API Reference

Packages:

weebo.si.rs/v1

weebo.si.rs/v1

Resource Types:

ProxyKubeApi

ProxyKubeApi

^{^{↩ Parent}}

Auto-generated derived type for ProxyKubeApiSpec via CustomResource

Name	Type	Description	Required
apiVersion	string	weebo.si.rs/v1	true
kind	string	ProxyKubeApi	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	Validations: !has(self.dashboard_group) \|\| self.dashboard_group != '': dashboard_group must not be empty when it is set !has(self.proxy_group) \|\| self.proxy_group != '': proxy_group must not be empty when it is set	true
status	object		false

ProxyKubeApi.spec

^{^{↩ Parent}}

Name	Type	Description	Required
cert	object	Certificate for the Kubernetes API	true
service	object	Service to expose the proxy	true
auth_config	object	Main configuration for authentication Validations: self.validate_against != 'OidcProvider' \|\| self.oidc_provider.enabled: validate_against is set to OidcProvider but the OIDC provider is not enabled	false
client_cert	object	Client certificate presented to the Kubernetes API for mutual TLS Leave unset when the cluster does not require client certificates	false
dashboard_group	string	If the proxy exposition is accessible via the dashboard the oidc group that allow access to the dashboard, should be unique Default: to the resource namespace + resource name	false
enabled	boolean	Enable or disable the proxy Default: true	false
expose_via_dashboard	boolean	If the proxy exposition should be accessible via the Dashboard Default: false Default: false	false
proxy_group	string	The oidc group required to proxy requests to this cluster Set it to decouple proxy access from dashboard access Default: the dashboard group when `expose_via_dashboard` is true, otherwise no group is required	false
security_config	object	Security configuration	false
virtual_apis	[]object	Virtual APIs to expose on top of this cluster A virtual API is an API the cluster does not serve, that the proxy synthesises by translating requests and responses Default: []	false

ProxyKubeApi.spec.cert

^{^{↩ Parent}}

Certificate for the Kubernetes API

Name	Type	Description	Required
Cert	string	Base64 encoded cert	false
ConfigMap	object	Configmap	false
Insecure	boolean	Insecure, do not use TLS	false
Secret	object	Use a cert from a secret	false

ProxyKubeApi.spec.cert.ConfigMap

^{^{↩ Parent}}

Configmap

Name	Type	Required
key	string	true
name	string	true
namespace	string	false

ProxyKubeApi.spec.cert.Secret

^{^{↩ Parent}}

Use a cert from a secret

Name	Type	Required
key	string	true
name	string	true
namespace	string	false

ProxyKubeApi.spec.service

^{^{↩ Parent}}

Service to expose the proxy

Name	Type	Description	Required
ExternalService	object	External service	false
KubernetesService	object	Kubernetes service	false

ProxyKubeApi.spec.service.ExternalService

^{^{↩ Parent}}

External service

Name	Type	Description	Required
url	string	URL of the external service (e.g. `https://example.com`)	true

ProxyKubeApi.spec.service.KubernetesService

^{^{↩ Parent}}

Kubernetes service

Name	Type	Description	Required
name	string	Name of the service	true
namespace	string	If not set, will use the resource namespace	false
port	integer	Port of the service Format: uint16 Minimum: 0 Maximum: 65535	false
port_name	string	Port name of the service	false

ProxyKubeApi.spec.auth_config

^{^{↩ Parent}}

Main configuration for authentication

Name	Type	Description	Required
oidc_provider	object	An enabled provider that cannot be contacted is a cluster that never authenticates anyone, so the apiserver refuses the CR outright. Validations: !self.enabled \|\| (self.issuer_url != '' && self.client_id != ''): an enabled OIDC provider requires a non-empty issuer_url and client_id !self.expose_oauth_authorization_server \|\| self.enabled: expose_oauth_authorization_server requires the OIDC provider to be enabled	true
disable_validation	boolean	Disable validation of the token against the configured JWT authenticators, OIDC provider or Kubernetes API If the `AuthenticationConfiguration` is not provided, does not validate the token against any of the configured JWT authenticators, OIDC provider or Kubernetes API Default : false Default: false	false
jwt	[]object	Default: []	false
validate_against	enum	Validate against the configured JWT authenticators, OIDC provider or Kubernetes API Default : `OidcProvider` if enabled, otherwise `JwtAuthenticators` if configured, otherwise Kubernetes Enum: OidcProvider, Kubernetes Default: Kubernetes	false

ProxyKubeApi.spec.auth_config.oidc_provider

^{^{↩ Parent}}

An enabled provider that cannot be contacted is a cluster that never authenticates anyone, so the apiserver refuses the CR outright.

Name	Type	Description	Required
client_id	string		true
issuer_url	string		true
accept_authorized_party	boolean	Accept a token whose `aud` does not name this service but whose `azp`/`client_id` does. Off by default: `azp`/`client_id` identify the client the token was issued to, not the resource, so accepting them weakens audience validation. Enable only for providers (e.g. Keycloak) that mint self-audience tokens carrying the client only in `azp`. Default: false	false
audience	string	Audience the access token must carry (its `aud` claim) to be accepted. When empty, `client_id` is used — correct for providers that put the client id in `aud`. Set it explicitly when the provider mints tokens for a distinct resource audience, so `client_id` (who the token is for) and the expected audience (what the token is for) are configured independently. Default:	false
client_secret	string		false
enabled	boolean	Default: false	false
expose_oauth_authorization_server	boolean	Expose a mediated OAuth 2.0 Authorization Server (RFC 6749 + PKCE) for this cluster, advertised at `/.well-known/oauth-authorization-server` (RFC 8414), like OpenShift does for its own OAuth server. The proxy itself becomes the authorization server an external caller talks to — `issuer`, `authorization_endpoint`, `token_endpoint`, and `jwks_uri` are all this cluster's own proxy URLs — mediating the whole exchange with the configured `issuer_url` server-side. A caller (e.g. `oc login`, or any RFC-8414-aware tool) never needs to be registered with — or even learn the hostname of — the upstream provider, and no companion `oauth2-proxy` is needed to serve this document. Off by default and unauthenticated by nature (discovery, and the authorization/token endpoints it advertises, must be reachable before a caller has a token): enabling it lets anonymous callers learn that this cluster exists and start a login against it. `redirect_uri` at `/oauth/authorize` is restricted to loopback addresses (`http://localhost`/`http://127.0.0.1`, RFC 8252) since callers are not pre-registered — accepting an arbitrary `redirect_uri` would be an open redirect. Requires `enabled: true`. Default: false	false
extra_scope	string	Default:	false

ProxyKubeApi.spec.auth_config.jwt[index]

^{^{↩ Parent}}

Name	Type	Required
claim_mappings	object	true
claim_validation_rules	[]object	true
issuer	object	true
user_validation_rules	[]object	true

ProxyKubeApi.spec.auth_config.jwt[index].claim_mappings

^{^{↩ Parent}}

Name	Type	Required
extra	[]object	true
groups	object	false
uid	object	false
username	object	false

ProxyKubeApi.spec.auth_config.jwt[index].claim_mappings.extra[index]

^{^{↩ Parent}}

Name	Type	Description	Required
key	string		true
value_expression	string		true

ProxyKubeApi.spec.auth_config.jwt[index].claim_mappings.groups

^{^{↩ Parent}}

Name	Type	Required
claim	string	true
expression	string	true
prefix	string	false

ProxyKubeApi.spec.auth_config.jwt[index].claim_mappings.uid

^{^{↩ Parent}}

Name	Type	Description	Required
claim	string		false
expression	string		false

ProxyKubeApi.spec.auth_config.jwt[index].claim_mappings.username

^{^{↩ Parent}}

Name	Type	Required
claim	string	true
expression	string	true
prefix	string	false

ProxyKubeApi.spec.auth_config.jwt[index].claim_validation_rules[index]

^{^{↩ Parent}}

Name	Type	Required
claim	string	true
expression	string	true
message	string	true
required_value	string	true

ProxyKubeApi.spec.auth_config.jwt[index].issuer

^{^{↩ Parent}}

Name	Type	Description	Required
audience_match_policy	enum	Enum: MatchAny	true
audiences	[]string		true
egress_selector	enum	Enum: controlplane, cluster	true
url	string		true
certificate_authority	string		false
discovery_url	string		false

ProxyKubeApi.spec.auth_config.jwt[index].user_validation_rules[index]

^{^{↩ Parent}}

Name	Type	Description	Required
expression	string		true
message	string		true

ProxyKubeApi.spec.client_cert

^{^{↩ Parent}}

Client certificate presented to the Kubernetes API for mutual TLS Leave unset when the cluster does not require client certificates

Name	Type	Description	Required
cert	object	PEM client certificate chain	true
key	object	PEM private key matching the certificate	true

ProxyKubeApi.spec.client_cert.cert

^{^{↩ Parent}}

PEM client certificate chain

Name	Type	Description	Required
Cert	string	Base64 encoded cert	false
ConfigMap	object	Configmap	false
Insecure	boolean	Insecure, do not use TLS	false
Secret	object	Use a cert from a secret	false

ProxyKubeApi.spec.client_cert.cert.ConfigMap

^{^{↩ Parent}}

Configmap

Name	Type	Required
key	string	true
name	string	true
namespace	string	false

ProxyKubeApi.spec.client_cert.cert.Secret

^{^{↩ Parent}}

Use a cert from a secret

Name	Type	Required
key	string	true
name	string	true
namespace	string	false

ProxyKubeApi.spec.client_cert.key

^{^{↩ Parent}}

PEM private key matching the certificate

Name	Type	Description	Required
Cert	string	Base64 encoded cert	false
ConfigMap	object	Configmap	false
Insecure	boolean	Insecure, do not use TLS	false
Secret	object	Use a cert from a secret	false

ProxyKubeApi.spec.client_cert.key.ConfigMap

^{^{↩ Parent}}

Configmap

Name	Type	Required
key	string	true
name	string	true
namespace	string	false

ProxyKubeApi.spec.client_cert.key.Secret

^{^{↩ Parent}}

Use a cert from a secret

Name	Type	Required
key	string	true
name	string	true
namespace	string	false

ProxyKubeApi.spec.security_config

^{^{↩ Parent}}

Security configuration

Name	Type	Description	Required
allowed_resources	[]object	Allowed resources, limit the access to the proxy to only these resources, if empty all resources are allowed The bound keeps the estimated cost of the per-item CEL rules within the budget the apiserver allows for a whole CRD schema. Default: []	false
allowed_ressources	[]object	Deprecated misspelling of `allowed_resources`, merged with it Kept as a real field rather than a serde alias on purpose: the apiserver prunes fields absent from the schema, so an alias alone would silently drop the security configuration of every existing resource. Remove it in the next major, once resources have been migrated. Default: []	false
enabled	boolean	Whether the token is validated beforehand Default: true	false
fail2login_equal_ban	object	Configuration for banning callers after multiple failed authentications Default: map[ban_duration:300 enabled:false exponential_backoff:false max_failed_logins:5]	false
per_user_group_rate_limiting	[]object	Per group rate limiting configuration This takes precedence over the global rate limiting configuration Default: []	false
rate_limiting	object	Global rate limiting configuration Default: map[enabled:false max_requests_per_minute:60]	false

ProxyKubeApi.spec.security_config.allowed_resources[index]

^{^{↩ Parent}}

How an allowed resource is described.

Path matches on the raw upstream path (with */**/{{...}} semantics);
Crd matches on group/version/kind and applies the per-namespace access rules, translating to a path via [super::AllowedCrdConfiguration].

Name Type Description Required

Name	Type	Description	Required
Crd	object	Allowed crd configuration, used in conjunction with the `allowed_paths` configuration /apis/{group}/{version}/namespaces/{namespace}/{kind}/	false
Path	object	Allowed path configuration, used in conjunction with the `allowed_paths` configuration The CEL rules mirror [`AllowedPathConfiguration::validate`] so a malformed rule is refused at admission rather than at reconcile time. The placeholder regex matches braces through character classes (`[{]`) rather than backslash escapes, for two independent reasons: CEL string literals reject `\{` outright, and the CRD is also shipped as a Helm template where two consecutive `{` would be read as a Go template action. Validations: self.path.startsWith('/'): path must start with '/' !self.parametised \|\| self.path.matches('^[^{}](([{]{[}][}])[^{}])*$'): a parametised path only accepts the username and group placeholders	false

Crd

object

Allowed crd configuration, used in conjunction with the allowed_paths configuration /apis/{group}/{version}/namespaces/{namespace}/{kind}/

false

Path

object

Allowed path configuration, used in conjunction with the allowed_paths configuration

The CEL rules mirror [AllowedPathConfiguration::validate] so a malformed rule is refused at admission rather than at reconcile time.

The placeholder regex matches braces through character classes ([{]) rather than backslash escapes, for two independent reasons: CEL string literals reject \{ outright, and the CRD is also shipped as a Helm template where two consecutive { would be read as a Go template action.

Validations:

self.path.startsWith('/'): path must start with '/'

!self.parametised || self.path.matches('^[^{}](([{]{[}][}])[^{}])*$'): a parametised path only accepts the username and group placeholders

false

ProxyKubeApi.spec.security_config.allowed_resources[index].Crd

^{^{↩ Parent}}

Allowed crd configuration, used in conjunction with the allowed_paths configuration /apis/{group}/{version}/namespaces/{namespace}/{kind}/

Name	Type	Description	Required
group	string	The group of the crd	true
kind	string	The kind of the crd	true
namespace	object	Wether or not the ressource is namespaced, if true, the namespace access rules will be applied to this resource	true
version	string	The version of the crd	true
namespaced	boolean	Namespaced or not default: true Default: true	false
plural	string	Wether or not the kind has a specific plural form, if true, the plural form will be used in the path instead of the kind for example, if the kind is "`MyResource`" and the plural form is "`MyResources`" the path will be /apis/{group}/{version}/namespaces/{namespace}/myresources/ instead of /apis/{group}/{version}/namespaces/{namespace}/myresource/ In case of cluster-scoped crd the path will be /apis/{group}/{version}/myresources/ instead of /apis/{group}/{version}/myresource/	false

ProxyKubeApi.spec.security_config.allowed_resources[index].Crd.namespace

^{^{↩ Parent}}

Wether or not the ressource is namespaced, if true, the namespace access rules will be applied to this resource

Name	Type	Description	Required
rule_kind	object	The kind of the namespace access rule	true
enabled	boolean	If the feature is enabled default: false Default: false	false

Name

Type

Description

Required

rule_kind

object

The kind of the namespace access rule

true

enabled

boolean

If the feature is enabled default: false

Default: false

false

ProxyKubeApi.spec.security_config.allowed_resources[index].Crd.namespace.rule_kind

^{^{↩ Parent}}

The kind of the namespace access rule

Name	Type	Description	Required
AllowedNamespaces	[]string		false
DeniedNamespaces	[]string		false
ParametisedRule	string	The parametised rule is a string that can contain the {{username}} parameter which will be replaced by the username of the user making the request, and the {{group}} parameter which will be replaced by the groups of the user making the request allowed parameters are : {{username}} and {{group}}	false

ProxyKubeApi.spec.security_config.allowed_resources[index].Path

^{^{↩ Parent}}

Allowed path configuration, used in conjunction with the allowed_paths configuration

The CEL rules mirror [AllowedPathConfiguration::validate] so a malformed rule is refused at admission rather than at reconcile time.

Name Type Description Required

Name	Type	Description	Required
path	string	The path to allow, if the request path equals this path, it will be allowed The length bound is not cosmetic: without it the apiserver assumes an unbounded string and refuses the CEL rule above as too expensive.	true
parametised	boolean	Wether or not the path is parametised if true, the path will be treated as a template, it either handle wildcard parameters, like "" or "dev-", or mustache-like parameters, like "{{username}}" or "{{group}}" for example, if the path is "/api/v1/namespaces//pods", it will allow all requests to pods in any namespace if the path is "/api/v1/namespaces/dev-/pods", it will allow all requests to pods in namespaces that start with "dev-" It will also try to detect mustache-like parameters, for example, if the path is "/api/v1/namespaces/{{username}}/pods" it will allow all requests to pods in namespaces carrying the username as a parameter if the selected field is an array, like the groups claim, it will try to match any of the values in the array for example, if the groups claim is ["dev-alice", "dev-bob"] and the path is "/api/v1/namespaces/{{group}}/pods", it will allow all requests to pods in namespaces that match either "dev-alice" or "dev-bob" Allowed parameters are : {{username}} and {{group}} A `` only matches inside a single path segment; use a `` segment to match any number of remaining segments (needed for subresources such as "/api/v1/namespaces/dev/pods/mypod/log") default: false Default*: false	false

path

string

The path to allow, if the request path equals this path, it will be allowed

The length bound is not cosmetic: without it the apiserver assumes an unbounded string and refuses the CEL rule above as too expensive.

true

parametised

boolean

Wether or not the path is parametised if true, the path will be treated as a template, it either handle wildcard parameters, like "" or "dev-", or mustache-like parameters, like "{{username}}" or "{{group}}" for example, if the path is "/api/v1/namespaces//pods", it will allow all requests to pods in any namespace if the path is "/api/v1/namespaces/dev-/pods", it will allow all requests to pods in namespaces that start with "dev-" It will also try to detect mustache-like parameters, for example, if the path is "/api/v1/namespaces/{{username}}/pods" it will allow all requests to pods in namespaces carrying the username as a parameter if the selected field is an array, like the groups claim, it will try to match any of the values in the array for example, if the groups claim is ["dev-alice", "dev-bob"] and the path is "/api/v1/namespaces/{{group}}/pods", it will allow all requests to pods in namespaces that match either "dev-alice" or "dev-bob" Allowed parameters are : {{username}} and {{group}} A * only matches inside a single path segment; use a ** segment to match any number of remaining segments (needed for subresources such as "/api/v1/namespaces/dev/pods/mypod/log") default: false

Default: false

false

ProxyKubeApi.spec.security_config.allowed_ressources[index]

^{^{↩ Parent}}

How an allowed resource is described.

Path matches on the raw upstream path (with */**/{{...}} semantics);
Crd matches on group/version/kind and applies the per-namespace access rules, translating to a path via [super::AllowedCrdConfiguration].

Name Type Description Required

Name	Type	Description	Required
Crd	object	Allowed crd configuration, used in conjunction with the `allowed_paths` configuration /apis/{group}/{version}/namespaces/{namespace}/{kind}/	false
Path	object	Allowed path configuration, used in conjunction with the `allowed_paths` configuration The CEL rules mirror [`AllowedPathConfiguration::validate`] so a malformed rule is refused at admission rather than at reconcile time. The placeholder regex matches braces through character classes (`[{]`) rather than backslash escapes, for two independent reasons: CEL string literals reject `\{` outright, and the CRD is also shipped as a Helm template where two consecutive `{` would be read as a Go template action. Validations: self.path.startsWith('/'): path must start with '/' !self.parametised \|\| self.path.matches('^[^{}](([{]{[}][}])[^{}])*$'): a parametised path only accepts the username and group placeholders	false

Crd

object

Allowed crd configuration, used in conjunction with the allowed_paths configuration /apis/{group}/{version}/namespaces/{namespace}/{kind}/

false

Path

object

Allowed path configuration, used in conjunction with the allowed_paths configuration

The CEL rules mirror [AllowedPathConfiguration::validate] so a malformed rule is refused at admission rather than at reconcile time.

Validations:

self.path.startsWith('/'): path must start with '/'

!self.parametised || self.path.matches('^[^{}](([{]{[}][}])[^{}])*$'): a parametised path only accepts the username and group placeholders

false

ProxyKubeApi.spec.security_config.allowed_ressources[index].Crd

^{^{↩ Parent}}

Allowed crd configuration, used in conjunction with the allowed_paths configuration /apis/{group}/{version}/namespaces/{namespace}/{kind}/

Name	Type	Description	Required
group	string	The group of the crd	true
kind	string	The kind of the crd	true
namespace	object	Wether or not the ressource is namespaced, if true, the namespace access rules will be applied to this resource	true
version	string	The version of the crd	true
namespaced	boolean	Namespaced or not default: true Default: true	false
plural	string	Wether or not the kind has a specific plural form, if true, the plural form will be used in the path instead of the kind for example, if the kind is "`MyResource`" and the plural form is "`MyResources`" the path will be /apis/{group}/{version}/namespaces/{namespace}/myresources/ instead of /apis/{group}/{version}/namespaces/{namespace}/myresource/ In case of cluster-scoped crd the path will be /apis/{group}/{version}/myresources/ instead of /apis/{group}/{version}/myresource/	false

ProxyKubeApi.spec.security_config.allowed_ressources[index].Crd.namespace

^{^{↩ Parent}}

Wether or not the ressource is namespaced, if true, the namespace access rules will be applied to this resource

Name	Type	Description	Required
rule_kind	object	The kind of the namespace access rule	true
enabled	boolean	If the feature is enabled default: false Default: false	false

Name

Type

Description

Required

rule_kind

object

The kind of the namespace access rule

true

enabled

boolean

If the feature is enabled default: false

Default: false

false

ProxyKubeApi.spec.security_config.allowed_ressources[index].Crd.namespace.rule_kind

^{^{↩ Parent}}

The kind of the namespace access rule

Name	Type	Description	Required
AllowedNamespaces	[]string		false
DeniedNamespaces	[]string		false
ParametisedRule	string	The parametised rule is a string that can contain the {{username}} parameter which will be replaced by the username of the user making the request, and the {{group}} parameter which will be replaced by the groups of the user making the request allowed parameters are : {{username}} and {{group}}	false

ProxyKubeApi.spec.security_config.allowed_ressources[index].Path

^{^{↩ Parent}}

Allowed path configuration, used in conjunction with the allowed_paths configuration

The CEL rules mirror [AllowedPathConfiguration::validate] so a malformed rule is refused at admission rather than at reconcile time.

Name Type Description Required

Name	Type	Description	Required
path	string	The path to allow, if the request path equals this path, it will be allowed The length bound is not cosmetic: without it the apiserver assumes an unbounded string and refuses the CEL rule above as too expensive.	true
parametised	boolean	Wether or not the path is parametised if true, the path will be treated as a template, it either handle wildcard parameters, like "" or "dev-", or mustache-like parameters, like "{{username}}" or "{{group}}" for example, if the path is "/api/v1/namespaces//pods", it will allow all requests to pods in any namespace if the path is "/api/v1/namespaces/dev-/pods", it will allow all requests to pods in namespaces that start with "dev-" It will also try to detect mustache-like parameters, for example, if the path is "/api/v1/namespaces/{{username}}/pods" it will allow all requests to pods in namespaces carrying the username as a parameter if the selected field is an array, like the groups claim, it will try to match any of the values in the array for example, if the groups claim is ["dev-alice", "dev-bob"] and the path is "/api/v1/namespaces/{{group}}/pods", it will allow all requests to pods in namespaces that match either "dev-alice" or "dev-bob" Allowed parameters are : {{username}} and {{group}} A `` only matches inside a single path segment; use a `` segment to match any number of remaining segments (needed for subresources such as "/api/v1/namespaces/dev/pods/mypod/log") default: false Default*: false	false

path

string

The path to allow, if the request path equals this path, it will be allowed

The length bound is not cosmetic: without it the apiserver assumes an unbounded string and refuses the CEL rule above as too expensive.

true

parametised

boolean

Default: false

false

ProxyKubeApi.spec.security_config.fail2login_equal_ban

^{^{↩ Parent}}

Configuration for banning callers after multiple failed authentications

Name	Type	Description	Required
ban_duration	integer	The duration of the ban in seconds default: 300 (5 minutes) 0 means permanent ban Format: uint32 Default: 300 Minimum: 0	false
enabled	boolean	If the feature is enabled default: false Default: false	false
exponential_backoff	boolean	If the time is exponentially increased with each failed login attempt default: false Default: false	false
max_failed_logins	integer	The number of failed login attempts before the user is banned default: 5 Format: uint32 Default: 5 Minimum: 0	false

ProxyKubeApi.spec.security_config.per_user_group_rate_limiting[index]

^{^{↩ Parent}}

Per-user group rate limiting configuration

Groups come from the user resolved by the configured authentication, so no claim mapping is needed here.

Name	Type	Description	Required
group	string	Group name	true
max_requests_per_minute	integer	The maximum number of requests per minute for this group This setting overrides the global rate limiting setting 0 disables the rate limiting for this group Format: uint32 Minimum: 0	true

Name

Type

Description

Required

group

string

Group name

true

max_requests_per_minute

integer

The maximum number of requests per minute for this group This setting overrides the global rate limiting setting 0 disables the rate limiting for this group

Format: uint32
Minimum: 0

true

ProxyKubeApi.spec.security_config.rate_limiting

^{^{↩ Parent}}

Global rate limiting configuration

Name	Type	Description	Required
enabled	boolean	If the feature is enabled default: false Default: false	false
max_requests_per_minute	integer	The maximum number of requests per minute default: 60 0 disables the rate global rate limiting Format: uint32 Default: 60 Minimum: 0	false

Name

Type

Description

Required

enabled

boolean

If the feature is enabled default: false

Default: false

false

max_requests_per_minute

integer

The maximum number of requests per minute default: 60 0 disables the rate global rate limiting

Format: uint32
Default: 60
Minimum: 0

false

ProxyKubeApi.spec.virtual_apis[index]

^{^{↩ Parent}}

Name	Type	Description	Required
kind	enum	Which virtual API to expose Enum: OpenShiftProject	true
enabled	boolean	Enable or disable this virtual API Default: true Default: true	false

Name

Type

Description

Required

kind

enum

Which virtual API to expose

Enum: OpenShiftProject

true

enabled

boolean

Enable or disable this virtual API Default: true

Default: true

false

ProxyKubeApi.status

^{^{↩ Parent}}

Name	Type	Required
exposed	boolean	true
error	string	false
path	string	false

Custom Resource Definitions

On this page