@pulumiverse/cpln
Version:
A Pulumi package for creating and managing Control Plane (cpln) resources.
1,515 lines • 183 kB
TypeScript
import * as outputs from "../types/output";
export interface CatalogTemplateResource {
/**
* The kind of resource (e.g., 'workload', 'secret', 'gvc').
*/
kind: string;
/**
* The full Control Plane link to the resource.
*/
link: string;
/**
* The name of the resource.
*/
name: string;
}
export interface CloudAccountAws {
/**
* Amazon Resource Name (ARN) Role.
*/
roleArn?: string;
}
export interface CloudAccountAzure {
/**
* Full link to an Azure secret. (e.g., /org/ORG_NAME/secret/AZURE_SECRET).
*/
secretLink?: string;
}
export interface CloudAccountGcp {
/**
* GCP project ID. Obtained from the GCP cloud console.
*/
projectId?: string;
}
export interface CloudAccountNgs {
/**
* Full link to a NATS Account Secret secret. (e.g., /org/ORG_NAME/secret/NATS_ACCOUNT_SECRET).
*/
secretLink?: string;
}
export interface CloudAccountStatus {
/**
* ISO-8601 timestamp of the last time the Cloud Account credentials were validated.
*/
lastChecked: string;
/**
* The last error message reported when validating the Cloud Account credentials.
*/
lastError: string;
/**
* Whether the Cloud Account credentials are valid and usable by Control Plane.
*/
usable: boolean;
}
export interface CustomLocationGeo {
/**
* City of the location.
*/
city: string;
/**
* Continent of the location.
*/
continent: string;
/**
* Country of the location.
*/
country: string;
/**
* Latitude of the location.
*/
lat: number;
/**
* Longitude of the location.
*/
lon: number;
/**
* State of the location.
*/
state: string;
}
export interface DomainRouteCanary {
/**
* The port to send canary traffic to. If not provided, the first configured port on the workload is used.
*/
port?: number;
/**
* The percentage of traffic to send to this canary workload. A weight of 0 disables the canary so it can be toggled on and off without removing it.
*/
weight: number;
/**
* The canary workload to route a weighted percentage of traffic to.
*/
workloadLink: string;
}
export interface DomainRouteHeaders {
/**
* Manipulates HTTP headers.
*/
request?: outputs.DomainRouteHeadersRequest;
}
export interface DomainRouteHeadersRequest {
/**
* Sets or overrides headers to all http requests for this route.
*/
set?: {
[key: string]: string;
};
}
export interface DomainRouteMirror {
/**
* The percentage of traffic to mirror to the specified workload.
*/
percent: number;
/**
* The port on the mirrored workload to send traffic to. If not provided, traffic will be mirrored to the first discovered port on the mirrored workload.
*/
port?: number;
/**
* The workload to mirror traffic to.
*/
workloadLink: string;
}
export interface DomainSpec {
/**
* Allows domain to accept wildcards. The associated GVC must have dedicated load balancing enabled.
*/
acceptAllHosts: boolean;
/**
* Accept all subdomains will accept any host that is a sub domain of the domain so *.$DOMAIN
*/
acceptAllSubdomains: boolean;
/**
* Defines the method used to prove domain ownership for certificate issuance.
*/
certChallengeType?: string;
/**
* In `cname` dnsMode, Control Plane will configure workloads to accept traffic for the domain but will not manage DNS records for the domain. End users must configure CNAME records in their own DNS pointed to the canonical workload endpoint. Currently `cname` dnsMode requires that a TLS server certificate be configured when subdomain based routing is used. In `ns` dnsMode, Control Plane will manage the subdomains and create all necessary DNS records. End users configure NS records to forward DNS requests to the Control Plane managed DNS servers. Valid values: `cname`, `ns`. Default: `cname`.
*/
dnsMode: string;
/**
* This value is set to a target GVC (using a full link) for use by subdomain based routing. Each workload in the GVC will receive a subdomain in the form ${workload.name}.${domain.name}. **Do not include if path based routing is used.**
*/
gvcLink?: string;
/**
* Domain port specifications.
*/
ports?: outputs.DomainSpecPort[];
/**
* Creates a unique subdomain for each replica of a stateful workload, enabling direct access to individual instances.
*/
workloadLink?: string;
}
export interface DomainSpecPort {
/**
* A security feature implemented by web browsers to allow resources on a web page to be requested from another domain outside the domain from which the resource originated.
*/
cors?: outputs.DomainSpecPortCors;
/**
* Sets or overrides headers to all http requests for this route.
*/
number: number;
/**
* Allowed protocol. Valid values: `http`, `http2`, `tcp`. Default: `http2`.
*/
protocol: string;
/**
* Inline routes for this port. Can coexist with separate cpln.DomainRoute resources on the same domain and port.
*/
routes?: outputs.DomainSpecPortRoute[];
/**
* Used for TLS connections for this Domain. End users are responsible for certificate updates.
*/
tls?: outputs.DomainSpecPortTls;
}
export interface DomainSpecPortCors {
/**
* Determines whether the client-side code (typically running in a web browser) is allowed to include credentials (such as cookies, HTTP authentication, or client-side SSL certificates) in cross-origin requests.
*/
allowCredentials: boolean;
/**
* Specifies the custom HTTP headers that are allowed in a cross-origin request to a specific resource.
*/
allowHeaders?: string[];
/**
* Specifies the HTTP methods (such as `GET`, `POST`, `PUT`, `DELETE`, etc.) that are allowed for a cross-origin request to a specific resource.
*/
allowMethods?: string[];
/**
* Determines which origins are allowed to access a particular resource on a server from a web browser.
*/
allowOrigins?: outputs.DomainSpecPortCorsAllowOrigin[];
/**
* The HTTP headers that a server allows to be exposed to the client in response to a cross-origin request. These headers provide additional information about the server's capabilities or requirements, aiding in proper handling of the request by the client's browser or application.
*/
exposeHeaders?: string[];
/**
* Maximum amount of time that a preflight request result can be cached by the client browser. Input is expected as a duration string (i.e, 24h, 20m, etc.).
*/
maxAge: string;
}
export interface DomainSpecPortCorsAllowOrigin {
/**
* Value of allowed origin.
*/
exact?: string;
regex?: string;
}
export interface DomainSpecPortRoute {
/**
* Routes a weighted percentage of traffic to one or more additional workloads. The combined weight of all canaries on a route must not exceed 100; the remaining weight goes to the primary workload. Only supported on http and http2 ports.
*/
canaries?: outputs.DomainSpecPortRouteCanary[];
/**
* Modify the headers for all http requests for this route.
*/
headers?: outputs.DomainSpecPortRouteHeaders;
/**
* This option allows forwarding traffic for different host headers to different workloads.
*/
hostPrefix?: string;
/**
* A regex to match the host header.
*/
hostRegex?: string;
/**
* Mirror the traffic to the specified workload(s). Only works for workloads running in the same location as the primary workload(s).
*/
mirrors?: outputs.DomainSpecPortRouteMirror[];
/**
* For the linked workload, the port to route traffic to.
*/
port?: number;
/**
* The path will match any unmatched path prefixes for the subdomain.
*/
prefix?: string;
/**
* Used to match URI paths. Uses the google re2 regex syntax.
*/
regex?: string;
/**
* A path prefix can be configured to be replaced when forwarding the request to the Workload.
*/
replacePrefix?: string;
/**
* The replica number of a stateful workload to route to. If not provided, traffic will be routed to all replicas.
*/
replica?: number;
/**
* The link of the workload to map the prefix to.
*/
workloadLink: string;
}
export interface DomainSpecPortRouteCanary {
/**
* The port to send canary traffic to. If not provided, the first configured port on the workload is used.
*/
port?: number;
/**
* The percentage of traffic to send to this canary workload. A weight of 0 disables the canary so it can be toggled on and off without removing it.
*/
weight: number;
/**
* The canary workload to route a weighted percentage of traffic to.
*/
workloadLink: string;
}
export interface DomainSpecPortRouteHeaders {
/**
* Manipulates HTTP headers.
*/
request?: outputs.DomainSpecPortRouteHeadersRequest;
}
export interface DomainSpecPortRouteHeadersRequest {
/**
* Sets or overrides headers to all http requests for this route.
*/
set?: {
[key: string]: string;
};
}
export interface DomainSpecPortRouteMirror {
/**
* The percentage of traffic to mirror to the specified workload.
*/
percent: number;
/**
* The port on the mirrored workload to send traffic to. If not provided, traffic will be mirrored to the first discovered port on the mirrored workload.
*/
port?: number;
/**
* The workload to mirror traffic to.
*/
workloadLink: string;
}
export interface DomainSpecPortTls {
/**
* Allowed cipher suites. Refer to the [Domain Reference](https://docs.controlplane.com/reference/domain#cipher-suites) for details.
*/
cipherSuites: string[];
/**
* The certificate authority PEM, stored as a TLS Secret, used to verify the authority of the client certificate. The only verification performed checks that the CN of the PEM matches the Domain (i.e., CN=*.DOMAIN).
*/
clientCertificate?: outputs.DomainSpecPortTlsClientCertificate;
/**
* Minimum TLS version to accept. Minimum is `1.0`. Default: `1.2`.
*/
minProtocolVersion: string;
/**
* Configure an optional custom server certificate for the domain. When the port number is 443 and this is not supplied, a certificate is provisioned automatically.
*/
serverCertificate?: outputs.DomainSpecPortTlsServerCertificate;
}
export interface DomainSpecPortTlsClientCertificate {
/**
* The secret will include a client certificate authority cert in PEM format used to verify requests which include client certificates. The key subject must match the domain and the key usage properties must be configured for client certificate authorization. The secret type must be keypair.
*/
secretLink?: string;
}
export interface DomainSpecPortTlsServerCertificate {
/**
* When provided, this is used as the server certificate authority. The secret type must be keypair and the content must be PEM encoded.
*/
secretLink?: string;
}
export interface DomainStatus {
/**
* List of required DNS record entries.
*/
dnsConfigs: outputs.DomainStatusDnsConfig[];
/**
* List of configured domain endpoints.
*/
endpoints: outputs.DomainStatusEndpoint[];
fingerprint: string;
/**
* Contains the cloud provider name, region, and certificate status.
*/
locations: outputs.DomainStatusLocation[];
/**
* Status of Domain. Possible values: `initializing`, `ready`, `pendingDnsConfig`, `pendingCertificate`, `usedByGvc`.
*/
status: string;
/**
* Warning message.
*/
warning: string;
}
export interface DomainStatusDnsConfig {
/**
* The host in DNS terminology refers to the domain or subdomain that the DNS record is associated with. It's essentially the name that is being queried or managed. For example, in a DNS record for `www.example.com`, `www` is a host in the domain `example.com`.
*/
host: string;
/**
* Time to live (TTL) is a value that signifies how long (in seconds) a DNS record should be cached by a resolver or a browser before a new request should be sent to refresh the data. Lower TTL values mean records are updated more frequently, which is beneficial for dynamic DNS configurations or during DNS migrations. Higher TTL values reduce the load on DNS servers and improve the speed of name resolution for end users by relying on cached data.
*/
ttl: number;
/**
* The DNS record type specifies the type of data the DNS record contains. Valid values: `CNAME`, `NS`, `TXT`.
*/
type: string;
/**
* The value of a DNS record contains the data the record is meant to convey, based on the type of the record.
*/
value: string;
}
export interface DomainStatusEndpoint {
/**
* URL of endpoint.
*/
url: string;
/**
* Full link to associated workload.
*/
workloadLink: string;
}
export interface DomainStatusLocation {
/**
* The current validity or status of the SSL/TLS certificate.
*/
certificateStatus: string;
/**
* The name of the location.
*/
name: string;
}
export interface GetGvcControlplaneTracing {
/**
* Key-value map of custom tags.
*/
customTags?: {
[key: string]: string;
};
/**
* Determines what percentage of requests should be traced.
*/
sampling: number;
}
export interface GetGvcKeda {
/**
* Enable KEDA for this GVC. KEDA is a Kubernetes-based event-driven autoscaler that allows you to scale workloads based on external events. When enabled, a keda operator will be deployed in the GVC and workloads in the GVC can use KEDA to scale based on external metrics.
*/
enabled: boolean;
/**
* A link to an Identity resource that will be used for KEDA. This will allow the keda operator to access cloud and network resources.
*/
identityLink?: string;
/**
* A list of secrets to be used as TriggerAuthentication objects. The TriggerAuthentication object will be named after the secret and can be used by triggers on workloads in this GVC.
*/
secrets?: string[];
}
export interface GetGvcLightstepTracing {
/**
* Full link to referenced Opaque Secret.
*/
credentials?: string;
/**
* Key-value map of custom tags.
*/
customTags?: {
[key: string]: string;
};
/**
* Tracing Endpoint Workload. Either the canonical endpoint or internal endpoint.
*/
endpoint: string;
/**
* Determines what percentage of requests should be traced.
*/
sampling: number;
}
export interface GetGvcLoadBalancer {
/**
* Creates a dedicated load balancer in each location and enables additional Domain features: custom ports, protocols and wildcard hostnames. Charges apply for each location.
*/
dedicated?: boolean;
/**
* The link or the name of the IP Set that will be used for this load balancer.
*/
ipset?: string;
multiZone?: outputs.GetGvcLoadBalancerMultiZone;
/**
* Specify the url to be redirected to for different http status codes.
*/
redirect?: outputs.GetGvcLoadBalancerRedirect;
/**
* Controls the address used for request logging and for setting the X-Envoy-External-Address header. If set to 1, then the last address in an existing X-Forwarded-For header will be used in place of the source client IP address. If set to 2, then the second to last address in an existing X-Forwarded-For header will be used in place of the source client IP address. If the XFF header does not have at least two addresses or does not exist then the source client IP address will be used instead.
*/
trustedProxies: number;
}
export interface GetGvcLoadBalancerMultiZone {
enabled: boolean;
}
export interface GetGvcLoadBalancerRedirect {
/**
* Specify the redirect url for all status codes in a class.
*/
class?: outputs.GetGvcLoadBalancerRedirectClass;
}
export interface GetGvcLoadBalancerRedirectClass {
/**
* An optional url redirect for 401 responses. Supports envoy format strings to include request information. E.g. https://your-oauth-server/oauth2/authorize?return_to=%REQ(:path)%&client_id=your-client-id
*/
status401?: string;
/**
* Specify the redirect url for any 500 level status code.
*/
status5xx?: string;
}
export interface GetGvcLocationOption {
/**
* Artificial latency offset in milliseconds added to measured latency. Positive values push traffic away from this location, negative values attract traffic. Default: `0`.
*/
latencyOffsetMs: number;
/**
* Maximum acceptable latency in milliseconds. If measured latency exceeds this value, the location is treated as unavailable for DNS geo routing.
*/
latencyToleranceMs: number;
/**
* Name of the location these options apply to.
*/
name: string;
/**
* Routing tier for DNS geo routing. Lower value = higher priority. Locations with the same `routingTier` form a group; within a group, lowest latency wins. If all locations in the highest-priority group are unavailable, the next group is used.
*/
routingTier: number;
}
export interface GetGvcLocationQuery {
/**
* Type of fetch. Specify either: `links` or `items`. Default: `items`.
*/
fetch: string;
specs?: outputs.GetGvcLocationQuerySpec[];
}
export interface GetGvcLocationQuerySpec {
/**
* Type of match. Available values: `all`, `any`, `none`. Default: `all`.
*/
match: string;
/**
* Terms can only contain one of the following attributes: `property`, `rel`, `tag`.
*/
terms?: outputs.GetGvcLocationQuerySpecTerm[];
}
export interface GetGvcLocationQuerySpecTerm {
/**
* Type of query operation. Available values: `=`, `>`, `>=`, `<`, `<=`, `!=`, `~`, `=~`, `exists`, `!exists`, `contains`. Default: `=`.
*/
op: string;
/**
* Property to use for query evaluation.
*/
property: string;
/**
* Relation to use for query evaluation.
*/
rel: string;
/**
* Tag key to use for query evaluation.
*/
tag: string;
/**
* Testing value for query evaluation.
*/
value: string;
}
export interface GetGvcOtelTracing {
/**
* Key-value map of custom tags.
*/
customTags?: {
[key: string]: string;
};
/**
* Tracing Endpoint Workload. Either the canonical endpoint or internal endpoint.
*/
endpoint: string;
/**
* Determines what percentage of requests should be traced.
*/
sampling: number;
}
export interface GetGvcSidecar {
envoy: string;
}
export interface GetHelmTemplatePostrender {
/**
* Arguments to the post-renderer.
*/
args?: string[];
/**
* The path to an executable to be used for post rendering.
*/
binaryPath: string;
}
export interface GetImageManifest {
/**
* The config is a JSON blob that contains the image configuration data which includes environment variables, default command to run, and other settings necessary to run the container based on this image.
*/
configs: outputs.GetImageManifestConfig[];
/**
* Layers lists the digests of the image's layers. These layers are filesystem changes or additions made in each step of the Docker image's creation process. The layers are stored separately and pulled as needed, which allows for efficient storage and transfer of images. Each layer is represented by a SHA256 digest, ensuring the integrity and authenticity of the image.
*/
layers: outputs.GetImageManifestLayer[];
/**
* Specifies the type of the content represented in the manifest, allowing Docker clients and registries to understand how to handle the document correctly.
*/
mediaType: string;
/**
* The version of the Docker Image Manifest format.
*/
schemaVersion: number;
}
export interface GetImageManifestConfig {
/**
* A unique SHA256 hash used to identify a specific image version within the image registry.
*/
digest: string;
/**
* Specifies the type of the content represented in the manifest, allowing Docker clients and registries to understand how to handle the document correctly.
*/
mediaType: string;
/**
* The size of the image or layer in bytes. This helps in estimating the space required and the download time.
*/
size: number;
}
export interface GetImageManifestLayer {
/**
* A unique SHA256 hash used to identify a specific image version within the image registry.
*/
digest: string;
/**
* Specifies the type of the content represented in the manifest, allowing Docker clients and registries to understand how to handle the document correctly.
*/
mediaType: string;
/**
* The size of the image or layer in bytes. This helps in estimating the space required and the download time.
*/
size: number;
}
export interface GetImagesImage {
/**
* The ID, in GUID format, of the image.
*/
cplnId: string;
/**
* A unique SHA256 hash used to identify a specific image version within the image registry.
*/
digest: string;
/**
* The manifest provides configuration and layers information about the image. It plays a crucial role in the Docker image distribution system, enabling image creation, verification, and replication in a consistent and secure manner.
*/
manifests: outputs.GetImagesImageManifest[];
/**
* Name of the image.
*/
name: string;
/**
* Respository name of the image.
*/
repository: string;
/**
* Full link to this resource. Can be referenced by other resources.
*/
selfLink: string;
/**
* Tag of the image.
*/
tag: string;
/**
* Key-value map of resource tags.
*/
tags: {
[key: string]: string;
};
}
export interface GetImagesImageManifest {
/**
* The config is a JSON blob that contains the image configuration data which includes environment variables, default command to run, and other settings necessary to run the container based on this image.
*/
configs: outputs.GetImagesImageManifestConfig[];
/**
* Layers lists the digests of the image's layers. These layers are filesystem changes or additions made in each step of the Docker image's creation process. The layers are stored separately and pulled as needed, which allows for efficient storage and transfer of images. Each layer is represented by a SHA256 digest, ensuring the integrity and authenticity of the image.
*/
layers: outputs.GetImagesImageManifestLayer[];
/**
* Specifies the type of the content represented in the manifest, allowing Docker clients and registries to understand how to handle the document correctly.
*/
mediaType: string;
/**
* The version of the Docker Image Manifest format.
*/
schemaVersion: number;
}
export interface GetImagesImageManifestConfig {
/**
* A unique SHA256 hash used to identify a specific image version within the image registry.
*/
digest: string;
/**
* Specifies the type of the content represented in the manifest, allowing Docker clients and registries to understand how to handle the document correctly.
*/
mediaType: string;
/**
* The size of the image or layer in bytes. This helps in estimating the space required and the download time.
*/
size: number;
}
export interface GetImagesImageManifestLayer {
/**
* A unique SHA256 hash used to identify a specific image version within the image registry.
*/
digest: string;
/**
* Specifies the type of the content represented in the manifest, allowing Docker clients and registries to understand how to handle the document correctly.
*/
mediaType: string;
/**
* The size of the image or layer in bytes. This helps in estimating the space required and the download time.
*/
size: number;
}
export interface GetImagesQuery {
/**
* Type of fetch. Specify either: `links` or `items`. Default: `items`.
*/
fetch: string;
/**
* The specification of the query.
*/
spec?: outputs.GetImagesQuerySpec;
}
export interface GetImagesQuerySpec {
/**
* Type of match. Available values: `all`, `any`, `none`. Default: `all`.
*/
match: string;
/**
* Terms can only contain one of the following attributes: `property`, `rel`, `tag`.
*/
terms?: outputs.GetImagesQuerySpecTerm[];
}
export interface GetImagesQuerySpecTerm {
/**
* Type of query operation. Available values: `=`, `>`, `>=`, `<`, `<=`, `!=`, `exists`, `!exists`. Default: `=`.
*/
op: string;
/**
* Property to use for query evaluation.
*/
property?: string;
/**
* Relation to use for query evaluation.
*/
rel?: string;
/**
* Tag key to use for query evaluation.
*/
tag?: string;
/**
* Testing value for query evaluation.
*/
value?: string;
}
export interface GetLocationGeo {
/**
* City of the location.
*/
city: string;
/**
* Continent of the location.
*/
continent: string;
/**
* Country of the location.
*/
country: string;
/**
* Latitude of the location.
*/
lat: number;
/**
* Longitude of the location.
*/
lon: number;
/**
* State of the location.
*/
state: string;
}
export interface GetLocationsLocation {
/**
* Cloud Provider of the location. Valid values: `aws`, `gcp`, `azure`, `byok`, `linode`, `vultr`, `equinix`, `oci`.
*/
cloudProvider: string;
/**
* The ID, in GUID format, of the location.
*/
cplnId: string;
/**
* Description of the location.
*/
description: string;
/**
* Indication if location is enabled.
*/
enabled: boolean;
geos: outputs.GetLocationsLocationGeo[];
/**
* A list of IP ranges of the location.
*/
ipRanges: string[];
/**
* Name of the location.
*/
name: string;
/**
* Origin of the location. Valid values: `builtin`, `default`, `custom`.
*/
origin: string;
/**
* Region of the location.
*/
region: string;
/**
* Full link to this resource. Can be referenced by other resources.
*/
selfLink: string;
/**
* Key-value map of resource tags.
*/
tags: {
[key: string]: string;
};
}
export interface GetLocationsLocationGeo {
/**
* City of the location.
*/
city: string;
/**
* Continent of the location.
*/
continent: string;
/**
* Country of the location.
*/
country: string;
/**
* Latitude of the location.
*/
lat: number;
/**
* Longitude of the location.
*/
lon: number;
/**
* State of the location.
*/
state: string;
}
export interface GetOrgAuthConfig {
/**
* List of domains which will auto-provision users when authenticating using SAML.
*/
domainAutoMembers: string[];
/**
* Enforce SAML only authentication.
*/
samlOnly: boolean;
}
export interface GetOrgObservability {
/**
* These emails are configured as alert recipients in Grafana when the 'grafana-default-email' contact delivery type is 'Email'.
*/
defaultAlertEmails: string[];
/**
* Log retention days. Min: 0. Max: 3650. Default: 30
*/
logsRetentionDays: number;
/**
* Metrics retention days. Min: 0. Max: 3650. Default: 30
*/
metricsRetentionDays: number;
/**
* Traces retention days. Min: 0. Max: 3650. Default: 30
*/
tracesRetentionDays: number;
}
export interface GetOrgSecurity {
threatDetection?: outputs.GetOrgSecurityThreatDetection;
}
export interface GetOrgSecurityThreatDetection {
/**
* Indicates whether threat detection should be forwarded or not.
*/
enabled: boolean;
/**
* Any threats with this severity and more severe will be sent. Others will be ignored. Valid values: `warning`, `error`, or `critical`.
*/
minimumSeverity?: string;
/**
* Configuration for syslog forwarding.
*/
syslog?: outputs.GetOrgSecurityThreatDetectionSyslog;
}
export interface GetOrgSecurityThreatDetectionSyslog {
/**
* The hostname to send syslog messages to.
*/
host: string;
/**
* The port to send syslog messages to. Min: 1. Max: 100000.
*/
port: number;
/**
* The transport-layer protocol to send the syslog messages over. If TCP is chosen, messages will be sent with TLS. Default: `tcp`.
*/
transport: string;
}
export interface GetOrgStatus {
/**
* The link of the account the org belongs to.
*/
accountLink: string;
/**
* Indicates whether the org is active or not.
*/
active: boolean;
endpointPrefix: string;
}
export interface GetSecretAw {
/**
* Access Key provided by AWS.
*/
accessKey: string;
/**
* AWS IAM Role External ID.
*/
externalId: string;
/**
* Role ARN provided by AWS.
*/
roleArn: string;
/**
* Secret Key provided by AWS.
*/
secretKey: string;
}
export interface GetSecretAzureConnector {
/**
* Code/Key to authenticate to deployment URL.
*/
code: string;
/**
* Deployment URL.
*/
url: string;
}
export interface GetSecretEcr {
/**
* Access Key provided by AWS.
*/
accessKey: string;
/**
* AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.
*/
externalId: string;
/**
* List of ECR repositories.
*/
repos: string[];
/**
* Role ARN provided by AWS.
*/
roleArn: string;
/**
* Secret Key provided by AWS.
*/
secretKey: string;
}
export interface GetSecretKeypair {
/**
* Passphrase for private key.
*/
passphrase: string;
/**
* Public Key.
*/
publicKey: string;
/**
* Secret/Private Key.
*/
secretKey: string;
}
export interface GetSecretNatsAccount {
/**
* Account ID.
*/
accountId: string;
/**
* Private Key.
*/
privateKey: string;
}
export interface GetSecretOpaque {
/**
* Available encodings: `plain`, `base64`. Default: `plain`.
*/
encoding: string;
/**
* Plain text or base64 encoded string. Use `encoding` attribute to specify encoding.
*/
payload: string;
}
export interface GetSecretTl {
/**
* Public Certificate.
*/
cert: string;
/**
* Chain Certificate.
*/
chain: string;
/**
* Private Certificate.
*/
key: string;
}
export interface GetSecretUserpass {
/**
* Available encodings: `plain`, `base64`. Default: `plain`.
*/
encoding: string;
/**
* Password.
*/
password: string;
/**
* Username.
*/
username: string;
}
export interface GetWorkloadContainer {
/**
* Command line arguments passed to the container at runtime. Replaces the CMD arguments of the running container. It is an ordered list.
*/
args: string[];
/**
* Override the entry point.
*/
command: string;
/**
* Reserved CPU of the workload when capacityAI is disabled. Maximum CPU when CapacityAI is enabled. Default: "50m".
*/
cpu: string;
/**
* Name-Value list of environment variables.
*/
env: {
[key: string]: string;
};
gpuCustoms?: outputs.GetWorkloadContainerGpuCustom[];
/**
* GPUs manufactured by NVIDIA, which are specialized hardware accelerators used to offload and accelerate computationally intensive tasks within the workload.
*/
gpuNvidias?: outputs.GetWorkloadContainerGpuNvidia[];
/**
* The full image and tag path.
*/
image: string;
/**
* Enables inheritance of GVC environment variables. A variable in spec.env will override a GVC variable with the same name.
*/
inheritEnv: boolean;
/**
* Lifecycle [Reference Page](https://docs.controlplane.com/reference/workload#lifecycle).
*/
lifecycles?: outputs.GetWorkloadContainerLifecycle[];
/**
* Liveness Probe
*/
livenessProbes?: outputs.GetWorkloadContainerLivenessProbe[];
/**
* Reserved memory of the workload when capacityAI is disabled. Maximum memory when CapacityAI is enabled. Default: "128Mi".
*/
memory: string;
/**
* [Reference Page](https://docs.controlplane.com/reference/workload#metrics).
*/
metrics?: outputs.GetWorkloadContainerMetric[];
/**
* Minimum CPU when capacity AI is enabled.
*/
minCpu: string;
/**
* Minimum memory when capacity AI is enabled.
*/
minMemory: string;
/**
* Name of the container.
*/
name: string;
/**
* The port the container exposes. Only one container is allowed to specify a port. Min: `80`. Max: `65535`. Used by `serverless` Workload type. **DEPRECATED - Use `ports`.**
*
* @deprecated The 'port' attribute will be deprecated in the next major version. Use the 'ports' attribute instead.
*/
port: number;
/**
* Communication endpoints used by the workload to send and receive network traffic.
*/
ports?: outputs.GetWorkloadContainerPort[];
/**
* Readiness Probe
*/
readinessProbes?: outputs.GetWorkloadContainerReadinessProbe[];
/**
* Mount Object Store (S3, GCS, AzureBlob) buckets as file system.
*/
volumes?: outputs.GetWorkloadContainerVolume[];
/**
* Override the working directory. Must be an absolute path.
*/
workingDirectory: string;
}
export interface GetWorkloadContainerGpuCustom {
/**
* Number of GPUs.
*/
quantity: number;
resource: string;
runtimeClass: string;
}
export interface GetWorkloadContainerGpuNvidia {
/**
* GPU Model (i.e.: t4)
*/
model: string;
/**
* Number of GPUs.
*/
quantity: number;
}
export interface GetWorkloadContainerLifecycle {
postStarts?: outputs.GetWorkloadContainerLifecyclePostStart[];
preStops?: outputs.GetWorkloadContainerLifecyclePreStop[];
}
export interface GetWorkloadContainerLifecyclePostStart {
execs?: outputs.GetWorkloadContainerLifecyclePostStartExec[];
}
export interface GetWorkloadContainerLifecyclePostStartExec {
/**
* Command and arguments executed immediately after the container is created.
*/
commands: string[];
}
export interface GetWorkloadContainerLifecyclePreStop {
execs?: outputs.GetWorkloadContainerLifecyclePreStopExec[];
}
export interface GetWorkloadContainerLifecyclePreStopExec {
/**
* Command and arguments executed immediately before the container is stopped.
*/
commands: string[];
}
export interface GetWorkloadContainerLivenessProbe {
execs?: outputs.GetWorkloadContainerLivenessProbeExec[];
failureThreshold: number;
grpcs?: outputs.GetWorkloadContainerLivenessProbeGrpc[];
httpGets?: outputs.GetWorkloadContainerLivenessProbeHttpGet[];
initialDelaySeconds: number;
periodSeconds: number;
successThreshold: number;
tcpSockets?: outputs.GetWorkloadContainerLivenessProbeTcpSocket[];
timeoutSeconds: number;
}
export interface GetWorkloadContainerLivenessProbeExec {
commands: string[];
}
export interface GetWorkloadContainerLivenessProbeGrpc {
port: number;
}
export interface GetWorkloadContainerLivenessProbeHttpGet {
httpHeaders: {
[key: string]: string;
};
path: string;
port: number;
scheme: string;
}
export interface GetWorkloadContainerLivenessProbeTcpSocket {
port: number;
}
export interface GetWorkloadContainerMetric {
/**
* Drop metrics that match given patterns.
*/
dropMetrics: string[];
/**
* Path from container emitting custom metrics.
*/
path: string;
/**
* Port from container emitting custom metrics.
*/
port: number;
}
export interface GetWorkloadContainerPort {
/**
* Port to expose.
*/
number: number;
/**
* Protocol. Choice of: `http`, `http2`, `tcp`, or `grpc`.
*/
protocol: string;
}
export interface GetWorkloadContainerReadinessProbe {
execs?: outputs.GetWorkloadContainerReadinessProbeExec[];
failureThreshold: number;
grpcs?: outputs.GetWorkloadContainerReadinessProbeGrpc[];
httpGets?: outputs.GetWorkloadContainerReadinessProbeHttpGet[];
initialDelaySeconds: number;
periodSeconds: number;
successThreshold: number;
tcpSockets?: outputs.GetWorkloadContainerReadinessProbeTcpSocket[];
timeoutSeconds: number;
}
export interface GetWorkloadContainerReadinessProbeExec {
commands: string[];
}
export interface GetWorkloadContainerReadinessProbeGrpc {
port: number;
}
export interface GetWorkloadContainerReadinessProbeHttpGet {
httpHeaders: {
[key: string]: string;
};
path: string;
port: number;
scheme: string;
}
export interface GetWorkloadContainerReadinessProbeTcpSocket {
port: number;
}
export interface GetWorkloadContainerVolume {
/**
* VM disk boot order. Only valid for `vm` workloads.
*/
bootOrder: number;
/**
* VM disk bus. Only valid for `vm` workloads. Valid values: `virtio`, `sata`, `scsi`.
*/
bus: string;
/**
* VM disk name. Required for `vm` workloads; rejected for other workload types.
*/
name: string;
/**
* File path added to workload pointing to the volume. Required for non-`vm` workloads; rejected for `vm` workloads (the volume is attached to the VM as a block device).
*/
path: string;
/**
* Only applicable to persistent volumes, this determines what Control Plane will do when creating a new workload replica if a corresponding volume exists. Available Values: `retain`, `recycle`. Default: `retain`. **DEPRECATED - No longer being used.**
*/
recoveryPolicy: string;
/**
* URI of a volume hosted at Control Plane (Volume Set) or at a cloud provider (AWS, Azure, GCP).
*/
uri: string;
}
export interface GetWorkloadFirewallSpec {
/**
* The external firewall is used to control inbound and outbound access to the workload for public-facing traffic.
*/
externals?: outputs.GetWorkloadFirewallSpecExternal[];
/**
* The internal firewall is used to control access between workloads.
*/
internals?: outputs.GetWorkloadFirewallSpecInternal[];
}
export interface GetWorkloadFirewallSpecExternal {
/**
* Firewall options for HTTP workloads.
*/
https?: outputs.GetWorkloadFirewallSpecExternalHttp[];
/**
* The list of ipv4/ipv6 addresses or cidr blocks that are allowed to access this workload. No external access is allowed by default. Specify '0.0.0.0/0' to allow access to the public internet.
*/
inboundAllowCidrs: string[];
/**
* The list of ipv4/ipv6 addresses or cidr blocks that are NOT allowed to access this workload. Addresses in the allow list will only be allowed if they do not exist in this list.
*/
inboundBlockedCidrs: string[];
/**
* The list of ipv4/ipv6 addresses or cidr blocks that this workload is allowed reach. No outbound access is allowed by default. Specify '0.0.0.0/0' to allow outbound access to the public internet.
*/
outboundAllowCidrs: string[];
/**
* The list of public hostnames that this workload is allowed to reach. No outbound access is allowed by default. A wildcard `*` is allowed on the prefix of the hostname only, ex: `*.amazonaws.com`. Use `outboundAllowCIDR` to allow access to all external websites.
*/
outboundAllowHostnames: string[];
/**
* Allow outbound access to specific ports and protocols. When not specified, communication to address ranges in outboundAllowCIDR is allowed on all ports and communication to names in outboundAllowHostname is allowed on ports 80/443.
*/
outboundAllowPorts?: outputs.GetWorkloadFirewallSpecExternalOutboundAllowPort[];
/**
* The list of ipv4/ipv6 addresses or cidr blocks that this workload is NOT allowed to reach. Addresses in the allow list will only be allowed if they do not exist in this list.
*/
outboundBlockedCidrs: string[];
}
export interface GetWorkloadFirewallSpecExternalHttp {
/**
* A list of header filters for HTTP workloads.
*/
inboundHeaderFilters?: outputs.GetWorkloadFirewallSpecExternalHttpInboundHeaderFilter[];
}
export interface GetWorkloadFirewallSpecExternalHttpInboundHeaderFilter {
/**
* A list of regular expressions to match for allowed header values. Headers that do not match ANY of these values will be filtered and will not reach the workload.
*/
allowedValues: string[];
/**
* A list of regular expressions to match for blocked header values. Headers that match ANY of these values will be filtered and will not reach the workload.
*/
blockedValues: string[];
/**
* The header to match for.
*/
key: string;
}
export interface GetWorkloadFirewallSpecExternalOutboundAllowPort {
/**
* Port number. Max: 65000
*/
number: number;
/**
* Either `http`, `https` or `tcp`.
*/
protocol: string;
}
export interface GetWorkloadFirewallSpecInternal {
/**
* Used to control the internal firewall configuration and mutual tls. Allowed Values: "none", "same-gvc", "same-org", "workload-list".
*/
inboundAllowType: string;
/**
* A list of specific workloads which are allowed to access this workload internally. This list is only used if the 'inboundAllowType' is set to 'workload-list'.
*/
inboundAllowWorkloads: string[];
}
export interface GetWorkloadHealth {
/**
* Readiness of the workload.
*/
readiness: string;
/**
* Number of locations where the workload is ready.
*/
readyLocations: number;
/**
* Number of ready replicas across all locations.
*/
readyReplicas: number;
/**
* Whether the most recent sync of the workload failed.
*/
syncFailed: boolean;
/**
* Total number of locations the workload is deployed to.
*/
totalLocations: number;
/**
* Total number of replicas across all locations.
*/
totalReplicas: number;
}
export interface GetWorkloadJob {
/**
* The maximum number of seconds Control Plane will wait for the job to complete. If a job does not succeed or fail in the allotted time, Control Plane will stop the job, moving it into the Removed status.
*/
activeDeadlineSeconds: number;
/**
* Either 'Forbid', 'Replace', or 'Allow'. This determines what Control Plane will do when the schedule requires a job to start, while a prior instance of the job is still running.
*/
concurrencyPolicy: string;
/**
* The maximum number of completed job instances to display. This should be an integer between 1 and 10. Default: `5`.
*/
historyLimit: number;
/**
* Either 'OnFailure' or 'Never'. This determines what Control Plane will do when a job instance fails. Enum: [ OnFailure, Never ] Default: `Never`.
*/
restartPolicy: string;
/**
* A standard cron [schedule expression](https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/#schedule-syntax) used to determine when your job should execute.
*/
schedule: string;
}
export interface GetWorkloadLoadBalancer {
/**
* Direct load balancers are created in each location that a workload is running in and are configured for the standard endpoints of the workload. Customers are responsible for configuring the workload with certificates if TLS is required.
*/
directs?: outputs.GetWorkloadLoadBalancerDirect[];
geoLocations?: outputs.GetWorkloadLoadBalancerGeoLocation[];
/**
* When enabled, individual replicas of the workload can be reached directly using the subdomain prefix replica-<index>. For example, replica-0.my-workload.my-gvc.cpln.local or replica-0.my-workload-<gvc-alias>.cpln.app - Can only be used with stateful workloads.
*/
replicaDirect: boolean;
}
export interface GetWorkloadLoadBalancerDirect {
/**
* When disabled, this load balancer will be stopped.
*/
enabled: boolean;
ipset: string;
/**
* List of ports that will be exposed by this load balancer.
*/
ports?: outputs.GetWorkloadLoadBalancerDirectPort[];
}
export interface GetWorkloadLoadBalancerDirectPort {
/**
* The port on the container tha will receive this traffic.
*/
containerPort: number;
/**
* The port that is available publicly.
*/
externalPort: number;
/**
* The protocol that is exposed publicly.
*/
protocol: string;
/**
* Overrides the default `https` url scheme that will be used for links in the UI and status.
*/
scheme: string;
}
export interface GetWorkloadLoadBalancerGeoLocation {
/**
* When enabled, geo location headers will be included on inbound http requests. Existing headers will be replaced.
*/
enabled: boolean;
headers?: outputs.GetWorkloadLoadBalancerGeoLocationHeader[];
}
export interface GetWorkloadLoadBalancerGeoLocationHeader {
/**
* The geo asn header.
*/
asn: string;
/**
* The geo city header.
*/
city: string;
/**
* The geo country header.
*/
country: string;
/**
* The geo region header.
*/
region: string;
}
export interface GetWorkloadLocalOption {
/**
* Auto-scaling adjusts horizontal scaling based on a set strategy, target value, and possibly a metric percentile.
*/
autoscalings?: outputs.GetWorkloadLocalOptionAutoscaling[];
/**
* Capacity AI. Default: `true`.
*/
capacityAi: boolean;
/**
* The highest frequency capacity AI is allowed to update resource reservations when CapacityAI is enabled.
*/
capacityAiUpdateMinutes: number;
/**
* Debug mode. Default: `false`.
*/
debug: boolean;
/**
* Valid only for `localOptions`. Override options for a specific location.
*/
location: string;
multiZones?: outputs.GetWorkloadLocalOptionMultiZone[];
/**
* Workload suspend. Default: `false`.
*/
suspend: boolean;
/**
* Timeout in seconds. Default: `5`.
*/
timeoutSeconds: number;
}
export interface GetWorkloadLocalOptionAutoscaling {
/**
* KEDA (Kubernetes-based Event Driven Autoscaling) allows for advanced autoscaling based on external metrics and triggers.
*/
kedas?: outputs.GetWorkloadLocalOptionAutoscalingKeda[];
/**
* A hard maximum for the number of concurrent requests allowed to a replica. If no replicas are available to fulfill the request then it will be queued until a replica with capacity is available and delivered as soon as one is available again. Capacity can be available from requests completing or when a new replica is available from scale out. Min: `0`. Max: `30000`. Default `0`.
*/
maxConcurrency: number;
/**
* The maximum allowed number of replicas. Min: `0`. Default `5`.
*/
maxScale: number;
/**
* Valid values: `concurrency`, `cpu`, `memory`, `rps`, `latency`, `keda` or `disabled`.
*/
metric: string;
/**
* For metrics represented as a distribution (e.g. latency) a percentile within the distribution must be chosen as the target.
*/
metricPercentile: string;
/**
* The minimum allowed number of replicas. Control Plane can scale the workload down to 0 when there is no traffic and scale up immediately to fulfill new requests. Min: `0`. Max: `maxScale`. Default `1`.
*/
minScale: number;
multis?: outputs.GetWorkloadLocalOptionAutoscalingMulti[];
/**
* The amount of time (in seconds) with no requests received before a workload is scaled to 0. Min: `30`. Max: `3600`. Default: `300`.
*/
scaleToZeroDelay: number;
/**
* Control Plane will scale the number of replicas for this deployment up/down in order to be as close as possible to the target metric across all replicas of a deployment. Min: `1`. Max: `20000`. Default: `95`.
*/
target: number;
}
export interface GetWorkloadLocalOptionAutoscalingKeda {
/**
* Advanced configuration options for KEDA.
*/
advanceds?: outputs.GetWorkloadLocalOptionAutoscalingKedaAdvanced[];
/**
* The cooldown period in seconds after scaling down to 0 replicas before KEDA will allow scaling up again.
*/
cooldownPeriod: number;
/**
* Fallback configuration for KEDA.
*/
fallbacks?: outputs.GetWorkloadLocalOptionAutoscalingKedaFallback[];
/**
* The initial cooldown period in seconds after scaling down to 0 replicas before KEDA will allow scaling up again.
*/
initialCooldownPeriod: number;
/**
* The interval in seconds at which KEDA will poll the external metrics to determine if scaling is required.
*/
pollingInterval: number;
/**
* An array of KEDA triggers to be used for scaling workload