Skip to content

GarageReferenceGrant v1beta1

API version: garage.rajsingh.info/v1beta1. Scope: Namespaced.

The custom-resource guide explains operational behavior. The JSON schemas are the validation source of truth.

Spec

GarageReferenceGrantSpec defines which namespaces and resource kinds are permitted to make cross-namespace references to resources in this namespace.

Field path Type Constraints Description
from array of object required; min items: 1 From lists the permitted sources of cross-namespace references.
from[].kind string required; enum: ["GarageKey", "GarageBucket", "GarageAdminToken"] Kind is the resource kind allowed to make cross-namespace references. GarageAdminToken remains in the schema for compatibility, but the static credential path is namespace-local and does not accept cross-namespace grants.
from[].namespace string min length: 1 Namespace is the exact namespace from which cross-namespace references are allowed. Exactly one of Namespace or NamespaceSelector must be set.
from[].namespaceSelector object NamespaceSelector selects source namespaces by their Kubernetes labels. Exactly one of Namespace or NamespaceSelector must be set. An empty selector matches every namespace.
from[].namespaceSelector.matchExpressions array of object matchExpressions is a list of label selector requirements. The requirements are ANDed.
from[].namespaceSelector.matchExpressions[].key string required key is the label key that the selector applies to.
from[].namespaceSelector.matchExpressions[].operator string required operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
from[].namespaceSelector.matchExpressions[].values array of string values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
from[].namespaceSelector.matchLabels map of string matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
to array of object To lists the target resource kinds (and optionally specific names) that may be referenced. If omitted, all GarageCluster and GarageBucket resources in this namespace are accessible. This preserves the original grant behavior; newer target kinds such as GarageKey require an explicit entry.
to[].kind string required; enum: ["GarageCluster", "GarageBucket", "GarageKey"] Kind is the target resource kind.
to[].name string min length: 1 Name restricts access to a specific resource. If omitted, all resources of the given kind in this namespace are accessible.

Status

GarageReferenceGrantStatus reflects which resources are currently using this grant.

Field path Type Constraints Description
conditions array of object Conditions represent the current state.
conditions[].lastTransitionTime string required; format: "date-time" lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
conditions[].message string required; max length: 32768 message is a human readable message indicating details about the transition. This may be an empty string.
conditions[].observedGeneration integer format: "int64"; min: 0 observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
conditions[].reason string required; min length: 1; max length: 1024; pattern: "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$" reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
conditions[].status string required; enum: ["True", "False", "Unknown"] status of the condition, one of True, False, Unknown.
conditions[].type string required; max length: 316; pattern: "^([a-z0-9]([-a-z0-9][a-z0-9])?(\.[a-z0-9]([-a-z0-9][a-z0-9])?)/)?(([A-Za-z0-9][-A-Za-z0-9_.])?[A-Za-z0-9])$" type of condition in CamelCase or in foo.example.com/CamelCase.
inUseBy array of object InUseBy lists resources currently referencing through this grant. Rebuilt on every reconcile — safe to delete when this is empty.
inUseBy[].kind string Kind of the referencing resource.
inUseBy[].name string Name of the referencing resource.
inUseBy[].namespace string Namespace of the referencing resource.