apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.3.0
  name: installations.operator.tigera.io
spec:
  group: operator.tigera.io
  names:
    kind: Installation
    listKind: InstallationList
    plural: installations
    singular: installation
  scope: Cluster
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: Installation configures an installation of Calico or Calico Enterprise.
          At most one instance of this resource is supported. It must be named "default".
          The Installation API installs core networking and network policy components,
          and provides general install-time configuration.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: Specification of the desired state for the Calico or Calico
              Enterprise installation.
            properties:
              calicoNetwork:
                description: CalicoNetwork specifies networking configuration options
                  for Calico.
                properties:
                  bgp:
                    description: BGP configures whether or not to enable Calico's
                      BGP capabilities.
                    enum:
                    - Enabled
                    - Disabled
                    type: string
                  containerIPForwarding:
                    description: 'ContainerIPForwarding configures whether ip forwarding
                      will be enabled for containers in the CNI configuration. Default:
                      Disabled'
                    enum:
                    - Enabled
                    - Disabled
                    type: string
                  hostPorts:
                    description: 'HostPorts configures whether or not Calico will
                      support Kubernetes HostPorts. Valid only when using the Calico
                      CNI plugin. Default: Enabled'
                    enum:
                    - Enabled
                    - Disabled
                    type: string
                  ipPools:
                    description: IPPools contains a list of IP pools to create if
                      none exist. At most one IP pool of each address family may be
                      specified. If omitted, a single pool will be configured if needed.
                    items:
                      properties:
                        blockSize:
                          description: 'BlockSize specifies the CIDR prefex length
                            to use when allocating per-node IP blocks from the main
                            IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)'
                          format: int32
                          type: integer
                        cidr:
                          description: CIDR contains the address range for the IP
                            Pool in classless inter-domain routing format.
                          type: string
                        encapsulation:
                          description: 'Encapsulation specifies the encapsulation
                            type that will be used with the IP Pool. Default: IPIP'
                          enum:
                          - IPIPCrossSubnet
                          - IPIP
                          - VXLAN
                          - VXLANCrossSubnet
                          - None
                          type: string
                        natOutgoing:
                          description: 'NATOutgoing specifies if NAT will be enabled
                            or disabled for outgoing traffic. Default: Enabled'
                          enum:
                          - Enabled
                          - Disabled
                          type: string
                        nodeSelector:
                          description: 'NodeSelector specifies the node selector that
                            will be set for the IP Pool. Default: ''all()'''
                          type: string
                      required:
                      - cidr
                      type: object
                    type: array
                  linuxDataplane:
                    description: 'LinuxDataplane is used to select the dataplane used
                      for Linux nodes. In particular, it causes the operator to add
                      required mounts and environment variables for the particular
                      dataplane. If not specified, iptables mode is used. Default:
                      Iptables'
                    enum:
                    - Iptables
                    - BPF
                    type: string
                  mtu:
                    description: MTU specifies the maximum transmission unit to use
                      on the pod network. If not specified, Calico will perform MTU
                      auto-detection based on the cluster network.
                    format: int32
                    type: integer
                  multiInterfaceMode:
                    description: 'MultiInterfaceMode configures what will configure
                      multiple interface per pod. Only valid for Calico Enterprise
                      installations using the Calico CNI plugin. Default: None'
                    enum:
                    - None
                    - Multus
                    type: string
                  nodeAddressAutodetectionV4:
                    description: NodeAddressAutodetectionV4 specifies an approach
                      to automatically detect node IPv4 addresses. If not specified,
                      will use default auto-detection settings to acquire an IPv4
                      address for each node.
                    properties:
                      canReach:
                        description: CanReach enables IP auto-detection based on which
                          source address on the node is used to reach the specified
                          IP or domain.
                        type: string
                      cidrs:
                        description: CIDRS enables IP auto-detection based on which
                          addresses on the nodes are within one of the provided CIDRs.
                        items:
                          type: string
                        type: array
                      firstFound:
                        description: FirstFound uses default interface matching parameters
                          to select an interface, performing best-effort filtering
                          based on well-known interface names.
                        type: boolean
                      interface:
                        description: Interface enables IP auto-detection based on
                          interfaces that match the given regex.
                        type: string
                      skipInterface:
                        description: SkipInterface enables IP auto-detection based
                          on interfaces that do not match the given regex.
                        type: string
                    type: object
                  nodeAddressAutodetectionV6:
                    description: NodeAddressAutodetectionV6 specifies an approach
                      to automatically detect node IPv6 addresses. If not specified,
                      IPv6 addresses will not be auto-detected.
                    properties:
                      canReach:
                        description: CanReach enables IP auto-detection based on which
                          source address on the node is used to reach the specified
                          IP or domain.
                        type: string
                      cidrs:
                        description: CIDRS enables IP auto-detection based on which
                          addresses on the nodes are within one of the provided CIDRs.
                        items:
                          type: string
                        type: array
                      firstFound:
                        description: FirstFound uses default interface matching parameters
                          to select an interface, performing best-effort filtering
                          based on well-known interface names.
                        type: boolean
                      interface:
                        description: Interface enables IP auto-detection based on
                          interfaces that match the given regex.
                        type: string
                      skipInterface:
                        description: SkipInterface enables IP auto-detection based
                          on interfaces that do not match the given regex.
                        type: string
                    type: object
                type: object
              certificateManagement:
                description: CertificateManagement configures pods to submit a CertificateSigningRequest
                  to the certificates.k8s.io/v1beta1 API in order to obtain TLS certificates.
                  This feature requires that you bring your own CSR signing and approval
                  process, otherwise pods will be stuck during initialization.
                properties:
                  caCert:
                    description: Certificate of the authority that signs the CertificateSigningRequests
                      in PEM format.
                    format: byte
                    type: string
                  keyAlgorithm:
                    description: 'Specify the algorithm used by pods to generate a
                      key pair that is associated with the X.509 certificate request.
                      Default: RSAWithSize2048'
                    enum:
                    - ""
                    - RSAWithSize2048
                    - RSAWithSize4096
                    - RSAWithSize8192
                    - ECDSAWithCurve256
                    - ECDSAWithCurve384
                    - ECDSAWithCurve521
                    type: string
                  signatureAlgorithm:
                    description: 'Specify the algorithm used for the signature of
                      the X.509 certificate request. Default: SHA256WithRSA'
                    enum:
                    - ""
                    - SHA256WithRSA
                    - SHA384WithRSA
                    - SHA512WithRSA
                    - ECDSAWithSHA256
                    - ECDSAWithSHA384
                    - ECDSAWithSHA512
                    type: string
                  signerName:
                    description: 'When a CSR is issued to the certificates.k8s.io
                      API, the signerName is added to the request in order to accommodate
                      for clusters with multiple signers. Must be formatted as: `<my-domain>/<my-signername>`.'
                    type: string
                required:
                - caCert
                - signerName
                type: object
              cni:
                description: CNI specifies the CNI that will be used by this installation.
                properties:
                  ipam:
                    description: IPAM specifies the pod IP address management that
                      will be used in the Calico or Calico Enterprise installation.
                    properties:
                      type:
                        description: "Specifies the IPAM plugin that will be used
                          in the Calico or Calico Enterprise installation. * For CNI
                          Plugin Calico, this field defaults to Calico. * For CNI
                          Plugin GKE, this field defaults to HostLocal. * For CNI
                          Plugin AzureVNET, this field defaults to AzureVNET. * For
                          CNI Plugin AmazonVPC, this field defaults to AmazonVPC.
                          \n The IPAM plugin is installed and configured only if the
                          CNI plugin is set to Calico, for all other values of the
                          CNI plugin the plugin binaries and CNI config is a dependency
                          that is expected to be installed separately. \n Default:
                          Calico"
                        enum:
                        - Calico
                        - HostLocal
                        - AmazonVPC
                        - AzureVNET
                        type: string
                    required:
                    - type
                    type: object
                  type:
                    description: "Specifies the CNI plugin that will be used in the
                      Calico or Calico Enterprise installation. * For KubernetesProvider
                      GKE, this field defaults to GKE. * For KubernetesProvider AKS,
                      this field defaults to AzureVNET. * For KubernetesProvider EKS,
                      this field defaults to AmazonVPC. * If aws-node daemonset exists
                      in kube-system when the Installation resource is created, this
                      field defaults to AmazonVPC. * For all other cases this field
                      defaults to Calico. \n For the value Calico, the CNI plugin
                      binaries and CNI config will be installed as part of deployment,
                      for all other values the CNI plugin binaries and CNI config
                      is a dependency that is expected to be installed separately.
                      \n Default: Calico"
                    enum:
                    - Calico
                    - GKE
                    - AmazonVPC
                    - AzureVNET
                    type: string
                required:
                - type
                type: object
              componentResources:
                description: ComponentResources can be used to customize the resource
                  requirements for each component. Node, Typha, and KubeControllers
                  are supported for installations.
                items:
                  description: The ComponentResource struct associates a ResourceRequirements
                    with a component by name
                  properties:
                    componentName:
                      description: ComponentName is an enum which identifies the component
                      enum:
                      - Node
                      - Typha
                      - KubeControllers
                      type: string
                    resourceRequirements:
                      description: ResourceRequirements allows customization of limits
                        and requests for compute resources such as cpu and memory.
                      properties:
                        limits:
                          additionalProperties:
                            anyOf:
                            - type: integer
                            - type: string
                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                            x-kubernetes-int-or-string: true
                          description: 'Limits describes the maximum amount of compute
                            resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/'
                          type: object
                        requests:
                          additionalProperties:
                            anyOf:
                            - type: integer
                            - type: string
                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                            x-kubernetes-int-or-string: true
                          description: 'Requests describes the minimum amount of compute
                            resources required. If Requests is omitted for a container,
                            it defaults to Limits if that is explicitly specified,
                            otherwise to an implementation-defined value. More info:
                            https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/'
                          type: object
                      type: object
                  required:
                  - componentName
                  - resourceRequirements
                  type: object
                type: array
              controlPlaneNodeSelector:
                additionalProperties:
                  type: string
                description: ControlPlaneNodeSelector is used to select control plane
                  nodes on which to run Calico components. This is globally applied
                  to all resources created by the operator excluding daemonsets.
                type: object
              controlPlaneReplicas:
                description: ControlPlaneReplicas defines how many replicas of the
                  control plane core components will be deployed. This field applies
                  to all control plane components that support High Availability.
                  Defaults to 2.
                format: int32
                type: integer
              controlPlaneTolerations:
                description: ControlPlaneTolerations specify tolerations which are
                  then globally applied to all resources created by the operator.
                items:
                  description: The pod this Toleration is attached to tolerates any
                    taint that matches the triple <key,value,effect> using the matching
                    operator <operator>.
                  properties:
                    effect:
                      description: Effect indicates the taint effect to match. Empty
                        means match all taint effects. When specified, allowed values
                        are NoSchedule, PreferNoSchedule and NoExecute.
                      type: string
                    key:
                      description: Key is the taint key that the toleration applies
                        to. Empty means match all taint keys. If the key is empty,
                        operator must be Exists; this combination means to match all
                        values and all keys.
                      type: string
                    operator:
                      description: Operator represents a key's relationship to the
                        value. Valid operators are Exists and Equal. Defaults to Equal.
                        Exists is equivalent to wildcard for value, so that a pod
                        can tolerate all taints of a particular category.
                      type: string
                    tolerationSeconds:
                      description: TolerationSeconds represents the period of time
                        the toleration (which must be of effect NoExecute, otherwise
                        this field is ignored) tolerates the taint. By default, it
                        is not set, which means tolerate the taint forever (do not
                        evict). Zero and negative values will be treated as 0 (evict
                        immediately) by the system.
                      format: int64
                      type: integer
                    value:
                      description: Value is the taint value the toleration matches
                        to. If the operator is Exists, the value should be empty,
                        otherwise just a regular string.
                      type: string
                  type: object
                type: array
              flexVolumePath:
                description: FlexVolumePath optionally specifies a custom path for
                  FlexVolume. If not specified, FlexVolume will be enabled by default.
                  If set to 'None', FlexVolume will be disabled. The default is based
                  on the kubernetesProvider.
                type: string
              imagePath:
                description: "ImagePath allows for the path part of an image to be
                  specified. If specified then the specified value will be used as
                  the image path for each image. If not specified or empty, the default
                  for each image will be used. A special case value, UseDefault, is
                  supported to explicitly specify the default image path will be used
                  for each image. \n Image format:    `<registry>/<imagePath>/<imagePrefix><imageName>:<image-tag>`
                  \n This option allows configuring the `<imagePath>` portion of the
                  above format."
                type: string
              imagePrefix:
                description: "ImagePrefix allows for the prefix part of an image to
                  be specified. If specified then the given value will be used as
                  a prefix on each image. If not specified or empty, no prefix will
                  be used. A special case value, UseDefault, is supported to explicitly
                  specify the default image prefix will be used for each image. \n
                  Image format:    `<registry>/<imagePath>/<imagePrefix><imageName>:<image-tag>`
                  \n This option allows configuring the `<imagePrefix>` portion of
                  the above format."
                type: string
              imagePullSecrets:
                description: ImagePullSecrets is an array of references to container
                  registry pull secrets to use. These are applied to all images to
                  be pulled.
                items:
                  description: LocalObjectReference contains enough information to
                    let you locate the referenced object inside the same namespace.
                  properties:
                    name:
                      description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                        TODO: Add other useful fields. apiVersion, kind, uid?'
                      type: string
                  type: object
                type: array
              kubernetesProvider:
                description: KubernetesProvider specifies a particular provider of
                  the Kubernetes platform and enables provider-specific configuration.
                  If the specified value is empty, the Operator will attempt to automatically
                  determine the current provider. If the specified value is not empty,
                  the Operator will still attempt auto-detection, but will additionally
                  compare the auto-detected value to the specified value to confirm
                  they match.
                enum:
                - ""
                - EKS
                - GKE
                - AKS
                - OpenShift
                - DockerEnterprise
                type: string
              nodeMetricsPort:
                description: NodeMetricsPort specifies which port calico/node serves
                  prometheus metrics on. By default, metrics are not enabled. If specified,
                  this overrides any FelixConfiguration resources which may exist.
                  If omitted, then prometheus metrics may still be configured through
                  FelixConfiguration.
                format: int32
                type: integer
              nodeUpdateStrategy:
                description: NodeUpdateStrategy can be used to customize the desired
                  update strategy, such as the MaxUnavailable field.
                properties:
                  rollingUpdate:
                    description: 'Rolling update config params. Present only if type
                      = "RollingUpdate". --- TODO: Update this to follow our convention
                      for oneOf, whatever we decide it to be. Same as Deployment `strategy.rollingUpdate`.
                      See https://github.com/kubernetes/kubernetes/issues/35345'
                    properties:
                      maxUnavailable:
                        anyOf:
                        - type: integer
                        - type: string
                        description: 'The maximum number of DaemonSet pods that can
                          be unavailable during the update. Value can be an absolute
                          number (ex: 5) or a percentage of total number of DaemonSet
                          pods at the start of the update (ex: 10%). Absolute number
                          is calculated from percentage by rounding up. This cannot
                          be 0. Default value is 1. Example: when this is set to 30%,
                          at most 30% of the total number of nodes that should be
                          running the daemon pod (i.e. status.desiredNumberScheduled)
                          can have their pods stopped for an update at any given time.
                          The update starts by stopping at most 30% of those DaemonSet
                          pods and then brings up new DaemonSet pods in their place.
                          Once the new pods are available, it then proceeds onto other
                          DaemonSet pods, thus ensuring that at least 70% of original
                          number of DaemonSet pods are available at all times during
                          the update.'
                        x-kubernetes-int-or-string: true
                    type: object
                  type:
                    description: Type of daemon set update. Can be "RollingUpdate"
                      or "OnDelete". Default is RollingUpdate.
                    type: string
                type: object
              nonPrivileged:
                description: NonPrivileged configures Calico to be run in non-privileged
                  containers as non-root users where possible.
                type: string
              registry:
                description: "Registry is the default Docker registry used for component
                  Docker images. If specified, all images will be pulled from this
                  registry. If not specified then the default registries will be used.
                  A special case value, UseDefault, is supported to explicitly specify
                  the default registries will be used. \n Image format:    `<registry>/<imagePath>/<imagePrefix><imageName>:<image-tag>`
                  \n This option allows configuring the `<registry>` portion of the
                  above format."
                type: string
              typhaAffinity:
                description: TyphaAffinity allows configuration of node affinity characteristics
                  for Typha pods.
                properties:
                  nodeAffinity:
                    description: NodeAffinity describes node affinity scheduling rules
                      for typha.
                    properties:
                      preferredDuringSchedulingIgnoredDuringExecution:
                        description: The scheduler will prefer to schedule pods to
                          nodes that satisfy the affinity expressions specified by
                          this field, but it may choose a node that violates one or
                          more of the expressions.
                        items:
                          description: An empty preferred scheduling term matches
                            all objects with implicit weight 0 (i.e. it's a no-op).
                            A null preferred scheduling term matches no objects (i.e.
                            is also a no-op).
                          properties:
                            preference:
                              description: A node selector term, associated with the
                                corresponding weight.
                              properties:
                                matchExpressions:
                                  description: A list of node selector requirements
                                    by node's labels.
                                  items:
                                    description: A node selector requirement is a
                                      selector that contains values, a key, and an
                                      operator that relates the key and values.
                                    properties:
                                      key:
                                        description: The label key that the selector
                                          applies to.
                                        type: string
                                      operator:
                                        description: Represents a key's relationship
                                          to a set of values. Valid operators are
                                          In, NotIn, Exists, DoesNotExist. Gt, and
                                          Lt.
                                        type: string
                                      values:
                                        description: An array of string values. If
                                          the operator is In or NotIn, the values
                                          array must be non-empty. If the operator
                                          is Exists or DoesNotExist, the values array
                                          must be empty. If the operator is Gt or
                                          Lt, the values array must have a single
                                          element, which will be interpreted as an
                                          integer. This array is replaced during a
                                          strategic merge patch.
                                        items:
                                          type: string
                                        type: array
                                    required:
                                    - key
                                    - operator
                                    type: object
                                  type: array
                                matchFields:
                                  description: A list of node selector requirements
                                    by node's fields.
                                  items:
                                    description: A node selector requirement is a
                                      selector that contains values, a key, and an
                                      operator that relates the key and values.
                                    properties:
                                      key:
                                        description: The label key that the selector
                                          applies to.
                                        type: string
                                      operator:
                                        description: Represents a key's relationship
                                          to a set of values. Valid operators are
                                          In, NotIn, Exists, DoesNotExist. Gt, and
                                          Lt.
                                        type: string
                                      values:
                                        description: An array of string values. If
                                          the operator is In or NotIn, the values
                                          array must be non-empty. If the operator
                                          is Exists or DoesNotExist, the values array
                                          must be empty. If the operator is Gt or
                                          Lt, the values array must have a single
                                          element, which will be interpreted as an
                                          integer. This array is replaced during a
                                          strategic merge patch.
                                        items:
                                          type: string
                                        type: array
                                    required:
                                    - key
                                    - operator
                                    type: object
                                  type: array
                              type: object
                            weight:
                              description: Weight associated with matching the corresponding
                                nodeSelectorTerm, in the range 1-100.
                              format: int32
                              type: integer
                          required:
                          - preference
                          - weight
                          type: object
                        type: array
                      requiredDuringSchedulingIgnoredDuringExecution:
                        description: 'WARNING: Please note that if the affinity requirements
                          specified by this field are not met at scheduling time,
                          the pod will NOT be scheduled onto the node. There is no
                          fallback to another affinity rules with this setting. This
                          may cause networking disruption or even catastrophic failure!
                          PreferredDuringSchedulingIgnoredDuringExecution should be
                          used for affinity unless there is a specific well understood
                          reason to use RequiredDuringSchedulingIgnoredDuringExecution
                          and you can guarantee that the RequiredDuringSchedulingIgnoredDuringExecution
                          will always have sufficient nodes to satisfy the requirement.
                          NOTE: RequiredDuringSchedulingIgnoredDuringExecution is
                          set by default for AKS nodes, to avoid scheduling Typhas
                          on virtual-nodes. If the affinity requirements specified
                          by this field cease to be met at some point during pod execution
                          (e.g. due to an update), the system may or may not try to
                          eventually evict the pod from its node.'
                        properties:
                          nodeSelectorTerms:
                            description: Required. A list of node selector terms.
                              The terms are ORed.
                            items:
                              description: A null or empty node selector term matches
                                no objects. The requirements of them are ANDed. The
                                TopologySelectorTerm type implements a subset of the
                                NodeSelectorTerm.
                              properties:
                                matchExpressions:
                                  description: A list of node selector requirements
                                    by node's labels.
                                  items:
                                    description: A node selector requirement is a
                                      selector that contains values, a key, and an
                                      operator that relates the key and values.
                                    properties:
                                      key:
                                        description: The label key that the selector
                                          applies to.
                                        type: string
                                      operator:
                                        description: Represents a key's relationship
                                          to a set of values. Valid operators are
                                          In, NotIn, Exists, DoesNotExist. Gt, and
                                          Lt.
                                        type: string
                                      values:
                                        description: An array of string values. If
                                          the operator is In or NotIn, the values
                                          array must be non-empty. If the operator
                                          is Exists or DoesNotExist, the values array
                                          must be empty. If the operator is Gt or
                                          Lt, the values array must have a single
                                          element, which will be interpreted as an
                                          integer. This array is replaced during a
                                          strategic merge patch.
                                        items:
                                          type: string
                                        type: array
                                    required:
                                    - key
                                    - operator
                                    type: object
                                  type: array
                                matchFields:
                                  description: A list of node selector requirements
                                    by node's fields.
                                  items:
                                    description: A node selector requirement is a
                                      selector that contains values, a key, and an
                                      operator that relates the key and values.
                                    properties:
                                      key:
                                        description: The label key that the selector
                                          applies to.
                                        type: string
                                      operator:
                                        description: Represents a key's relationship
                                          to a set of values. Valid operators are
                                          In, NotIn, Exists, DoesNotExist. Gt, and
                                          Lt.
                                        type: string
                                      values:
                                        description: An array of string values. If
                                          the operator is In or NotIn, the values
                                          array must be non-empty. If the operator
                                          is Exists or DoesNotExist, the values array
                                          must be empty. If the operator is Gt or
                                          Lt, the values array must have a single
                                          element, which will be interpreted as an
                                          integer. This array is replaced during a
                                          strategic merge patch.
                                        items:
                                          type: string
                                        type: array
                                    required:
                                    - key
                                    - operator
                                    type: object
                                  type: array
                              type: object
                            type: array
                        required:
                        - nodeSelectorTerms
                        type: object
                    type: object
                type: object
              typhaMetricsPort:
                description: TyphaMetricsPort specifies which port calico/typha serves
                  prometheus metrics on. By default, metrics are not enabled.
                format: int32
                type: integer
              variant:
                description: 'Variant is the product to install - one of Calico or
                  TigeraSecureEnterprise Default: Calico'
                enum:
                - Calico
                - TigeraSecureEnterprise
                type: string
            type: object
          status:
            description: Most recently observed state for the Calico or Calico Enterprise
              installation.
            properties:
              computed:
                description: Computed is the final installation including overlaid
                  resources.
                properties:
                  calicoNetwork:
                    description: CalicoNetwork specifies networking configuration
                      options for Calico.
                    properties:
                      bgp:
                        description: BGP configures whether or not to enable Calico's
                          BGP capabilities.
                        enum:
                        - Enabled
                        - Disabled
                        type: string
                      containerIPForwarding:
                        description: 'ContainerIPForwarding configures whether ip
                          forwarding will be enabled for containers in the CNI configuration.
                          Default: Disabled'
                        enum:
                        - Enabled
                        - Disabled
                        type: string
                      hostPorts:
                        description: 'HostPorts configures whether or not Calico will
                          support Kubernetes HostPorts. Valid only when using the
                          Calico CNI plugin. Default: Enabled'
                        enum:
                        - Enabled
                        - Disabled
                        type: string
                      ipPools:
                        description: IPPools contains a list of IP pools to create
                          if none exist. At most one IP pool of each address family
                          may be specified. If omitted, a single pool will be configured
                          if needed.
                        items:
                          properties:
                            blockSize:
                              description: 'BlockSize specifies the CIDR prefex length
                                to use when allocating per-node IP blocks from the
                                main IP pool CIDR. Default: 26 (IPv4), 122 (IPv6)'
                              format: int32
                              type: integer
                            cidr:
                              description: CIDR contains the address range for the
                                IP Pool in classless inter-domain routing format.
                              type: string
                            encapsulation:
                              description: 'Encapsulation specifies the encapsulation
                                type that will be used with the IP Pool. Default:
                                IPIP'
                              enum:
                              - IPIPCrossSubnet
                              - IPIP
                              - VXLAN
                              - VXLANCrossSubnet
                              - None
                              type: string
                            natOutgoing:
                              description: 'NATOutgoing specifies if NAT will be enabled
                                or disabled for outgoing traffic. Default: Enabled'
                              enum:
                              - Enabled
                              - Disabled
                              type: string
                            nodeSelector:
                              description: 'NodeSelector specifies the node selector
                                that will be set for the IP Pool. Default: ''all()'''
                              type: string
                          required:
                          - cidr
                          type: object
                        type: array
                      linuxDataplane:
                        description: 'LinuxDataplane is used to select the dataplane
                          used for Linux nodes. In particular, it causes the operator
                          to add required mounts and environment variables for the
                          particular dataplane. If not specified, iptables mode is
                          used. Default: Iptables'
                        enum:
                        - Iptables
                        - BPF
                        type: string
                      mtu:
                        description: MTU specifies the maximum transmission unit to
                          use on the pod network. If not specified, Calico will perform
                          MTU auto-detection based on the cluster network.
                        format: int32
                        type: integer
                      multiInterfaceMode:
                        description: 'MultiInterfaceMode configures what will configure
                          multiple interface per pod. Only valid for Calico Enterprise
                          installations using the Calico CNI plugin. Default: None'
                        enum:
                        - None
                        - Multus
                        type: string
                      nodeAddressAutodetectionV4:
                        description: NodeAddressAutodetectionV4 specifies an approach
                          to automatically detect node IPv4 addresses. If not specified,
                          will use default auto-detection settings to acquire an IPv4
                          address for each node.
                        properties:
                          canReach:
                            description: CanReach enables IP auto-detection based
                              on which source address on the node is used to reach
                              the specified IP or domain.
                            type: string
                          cidrs:
                            description: CIDRS enables IP auto-detection based on
                              which addresses on the nodes are within one of the provided
                              CIDRs.
                            items:
                              type: string
                            type: array
                          firstFound:
                            description: FirstFound uses default interface matching
                              parameters to select an interface, performing best-effort
                              filtering based on well-known interface names.
                            type: boolean
                          interface:
                            description: Interface enables IP auto-detection based
                              on interfaces that match the given regex.
                            type: string
                          skipInterface:
                            description: SkipInterface enables IP auto-detection based
                              on interfaces that do not match the given regex.
                            type: string
                        type: object
                      nodeAddressAutodetectionV6:
                        description: NodeAddressAutodetectionV6 specifies an approach
                          to automatically detect node IPv6 addresses. If not specified,
                          IPv6 addresses will not be auto-detected.
                        properties:
                          canReach:
                            description: CanReach enables IP auto-detection based
                              on which source address on the node is used to reach
                              the specified IP or domain.
                            type: string
                          cidrs:
                            description: CIDRS enables IP auto-detection based on
                              which addresses on the nodes are within one of the provided
                              CIDRs.
                            items:
                              type: string
                            type: array
                          firstFound:
                            description: FirstFound uses default interface matching
                              parameters to select an interface, performing best-effort
                              filtering based on well-known interface names.
                            type: boolean
                          interface:
                            description: Interface enables IP auto-detection based
                              on interfaces that match the given regex.
                            type: string
                          skipInterface:
                            description: SkipInterface enables IP auto-detection based
                              on interfaces that do not match the given regex.
                            type: string
                        type: object
                    type: object
                  certificateManagement:
                    description: CertificateManagement configures pods to submit a
                      CertificateSigningRequest to the certificates.k8s.io/v1beta1
                      API in order to obtain TLS certificates. This feature requires
                      that you bring your own CSR signing and approval process, otherwise
                      pods will be stuck during initialization.
                    properties:
                      caCert:
                        description: Certificate of the authority that signs the CertificateSigningRequests
                          in PEM format.
                        format: byte
                        type: string
                      keyAlgorithm:
                        description: 'Specify the algorithm used by pods to generate
                          a key pair that is associated with the X.509 certificate
                          request. Default: RSAWithSize2048'
                        enum:
                        - ""
                        - RSAWithSize2048
                        - RSAWithSize4096
                        - RSAWithSize8192
                        - ECDSAWithCurve256
                        - ECDSAWithCurve384
                        - ECDSAWithCurve521
                        type: string
                      signatureAlgorithm:
                        description: 'Specify the algorithm used for the signature
                          of the X.509 certificate request. Default: SHA256WithRSA'
                        enum:
                        - ""
                        - SHA256WithRSA
                        - SHA384WithRSA
                        - SHA512WithRSA
                        - ECDSAWithSHA256
                        - ECDSAWithSHA384
                        - ECDSAWithSHA512
                        type: string
                      signerName:
                        description: 'When a CSR is issued to the certificates.k8s.io
                          API, the signerName is added to the request in order to
                          accommodate for clusters with multiple signers. Must be
                          formatted as: `<my-domain>/<my-signername>`.'
                        type: string
                    required:
                    - caCert
                    - signerName
                    type: object
                  cni:
                    description: CNI specifies the CNI that will be used by this installation.
                    properties:
                      ipam:
                        description: IPAM specifies the pod IP address management
                          that will be used in the Calico or Calico Enterprise installation.
                        properties:
                          type:
                            description: "Specifies the IPAM plugin that will be used
                              in the Calico or Calico Enterprise installation. * For
                              CNI Plugin Calico, this field defaults to Calico. *
                              For CNI Plugin GKE, this field defaults to HostLocal.
                              * For CNI Plugin AzureVNET, this field defaults to AzureVNET.
                              * For CNI Plugin AmazonVPC, this field defaults to AmazonVPC.
                              \n The IPAM plugin is installed and configured only
                              if the CNI plugin is set to Calico, for all other values
                              of the CNI plugin the plugin binaries and CNI config
                              is a dependency that is expected to be installed separately.
                              \n Default: Calico"
                            enum:
                            - Calico
                            - HostLocal
                            - AmazonVPC
                            - AzureVNET
                            type: string
                        required:
                        - type
                        type: object
                      type:
                        description: "Specifies the CNI plugin that will be used in
                          the Calico or Calico Enterprise installation. * For KubernetesProvider
                          GKE, this field defaults to GKE. * For KubernetesProvider
                          AKS, this field defaults to AzureVNET. * For KubernetesProvider
                          EKS, this field defaults to AmazonVPC. * If aws-node daemonset
                          exists in kube-system when the Installation resource is
                          created, this field defaults to AmazonVPC. * For all other
                          cases this field defaults to Calico. \n For the value Calico,
                          the CNI plugin binaries and CNI config will be installed
                          as part of deployment, for all other values the CNI plugin
                          binaries and CNI config is a dependency that is expected
                          to be installed separately. \n Default: Calico"
                        enum:
                        - Calico
                        - GKE
                        - AmazonVPC
                        - AzureVNET
                        type: string
                    required:
                    - type
                    type: object
                  componentResources:
                    description: ComponentResources can be used to customize the resource
                      requirements for each component. Node, Typha, and KubeControllers
                      are supported for installations.
                    items:
                      description: The ComponentResource struct associates a ResourceRequirements
                        with a component by name
                      properties:
                        componentName:
                          description: ComponentName is an enum which identifies the
                            component
                          enum:
                          - Node
                          - Typha
                          - KubeControllers
                          type: string
                        resourceRequirements:
                          description: ResourceRequirements allows customization of
                            limits and requests for compute resources such as cpu
                            and memory.
                          properties:
                            limits:
                              additionalProperties:
                                anyOf:
                                - type: integer
                                - type: string
                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                x-kubernetes-int-or-string: true
                              description: 'Limits describes the maximum amount of
                                compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/'
                              type: object
                            requests:
                              additionalProperties:
                                anyOf:
                                - type: integer
                                - type: string
                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                x-kubernetes-int-or-string: true
                              description: 'Requests describes the minimum amount
                                of compute resources required. If Requests is omitted
                                for a container, it defaults to Limits if that is
                                explicitly specified, otherwise to an implementation-defined
                                value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/'
                              type: object
                          type: object
                      required:
                      - componentName
                      - resourceRequirements
                      type: object
                    type: array
                  controlPlaneNodeSelector:
                    additionalProperties:
                      type: string
                    description: ControlPlaneNodeSelector is used to select control
                      plane nodes on which to run Calico components. This is globally
                      applied to all resources created by the operator excluding daemonsets.
                    type: object
                  controlPlaneReplicas:
                    description: ControlPlaneReplicas defines how many replicas of
                      the control plane core components will be deployed. This field
                      applies to all control plane components that support High Availability.
                      Defaults to 2.
                    format: int32
                    type: integer
                  controlPlaneTolerations:
                    description: ControlPlaneTolerations specify tolerations which
                      are then globally applied to all resources created by the operator.
                    items:
                      description: The pod this Toleration is attached to tolerates
                        any taint that matches the triple <key,value,effect> using
                        the matching operator <operator>.
                      properties:
                        effect:
                          description: Effect indicates the taint effect to match.
                            Empty means match all taint effects. When specified, allowed
                            values are NoSchedule, PreferNoSchedule and NoExecute.
                          type: string
                        key:
                          description: Key is the taint key that the toleration applies
                            to. Empty means match all taint keys. If the key is empty,
                            operator must be Exists; this combination means to match
                            all values and all keys.
                          type: string
                        operator:
                          description: Operator represents a key's relationship to
                            the value. Valid operators are Exists and Equal. Defaults
                            to Equal. Exists is equivalent to wildcard for value,
                            so that a pod can tolerate all taints of a particular
                            category.
                          type: string
                        tolerationSeconds:
                          description: TolerationSeconds represents the period of
                            time the toleration (which must be of effect NoExecute,
                            otherwise this field is ignored) tolerates the taint.
                            By default, it is not set, which means tolerate the taint
                            forever (do not evict). Zero and negative values will
                            be treated as 0 (evict immediately) by the system.
                          format: int64
                          type: integer
                        value:
                          description: Value is the taint value the toleration matches
                            to. If the operator is Exists, the value should be empty,
                            otherwise just a regular string.
                          type: string
                      type: object
                    type: array
                  flexVolumePath:
                    description: FlexVolumePath optionally specifies a custom path
                      for FlexVolume. If not specified, FlexVolume will be enabled
                      by default. If set to 'None', FlexVolume will be disabled. The
                      default is based on the kubernetesProvider.
                    type: string
                  imagePath:
                    description: "ImagePath allows for the path part of an image to
                      be specified. If specified then the specified value will be
                      used as the image path for each image. If not specified or empty,
                      the default for each image will be used. A special case value,
                      UseDefault, is supported to explicitly specify the default image
                      path will be used for each image. \n Image format:    `<registry>/<imagePath>/<imagePrefix><imageName>:<image-tag>`
                      \n This option allows configuring the `<imagePath>` portion
                      of the above format."
                    type: string
                  imagePrefix:
                    description: "ImagePrefix allows for the prefix part of an image
                      to be specified. If specified then the given value will be used
                      as a prefix on each image. If not specified or empty, no prefix
                      will be used. A special case value, UseDefault, is supported
                      to explicitly specify the default image prefix will be used
                      for each image. \n Image format:    `<registry>/<imagePath>/<imagePrefix><imageName>:<image-tag>`
                      \n This option allows configuring the `<imagePrefix>` portion
                      of the above format."
                    type: string
                  imagePullSecrets:
                    description: ImagePullSecrets is an array of references to container
                      registry pull secrets to use. These are applied to all images
                      to be pulled.
                    items:
                      description: LocalObjectReference contains enough information
                        to let you locate the referenced object inside the same namespace.
                      properties:
                        name:
                          description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            TODO: Add other useful fields. apiVersion, kind, uid?'
                          type: string
                      type: object
                    type: array
                  kubernetesProvider:
                    description: KubernetesProvider specifies a particular provider
                      of the Kubernetes platform and enables provider-specific configuration.
                      If the specified value is empty, the Operator will attempt to
                      automatically determine the current provider. If the specified
                      value is not empty, the Operator will still attempt auto-detection,
                      but will additionally compare the auto-detected value to the
                      specified value to confirm they match.
                    enum:
                    - ""
                    - EKS
                    - GKE
                    - AKS
                    - OpenShift
                    - DockerEnterprise
                    type: string
                  nodeMetricsPort:
                    description: NodeMetricsPort specifies which port calico/node
                      serves prometheus metrics on. By default, metrics are not enabled.
                      If specified, this overrides any FelixConfiguration resources
                      which may exist. If omitted, then prometheus metrics may still
                      be configured through FelixConfiguration.
                    format: int32
                    type: integer
                  nodeUpdateStrategy:
                    description: NodeUpdateStrategy can be used to customize the desired
                      update strategy, such as the MaxUnavailable field.
                    properties:
                      rollingUpdate:
                        description: 'Rolling update config params. Present only if
                          type = "RollingUpdate". --- TODO: Update this to follow
                          our convention for oneOf, whatever we decide it to be. Same
                          as Deployment `strategy.rollingUpdate`. See https://github.com/kubernetes/kubernetes/issues/35345'
                        properties:
                          maxUnavailable:
                            anyOf:
                            - type: integer
                            - type: string
                            description: 'The maximum number of DaemonSet pods that
                              can be unavailable during the update. Value can be an
                              absolute number (ex: 5) or a percentage of total number
                              of DaemonSet pods at the start of the update (ex: 10%).
                              Absolute number is calculated from percentage by rounding
                              up. This cannot be 0. Default value is 1. Example: when
                              this is set to 30%, at most 30% of the total number
                              of nodes that should be running the daemon pod (i.e.
                              status.desiredNumberScheduled) can have their pods stopped
                              for an update at any given time. The update starts by
                              stopping at most 30% of those DaemonSet pods and then
                              brings up new DaemonSet pods in their place. Once the
                              new pods are available, it then proceeds onto other
                              DaemonSet pods, thus ensuring that at least 70% of original
                              number of DaemonSet pods are available at all times
                              during the update.'
                            x-kubernetes-int-or-string: true
                        type: object
                      type:
                        description: Type of daemon set update. Can be "RollingUpdate"
                          or "OnDelete". Default is RollingUpdate.
                        type: string
                    type: object
                  nonPrivileged:
                    description: NonPrivileged configures Calico to be run in non-privileged
                      containers as non-root users where possible.
                    type: string
                  registry:
                    description: "Registry is the default Docker registry used for
                      component Docker images. If specified, all images will be pulled
                      from this registry. If not specified then the default registries
                      will be used. A special case value, UseDefault, is supported
                      to explicitly specify the default registries will be used. \n
                      Image format:    `<registry>/<imagePath>/<imagePrefix><imageName>:<image-tag>`
                      \n This option allows configuring the `<registry>` portion of
                      the above format."
                    type: string
                  typhaAffinity:
                    description: TyphaAffinity allows configuration of node affinity
                      characteristics for Typha pods.
                    properties:
                      nodeAffinity:
                        description: NodeAffinity describes node affinity scheduling
                          rules for typha.
                        properties:
                          preferredDuringSchedulingIgnoredDuringExecution:
                            description: The scheduler will prefer to schedule pods
                              to nodes that satisfy the affinity expressions specified
                              by this field, but it may choose a node that violates
                              one or more of the expressions.
                            items:
                              description: An empty preferred scheduling term matches
                                all objects with implicit weight 0 (i.e. it's a no-op).
                                A null preferred scheduling term matches no objects
                                (i.e. is also a no-op).
                              properties:
                                preference:
                                  description: A node selector term, associated with
                                    the corresponding weight.
                                  properties:
                                    matchExpressions:
                                      description: A list of node selector requirements
                                        by node's labels.
                                      items:
                                        description: A node selector requirement is
                                          a selector that contains values, a key,
                                          and an operator that relates the key and
                                          values.
                                        properties:
                                          key:
                                            description: The label key that the selector
                                              applies to.
                                            type: string
                                          operator:
                                            description: Represents a key's relationship
                                              to a set of values. Valid operators
                                              are In, NotIn, Exists, DoesNotExist.
                                              Gt, and Lt.
                                            type: string
                                          values:
                                            description: An array of string values.
                                              If the operator is In or NotIn, the
                                              values array must be non-empty. If the
                                              operator is Exists or DoesNotExist,
                                              the values array must be empty. If the
                                              operator is Gt or Lt, the values array
                                              must have a single element, which will
                                              be interpreted as an integer. This array
                                              is replaced during a strategic merge
                                              patch.
                                            items:
                                              type: string
                                            type: array
                                        required:
                                        - key
                                        - operator
                                        type: object
                                      type: array
                                    matchFields:
                                      description: A list of node selector requirements
                                        by node's fields.
                                      items:
                                        description: A node selector requirement is
                                          a selector that contains values, a key,
                                          and an operator that relates the key and
                                          values.
                                        properties:
                                          key:
                                            description: The label key that the selector
                                              applies to.
                                            type: string
                                          operator:
                                            description: Represents a key's relationship
                                              to a set of values. Valid operators
                                              are In, NotIn, Exists, DoesNotExist.
                                              Gt, and Lt.
                                            type: string
                                          values:
                                            description: An array of string values.
                                              If the operator is In or NotIn, the
                                              values array must be non-empty. If the
                                              operator is Exists or DoesNotExist,
                                              the values array must be empty. If the
                                              operator is Gt or Lt, the values array
                                              must have a single element, which will
                                              be interpreted as an integer. This array
                                              is replaced during a strategic merge
                                              patch.
                                            items:
                                              type: string
                                            type: array
                                        required:
                                        - key
                                        - operator
                                        type: object
                                      type: array
                                  type: object
                                weight:
                                  description: Weight associated with matching the
                                    corresponding nodeSelectorTerm, in the range 1-100.
                                  format: int32
                                  type: integer
                              required:
                              - preference
                              - weight
                              type: object
                            type: array
                          requiredDuringSchedulingIgnoredDuringExecution:
                            description: 'WARNING: Please note that if the affinity
                              requirements specified by this field are not met at
                              scheduling time, the pod will NOT be scheduled onto
                              the node. There is no fallback to another affinity rules
                              with this setting. This may cause networking disruption
                              or even catastrophic failure! PreferredDuringSchedulingIgnoredDuringExecution
                              should be used for affinity unless there is a specific
                              well understood reason to use RequiredDuringSchedulingIgnoredDuringExecution
                              and you can guarantee that the RequiredDuringSchedulingIgnoredDuringExecution
                              will always have sufficient nodes to satisfy the requirement.
                              NOTE: RequiredDuringSchedulingIgnoredDuringExecution
                              is set by default for AKS nodes, to avoid scheduling
                              Typhas on virtual-nodes. If the affinity requirements
                              specified by this field cease to be met at some point
                              during pod execution (e.g. due to an update), the system
                              may or may not try to eventually evict the pod from
                              its node.'
                            properties:
                              nodeSelectorTerms:
                                description: Required. A list of node selector terms.
                                  The terms are ORed.
                                items:
                                  description: A null or empty node selector term
                                    matches no objects. The requirements of them are
                                    ANDed. The TopologySelectorTerm type implements
                                    a subset of the NodeSelectorTerm.
                                  properties:
                                    matchExpressions:
                                      description: A list of node selector requirements
                                        by node's labels.
                                      items:
                                        description: A node selector requirement is
                                          a selector that contains values, a key,
                                          and an operator that relates the key and
                                          values.
                                        properties:
                                          key:
                                            description: The label key that the selector
                                              applies to.
                                            type: string
                                          operator:
                                            description: Represents a key's relationship
                                              to a set of values. Valid operators
                                              are In, NotIn, Exists, DoesNotExist.
                                              Gt, and Lt.
                                            type: string
                                          values:
                                            description: An array of string values.
                                              If the operator is In or NotIn, the
                                              values array must be non-empty. If the
                                              operator is Exists or DoesNotExist,
                                              the values array must be empty. If the
                                              operator is Gt or Lt, the values array
                                              must have a single element, which will
                                              be interpreted as an integer. This array
                                              is replaced during a strategic merge
                                              patch.
                                            items:
                                              type: string
                                            type: array
                                        required:
                                        - key
                                        - operator
                                        type: object
                                      type: array
                                    matchFields:
                                      description: A list of node selector requirements
                                        by node's fields.
                                      items:
                                        description: A node selector requirement is
                                          a selector that contains values, a key,
                                          and an operator that relates the key and
                                          values.
                                        properties:
                                          key:
                                            description: The label key that the selector
                                              applies to.
                                            type: string
                                          operator:
                                            description: Represents a key's relationship
                                              to a set of values. Valid operators
                                              are In, NotIn, Exists, DoesNotExist.
                                              Gt, and Lt.
                                            type: string
                                          values:
                                            description: An array of string values.
                                              If the operator is In or NotIn, the
                                              values array must be non-empty. If the
                                              operator is Exists or DoesNotExist,
                                              the values array must be empty. If the
                                              operator is Gt or Lt, the values array
                                              must have a single element, which will
                                              be interpreted as an integer. This array
                                              is replaced during a strategic merge
                                              patch.
                                            items:
                                              type: string
                                            type: array
                                        required:
                                        - key
                                        - operator
                                        type: object
                                      type: array
                                  type: object
                                type: array
                            required:
                            - nodeSelectorTerms
                            type: object
                        type: object
                    type: object
                  typhaMetricsPort:
                    description: TyphaMetricsPort specifies which port calico/typha
                      serves prometheus metrics on. By default, metrics are not enabled.
                    format: int32
                    type: integer
                  variant:
                    description: 'Variant is the product to install - one of Calico
                      or TigeraSecureEnterprise Default: Calico'
                    enum:
                    - Calico
                    - TigeraSecureEnterprise
                    type: string
                type: object
              imageSet:
                description: ImageSet is the name of the ImageSet being used, if there
                  is an ImageSet that is being used. If an ImageSet is not being used
                  then this will not be set.
                type: string
              mtu:
                description: MTU is the most recently observed value for pod network
                  MTU. This may be an explicitly configured value, or based on Calico's
                  native auto-detetion.
                format: int32
                type: integer
              variant:
                description: Variant is the most recently observed installed variant
                  - one of Calico or TigeraSecureEnterprise
                enum:
                - Calico
                - TigeraSecureEnterprise
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
