> ## Documentation Index > Fetch the complete documentation index at: https://docs.controlplane.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a workload ## OpenAPI ````yaml post /org/{org}/gvc/{gvc}/workload openapi: 3.0.3 info: title: Control Plane Core API description: Copyright © 2023 Control Plane Corporation. All rights reserved. version: 1.0.0 servers: - url: https://api.cpln.io description: '' security: - {} - serviceAccountKey: [] - jwt: [] externalDocs: url: https://docs.controlplane.com/ description: End-user documentation paths: /org/{org}/gvc/{gvc}/workload: post: tags: - workload summary: Create a workload parameters: - in: path name: org required: true schema: type: string - in: path name: gvc required: true schema: type: string requestBody: description: '' content: application/json: schema: $ref: '#/components/schemas/workload' responses: '201': description: Workload was created successfully content: application/json: {} headers: Location: description: Link to the new workload schema: type: string '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/error' '403': description: Access denied content: application/json: schema: $ref: '#/components/schemas/error' components: schemas: workload: type: object properties: id: type: string readOnly: true kind: type: string readOnly: true version: type: integer readOnly: true description: type: string maxLength: 250 tags: type: object created: type: string format: date-time readOnly: true lastModified: type: string format: date-time readOnly: true links: type: array items: $ref: '#/components/schemas/link' readOnly: true name: type: string maxLength: 49 description: Name of the workload (max 49 characters) health: type: object properties: readiness: type: string syncFailed: type: boolean readyLocations: type: integer totalLocations: type: integer readyReplicas: type: integer totalReplicas: type: integer additionalProperties: false spec: type: object properties: type: type: string enum: - serverless - standard - cron - stateful - vm default: serverless description: >- Type of workload: standard (always running), cron (scheduled jobs), stateful (persistent state), serverless (rapid autoscaling), or vm (KubeVirt-backed virtual machine). identityLink: type: string description: >- The identityLink is used as the access scope for 3rd party cloud resources. A single identity can provide access to multiple cloud providers. containers: type: array items: type: object properties: name: type: string maxLength: 64 description: The name of the container. image: type: string description: >- The full image and tag path for a public or private docker registry. Private container images must have valid credentials configured in 'pullSecretLinks' on the GVC (Global Virtual Cloud). Required for all workload types except 'vm', which boots from spec.vm.bootDisk.source instead. workingDir: type: string maxLength: 128 description: The working directory for the container process metrics: type: object properties: port: type: integer description: Port where Prometheus metrics are exposed path: type: string maxLength: 128 default: /metrics description: HTTP path where Prometheus metrics are exposed dropMetrics: type: array items: type: string description: Drop metrics that match given patterns additionalProperties: false description: Prometheus metrics configuration for the container port: type: integer description: >- The port in the container which receives external traffic or traffic from other workloads. Only one container is allowed to specify a port. ports: type: array items: type: object properties: protocol: type: string enum: - http - http2 - grpc - tcp default: http description: >- Protocol used by the port (http, http2, grpc, or tcp) number: type: integer description: Port number additionalProperties: false description: >- The ports in the container which can receive internal and external traffic. For serverless workloads only the first port will be used. memory: type: string maxLength: 20 default: 128Mi description: >- reserved memory of the workload when capacityAI is disabled. maximum memory when CapacityAI is enabled. readinessProbe: type: object properties: exec: type: object properties: command: type: array items: type: string description: Command to execute for the health check additionalProperties: false description: Execute a command to check health grpc: type: object properties: port: type: integer description: Port to perform the gRPC health check on additionalProperties: false description: Perform a gRPC health check tcpSocket: type: object properties: port: type: integer description: Port to perform the TCP socket check on additionalProperties: false description: Perform a TCP socket health check httpGet: type: object properties: path: type: string maxLength: 256 default: / description: HTTP path to request for the health check port: type: integer description: Port to perform the HTTP health check on httpHeaders: type: array items: type: object properties: name: type: string maxLength: 128 description: HTTP header name value: type: string maxLength: 128 description: HTTP header value additionalProperties: false description: >- Custom HTTP headers to include in the health check request scheme: type: string enum: - HTTP - HTTPS default: HTTP description: HTTP scheme to use (HTTP or HTTPS) additionalProperties: false description: Perform an HTTP GET health check initialDelaySeconds: type: integer description: >- Number of seconds to wait before performing the first health check periodSeconds: type: integer description: How often (in seconds) to perform the health check timeoutSeconds: type: integer description: >- Number of seconds after which the health check times out successThreshold: type: integer description: >- Minimum consecutive successes for the health check to be considered successful after having failed failureThreshold: type: integer description: >- Minimum consecutive failures for the health check to be considered failed after having succeeded additionalProperties: false description: >- A Probe to check if the workload is ready to receive additional traffic. livenessProbe: type: object properties: exec: type: object properties: command: type: array items: type: string description: Command to execute for the health check additionalProperties: false description: Execute a command to check health grpc: type: object properties: port: type: integer description: Port to perform the gRPC health check on additionalProperties: false description: Perform a gRPC health check tcpSocket: type: object properties: port: type: integer description: Port to perform the TCP socket check on additionalProperties: false description: Perform a TCP socket health check httpGet: type: object properties: path: type: string maxLength: 256 default: / description: HTTP path to request for the health check port: type: integer description: Port to perform the HTTP health check on httpHeaders: type: array items: type: object properties: name: type: string maxLength: 128 description: HTTP header name value: type: string maxLength: 128 description: HTTP header value additionalProperties: false description: >- Custom HTTP headers to include in the health check request scheme: type: string enum: - HTTP - HTTPS default: HTTP description: HTTP scheme to use (HTTP or HTTPS) additionalProperties: false description: Perform an HTTP GET health check periodSeconds: type: integer description: How often (in seconds) to perform the health check timeoutSeconds: type: integer description: >- Number of seconds after which the health check times out successThreshold: type: integer description: >- Minimum consecutive successes for the health check to be considered successful after having failed failureThreshold: type: integer description: >- Minimum consecutive failures for the health check to be considered failed after having succeeded initialDelaySeconds: type: integer description: >- Number of seconds to wait before performing the first health check additionalProperties: false description: >- A Probe to check if the workload is healthy or should be restarted. cpu: type: string maxLength: 20 default: 50m description: >- reserved CPU of the workload when capacityAI is disabled. maximum CPU when CapacityAI is enabled. minCpu: type: string maxLength: 20 description: Minimum CPU when capacityAI is enabled. minMemory: type: string maxLength: 20 description: Minimum memory when capacityAI is enabled env: type: array items: type: object properties: name: type: string maxLength: 120 value: type: string maxLength: 4096 additionalProperties: false description: >- Environment variables for the container at runtime. Default environment variables are also provided: CPLN_GVC, CPLN_LOCATION, CPLN_ORG, CPLN_PROVIDER, CPLN_WORKLOAD gpu: type: object properties: nvidia: type: object properties: model: type: object description: NVIDIA GPU model (t4 or a10g) quantity: type: number description: Number of NVIDIA GPUs to allocate additionalProperties: false description: NVIDIA GPU resource specification custom: type: object properties: resource: type: string maxLength: 64 description: Custom GPU resource name (e.g., amd.com/gpu) runtimeClass: type: string maxLength: 64 description: Runtime class for custom GPU quantity: type: number description: Number of custom GPUs to allocate additionalProperties: false description: Custom GPU resource specification for non-NVIDIA GPUs additionalProperties: false description: Reserved GPU resources for the workload. inheritEnv: type: boolean description: >- Enables inheritance of GVC environment variables. A variable in spec.env will override a GVC variable with the same name. command: type: string maxLength: 256 description: Optionally override the entrypoint args: type: array items: type: string description: >- Command line arguments passed to the container at runtime. Replaces the CMD arguments of the running container. It is an ordered list. lifecycle: type: object properties: postStart: type: object properties: exec: type: object properties: command: type: array items: type: string description: >- Command and arguments executed immediately after the container is created. additionalProperties: false description: Execute a command when the container starts additionalProperties: false description: Actions to perform after the container starts preStop: type: object properties: exec: type: object properties: command: type: array items: type: string description: >- Command and arguments executed immediately before the container is stopped. additionalProperties: false description: Execute a command before the container stops additionalProperties: false description: Actions to perform before the container stops additionalProperties: false description: Lifecycle hooks for the container volumes: type: array items: type: object properties: uri: type: string recoveryPolicy: type: string enum: - retain - recycle default: retain description: >- Only applicable to persistent volumes, this determines what Control Plane will do when creating a new workload replica if a corresponding volume exists. path: type: string description: >- Mount path inside the container. Required for non-vm workloads; rejected for type=vm. name: type: string maxLength: 63 description: >- VM disk name. Required for type=vm; rejected for other workload types. bus: type: string enum: - virtio - sata - scsi description: >- VM disk bus. Only valid for type=vm. A cpln://secret/ volume on a sata or scsi bus is presented to the guest as a read-only CD-ROM. bootOrder: type: integer description: VM disk boot order. Only valid for type=vm. additionalProperties: false description: >- Mount Object Store (S3, GCS, AzureBlob) buckets as file system additionalProperties: false description: List of containers that make up the workload firewallConfig: type: object properties: external: type: object properties: inboundAllowCIDR: type: array items: type: string description: >- The list of ipv4/ipv6 addresses or cidr blocks that are allowed to access this workload. No external access is allowed by default. Specify '0.0.0.0/0' to allow access to the public internet. inboundBlockedCIDR: type: array items: type: string description: >- The list of ipv4/ipv6 addresses or cidr blocks that are NOT allowed to access this workload. Addresses in the allow list will only be allowed if they do not exist in this list. outboundAllowHostname: type: array items: type: string maxLength: 128 description: >- DNS hostname with optional wildcard prefix (e.g., *.example.com, example.com) description: >- The list of public hostnames that this workload is allowed to reach. No outbound access is allowed by default. A wildcard '*' is allowed on the prefix of the hostname only, ex: '*.amazonaws.com'. Use 'outboundAllowCIDR' to allow access to all external websites (not recommended). The ports 80, 443 & 445 are allowed by default. This can be modified using the outboundAllowPort setting. outboundAllowPort: type: array items: type: object properties: protocol: type: string enum: - http - https - tcp default: tcp description: Protocol to allow (http, https, or tcp) number: type: integer description: Port number to allow additionalProperties: false description: >- Allow outbound access to specific ports and protocols. When not specified, communication to address ranges in outboundAllowCIDR is allowed on all ports and communication to names in outboundAllowHostname is allowed on ports 80/443. outboundAllowCIDR: type: array items: type: string description: >- The list of ipv4/ipv6 addresses or cidr blocks that this workload is allowed reach. No outbound access is allowed by default. Specify '0.0.0.0/0' to allow outbound access to the public internet (not recommended). outboundBlockedCIDR: type: array items: type: string description: >- The list of ipv4/ipv6 addresses or cidr blocks that this workload is NOT allowed reach. Addresses in the allow list will only be allowed if they do not exist in this list. http: type: object properties: inboundHeaderFilter: type: array items: type: object properties: key: type: string maxLength: 128 description: The header to match for. allowedValues: type: array items: type: string description: >- A list of regular expressions to match for allowed header values. Headers that do not match ANY of these values will be filtered and will not reach the workload. blockedValues: type: array items: type: string description: >- A list of regular expressions to match for blocked header values. Headers that match ANY of these values will be filtered and will not reach the workload. additionalProperties: false description: >- If provided, in order to be an accepted request that is forwarded to the workload, the request must include headers which match the allowedValues regex or must not include headers which match the blockedValues regex. description: A list of header filters for HTTP workloads. additionalProperties: false description: firewall options for HTTP workloads additionalProperties: false description: >- The external firewall is used to control access to and from the public internet. internal: type: object properties: inboundAllowType: type: string enum: - none - same-gvc - same-org - workload-list default: none description: >- Used to control the internal firewall configuration and mutual tls. 'none': no access is allowed between this workload and other workloads on Control Plane. 'same-gvc': workloads running on the same Global Virtual Cloud are allowed to access this workload internally. 'same-org': workloads running on the same Control Plane Organization are allowed to access this workload internally. 'workload-list': specific workloads provided in the 'inboundAllowWorkload' array are allowed to access this workload internally. inboundAllowWorkload: type: array items: type: string description: >- A list of specific workloads which are allowed to access this workload internally. additionalProperties: false description: >- The internal firewall is used to control access between workloads. additionalProperties: false description: >- Optional control of inbound and outbound access to the workload for external (public) and internal (service to service) traffic. Access is restricted by default. defaultOptions: type: object properties: autoscaling: type: object properties: metric: type: string enum: - concurrency - cpu - memory - rps - latency - keda - disabled description: >- Controls the metric which will be used for scaling decisions.The goal is to maintain the target across all replicas of a deployment.'concurrency' uses the number of concurrent requests for the target.'cpu' uses % processor time for the target.'memory' memory in Mi for the target.'rps' uses requests per second for the target.'latency' uses the average request response time for the target. multi: type: array items: type: object properties: metric: type: object target: type: integer description: >- Control Plane will scale the number of replicas for this deployment up/downin order to be as close as possible to the target metric across all replicas of a deployment. additionalProperties: false metricPercentile: type: string enum: - p50 - p75 - p99 description: >- For metrics represented as a distribution (e.g. latency) a percentile within the distribution must be chosen as the target. target: type: integer description: >- Control Plane will scale the number of replicas for this deployment up/downin order to be as close as possible to the target metric across all replicas of a deployment. maxScale: type: integer description: The maximum allowed number of replicas. minScale: type: integer description: >- The minimum allowed number of replicas. Control Plane can scale the workload down to 0 when there is no traffic and scale up immediately to fulfill new requests. scaleToZeroDelay: type: number description: >- The amount of time with no requests received before a workload is scaled to 0. maxConcurrency: type: number description: >- A hard maximum for the number of concurrent requests allowed to a replica. If no replicas are available to fulfill the request then it will be queued until a replica with capacity is available and delivered as soon as one is available again. Capacity can be available from requests completing or when a new replica is available from scale out. A value of 0 allows all requests. keda: type: object properties: triggers: type: array items: type: object properties: type: type: string description: >- The type of KEDA trigger, e.g "prometheus", "aws-sqs", etc. metadata: type: object description: >- The configuration parameters that the trigger requires name: type: string description: >- An optional name for the trigger. If not provided, a default name will be generated based on the trigger type. useCachedMetrics: type: boolean description: >- Enables caching of metric values during polling interval metricType: type: string enum: - AverageValue - Value - Utilization description: The type of metric to be used for scaling. authenticationRef: type: object properties: name: type: string description: >- The name of secret listed in the GVC spec.keda.secrets additionalProperties: false additionalProperties: false description: KEDA trigger configuration description: >- An array of KEDA triggers to be used for scaling workloads in this GVC. advanced: type: object properties: scalingModifiers: type: object properties: target: type: string description: >- defines new target value to scale on for the composed metric. activationTarget: type: string description: >- defines the new activation target value to scale on for the composed metric. metricType: type: string enum: - AverageValue - Value - Utilization description: >- defines metric type used for this new composite-metric. formula: type: string description: >- composes metrics together and allows them to be modified/manipulated. It accepts mathematical/conditional statements additionalProperties: false additionalProperties: false fallback: type: object properties: failureThreshold: type: integer description: >- Number of consecutive failures required to trigger fallback behavior. replicas: type: integer description: >- Number of replicas to scale to when fallback is triggered. behavior: type: string enum: - static - currentReplicas - currentReplicasIfHigher - currentReplicasIfLower description: Behavior to apply when fallback is triggered. additionalProperties: false pollingInterval: type: integer cooldownPeriod: type: integer initialCooldownPeriod: type: integer additionalProperties: false additionalProperties: false timeoutSeconds: type: number description: >- The maximum request duration that is allowed for Control Plane to respond.This timeout can be reached when the Control Plane is waiting for the workload to respond or waitingfor a new workload to become available when using Autoscaling. capacityAI: type: boolean description: >- Enables intelligent dynamic resource allocation of CPU and Memory for each container by setting resource reservations using analysis of historical usage data. This can significantly reduce cost but may cause temporary performance issues for workloads with sudden spikes in usage. capacityAIUpdateMinutes: type: integer description: >- The highest frequency capacity AI is allowed to update resource reservations when CapacityAI is enabled. spot: type: boolean description: >- Enables use of spot instances to reduce cost of running workloads with an increasedpotential of rescheduling workloads onto new nodes when they are forced to terminate. debug: type: boolean description: >- Enables debug response headers when the headers "x-cpln-debug: true" is in the request. suspend: type: boolean multiZone: type: object properties: enabled: type: boolean additionalProperties: false additionalProperties: false description: >- Set defaultOptions for the workload in all Control Plane Locations. localOptions: type: array items: type: object properties: autoscaling: type: object properties: metric: type: string enum: - concurrency - cpu - memory - rps - latency - keda - disabled description: >- Controls the metric which will be used for scaling decisions.The goal is to maintain the target across all replicas of a deployment.'concurrency' uses the number of concurrent requests for the target.'cpu' uses % processor time for the target.'memory' memory in Mi for the target.'rps' uses requests per second for the target.'latency' uses the average request response time for the target. multi: type: array items: type: object properties: metric: type: object target: type: integer description: >- Control Plane will scale the number of replicas for this deployment up/downin order to be as close as possible to the target metric across all replicas of a deployment. additionalProperties: false metricPercentile: type: string enum: - p50 - p75 - p99 description: >- For metrics represented as a distribution (e.g. latency) a percentile within the distribution must be chosen as the target. target: type: integer description: >- Control Plane will scale the number of replicas for this deployment up/downin order to be as close as possible to the target metric across all replicas of a deployment. maxScale: type: integer description: The maximum allowed number of replicas. minScale: type: integer description: >- The minimum allowed number of replicas. Control Plane can scale the workload down to 0 when there is no traffic and scale up immediately to fulfill new requests. scaleToZeroDelay: type: number description: >- The amount of time with no requests received before a workload is scaled to 0. maxConcurrency: type: number description: >- A hard maximum for the number of concurrent requests allowed to a replica. If no replicas are available to fulfill the request then it will be queued until a replica with capacity is available and delivered as soon as one is available again. Capacity can be available from requests completing or when a new replica is available from scale out. A value of 0 allows all requests. keda: type: object properties: triggers: type: array items: type: object properties: type: type: string description: >- The type of KEDA trigger, e.g "prometheus", "aws-sqs", etc. metadata: type: object description: >- The configuration parameters that the trigger requires name: type: string description: >- An optional name for the trigger. If not provided, a default name will be generated based on the trigger type. useCachedMetrics: type: boolean description: >- Enables caching of metric values during polling interval metricType: type: string enum: - AverageValue - Value - Utilization description: The type of metric to be used for scaling. authenticationRef: type: object properties: name: type: string description: >- The name of secret listed in the GVC spec.keda.secrets additionalProperties: false additionalProperties: false description: KEDA trigger configuration description: >- An array of KEDA triggers to be used for scaling workloads in this GVC. advanced: type: object properties: scalingModifiers: type: object properties: target: type: string description: >- defines new target value to scale on for the composed metric. activationTarget: type: string description: >- defines the new activation target value to scale on for the composed metric. metricType: type: string enum: - AverageValue - Value - Utilization description: >- defines metric type used for this new composite-metric. formula: type: string description: >- composes metrics together and allows them to be modified/manipulated. It accepts mathematical/conditional statements additionalProperties: false additionalProperties: false fallback: type: object properties: failureThreshold: type: integer description: >- Number of consecutive failures required to trigger fallback behavior. replicas: type: integer description: >- Number of replicas to scale to when fallback is triggered. behavior: type: string enum: - static - currentReplicas - currentReplicasIfHigher - currentReplicasIfLower description: Behavior to apply when fallback is triggered. additionalProperties: false pollingInterval: type: integer cooldownPeriod: type: integer initialCooldownPeriod: type: integer additionalProperties: false additionalProperties: false timeoutSeconds: type: number description: >- The maximum request duration that is allowed for Control Plane to respond.This timeout can be reached when the Control Plane is waiting for the workload to respond or waitingfor a new workload to become available when using Autoscaling. capacityAI: type: boolean description: >- Enables intelligent dynamic resource allocation of CPU and Memory for each container by setting resource reservations using analysis of historical usage data. This can significantly reduce cost but may cause temporary performance issues for workloads with sudden spikes in usage. capacityAIUpdateMinutes: type: integer description: >- The highest frequency capacity AI is allowed to update resource reservations when CapacityAI is enabled. spot: type: boolean description: >- Enables use of spot instances to reduce cost of running workloads with an increasedpotential of rescheduling workloads onto new nodes when they are forced to terminate. debug: type: boolean description: >- Enables debug response headers when the headers "x-cpln-debug: true" is in the request. suspend: type: boolean multiZone: type: object properties: enabled: type: boolean additionalProperties: false location: type: string additionalProperties: false description: >- Set defaultOptions for the workload in all Control Plane Locations. description: >- Override defaultOptions for the workload in specific Control Plane Locations. job: type: object properties: schedule: type: string description: A standard cron schedule expression (5 fields). concurrencyPolicy: type: string enum: - Forbid - Replace - Allow default: Forbid description: >- Either 'Forbid', 'Replace', or 'Allow'. This determines what Control Plane will do when the schedule requires a job to start, while a prior instance of the job is still running. historyLimit: type: integer description: >- The maximum number of completed job instances to display. This should be an integer between 1 and 10. restartPolicy: type: string enum: - OnFailure - Never description: >- Either 'OnFailure' or 'Never'. This determines what Control Plane will do when a job instance fails. activeDeadlineSeconds: type: number description: >- The maximum number of seconds Control Plane will wait for the job to complete. If a job does not succeed or fail in the allotted time, Control Plane will stop the job, moving it into the Removed status. additionalProperties: false description: Job configuration for cron workloads sidecar: type: object properties: envoy: type: object properties: accessLog: type: array items: type: object properties: priority: type: number name: type: string enum: - envoy.http_grpc_access_log excludedWorkloads: type: array items: type: string typed_config: type: object properties: '@type': type: object common_config: type: object properties: log_name: type: string grpc_service: type: object properties: envoy_grpc: type: object properties: cluster_name: type: string authority: type: string default: adjust: null in: false iterables: null map: null separator: . type: value ancestor: 1 path: - cluster_name depth: 1 key: cluster_name root: cluster_name display: ref:cluster_name retry_policy: type: object properties: retry_back_off: type: object properties: base_interval: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false max_interval: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false additionalProperties: false num_retries: type: number additionalProperties: false additionalProperties: false google_grpc: type: object properties: target_uri: type: string channel_credentials: type: object properties: ssl_credentials: type: object properties: root_certs: type: object properties: filename: type: string inline_bytes: {} inline_string: type: string environment_variable: type: string additionalProperties: false private_key: type: object properties: filename: type: string inline_bytes: {} inline_string: type: string environment_variable: type: string additionalProperties: false cert_chain: type: object properties: filename: type: string inline_bytes: {} inline_string: type: string environment_variable: type: string additionalProperties: false additionalProperties: false google_default: type: object properties: {} additionalProperties: false additionalProperties: false call_credentials: type: array items: type: object properties: access_token: type: string google_compute_engine: type: object properties: {} additionalProperties: false google_refresh_token: type: string service_account_jwt_access: type: object properties: json_key: type: string token_lifetime_seconds: type: integer additionalProperties: false google_iam: type: object properties: authorization_token: type: string authority_selector: type: string additionalProperties: false from_plugin: type: object properties: name: type: string typed_config: type: object additionalProperties: false sts_service: type: object properties: token_exchange_service_uri: type: string resource: type: string audience: type: string scope: type: string requested_token_type: type: string subject_token_path: type: string subject_token_type: type: string actor_token_path: type: string actor_token_type: type: string additionalProperties: false additionalProperties: false stat_prefix: type: string credentials_factory_name: type: string config: type: object additionalProperties: false timeout: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false initial_metadata: type: array items: type: object properties: key: type: string value: type: string raw_value: {} additionalProperties: false additionalProperties: false transport_api_version: type: string enum: - AUTO - V2 - V3 buffer_flush_interval: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false buffer_size_bytes: type: integer filter_state_objects_to_log: type: array items: type: string grpc_stream_retry_policy: type: object properties: retry_back_off: type: object properties: base_interval: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false max_interval: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false additionalProperties: false num_retries: type: number additionalProperties: false additionalProperties: false additional_request_headers_to_log: type: array items: type: string additional_response_headers_to_log: type: array items: type: string additional_response_trailers_to_log: type: array items: type: string additionalProperties: false additionalProperties: false clusters: type: array items: type: object properties: name: type: string excludedWorkloads: type: array items: type: string transport_socket_matches: type: object alt_stat_name: type: object type: type: string enum: - STATIC - STRICT_DNS - LOGICAL_DNS - EDS - ORIGINAL_DST cluster_type: type: object eds_cluster_config: type: object connect_timeout: type: object per_connection_buffer_limit_bytes: type: object lb_policy: type: object load_assignment: type: object properties: cluster_name: type: string endpoints: type: object policy: type: object additionalProperties: false health_checks: type: object max_requests_per_connection: type: object circuit_breakers: type: object upstream_http_protocol_options: type: object common_http_protocol_options: type: object http_protocol_options: type: object http2_protocol_options: type: object typed_extension_protocol_options: type: object dns_refresh_rate: type: object dns_failure_refresh_rate: type: object respect_dns_ttl: type: object dns_lookup_family: type: object dns_resolvers: type: object use_tcp_for_dns_lookups: type: object dns_resolution_config: type: object typed_dns_resolver_config: type: object wait_for_warm_on_init: type: object outlier_detection: type: object cleanup_interval: type: object upstream_bind_config: type: object lb_subset_config: type: object ring_hash_lb_config: type: object maglev_lb_config: type: object least_request_lb_config: type: object common_lb_config: type: object transport_socket: type: object metadata: type: object protocol_selection: type: object upstream_connection_options: type: object close_connections_on_host_health_failure: type: object ignore_health_on_host_removal: type: object filters: type: object load_balancing_policy: type: object track_timeout_budgets: type: object upstream_config: type: object track_cluster_stats: type: object preconnect_policy: type: object connection_pool_per_downstream_connection: type: object additionalProperties: false excludedExternalAuth: type: array items: type: object properties: match: type: object properties: prefix: type: string path: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false path_separated_prefix: type: string path_match_policy: type: object properties: name: type: string typed_config: type: object additionalProperties: false case_sensitive: type: boolean runtime_fraction: type: object properties: default_value: type: object properties: numerator: type: integer denominator: type: integer additionalProperties: false runtime_key: type: string additionalProperties: false headers: type: array items: type: object properties: name: type: string safe_regex_match: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false range_match: type: object properties: start: type: integer end: type: integer additionalProperties: false present_match: type: boolean string_match: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false invert_match: type: boolean treat_missing_header_as_empty: type: boolean additionalProperties: false query_parameters: type: array items: type: object properties: name: type: string string_match: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false present_match: type: boolean additionalProperties: false grpc: type: object properties: presented: type: boolean validated: type: boolean additionalProperties: false tls_context: type: object properties: presented: type: boolean validated: type: boolean additionalProperties: false dynamic_metadata: type: array items: type: object properties: filter: type: string path: type: array items: type: object properties: key: type: string additionalProperties: false value: type: object properties: null_match: type: object double_match: type: object properties: range: type: object properties: start: type: number end: type: number additionalProperties: false exact: type: number additionalProperties: false string_match: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false bool_match: type: boolean present_match: type: boolean additionalProperties: false invert: type: boolean additionalProperties: false additionalProperties: false port: type: integer svcPort: type: integer additionalProperties: false excludedRateLimit: type: array items: type: object properties: match: type: object properties: prefix: type: string path: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false path_separated_prefix: type: string path_match_policy: type: object properties: name: type: string typed_config: type: object additionalProperties: false case_sensitive: type: boolean runtime_fraction: type: object properties: default_value: type: object properties: numerator: type: integer denominator: type: integer additionalProperties: false runtime_key: type: string additionalProperties: false headers: type: array items: type: object properties: name: type: string safe_regex_match: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false range_match: type: object properties: start: type: integer end: type: integer additionalProperties: false present_match: type: boolean string_match: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false invert_match: type: boolean treat_missing_header_as_empty: type: boolean additionalProperties: false query_parameters: type: array items: type: object properties: name: type: string string_match: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false present_match: type: boolean additionalProperties: false grpc: type: object properties: presented: type: boolean validated: type: boolean additionalProperties: false tls_context: type: object properties: presented: type: boolean validated: type: boolean additionalProperties: false dynamic_metadata: type: array items: type: object properties: filter: type: string path: type: array items: type: object properties: key: type: string additionalProperties: false value: type: object properties: null_match: type: object double_match: type: object properties: range: type: object properties: start: type: number end: type: number additionalProperties: false exact: type: number additionalProperties: false string_match: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false bool_match: type: boolean present_match: type: boolean additionalProperties: false invert: type: boolean additionalProperties: false additionalProperties: false port: type: integer svcPort: type: integer additionalProperties: false http: type: array items: oneOf: - type: object properties: priority: type: number excludedWorkloads: type: array items: type: string name: type: string enum: - envoy.filters.http.ext_authz typed_config: type: object properties: grpc_service: type: object properties: envoy_grpc: type: object properties: cluster_name: type: string authority: type: string default: adjust: null in: false iterables: null map: null separator: . type: value ancestor: 1 path: - cluster_name depth: 1 key: cluster_name root: cluster_name display: ref:cluster_name retry_policy: type: object properties: retry_back_off: type: object properties: base_interval: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false max_interval: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false additionalProperties: false num_retries: type: number additionalProperties: false additionalProperties: false google_grpc: type: object properties: target_uri: type: string channel_credentials: type: object properties: ssl_credentials: type: object properties: root_certs: type: object properties: filename: type: string inline_bytes: {} inline_string: type: string environment_variable: type: string additionalProperties: false private_key: type: object properties: filename: type: string inline_bytes: {} inline_string: type: string environment_variable: type: string additionalProperties: false cert_chain: type: object properties: filename: type: string inline_bytes: {} inline_string: type: string environment_variable: type: string additionalProperties: false additionalProperties: false google_default: type: object properties: {} additionalProperties: false additionalProperties: false call_credentials: type: array items: type: object properties: access_token: type: string google_compute_engine: type: object properties: {} additionalProperties: false google_refresh_token: type: string service_account_jwt_access: type: object properties: json_key: type: string token_lifetime_seconds: type: integer additionalProperties: false google_iam: type: object properties: authorization_token: type: string authority_selector: type: string additionalProperties: false from_plugin: type: object properties: name: type: string typed_config: type: object additionalProperties: false sts_service: type: object properties: token_exchange_service_uri: type: string resource: type: string audience: type: string scope: type: string requested_token_type: type: string subject_token_path: type: string subject_token_type: type: string actor_token_path: type: string actor_token_type: type: string additionalProperties: false additionalProperties: false stat_prefix: type: string credentials_factory_name: type: string config: type: object additionalProperties: false timeout: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false initial_metadata: type: array items: type: object properties: key: type: string value: type: string raw_value: {} additionalProperties: false additionalProperties: false http_service: type: object properties: server_uri: type: object properties: uri: type: string cluster: type: string timeout: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false additionalProperties: false path_prefix: type: string authorization_request: type: object properties: allowed_headers: type: object properties: patterns: type: array items: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false additionalProperties: false headers_to_add: type: array items: type: object properties: key: type: string value: type: string raw_value: {} additionalProperties: false additionalProperties: false authorization_response: type: object properties: allowed_upstream_headers: type: object properties: patterns: type: array items: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false additionalProperties: false allowed_upstream_headers_to_append: type: object properties: patterns: type: array items: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false additionalProperties: false allowed_client_headers: type: object properties: patterns: type: array items: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false additionalProperties: false allowed_client_headers_on_success: type: object properties: patterns: type: array items: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false additionalProperties: false dynamic_metadata_from_headers: type: object properties: patterns: type: array items: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false additionalProperties: false additionalProperties: false additionalProperties: false failure_mode_allow: type: boolean failure_mode_allow_header_add: type: boolean with_request_body: type: object properties: max_request_bytes: type: integer allow_partial_message: type: boolean pack_as_bytes: type: boolean additionalProperties: false clear_route_cache: type: boolean status_on_error: type: object properties: code: type: string enum: - Empty - Continue - OK - Created - Accepted - NonAuthoritativeInformation - NoContent - ResetContent - PartialContent - MultiStatus - AlradyReported - IMUsed - MultipleChoices - MovedPermanently - Found - SeeOther - NotModified - UseProxy - TemporaryRedirect - PermanentRedirect - BadRequest - Unauthroized - PaymentRequired - Forbidden - NotFound - MethodNotAllowed - NotAcceptable - ProxyAuthenticationRequired - RequestTimeout - Conflict - Gone - LengthRequired - PreconditionFailed - PayloadTooLarge - URITooLong - UnsupportedMediaType - RangeNotSatisfiable - ExpectationFailed - MisdirectedRequest - UnprocessableEntity - Locked - FailedDependency - UpgradeRequired - PreconditionRequired - TooManyRequests - RequestHeaderFieldsTooLarge - InternalServerError - NotImplemented - BadGateway - ServiceUnavailable - GatewayTimeout - HTTPVersionNotSupported - VariantAlsoNegotiates - InsufficientStorage - LoopDetected - NotExtended - NetworkAuthenticationRequired additionalProperties: false metadata_context_namespaces: type: array items: type: string typed_metadata_context_namespaces: type: array items: type: string route_metadata_context_namespaces: type: array items: type: string route_typed_metadata_context_namespaces: type: array items: type: string filter_enabled: type: object properties: numerator: type: integer denominator: type: integer additionalProperties: false deny_at_disable: type: object properties: default_value: type: boolean runtime_key: type: string additionalProperties: false include_peer_certificate: type: boolean stat_prefix: type: string bootstrap_metadata_labels_key: type: string allowed_headers: type: object properties: patterns: type: array items: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false additionalProperties: false include_tls_session: type: boolean charge_cluster_response_stats: type: boolean transport_api_version: type: string enum: - AUTO - V2 - V3 '@type': type: string enum: - >- type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz additionalProperties: false additionalProperties: false - type: object properties: priority: type: number excludedWorkloads: type: array items: type: string name: type: string enum: - envoy.filters.http.jwt_authn typed_config: type: object properties: providers: type: object rules: type: array items: type: object properties: match: type: object properties: prefix: type: string headers: type: array items: type: object properties: name: type: string safe_regex_match: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false range_match: type: object properties: start: type: integer end: type: integer additionalProperties: false present_match: type: boolean string_match: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false invert_match: type: boolean treat_missing_header_as_empty: type: boolean additionalProperties: false additionalProperties: false requires: type: object properties: provider_name: type: string additionalProperties: false additionalProperties: false filter_state_rules: type: object properties: name: type: string requires: type: object additionalProperties: false bypass_cors_preflight: type: boolean requirement_map: type: object '@type': type: string enum: - >- type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication additionalProperties: false additionalProperties: false - type: object properties: priority: type: number excludedWorkloads: type: array items: type: string name: type: string enum: - envoy.filters.http.grpc_web typed_config: type: object properties: '@type': type: string enum: - >- type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb additionalProperties: false additionalProperties: false - type: object properties: priority: type: number excludedWorkloads: type: array items: type: string name: type: string enum: - envoy.filters.http.connect_grpc_bridge typed_config: type: object properties: '@type': type: string enum: - >- type.googleapis.com/envoy.extensions.filters.http.connect_grpc_bridge.v3.FilterConfig additionalProperties: false additionalProperties: false - type: object properties: priority: type: number excludedWorkloads: type: array items: type: string name: type: string enum: - envoy.filters.http.grpc_json_transcoder typed_config: type: object properties: proto_descriptor: type: string proto_descriptor_bin: {} services: type: array items: type: string print_options: type: object properties: add_whitespace: type: boolean always_print_primitive_fields: type: boolean always_print_enums_as_ints: type: boolean preserve_proto_field_names: type: boolean stream_newline_delimited: type: boolean additionalProperties: false match_incoming_request_route: type: boolean ignored_query_parameters: type: array items: type: string auto_mapping: type: boolean ignore_unknown_query_parameters: type: boolean convert_grpc_status: type: boolean url_unescape_spec: type: string enum: - ALL_CHARACTERS_EXCEPT_RESERVED - ALL_CHARACTERS_EXCEPT_SLASH - ALL_CHARACTERS query_param_unescape_plus: type: boolean match_unregistered_custom_verb: type: boolean request_validation_options: type: object properties: reject_unknown_method: type: boolean reject_unknown_query_parameters: type: boolean reject_binding_body_field_collisions: type: boolean additionalProperties: false case_insensitive_enum_parsing: type: boolean max_request_body_size: type: integer max_response_body_size: type: integer '@type': type: string enum: - >- type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder additionalProperties: false additionalProperties: false - type: object properties: priority: type: number excludedWorkloads: type: array items: type: string name: type: string enum: - envoy.filters.http.cors typed_config: type: object properties: allow_origin_string_match: type: array items: type: object properties: exact: type: string prefix: type: string suffix: type: string safe_regex: type: object properties: google_re2: type: object properties: max_program_size: type: integer additionalProperties: false regex: type: string additionalProperties: false contains: type: string ignore_case: type: boolean additionalProperties: false allow_methods: type: string allow_headers: type: string expose_headers: type: string max_age: type: string allow_credentials: type: boolean filter_enabled: type: object properties: default_value: type: object properties: numerator: type: integer denominator: type: integer additionalProperties: false runtime_key: type: string additionalProperties: false shadow_enabled: type: object properties: default_value: type: object properties: numerator: type: integer denominator: type: integer additionalProperties: false runtime_key: type: string additionalProperties: false allow_private_network_access: type: boolean '@type': type: string enum: - >- type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors additionalProperties: false additionalProperties: false - type: object properties: priority: type: number excludedWorkloads: type: array items: type: string name: type: string enum: - envoy.filters.http.ratelimit typed_config: type: object properties: domain: type: string stage: type: integer request_type: type: string enum: - internal - external - both timeout: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false failure_mode_deny: type: boolean rate_limited_as_resource_exhausted: type: boolean rate_limit_service: type: object properties: grpc_service: type: object properties: envoy_grpc: type: object properties: cluster_name: type: string authority: type: string default: adjust: null in: false iterables: null map: null separator: . type: value ancestor: 1 path: - cluster_name depth: 1 key: cluster_name root: cluster_name display: ref:cluster_name retry_policy: type: object properties: retry_back_off: type: object properties: base_interval: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false max_interval: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false additionalProperties: false num_retries: type: number additionalProperties: false additionalProperties: false google_grpc: type: object properties: target_uri: type: string channel_credentials: type: object properties: ssl_credentials: type: object properties: root_certs: type: object properties: filename: type: string inline_bytes: {} inline_string: type: string environment_variable: type: string additionalProperties: false private_key: type: object properties: filename: type: string inline_bytes: {} inline_string: type: string environment_variable: type: string additionalProperties: false cert_chain: type: object properties: filename: type: string inline_bytes: {} inline_string: type: string environment_variable: type: string additionalProperties: false additionalProperties: false google_default: type: object properties: {} additionalProperties: false additionalProperties: false call_credentials: type: array items: type: object properties: access_token: type: string google_compute_engine: type: object properties: {} additionalProperties: false google_refresh_token: type: string service_account_jwt_access: type: object properties: json_key: type: string token_lifetime_seconds: type: integer additionalProperties: false google_iam: type: object properties: authorization_token: type: string authority_selector: type: string additionalProperties: false from_plugin: type: object properties: name: type: string typed_config: type: object additionalProperties: false sts_service: type: object properties: token_exchange_service_uri: type: string resource: type: string audience: type: string scope: type: string requested_token_type: type: string subject_token_path: type: string subject_token_type: type: string actor_token_path: type: string actor_token_type: type: string additionalProperties: false additionalProperties: false stat_prefix: type: string credentials_factory_name: type: string config: type: object additionalProperties: false timeout: oneOf: - type: string - type: object properties: seconds: type: integer nanos: type: integer additionalProperties: false initial_metadata: type: array items: type: object properties: key: type: string value: type: string raw_value: {} additionalProperties: false additionalProperties: false transport_api_version: type: string enum: - AUTO - V2 - V3 additionalProperties: false enable_x_ratelimit_headers: type: string enum: - 'OFF' - DRAFT_VERSION_03 disable_x_envoy_ratelimited_header: type: boolean rate_limited_status: type: object properties: code: type: string enum: - Empty - Continue - OK - Created - Accepted - NonAuthoritativeInformation - NoContent - ResetContent - PartialContent - MultiStatus - AlradyReported - IMUsed - MultipleChoices - MovedPermanently - Found - SeeOther - NotModified - UseProxy - TemporaryRedirect - PermanentRedirect - BadRequest - Unauthroized - PaymentRequired - Forbidden - NotFound - MethodNotAllowed - NotAcceptable - ProxyAuthenticationRequired - RequestTimeout - Conflict - Gone - LengthRequired - PreconditionFailed - PayloadTooLarge - URITooLong - UnsupportedMediaType - RangeNotSatisfiable - ExpectationFailed - MisdirectedRequest - UnprocessableEntity - Locked - FailedDependency - UpgradeRequired - PreconditionRequired - TooManyRequests - RequestHeaderFieldsTooLarge - InternalServerError - NotImplemented - BadGateway - ServiceUnavailable - GatewayTimeout - HTTPVersionNotSupported - VariantAlsoNegotiates - InsufficientStorage - LoopDetected - NotExtended - NetworkAuthenticationRequired additionalProperties: false response_headers_to_add: type: array items: type: object properties: header: type: object properties: key: type: string value: type: string raw_value: {} additionalProperties: false append: type: boolean append_action: type: string enum: - APPEND_IF_EXISTS_OR_ADD - ADD_IF_ABSENT - OVERWRITE_IF_EXISTS_OR_ADD - OVERWRITE_IF_EXISTS keep_empty_value: type: boolean additionalProperties: false status_on_error: type: object properties: code: type: string enum: - Empty - Continue - OK - Created - Accepted - NonAuthoritativeInformation - NoContent - ResetContent - PartialContent - MultiStatus - AlradyReported - IMUsed - MultipleChoices - MovedPermanently - Found - SeeOther - NotModified - UseProxy - TemporaryRedirect - PermanentRedirect - BadRequest - Unauthroized - PaymentRequired - Forbidden - NotFound - MethodNotAllowed - NotAcceptable - ProxyAuthenticationRequired - RequestTimeout - Conflict - Gone - LengthRequired - PreconditionFailed - PayloadTooLarge - URITooLong - UnsupportedMediaType - RangeNotSatisfiable - ExpectationFailed - MisdirectedRequest - UnprocessableEntity - Locked - FailedDependency - UpgradeRequired - PreconditionRequired - TooManyRequests - RequestHeaderFieldsTooLarge - InternalServerError - NotImplemented - BadGateway - ServiceUnavailable - GatewayTimeout - HTTPVersionNotSupported - VariantAlsoNegotiates - InsufficientStorage - LoopDetected - NotExtended - NetworkAuthenticationRequired additionalProperties: false stat_prefix: type: string '@type': type: string enum: - >- type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit additionalProperties: false additionalProperties: false network: type: array items: type: object volumes: type: array items: type: object properties: uri: type: string recoveryPolicy: type: string enum: - retain - recycle default: retain description: >- Only applicable to persistent volumes, this determines what Control Plane will do when creating a new workload replica if a corresponding volume exists. path: type: string description: >- Mount path inside the container. Required for non-vm workloads; rejected for type=vm. name: type: string maxLength: 63 description: >- VM disk name. Required for type=vm; rejected for other workload types. bus: type: string enum: - virtio - sata - scsi description: >- VM disk bus. Only valid for type=vm. A cpln://secret/ volume on a sata or scsi bus is presented to the guest as a read-only CD-ROM. bootOrder: type: integer description: VM disk boot order. Only valid for type=vm. additionalProperties: false additionalProperties: false description: Envoy proxy filters additionalProperties: false description: Sidecar container configuration supportDynamicTags: type: boolean description: >- If this is enabled, Control Plane will automatically redeploy your workload when one of the container images is updated in the container registry. rolloutOptions: type: object properties: minReadySeconds: type: integer description: >- The minimum number of seconds a container must run without crashing to be considered available maxUnavailableReplicas: type: string maxLength: 5 description: >- Maximum number or percentage of replicas that can be unavailable during a rollout maxSurgeReplicas: type: string maxLength: 5 description: >- Maximum number or percentage of replicas that can be created above the desired count during a rollout scalingPolicy: type: string enum: - OrderedReady - Parallel default: OrderedReady description: >- Determines whether replicas are scaled in order (OrderedReady) or in parallel (Parallel) terminationGracePeriodSeconds: type: number description: >- The amount of time in seconds a workload has to gracefully terminate before forcefully terminating it. This includes the time it takes for the preStop hook to run. additionalProperties: false description: Configuration for how workload updates are rolled out securityOptions: type: object properties: filesystemGroupId: type: integer description: The group id assigned to any mounted volume runAsUser: type: integer description: The user id assigned to all container processes additionalProperties: false description: Security context for the workload loadBalancer: type: object properties: direct: type: object properties: enabled: type: boolean description: when disabled, this load balancer will be stopped ports: type: array items: type: object properties: externalPort: type: number description: The port that is available publicly protocol: type: string enum: - TCP - UDP description: The protocol that is exposed publicly scheme: type: string enum: - http - tcp - https - ws - wss description: >- overrides the default `https` url scheme that will be used for links in the UI and status containerPort: type: integer description: >- The port on the container tha will receive this traffic additionalProperties: false description: list of ports that will be exposed by this load balancer ipSet: type: string description: IP set to use for dedicated IPs additionalProperties: false description: >- direct load balancers are created in each location that a workload is running in and are configured for the standard endpoints of the workload. Customers are responsible for configuring the workload with certificates if TLS is required geoLocation: type: object properties: enabled: type: boolean description: >- When enabled, geo location headers will be included on inbound http requests. Existing headers will be replaced. headers: type: object properties: asn: type: string maxLength: 128 description: The geo asn header city: type: string maxLength: 128 description: The geo city header country: type: string maxLength: 128 description: The geo country header region: type: string maxLength: 128 description: The geo region header additionalProperties: false description: Custom header names for geo location data additionalProperties: false description: Geo location header configuration replicaDirect: type: boolean description: >- When enabled, individual replicas of the workload can be reached directly using the subdomain prefix replica-. For example, replica-0.my-workload.my-gvc.cpln.local or replica-0.my-workload-.cpln.app Can only be used with stateful workloads. additionalProperties: false description: Load balancer configuration extras: type: object properties: affinity: type: object description: Kubernetes pod affinity and anti-affinity rules tolerations: type: array items: type: object description: Kubernetes pod tolerations for node taints topologySpreadConstraints: type: array items: type: object description: Kubernetes topology spread constraints for pod distribution additionalProperties: false description: Additional Kubernetes customizations for BYOK requestRetryPolicy: type: object properties: attempts: type: integer description: Maximum number of retry attempts for failed requests retryOn: type: array items: type: string maxLength: 32 description: >- List of conditions that trigger request retries (e.g., 5xx, gateway-error, connect-failure, unavailable) additionalProperties: false description: Policy for retrying failed requests vm: type: object properties: bootDisk: type: object properties: source: type: object properties: oci: type: object properties: image: type: string description: >- Full image reference of a containerDisk (e.g., quay.io/containerdisks/ubuntu:22.04 or /org//image/:) additionalProperties: false description: >- Boot from an OCI containerDisk image. Default when no boot source is set; otherwise overrides containers[0].image. http: type: object properties: url: type: string checksum: type: string maxLength: 160 description: >- Disk image checksum, formatted as "sha256:" or "sha512:" additionalProperties: false description: >- Boot disk image fetched over HTTP/HTTPS. Requires persist.volumeSet. additionalProperties: false description: Exactly one source must be specified. persist: type: object properties: volumeSet: type: string description: >- VolumeSet URI used to provision one PVC per replica for the boot disk. Format: cpln://volumeset/. additionalProperties: false description: >- Per-replica boot PVC populated via CDI. Required for any non-OCI source. bus: type: string enum: - virtio - sata - scsi default: virtio bootOrder: type: integer additionalProperties: false description: >- Boot disk configuration. When source is omitted, containers[0].image is used as an OCI containerDisk. cpu: type: object properties: sockets: type: integer description: >- CPU sockets visible to the guest. Cores are derived from containers[0].cpu. threads: type: integer description: CPU threads per core visible to the guest. additionalProperties: false firmware: type: object properties: bootloader: type: string enum: - bios - efi default: efi secureBoot: type: boolean description: >- Enable UEFI Secure Boot. Not yet supported: pending persistent EFI NVRAM, without which the guest is unbootable after a reboot. uuid: type: string description: >- Fixed SMBIOS UUID for the VM. KubeVirt generates one when omitted. serial: type: string maxLength: 64 description: SMBIOS system serial number reported to the guest. smbios: type: object properties: manufacturer: type: string maxLength: 64 product: type: string maxLength: 64 version: type: string maxLength: 64 sku: type: string maxLength: 64 family: type: string maxLength: 64 additionalProperties: false additionalProperties: false guestOS: type: string enum: - linux - windows default: linux description: >- Guest operating system family. Drives per-OS cloud-init payload (file paths, init system, env/hosts injection, SSH CA bootstrap). networks: type: array items: type: object properties: name: type: string maxLength: 15 default: default additionalProperties: false description: >- Pod-network interfaces for the VM. v1 supports a single network; multi-network arrives with per-interface port routing. cloudInit: type: object properties: userData: type: string maxLength: 16384 description: >- Inline cloud-init user-data. Not encrypted at rest in the data-service — use userDataSecret for sensitive payloads. userDataBase64: type: string maxLength: 22000 description: >- Inline cloud-init user-data, base64-encoded. Same caveats as userData. userDataSecret: type: string description: >- Secret containing cloud-init user-data (key: userdata or user-data). sshPublicKeySecrets: type: array items: type: string description: >- SSH public keys injected via cloud-init. Each Secret may carry one or more keys. additionalProperties: false accessCredentials: type: array items: type: object properties: sshPublicKeySecret: type: string users: type: array items: type: string maxLength: 32 deliveryMethod: type: string enum: - qemuGuestAgent - configDrive default: qemuGuestAgent additionalProperties: false runStrategy: type: string enum: - Always - RerunOnFailure - Manual - Halted default: Always description: >- KubeVirt RunStrategy. Use Halted to keep the pool defined but powered off. clock: type: object properties: timezone: type: string maxLength: 64 default: UTC additionalProperties: false hostname: type: string maxLength: 63 subdomain: type: string maxLength: 63 additionalProperties: false description: >- VM-only configuration. Required when type=vm; rejected otherwise. additionalProperties: false description: Workload specification status: type: object properties: parentId: type: string description: UUID of the parent GVC canonicalEndpoint: type: string description: Canonical endpoint URL for the workload endpoint: type: string description: Primary endpoint URL for the workload internalName: type: string description: Internal DNS name for the workload replicaInternalNames: type: array items: type: string description: Internal DNS names for individual replicas healthCheck: type: object properties: active: type: boolean description: Whether the health check is currently active success: type: boolean description: Whether the most recent health check succeeded code: type: integer description: HTTP status code from the most recent health check message: type: string description: Status message from the most recent health check failures: type: integer description: Number of consecutive failed health checks successes: type: integer description: Number of consecutive successful health checks lastChecked: type: string format: date-time description: Timestamp of the most recent health check additionalProperties: false description: Current health check status currentReplicaCount: type: number description: Current number of running replicas resolvedImages: type: object properties: resolvedForVersion: type: integer description: Workload version for which images were resolved resolvedAt: type: string format: date-time description: Timestamp when images were last resolved errorMessages: type: array items: type: string description: Error messages from image resolution failures nextRetryAt: type: string format: date-time description: Timestamp when image resolution will be retried images: type: array items: type: object properties: digest: type: string description: Image digest SHA manifests: type: array items: type: object properties: image: type: string description: Full image name with tag mediaType: type: string description: Media type of the image manifest digest: type: string description: Digest SHA of the image manifest platform: type: object description: Platform information (os, architecture, etc.) additionalProperties: false description: List of image manifests for multi-architecture images additionalProperties: false description: List of resolved container images additionalProperties: false description: Information about resolved container images loadBalancer: type: array items: type: object properties: origin: type: string description: Origin location of the load balancer url: type: string description: URL of the load balancer endpoint additionalProperties: false description: Load balancer status information suspendedStatus: type: string additionalProperties: false description: Runtime status of the workload (read-only) readOnly: true additionalProperties: false error: type: object properties: status: type: integer message: type: string code: type: string details: type: object id: type: string additionalProperties: false link: type: object properties: rel: type: string href: type: string additionalProperties: false securitySchemes: serviceAccountKey: type: apiKey in: header name: Authorization description: Service account key can be used as API keys jwt: type: http scheme: bearer bearerFormat: JWT description: IDP-provided token ````