---
"$schema": http://json-schema.org/draft/2019-09/schema#
id: intercept_crd_spec.json
type: object
title: Telepresence CRD Intercept Specification
description: The CRD Intercept Specification defines Telepresence intercepts.
additionalProperties: false
required: ["apiVersion", "kind", "metadata", "spec"]
properties:
  apiVersion:
    description: APIVersion defines the versioned schema of this representation of an object.
    type: string
    const: getambassador.io/v1alpha2
  kind:
    description: Kind is a string value representing the REST resource this object represents.
    type: string
    const: InterceptSpecification
  metadata:
    description: Standard object metadata.
    type: object
    additionalProperties: false
    required: ["name"]
    properties:
      name:
        description: The name of the CRD.
        type: string
        pattern: "^[a-z0-9][a-z0-9-]{1,62}$"
      namespace:
        description: The namespace of the CRD.
        type: string
        pattern: "^[a-z0-9][a-z0-9-]{1,62}$"
  spec:
    type: object
    description: The Intercept Specification defines Telepresence intercepts.
    x-kubernetes-validations:
      - rule: 'self.prerequisites.all(p, self.handlers.exists(h, h.name == p.create))'
        message: prerequistes create must reference an existing handler name
      - rule: 'self.prerequisites.all(p, !has(p.delete) || self.handlers.exists(h, h.name == p.delete))'
        message: prerequistes delete must reference an existing handler name
      - rule: 'self.workloads.all(w, w.intercepts.all(i, self.handlers.exists(h, h.name == i.handler)))'
        message: intercepts handler must reference an existing handler name
    additionalProperties: false
    properties:
      name:
        description: An name to give to the specification.
        type: string
        pattern: "^[a-zA-Z][a-zA-Z0-9_-]*$"
      prerequisites:
        type: array
        maxItems: 16
        items:
          description: Things to create prior to starting any intercepts, and delete once the intercept is complete.
          type: object
          required:
            - create
          additionalProperties: false
          properties:
            create:
              description: A handler to create things prior to starting any intercepts.
              type: string
              pattern: "^[a-zA-Z][a-zA-Z0-9_-]*$"
              maxLength: 64
            delete:
              description: A handler to delete the created things once all intercepts
                have ended.
              type: string
              pattern: "^[a-zA-Z][a-zA-Z0-9_-]*$"
              maxLength: 64
      connection:
        description: Connection properties to use when Telepresence connects to the cluster.
        type: object
        additionalProperties: false
        properties:
          as:
            description: Username to impersonate for the operation.
            type: string
          asGroups:
            description: Groups to impersonate for the operation.
            type: array
            items:
              type: string
          asUID:
            description: UID to impersonate for the operation.
            type: string
          cluster:
            description: The name of the kubeconfig cluster to use
            type: string
          context:
            description: The name of the kubeconfig context to use
            type: string
          user:
            description: The name of the kubeconfig user to use
            type: string
          managerNamespace:
            description: The namespace where the traffic manager is to be found.
            type: string
            pattern: "^[a-z0-9][a-z0-9-]{1,62}$"
          mappedNamespaces:
            description: The namespaces that Telepresence will be concerned with
            type: array
            items:
              description: RFC 1123 label name
              type: string
              pattern: "^[a-z0-9][a-z0-9-]{1,62}$"
          alsoProxy:
            description: Additional comma separated list of CIDR to proxy.
            type: array
            items:
              type: string
          neverProxy:
            description: Comma separated list of CIDR to never proxy.
            type: array
            items:
              type: string
      workloads:
        description: Remote workloads that are intercepted, keyed by workload name.
        type: array
        minItems: 1
        maxItems: 32
        items:
          description: An intercepted workload (Deployment, ReplicaSet or StatefulSet),
            keyed by name.
          type: object
          required:
            - name
          additionalProperties: false
          maxProperties: 3
          properties:
            name:
              type: string
              pattern: "^[a-z][a-z0-9-]*$"
              maxLength: 64
            namespace:
              description: The namespace for the workload and services
              type: string
              pattern: "^[a-z0-9][a-z0-9-]{1,62}$"
              maxLength: 64
            intercepts:
              description: The services and/or ports to intercept
              type: array
              minItems: 1
              maxItems: 16
              items:
                type: object
                required:
                  - handler
                additionalProperties: false
                properties:
                  enabled:
                    description: If set to false, disables this intercept. Default is true
                    type: boolean
                  handler:
                    description: The intercept handler that handles this intercept.
                    type: string
                    pattern: "^[a-zA-Z][a-zA-Z0-9_-]*$"
                    maxLength: 64
                  localPort:
                    description: The local port that will receive the intercepted traffic.
                    type: integer
                    minimum: 1
                    maximum: 65535
                  mountPoint:
                    description: The local directory or drive where the remote volumes are mounted
                    type: string
                  service:
                    description: Name of service to intercept
                    type: string
                    pattern: "^[a-z][a-z0-9-]{1,62}$"
                  port:
                    description: The port that will be intercepted.
                    x-kubernetes-int-or-string: true
                    anyOf:
                      - type: integer
                        minimum: 1
                        maximum: 65535
                      - type: string
                        pattern: "^[a-z][a-z0-9-]{1,62}$"
                  global:
                    description: If true, then intercept all tcp/udp traffic. Mutually
                      exclusive with headers and pathXxx properties
                    type: boolean
                  headers:
                    description: Headers that will filter the intercept. If omitted or
                      empty, and if global isn't explicitly set to true, an auto header
                      will be generated
                    type: array
                    x-kubernetes-list-map-keys:
                      - name
                    x-kubernetes-list-type: map
                    items:
                      type: object
                      required:
                        - name
                        - value
                      properties:
                        name:
                          type: string
                        value:
                          type: string
                  meta:
                    description: Metadata that will be returned by the Telepresence API
                      server
                    type: array
                    x-kubernetes-list-map-keys:
                      - name
                    x-kubernetes-list-type: map
                    items:
                      type: object
                      additionalProperties: false
                      required:
                        - name
                        - value
                      properties:
                        name:
                          type: string
                          pattern: "^[a-zA-Z][a-zA-Z0-9._-]*$"
                        value:
                          type: string
                  pathPrefix:
                    description: Path prefix filter for the intercept. Defaults to "/"
                    type: string
                  pathSuffix:
                    description: Path suffix filter for the intercept.
                    type: string
                  pathEqual:
                    description: Path filter for the intercept.
                    type: string
                  pathRegexp:
                    description: Path regular expression filter for the intercept.
                    type: string
                  plaintext:
                    description: Use plaintext format when communicating with the interceptor
                      process on the local workstation. Only meaningful when intercepting
                      workloads annotated with "getambassador.io/inject-originating-tls-secret"
                      to prevent that TLS is used during intercepts
                    type: boolean
                  previewURL:
                    type: object
                    additionalProperties: false
                    properties:
                      enable:
                        description: Enable preview URL (default true)
                        type: boolean
                      banner:
                        description: Display banner on preview page (default true)
                        type: boolean
                      ingress:
                        type: object
                        additionalProperties: false
                        properties:
                          host:
                            description: The ingress hostname.
                            type: string
                          l5Host:
                            description: The ingress L5 Hostname. Defaults to ingressHost
                            type: string
                          port:
                            description: The ingress port.
                            type: integer
                            minimum: 1
                            maximum: 65535
                          tls:
                            description: Determines if TLS is used.
                            type: boolean
                      extraHeaders:
                        description: Additional headers in key1=value1,key2=value2 pairs
                          injected in every preview page request
                        type: array
                        x-kubernetes-list-map-keys:
                          - name
                        x-kubernetes-list-type: map
                        items:
                          type: object
                          required:
                            - name
                            - value
                          additionalProperties: false
                          properties:
                            name:
                              type: string
                              pattern: "^[a-zA-Z][a-zA-Z0-9._-]*$"
                            value:
                              type: string
      handlers:
        type: array
        x-kubernetes-list-map-keys:
          - name
        x-kubernetes-list-type: map
        minItems: 1
        maxItems: 64
        items:
          type: object
          required:
            - name
          oneOf:
            - required:
                - script
              not:
                required:
                  - docker
            - required:
                - docker
              not:
                required:
                  - script
          additionalProperties: false
          properties:
            name:
              type: string
              pattern: "^[a-zA-Z][a-zA-Z0-9_-]*$"
              maxLength: 64
            environment:
              description: Additional environment
              type: array
              x-kubernetes-list-map-keys:
                - name
              x-kubernetes-list-type: map
              items:
                type: object
                required:
                  - name
                  - value
                additionalProperties: false
                properties:
                  name:
                    type: string
                    pattern: "^[a-zA-Z_][a-zA-Z0-9_]*$"
                  value:
                    type: string
            stopGracePeriod:
              description: Number of seconds to wait after a SIGTERM before the SIGKILL arrives
              type: integer
            docker:
              description: docker run [OPTIONS] IMAGE[:TAG|@DIGEST] [COMMAND] [ARG...]
              type: object
              oneOf:
                - required:
                    - image
                  not:
                    required:
                      - build
                - required:
                    - build
                  not:
                    required:
                      - image
              additionalProperties: false
              properties:
                build:
                  description:  Build Docker image from source
                  type: object
                  required:
                    - context
                  additionalProperties: false
                  properties:
                    context:
                      type: string
                      description: A path to a directory containing a Dockerfile, or a url to a git repository
                    args:
                      description: Optional docker build command arguments
                      type: array
                      items:
                        type: string
                image:
                  description: Image to run in the form IMAGE[:TAG|@DIGEST]
                  type: string
                  pattern: "^([a-zA-Z][a-zA-Z0-9._-]+(:\\d+)?/)?[a-z0-9._-]+(/[a-z0-9._-]+)*((@[a-z0-9]+:[a-z0-9]+)|(:[a-zA-Z0-9._-]{1,128}))?$"
                options:
                  description: Options (flags) to pass to docker run
                  type: array
                  items:
                    type: string
                command:
                  description: Optional command
                  type: string
                args:
                  description: Optional command arguments
                  type: array
                  items:
                    type: string
                ports:
                  description: Non intercept related ports exposed to the host, such as ports used for debugging
                  type: array
                  items:
                    type: integer
                    minimum: 1
                    maximum: 65535
            script:
              description: Run a script using a shell
              type: object
              required:
                - run
              additionalProperties: false
              properties:
                run:
                  description: Script to run with a shell.
                  type: string
                shell:
                  description: The shell used when running the script.
                  type: string
                  enum:
                    - bash
                    - zsh
                    - sh
