
cplnId: string;
/**
* Description of the location.
*/
description: string;
/**
* Indication if location is enabled.
*/
enabled: boolean;
geos: outputs.GetLocationsLocationGeo[];
/**
* A list of IP ranges of the location.
*/
ipRanges: string[];
/**
* Name of the location.
*/
name: string;
/**
* Region of the location.
*/
region: string;
/**
* Full link to this resource. Can be referenced by other resources.
*/
selfLink: string;
/**
* Key-value map of resource tags.
*/
tags: {
[key: string]: string;
};
}
export interface GetLocationsLocationGeo {
/**
* City of the location.
*/
city: string;
/**
* Continent of the location.
*/
continent: string;
/**
* Country of the location.
*/
country: string;
/**
* Latitude of the location.
*/
lat: number;
/**
* Longitude of the location.
*/
lon: number;
/**
* State of the location.
*/
state: string;
}
export interface GetOrgAuthConfig {
/**
* List of domains which will auto-provision users when authenticating using SAML.
*/
domainAutoMembers: string[];
/**
* Enforce SAML only authentication.
*/
samlOnly: boolean;
}
export interface GetOrgObservability {
/**
* These emails are configured as alert recipients in Grafana when the 'grafana-default-email' contact delivery type is 'Email'.
*/
defaultAlertEmails: string[];
/**
* Log retention days. Default: 30
*/
logsRetentionDays: number;
/**
* Metrics retention days. Default: 30
*/
metricsRetentionDays: number;
/**
* Traces retention days. Default: 30
*/
tracesRetentionDays: number;
}
export interface GetOrgSecurity {
threatDetection?: outputs.GetOrgSecurityThreatDetection;
}
export interface GetOrgSecurityThreatDetection {
/**
* Indicates whether threat detection should be forwarded or not.
*/
enabled: boolean;
/**
* Any threats with this severity and more severe will be sent. Others will be ignored. Valid values: `warning`, `error`, or `critical`.
*/
minimumSeverity?: string;
/**
* Configuration for syslog forwarding.
*/
syslog?: outputs.GetOrgSecurityThreatDetectionSyslog;
}
export interface GetOrgSecurityThreatDetectionSyslog {
/**
* The hostname to send syslog messages to.
*/
host: string;
/**
* The port to send syslog messages to.
*/
port: number;
/**
* The transport-layer protocol to send the syslog messages over. If TCP is chosen, messages will be sent with TLS. Default: `tcp`.
*/
transport: string;
}
export interface GetOrgStatus {
/**
* The link of the account the org belongs to.
*/
accountLink: string;
/**
* Indicates whether the org is active or not.
*/
active: boolean;
}
export interface GetSecretAw {
/**
* Access Key provided by AWS.
*/
accessKey: string;
/**
* AWS IAM Role External ID.
*/
externalId: string;
/**
* Role ARN provided by AWS.
*/
roleArn: string;
/**
* Secret Key provided by AWS.
*/
secretKey: string;
}
export interface GetSecretAzureConnector {
/**
* Code/Key to authenticate to deployment URL.
*/
code: string;
/**
* Deployment URL.
*/
url: string;
}
export interface GetSecretEcr {
/**
* Access Key provided by AWS.
*/
accessKey: string;
/**
* AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.
*/
externalId?: string;
/**
* List of ECR repositories.
*/
repos: string[];
/**
* Role ARN provided by AWS.
*/
roleArn: string;
/**
* Secret Key provided by AWS.
*/
secretKey: string;
}
export interface GetSecretKeypair {
/**
* Passphrase for private key.
*/
passphrase: string;
/**
* Public Key.
*/
publicKey: string;
/**
* Secret/Private Key.
*/
secretKey: string;
}
export interface GetSecretNatsAccount {
/**
* Account ID.
*/
accountId: string;
/**
* Private Key.
*/
privateKey: string;
}
export interface GetSecretOpaque {
/**
* Available encodings: `plain`, `base64`. Default: `plain`.
*/
encoding: string;
/**
* Plain text or base64 encoded string. Use `encoding` attribute to specify encoding.
*/
payload: string;
}
export interface GetSecretTl {
/**
* Public Certificate.
*/
cert: string;
/**
* Chain Certificate.
*/
chain: string;
/**
* Private Certificate.
*/
key: string;
}
export interface GetSecretUserpass {
/**
* Available encodings: `plain`, `base64`. Default: `plain`.
*/
encoding: string;
/**
* Password.
*/
password: string;
/**
* Username.
*/
username: string;
}
export interface GroupIdentityMatcher {
/**
* Executes the expression against the users' claims to decide whether a user belongs to this group. This method is useful for managing the grouping of users logged in with SAML providers.
*/
expression: string;
/**
* Language of the expression. Either `jmespath` or `javascript`. Default: `jmespath`.
*/
language: string;
}
export interface GroupMemberQuery {
/**
* Type of fetch. Specify either: `links` or `items`. Default: `items`.
*/
fetch: string;
spec?: outputs.GroupMemberQuerySpec;
}
export interface GroupMemberQuerySpec {
/**
* Type of match. Available values: `all`, `any`, `none`. Default: `all`.
*/
match: string;
/**
* Terms can only contain one of the following attributes: `property`, `rel`, `tag`.
*/
terms?: outputs.GroupMemberQuerySpecTerm[];
}
export interface GroupMemberQuerySpecTerm {
/**
* Type of query operation. Available values: `=`, `>`, `>=`, `<`, `<=`, `!=`, `exists`, `!exists`. Default: `=`.
*/
op: string;
/**
* Property to use for query evaluation.
*/
property?: string;
/**
* Relation to use for query evaluation.
*/
rel?: string;
/**
* Tag key to use for query evaluation.
*/
tag?: string;
/**
* Testing value for query evaluation.
*/
value?: string;
}
export interface GvcControlplaneTracing {
/**
* Key-value map of custom tags.
*/
customTags?: {
[key: string]: string;
};
/**
* Determines what percentage of requests should be traced.
*/
sampling: number;
}
export interface GvcLightstepTracing {
/**
* Full link to referenced Opaque Secret.
*/
credentials?: string;
/**
* Key-value map of custom tags.
*/
customTags?: {
[key: string]: string;
};
/**
* Tracing Endpoint Workload. Either the canonical endpoint or internal endpoint.
*/
endpoint: string;
/**
* Determines what percentage of requests should be traced.
*/
sampling: number;
}
export interface GvcLoadBalancer {
/**
* Creates a dedicated load balancer in each location and enables additional Domain features: custom ports, protocols and wildcard hostnames. Charges apply for each location.
*/
dedicated?: boolean;
/**
* The link or the name of the IP Set that will be used for this load balancer.
*/
ipset?: string;
multiZone?: outputs.GvcLoadBalancerMultiZone;
/**
* Specify the url to be redirected to for different http status codes.
*/
redirect?: outputs.GvcLoadBalancerRedirect;
/**
* Controls the address used for request logging and for setting the X-Envoy-External-Address header. If set to 1, then the last address in an existing X-Forwarded-For header will be used in place of the source client IP address. If set to 2, then the second to last address in an existing X-Forwarded-For header will be used in place of the source client IP address. If the XFF header does not have at least two addresses or does not exist then the source client IP address will be used instead.
*/
trustedProxies: number;
}
export interface GvcLoadBalancerMultiZone {
enabled: boolean;
}
export interface GvcLoadBalancerRedirect {
/**
* Specify the redirect url for all status codes in a class.
*/
class?: outputs.GvcLoadBalancerRedirectClass;
}
export interface GvcLoadBalancerRedirectClass {
/**
* An optional url redirect for 401 responses. Supports envoy format strings to include request information. E.g. https://your-oauth-server/oauth2/authorize?return_to=%REQ(:path)%&client_id=your-client-id
*/
status401?: string;
/**
* Specify the redirect url for any 500 level status code.
*/
status5xx?: string;
}
export interface GvcOtelTracing {
/**
* Key-value map of custom tags.
*/
customTags?: {
[key: string]: string;
};
/**
* Tracing Endpoint Workload. Either the canonical endpoint or internal endpoint.
*/
endpoint: string;
/**
* Determines what percentage of requests should be traced.
*/
sampling: number;
}
export interface GvcSidecar {
envoy: string;
}
export interface IdentityAwsAccessPolicy {
/**
* Full link to referenced cloud account.
*/
cloudAccountLink: string;
/**
* List of policies.
*/
policyRefs?: string[];
/**
* Role name.
*/
roleName?: string;
/**
* The trust policy for the role.
*/
trustPolicies?: outputs.IdentityAwsAccessPolicyTrustPolicy[];
}
export interface IdentityAwsAccessPolicyTrustPolicy {
/**
* List of statements.
*/
statements?: {
[key: string]: string;
}[];
/**
* Version of the policy.
*/
version: string;
}
export interface IdentityAzureAccessPolicy {
/**
* Full link to referenced cloud account.
*/
cloudAccountLink: string;
/**
* The process of assigning specific roles or permissions to an entity, such as a user or a service principal, within the system.
*/
roleAssignments?: outputs.IdentityAzureAccessPolicyRoleAssignment[];
}
export interface IdentityAzureAccessPolicyRoleAssignment {
/**
* List of assigned roles.
*/
roles?: string[];
/**
* Scope of roles.
*/
scope?: string;
}
export interface IdentityGcpAccessPolicy {
/**
* The association or connection between a particular identity, such as a user or a group, and a set of permissions or roles within the system.
*/
bindings?: outputs.IdentityGcpAccessPolicyBinding[];
/**
* Full link to referenced cloud account.
*/
cloudAccountLink: string;
/**
* Comma delimited list of GCP scope URLs.
*/
scopes: string[];
/**
* Name of existing GCP service account.
*/
serviceAccount?: string;
}
export interface IdentityGcpAccessPolicyBinding {
/**
* Name of resource for binding.
*/
resource?: string;
/**
* List of allowed roles.
*/
roles?: string[];
}
export interface IdentityNativeNetworkResource {
/**
* A feature provided by AWS that enables private connectivity between private VPCs and compute running at Control Plane without traversing the public internet.
*/
awsPrivateLink?: outputs.IdentityNativeNetworkResourceAwsPrivateLink;
/**
* Fully qualified domain name.
*/
fqdn: string;
/**
* Capability provided by GCP that allows private communication between private VPC networks and compute running at Control Plane.
*/
gcpServiceConnect?: outputs.IdentityNativeNetworkResourceGcpServiceConnect;
/**
* Name of the Native Network Resource.
*/
name: string;
/**
* Ports to expose. At least one port is required.
*/
ports: number[];
}
export interface IdentityNativeNetworkResourceAwsPrivateLink {
/**
* Endpoint service name.
*/
endpointServiceName: string;
}
export interface IdentityNativeNetworkResourceGcpServiceConnect {
/**
* Target service name.
*/
targetService: string;
}
export interface IdentityNetworkResource {
/**
* Full link to referenced Agent.
*/
agentLink?: string;
/**
* Fully qualified domain name.
*/
fqdn?: string;
/**
* List of IP addresses.
*/
ips?: string[];
/**
* Name of the Network Resource.
*/
name: string;
/**
* Ports to expose.
*/
ports: number[];
/**
* Resolver IP.
*/
resolverIp?: string;
}
export interface IdentityNgsAccessPolicy {
/**
* Full link to referenced cloud account.
*/
cloudAccountLink: string;
/**
* Max number of bytes a connection can send. Default: -1
*/
data: number;
/**
* Max message payload. Default: -1
*/
payload: number;
/**
* Pub Permission.
*/
pub?: outputs.IdentityNgsAccessPolicyPub;
/**
* Reponses.
*/
resp?: outputs.IdentityNgsAccessPolicyResp;
/**
* Sub Permission.
*/
sub?: outputs.IdentityNgsAccessPolicySub;
/**
* Max number of subscriptions per connection. Default: -1
*/
subs: number;
}
export interface IdentityNgsAccessPolicyPub {
/**
* List of allow subjects.
*/
allows?: string[];
/**
* List of deny subjects.
*/
denies?: string[];
}
export interface IdentityNgsAccessPolicyResp {
/**
* Number of responses allowed on the replyTo subject, -1 means no limit. Default: -1
*/
max: number;
/**
* Deadline to send replies on the replyTo subject [#ms(millis) | #s(econds) | m(inutes) | h(ours)]. -1 means no restriction.
*/
ttl?: string;
}
export interface IdentityNgsAccessPolicySub {
/**
* List of allow subjects.
*/
allows?: string[];
/**
* List of deny subjects.
*/
denies?: string[];
}
export interface IpSetLocation {
/**
* The self link of a location.
*/
name: string;
retentionPolicy: string;
}
export interface IpSetStatus {
error: string;
ipAddresses: outputs.IpSetStatusIpAddress[];
warning: string;
}
export interface IpSetStatusIpAddress {
created: string;
id: string;
ip: string;
name: string;
state: string;
}
export interface LocationGeo {
/**
* City of the location.
*/
city: string;
/**
* Continent of the location.
*/
continent: string;
/**
* Country of the location.
*/
country: string;
/**
* Latitude of the location.
*/
lat: number;
/**
* Longitude of the location.
*/
lon: number;
/**
* State of the location.
*/
state: string;
}
export interface Mk8sAddOns {
awsEcr?: outputs.Mk8sAddOnsAwsEcr;
awsEfs?: outputs.Mk8sAddOnsAwsEfs;
awsElb?: outputs.Mk8sAddOnsAwsElb;
awsWorkloadIdentity?: boolean;
azureAcr?: outputs.Mk8sAddOnsAzureAcr;
azureWorkloadIdentity?: outputs.Mk8sAddOnsAzureWorkloadIdentity;
dashboard?: boolean;
localPathStorage?: boolean;
logs?: outputs.Mk8sAddOnsLogs;
/**
* Scrape pods annotated with prometheus.io/scrape=true
*/
metrics?: outputs.Mk8sAddOnsMetrics;
nvidia?: outputs.Mk8sAddOnsNvidia;
sysbox?: boolean;
}
export interface Mk8sAddOnsAwsEcr {
/**
* Role to use when authorizing ECR pulls. Optional on AWS, in which case it will use the instance role to pull.
*/
roleArn?: string;
}
export interface Mk8sAddOnsAwsEfs {
/**
* Use this role for EFS interaction.
*/
roleArn?: string;
}
export interface Mk8sAddOnsAwsElb {
/**
* Role to use when authorizing calls to EC2 ELB. Optional on AWS, when not provided it will create the recommended role.
*/
roleArn?: string;
}
export interface Mk8sAddOnsAzureAcr {
clientId: string;
}
export interface Mk8sAddOnsAzureWorkloadIdentity {
/**
* Tenant ID to use for workload identity.
*/
tenantId?: string;
}
export interface Mk8sAddOnsLogs {
/**
* Collect k8s audit log as log events.
*/
auditEnabled?: boolean;
/**
* Collect docker logs if docker is also running.
*/
docker?: boolean;
/**
* Collect K8S events from all namespaces.
*/
events?: boolean;
excludeNamespaces?: string;
includeNamespaces?: string;
/**
* Collect kernel logs.
*/
kernel?: boolean;
/**
* Collect kubelet logs from journald.
*/
kubelet?: boolean;
}
export interface Mk8sAddOnsMetrics {
/**
* Enable scraping apiserver stats.
*/
apiServer?: boolean;
/**
* Enable CNI-level container stats.
*/
cadvisor?: boolean;
/**
* Enable scraping of core-dns service.
*/
coreDns?: boolean;
/**
* Enable kube-state metrics.
*/
kubeState?: boolean;
/**
* Enable scraping kubelet stats.
*/
kubelet?: boolean;
/**
* Enable collecting node-level stats (disk, network, filesystem, etc).
*/
nodeExporter?: boolean;
scrapeAnnotated?: outputs.Mk8sAddOnsMetricsScrapeAnnotated;
}
export interface Mk8sAddOnsMetricsScrapeAnnotated {
excludeNamespaces?: string;
includeNamespaces?: string;
intervalSeconds: number;
retainLabels?: string;
}
export interface Mk8sAddOnsNvidia {
taintGpuNodes?: boolean;
}
export interface Mk8sAwsProvider {
autoscaler?: outputs.Mk8sAwsProviderAutoscaler;
/**
* Extra tags to attach to all created objects.
*/
awsTags?: {
[key: string]: string;
};
/**
* Control Plane will set up the cluster by assuming this role.
*/
deployRoleArn: string;
deployRoleChains?: outputs.Mk8sAwsProviderDeployRoleChain[];
/**
* KMS key used to encrypt volumes. Supports SSM.
*/
diskEncryptionKeyArn?: string;
extraNodePolicies?: string[];
/**
* Default image for all nodes.
*/
image?: outputs.Mk8sAwsProviderImage;
/**
* Name of keyPair. Supports SSM
*/
keyPair?: string;
networking?: outputs.Mk8sAwsProviderNetworking;
/**
* List of node pools.
*/
nodePools?: outputs.Mk8sAwsProviderNodePool[];
/**
* Optional shell script that will be run before K8s is installed. Supports SSM.
*/
preInstallScript?: string;
/**
* Region where the cluster nodes will live.
*/
region: string;
/**
* Security groups to deploy nodes to. Security groups control if the cluster is multi-zone or single-zon.
*/
securityGroupIds?: string[];
/**
* If true, Control Plane will not create any roles.
*/
skipCreateRoles: boolean;
/**
* The vpc where nodes will be deployed. Supports SSM.
*/
vpcId: string;
}
export interface Mk8sAwsProviderAutoscaler {
expanders: string[];
unneededTime: string;
unreadyTime: string;
utilizationThreshold: number;
}
export interface Mk8sAwsProviderDeployRoleChain {
externalId?: string;
roleArn: string;
/**
* Control Plane will set up the cluster by assuming this role.
*/
sessionNamePrefix?: string;
}
export interface Mk8sAwsProviderImage {
/**
* Support SSM.
*/
exact?: string;
recommended?: string;
}
export interface Mk8sAwsProviderNetworking {
/**
* DNS forwarder used by the cluster. Can be a space-delimited list of dns servers. Default is /etc/resolv.conf when not specified.
*/
dnsForwarder?: string;
/**
* The CIDR of the pod network.
*/
podNetwork: string;
/**
* The CIDR of the service network.
*/
serviceNetwork: string;
}
export interface Mk8sAwsProviderNodePool {
/**
* Size in GB.
*/
bootDiskSize: number;
/**
* Security groups to deploy nodes to. Security groups control if the cluster is multi-zone or single-zon.
*/
extraSecurityGroupIds?: string[];
instanceTypes: string[];
/**
* Labels to attach to nodes of a node pool.
*/
labels?: {
[key: string]: string;
};
maxSize: number;
minSize: number;
name: string;
onDemandBaseCapacity: number;
onDemandPercentageAboveBaseCapacity: number;
/**
* Default image for all nodes.
*/
overrideImage?: outputs.Mk8sAwsProviderNodePoolOverrideImage;
spotAllocationStrategy: string;
subnetIds: string[];
/**
* Taint for the nodes of a pool.
*/
taints?: outputs.Mk8sAwsProviderNodePoolTaint[];
}
export interface Mk8sAwsProviderNodePoolOverrideImage {
/**
* Support SSM.
*/
exact?: string;
recommended?: string;
}
export interface Mk8sAwsProviderNodePoolTaint {
effect?: string;
key?: string;
value?: string;
}
export interface Mk8sAzureProvider {
autoscaler?: outputs.Mk8sAzureProviderAutoscaler;
/**
* Default image for all nodes.
*/
image?: outputs.Mk8sAzureProviderImage;
/**
* Region where the cluster nodes will live.
*/
location: string;
/**
* The vpc where nodes will be deployed.
*/
networkId: string;
networking?: outputs.Mk8sAzureProviderNetworking;
nodePools?: outputs.Mk8sAzureProviderNodePool[];
/**
* Optional shell script that will be run before K8s is installed. Supports SSM.
*/
preInstallScript?: string;
resourceGroup: string;
sdkSecretLink: string;
/**
* SSH keys to install for "azureuser" linux user
*/
sshKeys: string[];
subscriptionId: string;
/**
* Extra tags to attach to all created objects.
*/
tags?: {
[key: string]: string;
};
}
export interface Mk8sAzureProviderAutoscaler {
expanders: string[];
unneededTime: string;
unreadyTime: string;
utilizationThreshold: number;
}
export interface Mk8sAzureProviderImage {
recommended?: string;
reference?: outputs.Mk8sAzureProviderImageReference;
}
export interface Mk8sAzureProviderImageReference {
offer: string;
publisher: string;
sku: string;
version: string;
}
export interface Mk8sAzureProviderNetworking {
/**
* DNS forwarder used by the cluster. Can be a space-delimited list of dns servers. Default is /etc/resolv.conf when not specified.
*/
dnsForwarder?: string;
/**
* The CIDR of the pod network.
*/
podNetwork: string;
/**
* The CIDR of the service network.
*/
serviceNetwork: string;
}
export interface Mk8sAzureProviderNodePool {
bootDiskSize: number;
/**
* Labels to attach to nodes of a node pool.
*/
labels?: {
[key: string]: string;
};
maxSize: number;
minSize: number;
name: string;
overrideImage?: outputs.Mk8sAzureProviderNodePoolOverrideImage;
size: string;
subnetId: string;
/**
* Taint for the nodes of a pool.
*/
taints?: outputs.Mk8sAzureProviderNodePoolTaint[];
zones: number[];
}
export interface Mk8sAzureProviderNodePoolOverrideImage {
recommended?: string;
reference?: outputs.Mk8sAzureProviderNodePoolOverrideImageReference;
}
export interface Mk8sAzureProviderNodePoolOverrideImageReference {
offer: string;
publisher: string;
sku: string;
version: string;
}
export interface Mk8sAzureProviderNodePoolTaint {
effect?: string;
key?: string;
value?: string;
}
export interface Mk8sDigitalOceanProvider {
autoscaler?: outputs.Mk8sDigitalOceanProviderAutoscaler;
/**
* Extra tags to attach to droplets.
*/
digitalOceanTags?: string[];
/**
* Extra SSH keys to provision for user root that are not registered in the DigitalOcean.
*/
extraSshKeys?: string[];
/**
* Default image for all nodes.
*/
image: string;
networking?: outputs.Mk8sDigitalOceanProviderNetworking;
nodePools?: outputs.Mk8sDigitalOceanProviderNodePool[];
/**
* Optional shell script that will be run before K8s is installed. Supports SSM.
*/
preInstallScript?: string;
/**
* Region to deploy nodes to.
*/
region: string;
/**
* Optional set of IPs to assign as extra IPs for nodes of the cluster.
*/
reservedIps?: string[];
/**
* SSH key name for accessing deployed nodes.
*/
sshKeys: string[];
/**
* Link to a secret holding personal access token.
*/
tokenSecretLink: string;
/**
* ID of the Hetzner network to deploy nodes to.
*/
vpcId: string;
}
export interface Mk8sDigitalOceanProviderAutoscaler {
expanders: string[];
unneededTime: string;
unreadyTime: string;
utilizationThreshold: number;
}
export interface Mk8sDigitalOceanProviderNetworking {
/**
* DNS forwarder used by the cluster. Can be a space-delimited list of dns servers. Default is /etc/resolv.conf when not specified.
*/
dnsForwarder?: string;
/**
* The CIDR of the pod network.
*/
podNetwork: string;
/**
* The CIDR of the service network.
*/
serviceNetwork: string;
}
export interface Mk8sDigitalOceanProviderNodePool {
dropletSize: string;
/**
* Labels to attach to nodes of a node pool.
*/
labels?: {
[key: string]: string;
};
maxSize: number;
minSize: number;
name: string;
overrideImage?: string;
/**
* Taint for the nodes of a pool.
*/
taints?: outputs.Mk8sDigitalOceanProviderNodePoolTaint[];
}
export interface Mk8sDigitalOceanProviderNodePoolTaint {
effect?: string;
key?: string;
value?: string;
}
export interface Mk8sEphemeralProvider {
/**
* Control Plane location that will host the K8s components. Prefer one that is closest to where the nodes are running.
*/
location: string;
/**
* List of node pools.
*/
nodePools?: outputs.Mk8sEphemeralProviderNodePool[];
}
export interface Mk8sEphemeralProviderNodePool {
/**
* CPU architecture of the nodes.
*/
arch: string;
/**
* Number of nodes to deploy.
*/
count: number;
/**
* Allocated CPU.
*/
cpu: string;
/**
* Linux distro to use for ephemeral nodes.
*/
flavor: string;
/**
* Labels to attach to nodes of a node pool.
*/
labels?: {
[key: string]: string;
};
/**
* Allocated memory.
*/
memory: string;
name: string;
/**
* Taint for the nodes of a pool.
*/
taints?: outputs.Mk8sEphemeralProviderNodePoolTaint[];
}
export interface Mk8sEphemeralProviderNodePoolTaint {
effect?: string;
key?: string;
value?: string;
}
export interface Mk8sFirewall {
description?: string;
sourceCidr: string;
}
export interface Mk8sGenericProvider {
/**
* Control Plane location that will host the K8s components. Prefer one that is closest to where the nodes are running.
*/
location: string;
networking?: outputs.Mk8sGenericProviderNetworking;
/**
* List of node pools.
*/
nodePools?: outputs.Mk8sGenericProviderNodePool[];
}
export interface Mk8sGenericProviderNetworking {
/**
* DNS forwarder used by the cluster. Can be a space-delimited list of dns servers. Default is /etc/resolv.conf when not specified.
*/
dnsForwarder?: string;
/**
* The CIDR of the pod network.
*/
podNetwork: string;
/**
* The CIDR of the service network.
*/
serviceNetwork: string;
}
export interface Mk8sGenericProviderNodePool {
/**
* Labels to attach to nodes of a node pool.
*/
labels?: {
[key: string]: string;
};
name: string;
/**
* Taint for the nodes of a pool.
*/
taints?: outputs.Mk8sGenericProviderNodePoolTaint[];
}
export interface Mk8sGenericProviderNodePoolTaint {
effect?: string;
key?: string;
value?: string;
}
export interface Mk8sHetznerProvider {
autoscaler?: outputs.Mk8sHetznerProviderAutoscaler;
/**
* Node pools that can configure dedicated Hetzner servers.
*/
dedicatedServerNodePools?: outputs.Mk8sHetznerProviderDedicatedServerNodePool[];
/**
* Optional firewall rule to attach to all nodes.
*/
firewallId?: string;
/**
* If supplied, nodes will get assigned a random floating ip matching the selector.
*/
floatingIpSelector?: {
[key: string]: string;
};
/**
* Extra labels to attach to servers.
*/
hetznerLabels?: {
[key: string]: string;
};
/**
* Default image for all nodes.
*/
image: string;
/**
* ID of the Hetzner network to deploy nodes to.
*/
networkId: string;
networking?: outputs.Mk8sHetznerProviderNetworking;
nodePools?: outputs.Mk8sHetznerProviderNodePool[];
/**
* Optional shell script that will be run before K8s is installed. Supports SSM.
*/
preInstallScript?: string;
/**
* Hetzner region to deploy nodes to.
*/
region: string;
/**
* SSH key name for accessing deployed nodes.
*/
sshKey?: string;
/**
* Link to a secret holding Hetzner access key.
*/
tokenSecretLink: string;
}
export interface Mk8sHetznerProviderAutoscaler {
expanders: string[];
unneededTime: string;
unreadyTime: string;
utilizationThreshold: number;
}
export interface Mk8sHetznerProviderDedicatedServerNodePool {
/**
* Labels to attach to nodes of a node pool.
*/
labels?: {
[key: string]: string;
};
name: string;
/**
* Taint for the nodes of a pool.
*/
taints?: outputs.Mk8sHetznerProviderDedicatedServerNodePoolTaint[];
}
export interface Mk8sHetznerProviderDedicatedServerNodePoolTaint {
effect?: string;
key?: string;
value?: string;
}
export interface Mk8sHetznerProviderNetworking {
/**
* DNS forwarder used by the cluster. Can be a space-delimited list of dns servers. Default is /etc/resolv.conf when not specified.
*/
dnsForwarder?: string;
/**
* The CIDR of the pod network.
*/
podNetwork: string;
/**
* The CIDR of the service network.
*/
serviceNetwork: string;
}
export interface Mk8sHetznerProviderNodePool {
/**
* Labels to attach to nodes of a node pool.
*/
labels?: {
[key: string]: string;
};
maxSize: number;
minSize: number;
name: string;
overrideImage?: string;
serverType: string;
/**
* Taint for the nodes of a pool.
*/
taints?: outputs.Mk8sHetznerProviderNodePoolTaint[];
}
export interface Mk8sHetznerProviderNodePoolTaint {
effect?: string;
key?: string;
value?: string;
}
export interface Mk8sLambdalabsProvider {
autoscaler?: outputs.Mk8sLambdalabsProviderAutoscaler;
fileSystems?: string[];
/**
* List of node pools.
*/
nodePools?: outputs.Mk8sLambdalabsProviderNodePool[];
/**
* Optional shell script that will be run before K8s is installed. Supports SSM.
*/
preInstallScript?: string;
/**
* Region where the cluster nodes will live.
*/
region: string;
/**
* SSH key name for accessing deployed nodes.
*/
sshKey: string;
/**
* Link to a secret holding Lambdalabs access key.
*/
tokenSecretLink: string;
unmanagedNodePools?: outputs.Mk8sLambdalabsProviderUnmanagedNodePool[];
}
export interface Mk8sLambdalabsProviderAutoscaler {
expanders: string[];
unneededTime: string;
unreadyTime: string;
utilizationThreshold: number;
}
export interface Mk8sLambdalabsProviderNodePool {
instanceType: string;
/**
* Labels to attach to nodes of a node pool.
*/
labels?: {
[key: string]: string;
};
maxSize: number;
minSize: number;
name: string;
/**
* Taint for the nodes of a pool.
*/