diff --git a/commands/apply.configuration.html b/commands/apply.configuration.html index 8f5d7759..4aa554ee 100644 --- a/commands/apply.configuration.html +++ b/commands/apply.configuration.html @@ -197,7 +197,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/check-update.configuration.html b/commands/check-update.configuration.html index 44fce4b4..bebdcb18 100644 --- a/commands/check-update.configuration.html +++ b/commands/check-update.configuration.html @@ -201,7 +201,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/completion.configuration.html b/commands/completion.configuration.html index 4fb3333f..219fae75 100644 --- a/commands/completion.configuration.html +++ b/commands/completion.configuration.html @@ -182,7 +182,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/delete.configuration.html b/commands/delete.configuration.html index d228790f..03e6920d 100644 --- a/commands/delete.configuration.html +++ b/commands/delete.configuration.html @@ -194,7 +194,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/deploy.configuration.html b/commands/deploy.configuration.html index 99c85b28..2516e4d0 100644 --- a/commands/deploy.configuration.html +++ b/commands/deploy.configuration.html @@ -201,7 +201,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/helm.configuration.html b/commands/helm.configuration.html index 139defe9..7ee15e93 100644 --- a/commands/helm.configuration.html +++ b/commands/helm.configuration.html @@ -211,7 +211,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/help.configuration.html b/commands/help.configuration.html index 25071e6f..5a9c96d3 100644 --- a/commands/help.configuration.html +++ b/commands/help.configuration.html @@ -173,7 +173,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/http.configuration.html b/commands/http.configuration.html index 0eb0b589..30359179 100644 --- a/commands/http.configuration.html +++ b/commands/http.configuration.html @@ -195,7 +195,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/inspect.configuration.html b/commands/inspect.configuration.html index e0ef0af1..276e0379 100644 --- a/commands/inspect.configuration.html +++ b/commands/inspect.configuration.html @@ -181,7 +181,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/lint.configuration.html b/commands/lint.configuration.html index 4563127c..b7fc3037 100644 --- a/commands/lint.configuration.html +++ b/commands/lint.configuration.html @@ -91,6 +91,38 @@

Linting Checks

Here is the list of available checks by defaults.

+

access-to-create-pods

+
+

Name: access-to-create-pods.

+
+
+

Indicates when a subject (Group/User/ServiceAccount) has create access to Pods. +CIS Benchmark 5.1.4: The ability to create pods in a cluster opens up possibilities for privilege escalation and should be restricted, where possible.

+
+
+

Remediation

+
+

Where possible, remove create access to pod objects in the cluster.

+
+
+
+
+

access-to-secrets

+
+

Name: access-to-secrets.

+
+
+

Indicates when a subject (Group/User/ServiceAccount) has access to Secrets. +CIS Benchmark 5.1.2: Access to secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation.

+
+
+

Remediation

+
+

Where possible, remove get, list and watch access to secret objects in the cluster.

+
+
+
+

cpu-limits

Name: cpu-limits.

@@ -99,7 +131,7 @@

cpu-limits

Ensures resources.limits.cpu is set.

-

Remediation

+

Remediation

Set resources.limits.cpu.

@@ -114,13 +146,168 @@

cpu-requests

Ensures resources.requests.cpu is set.

-

Remediation

+

Remediation

Set resources.requests.cpu.

+

default-service-account

+
+

Name: default-service-account.

+
+
+

Indicates when pods use the default service account.

+
+
+

Remediation

+
+

Create a dedicated service account for your pod. +Refer to https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ for details.

+
+
+
+
+

deprecated-service-account-field

+
+

Name: deprecated-service-account-field.

+
+
+

Indicates when deployments use the deprecated serviceAccount field.

+
+
+

Remediation

+
+

Use the serviceAccountName field instead. If you must specify serviceAccount, ensure values for serviceAccount and serviceAccountName match.

+
+
+
+
+

dnsconfig-options

+
+

Name: dnsconfig-options.

+
+
+

Alert on deployments that have no specified dnsConfig options

+
+
+

Remediation

+
+

Specify dnsconfig options in your Pod specification to ensure the expected DNS setting on the Pod. +Refer to https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config for details.

+
+
+
+
+

docker-sock

+
+

Name: docker-sock.

+
+
+

Alert on deployments with docker.sock mounted in containers.

+
+
+

Remediation

+
+

Ensure the Docker socket is not mounted inside any containers by removing the associated +Volume and VolumeMount in deployment yaml specification. +If the Docker socket is mounted inside a container it could allow processes running within +the container to execute Docker commands which would effectively allow for full control of the host.

+
+
+
+
+

drop-net-raw-capability

+
+

Name: drop-net-raw-capability.

+
+
+

Indicates when containers do not drop NET_RAW capability

+
+
+

Remediation

+
+

NET_RAW makes it so that an application within the container is able to craft raw packets, use raw sockets, and bind to any address. Remove this capability in the containers under containers security contexts.

+
+
+
+
+

duplicate-env-var

+
+

Name: duplicate-env-var.

+
+
+

Check that duplicate named env vars aren’t passed to a deployment like.

+
+
+

Remediation

+
+

Confirm that your DeploymentLike doesn’t have duplicate env vars names.

+
+
+
+
+

host-ipc

+
+

Name: host-ipc.

+
+
+

Alert on pods/deployment-likes with sharing host’s IPC namespace

+
+
+

Remediation

+
+

Ensure the host’s IPC namespace is not shared.

+
+
+
+
+

host-network

+
+

Name: host-network.

+
+
+

Alert on pods/deployment-likes with sharing host’s network namespace

+
+
+

Remediation

+
+

Ensure the host’s network namespace is not shared.

+
+
+
+
+

host-pid

+
+

Name: host-pid.

+
+
+

Alert on pods/deployment-likes with sharing host’s process namespace

+
+
+

Remediation

+
+

Ensure the host’s process namespace is not shared.

+
+
+
+
+

hpa-minimum-three-replicas

+
+

Name: hpa-minimum-three-replicas.

+
+
+

Indicates when a HorizontalPodAutoscaler specifies less than three minReplicas

+
+
+

Remediation

+
+

Increase the number of replicas in the HorizontalPodAutoscaler to at least three to increase fault tolerance.

+
+
+
+

memory-limits

Name: memory-limits.

@@ -129,7 +316,7 @@

memory-limits

Ensures resources.limits.memory is set.

-

Remediation

+

Remediation

Set resources.limits.memory.

@@ -144,13 +331,43 @@

memory-requests

Ensures resources.requests.memory is set.

-

Remediation

+

Remediation

Set resources.requests.memory.

+

minimum-three-replicas

+
+

Name: minimum-three-replicas.

+
+
+

Indicates when a deployment uses less than three replicas

+
+
+

Remediation

+
+

Increase the number of replicas in the deployment to at least three to increase the fault tolerance of the deployment.

+
+
+
+
+

mismatching-selector

+
+

Name: mismatching-selector.

+
+
+

Indicates when deployment selectors fail to match the pod template labels.

+
+
+

Remediation

+
+

Confirm that your deployment selector correctly matches the labels in its pod template.

+
+
+
+

missing-anti-affinity

Name: missing-anti-affinity.

@@ -159,13 +376,29 @@

missing-anti-affinity

When replicas > 1 setting an anti-affinity enables to distribute the load accross machines setting 'topologyKey: "kubernetes.io/hostname"', see https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity.

-

Remediation

+

Remediation

Add podAntiAffinity in your deployment descriptor.

+

no-extensions-v1beta

+
+

Name: no-extensions-v1beta.

+
+
+

Indicates when objects use deprecated API versions under extensions/v1beta.

+
+
+

Remediation

+
+

Migrate using the apps/v1 API versions for the objects. +Refer to https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/ for details.

+
+
+
+

no-latest

Name: no-latest.

@@ -174,7 +407,7 @@

no-latest

Ensures no latest image is used.

-

Remediation

+

Remediation

Ensure to tag any image you use and use an immutable tag if possible or at least versionned flavor.

@@ -189,13 +422,28 @@

no-liveness-probe

Ensures a liveness probe is defined.

-

Remediation

+

Remediation

Any container (from containers array) should have a liveness probe.

+

no-read-only-root-fs

+
+

Name: no-read-only-root-fs.

+
+
+

Indicates when containers are running without a read-only root filesystem.

+
+
+

Remediation

+
+

Set readOnlyRootFilesystem to true in the container securityContext.

+
+
+
+

no-readiness-probe

Name: no-readiness-probe.

@@ -204,12 +452,189 @@

no-readiness-probe

Ensures a readinessProbe probe is defined.

-

Remediation

+

Remediation

Any container (from containers array) should have a readinessProbe probe.

+
+

privilege-escalation-container

+
+

Name: privilege-escalation-container.

+
+
+

Alert on containers of allowing privilege escalation that could gain more privileges than its parent process.

+
+
+

Remediation

+
+

Ensure containers do not allow privilege escalation by setting +allowPrivilegeEscalation=false, privileged=false and removing CAP_SYS_ADMIN capability. +See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for more details.

+
+
+
+
+

privileged-container

+
+

Name: privileged-container.

+
+
+

Indicates when deployments have containers running in privileged mode.

+
+
+

Remediation

+
+

Do not run your container as privileged unless it is required.

+
+
+
+
+

privileged-ports

+
+

Name: privileged-ports.

+
+
+

Alert on deployments with privileged ports mapped in containers

+
+
+

Remediation

+
+

Ensure privileged ports [0, 1024] are not mapped within containers.

+
+
+
+
+

read-secret-from-env-var

+
+

Name: read-secret-from-env-var.

+
+
+

Indicates when a deployment reads secret from environment variables. +CIS Benchmark 5.4.1: "Prefer using secrets as files over secrets as environment variables. "

+
+
+

Remediation

+
+

If possible, rewrite application code to read secrets from mounted secret files, rather than from environment variables. +Refer to https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets for details.

+
+
+
+
+

run-as-non-root

+
+

Name: run-as-non-root.

+
+
+

Indicates when containers are not set to runAsNonRoot.

+
+
+

Remediation

+
+

Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext. +Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.

+
+
+
+
+

sensitive-host-mounts

+
+

Name: sensitive-host-mounts.

+
+
+

Alert on deployments with sensitive host system directories mounted in containers.

+
+
+

Remediation

+
+

Ensure sensitive host system directories are not mounted in containers by removing those Volumes and VolumeMounts.

+
+
+
+
+

unsafe-proc-mount

+
+

Name: unsafe-proc-mount.

+
+
+

Alert on deployments with unsafe /proc mount (procMount=Unmasked) that will bypass the default masking behavior of the container runtime

+
+
+

Remediation

+
+

Ensure container does not unsafely exposes parts of /proc by setting procMount=Default. +Unmasked ProcMount bypasses the default masking behavior of the container runtime. +See https://kubernetes.io/docs/concepts/security/pod-security-standards/ for more details.

+
+
+
+
+

unsafe-sysctls

+
+

Name: unsafe-sysctls.

+
+
+

Alert on deployments specifying unsafe sysctls that may lead to severe problems like wrong behavior of containers

+
+
+

Remediation

+
+

Ensure container does not allow unsafe allocation of system resources by removing unsafe sysctls configurations. +For more details see https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ +https://docs.docker.com/engine/reference/commandline/run/#configure-namespaced-kernel-parameters-sysctls-at-runtime.

+
+
+
+
+

use-namespace

+
+

Name: use-namespace.

+
+
+

Indicates when a resource is deployed to the default namespace. +CIS Benchmark 5.7.1: Create administrative boundaries between resources using namespaces. +CIS Benchmark 5.7.4: The default namespace should not be used.

+
+
+

Remediation

+
+

Create namespaces for objects in your deployment.

+
+
+
+
+

wildcard-in-rules

+
+

Name: wildcard-in-rules.

+
+
+

Indicate when a wildcard is used in Role or ClusterRole rules. +CIS Benchmark 5.1.3 Use of wildcards is not optimal from a security perspective as it may allow for inadvertent access to be granted when new resources are added to the Kubernetes API either as CRDs or in later versions of the product.

+
+
+

Remediation

+
+

Where possible replace any use of wildcards in clusterroles and roles with specific objects or actions.

+
+
+
+
+

writable-host-mount

+
+

Name: writable-host-mount.

+
+
+

Indicates when containers mount a host path as writable.

+
+
+

Remediation

+
+

Set containers to mount host paths as readOnly, if you need to access files on the host.

+
+
+
@@ -225,6 +650,10 @@

Configuration

If true, an exception is throw if there is at least one error. Default value: ERROR

+
--forcedRules (BUNDLEBEE_LINT_FORCEDRULES)
+
+

Comma separated list of rules to use (others being ignored). all means use all discovered rules. Default value: all

+
--from (BUNDLEBEE_LINT_FROM)

Root dependency to download to get the manifest. If set to auto it is assumed to be present in current classpath. Default value: auto

@@ -321,7 +750,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/list-lint-rules.configuration.html b/commands/list-lint-rules.configuration.html index 6ee9d037..aee7b44f 100644 --- a/commands/list-lint-rules.configuration.html +++ b/commands/list-lint-rules.configuration.html @@ -160,7 +160,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/process.configuration.html b/commands/process.configuration.html index aa69b288..c286df75 100644 --- a/commands/process.configuration.html +++ b/commands/process.configuration.html @@ -201,7 +201,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/rollback.configuration.html b/commands/rollback.configuration.html index 87dccae3..f443d1c0 100644 --- a/commands/rollback.configuration.html +++ b/commands/rollback.configuration.html @@ -244,7 +244,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/run.configuration.html b/commands/run.configuration.html index 04a8e0eb..21464ff4 100644 --- a/commands/run.configuration.html +++ b/commands/run.configuration.html @@ -189,7 +189,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/versions.configuration.html b/commands/versions.configuration.html index a73b54f1..a4925bac 100644 --- a/commands/versions.configuration.html +++ b/commands/versions.configuration.html @@ -169,7 +169,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/commands/yaml2json.configuration.html b/commands/yaml2json.configuration.html index 0e1ee812..cd119c32 100644 --- a/commands/yaml2json.configuration.html +++ b/commands/yaml2json.configuration.html @@ -173,7 +173,7 @@

Inherited Global Configuration

--bundlebee.kube.implicitlyDroppedAttributes (BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES)
-

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

+

Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

--bundlebee.kube.logDescriptorOnParsingError (BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR)
diff --git a/generated/jsonschema/manifest.descriptor.json b/generated/jsonschema/manifest.descriptor.json index b41648d6..2f7e5432 100644 --- a/generated/jsonschema/manifest.descriptor.json +++ b/generated/jsonschema/manifest.descriptor.json @@ -366,6 +366,22 @@ } } }, + "ignoredLintingRules":{ + "type":"array", + "title":"Manifest.ignoredLintingRules", + "description":"Ignored linting rule names when using `lint` command.", + "items":{ + "$id":"io_yupiik_bundlebee_core_descriptor_Manifest_IgnoredLintingRule", + "type":"object", + "properties":{ + "name":{ + "type":"string", + "title":"IgnoredLintingRule.name", + "description":"Name of the rule to ignore." + } + } + } + }, "interpolateAlveoli":{ "type":"boolean", "title":"Manifest.interpolateAlveoli", diff --git a/how-it-works.html b/how-it-works.html index a966b3a1..dc9861fb 100644 --- a/how-it-works.html +++ b/how-it-works.html @@ -169,6 +169,12 @@

Manifest Descriptor

List of described applications/libraries.

+

Manifest.ignoredLintingRules

+

ignoredLintingRules

+

array of object

+

Ignored linting rule names when using lint command.

+ +

Manifest.references

references

array of object

@@ -648,12 +654,43 @@

Alveolus.patches

+

Manifest.ignoredLintingRules

+
+

Ignored linting rule names when using lint command.

+
+ + ++++++ + + + + + + + + + + + + + + + + +
Table 11. Manifest.ignoredLintingRules
NameJSON NameTypeDescription

name

name

string

Name of the rule to ignore.

+
+

Manifest.references

List of files referenced as other manifests. They are merged with this (main) manifest by appending requirements and alveoli. It is relative to this manifest location. Important: it is only about the same module references, external references are dependencies in an alveoli. It enables to split a huge manifest.json for an easier maintenance.

- +@@ -684,7 +721,7 @@

Manifest.requi

Pre manifest execution checks (bundlebee version typically). Avoids to install using a bundlebee version not compatible with the alveoli. Can be fully omitted.

Table 11. Manifest.referencesTable 12. Manifest.references
- +@@ -1109,6 +1146,22 @@

JSON-Schema

} } }, + "ignoredLintingRules":{ + "type":"array", + "title":"Manifest.ignoredLintingRules", + "description":"Ignored linting rule names when using `lint` command.", + "items":{ + "$id":"io_yupiik_bundlebee_core_descriptor_Manifest_IgnoredLintingRule", + "type":"object", + "properties":{ + "name":{ + "type":"string", + "title":"IgnoredLintingRule.name", + "description":"Name of the rule to ignore." + } + } + } + }, "interpolateAlveoli":{ "type":"boolean", "title":"Manifest.interpolateAlveoli", @@ -1531,6 +1584,14 @@

Windows and CLI

Table 12. Manifest.requirementsTable 13. Manifest.requirements
+ +
+

Linting

+
+
+

Linting is quite specific so it has its own documentation.

+
+
diff --git a/linting.html b/linting.html new file mode 100644 index 00000000..1298c612 --- /dev/null +++ b/linting.html @@ -0,0 +1,789 @@ + + + + + Linting + + + + + + + + + + + + + + + + + + +
+
+
+
+ +
+
+ +
    • + + +
    +
    +
    +
    +
    +
    +

    Menu

    + +
    + +
    +
    +

    Linting

    +
    +
    +
    +
    +
    +

    Linting is the process of running validations on descriptors.

    +
    +
    +

    Bundlebee is able to read common "pre-rendered" descriptors (from Helm for example) as long as a manifest.json is properly formatted so you can run the linter on any descriptor even if it is working out of the box for Bundlebee alveoli (where you just run bundlebee lint …​ command without pre-processing).

    +
    +
    +
    +
    +

    Rules

    +
    +
    +

    Here is the available rules (built-in).

    +
    +
    +

    Linting Checks

    +
    +

    Here is the list of available checks by defaults.

    +
    +
    +

    access-to-create-pods

    +
    +

    Name: access-to-create-pods.

    +
    +
    +

    Indicates when a subject (Group/User/ServiceAccount) has create access to Pods. +CIS Benchmark 5.1.4: The ability to create pods in a cluster opens up possibilities for privilege escalation and should be restricted, where possible.

    +
    +
    +
    Remediation
    +
    +

    Where possible, remove create access to pod objects in the cluster.

    +
    +
    +
    +
    +

    access-to-secrets

    +
    +

    Name: access-to-secrets.

    +
    +
    +

    Indicates when a subject (Group/User/ServiceAccount) has access to Secrets. +CIS Benchmark 5.1.2: Access to secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation.

    +
    +
    +
    Remediation
    +
    +

    Where possible, remove get, list and watch access to secret objects in the cluster.

    +
    +
    +
    +
    +

    cpu-limits

    +
    +

    Name: cpu-limits.

    +
    +
    +

    Ensures resources.limits.cpu is set.

    +
    +
    +
    Remediation
    +
    +

    Set resources.limits.cpu.

    +
    +
    +
    +
    +

    cpu-requests

    +
    +

    Name: cpu-requests.

    +
    +
    +

    Ensures resources.requests.cpu is set.

    +
    +
    +
    Remediation
    +
    +

    Set resources.requests.cpu.

    +
    +
    +
    +
    +

    default-service-account

    +
    +

    Name: default-service-account.

    +
    +
    +

    Indicates when pods use the default service account.

    +
    +
    +
    Remediation
    +
    +

    Create a dedicated service account for your pod. +Refer to https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ for details.

    +
    +
    +
    +
    +

    deprecated-service-account-field

    +
    +

    Name: deprecated-service-account-field.

    +
    +
    +

    Indicates when deployments use the deprecated serviceAccount field.

    +
    +
    +
    Remediation
    +
    +

    Use the serviceAccountName field instead. If you must specify serviceAccount, ensure values for serviceAccount and serviceAccountName match.

    +
    +
    +
    +
    +

    dnsconfig-options

    +
    +

    Name: dnsconfig-options.

    +
    +
    +

    Alert on deployments that have no specified dnsConfig options

    +
    +
    +
    Remediation
    +
    +

    Specify dnsconfig options in your Pod specification to ensure the expected DNS setting on the Pod. +Refer to https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config for details.

    +
    +
    +
    +
    +

    docker-sock

    +
    +

    Name: docker-sock.

    +
    +
    +

    Alert on deployments with docker.sock mounted in containers.

    +
    +
    +
    Remediation
    +
    +

    Ensure the Docker socket is not mounted inside any containers by removing the associated +Volume and VolumeMount in deployment yaml specification. +If the Docker socket is mounted inside a container it could allow processes running within +the container to execute Docker commands which would effectively allow for full control of the host.

    +
    +
    +
    +
    +

    drop-net-raw-capability

    +
    +

    Name: drop-net-raw-capability.

    +
    +
    +

    Indicates when containers do not drop NET_RAW capability

    +
    +
    +
    Remediation
    +
    +

    NET_RAW makes it so that an application within the container is able to craft raw packets, use raw sockets, and bind to any address. Remove this capability in the containers under containers security contexts.

    +
    +
    +
    +
    +

    duplicate-env-var

    +
    +

    Name: duplicate-env-var.

    +
    +
    +

    Check that duplicate named env vars aren’t passed to a deployment like.

    +
    +
    +
    Remediation
    +
    +

    Confirm that your DeploymentLike doesn’t have duplicate env vars names.

    +
    +
    +
    +
    +

    host-ipc

    +
    +

    Name: host-ipc.

    +
    +
    +

    Alert on pods/deployment-likes with sharing host’s IPC namespace

    +
    +
    +
    Remediation
    +
    +

    Ensure the host’s IPC namespace is not shared.

    +
    +
    +
    +
    +

    host-network

    +
    +

    Name: host-network.

    +
    +
    +

    Alert on pods/deployment-likes with sharing host’s network namespace

    +
    +
    +
    Remediation
    +
    +

    Ensure the host’s network namespace is not shared.

    +
    +
    +
    +
    +

    host-pid

    +
    +

    Name: host-pid.

    +
    +
    +

    Alert on pods/deployment-likes with sharing host’s process namespace

    +
    +
    +
    Remediation
    +
    +

    Ensure the host’s process namespace is not shared.

    +
    +
    +
    +
    +

    hpa-minimum-three-replicas

    +
    +

    Name: hpa-minimum-three-replicas.

    +
    +
    +

    Indicates when a HorizontalPodAutoscaler specifies less than three minReplicas

    +
    +
    +
    Remediation
    +
    +

    Increase the number of replicas in the HorizontalPodAutoscaler to at least three to increase fault tolerance.

    +
    +
    +
    +
    +

    memory-limits

    +
    +

    Name: memory-limits.

    +
    +
    +

    Ensures resources.limits.memory is set.

    +
    +
    +
    Remediation
    +
    +

    Set resources.limits.memory.

    +
    +
    +
    +
    +

    memory-requests

    +
    +

    Name: memory-requests.

    +
    +
    +

    Ensures resources.requests.memory is set.

    +
    +
    +
    Remediation
    +
    +

    Set resources.requests.memory.

    +
    +
    +
    +
    +

    minimum-three-replicas

    +
    +

    Name: minimum-three-replicas.

    +
    +
    +

    Indicates when a deployment uses less than three replicas

    +
    +
    +
    Remediation
    +
    +

    Increase the number of replicas in the deployment to at least three to increase the fault tolerance of the deployment.

    +
    +
    +
    +
    +

    mismatching-selector

    +
    +

    Name: mismatching-selector.

    +
    +
    +

    Indicates when deployment selectors fail to match the pod template labels.

    +
    +
    +
    Remediation
    +
    +

    Confirm that your deployment selector correctly matches the labels in its pod template.

    +
    +
    +
    +
    +

    missing-anti-affinity

    +
    +

    Name: missing-anti-affinity.

    +
    +
    +

    When replicas > 1 setting an anti-affinity enables to distribute the load accross machines setting 'topologyKey: "kubernetes.io/hostname"', see https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity.

    +
    +
    +
    Remediation
    +
    +

    Add podAntiAffinity in your deployment descriptor.

    +
    +
    +
    +
    +

    no-extensions-v1beta

    +
    +

    Name: no-extensions-v1beta.

    +
    +
    +

    Indicates when objects use deprecated API versions under extensions/v1beta.

    +
    +
    +
    Remediation
    +
    +

    Migrate using the apps/v1 API versions for the objects. +Refer to https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/ for details.

    +
    +
    +
    +
    +

    no-latest

    +
    +

    Name: no-latest.

    +
    +
    +

    Ensures no latest image is used.

    +
    +
    +
    Remediation
    +
    +

    Ensure to tag any image you use and use an immutable tag if possible or at least versionned flavor.

    +
    +
    +
    +
    +

    no-liveness-probe

    +
    +

    Name: no-liveness-probe.

    +
    +
    +

    Ensures a liveness probe is defined.

    +
    +
    +
    Remediation
    +
    +

    Any container (from containers array) should have a liveness probe.

    +
    +
    +
    +
    +

    no-read-only-root-fs

    +
    +

    Name: no-read-only-root-fs.

    +
    +
    +

    Indicates when containers are running without a read-only root filesystem.

    +
    +
    +
    Remediation
    +
    +

    Set readOnlyRootFilesystem to true in the container securityContext.

    +
    +
    +
    +
    +

    no-readiness-probe

    +
    +

    Name: no-readiness-probe.

    +
    +
    +

    Ensures a readinessProbe probe is defined.

    +
    +
    +
    Remediation
    +
    +

    Any container (from containers array) should have a readinessProbe probe.

    +
    +
    +
    +
    +

    privilege-escalation-container

    +
    +

    Name: privilege-escalation-container.

    +
    +
    +

    Alert on containers of allowing privilege escalation that could gain more privileges than its parent process.

    +
    +
    +
    Remediation
    +
    +

    Ensure containers do not allow privilege escalation by setting +allowPrivilegeEscalation=false, privileged=false and removing CAP_SYS_ADMIN capability. +See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for more details.

    +
    +
    +
    +
    +

    privileged-container

    +
    +

    Name: privileged-container.

    +
    +
    +

    Indicates when deployments have containers running in privileged mode.

    +
    +
    +
    Remediation
    +
    +

    Do not run your container as privileged unless it is required.

    +
    +
    +
    +
    +

    privileged-ports

    +
    +

    Name: privileged-ports.

    +
    +
    +

    Alert on deployments with privileged ports mapped in containers

    +
    +
    +
    Remediation
    +
    +

    Ensure privileged ports [0, 1024] are not mapped within containers.

    +
    +
    +
    +
    +

    read-secret-from-env-var

    +
    +

    Name: read-secret-from-env-var.

    +
    +
    +

    Indicates when a deployment reads secret from environment variables. +CIS Benchmark 5.4.1: "Prefer using secrets as files over secrets as environment variables. "

    +
    +
    +
    Remediation
    +
    +

    If possible, rewrite application code to read secrets from mounted secret files, rather than from environment variables. +Refer to https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets for details.

    +
    +
    +
    +
    +

    run-as-non-root

    +
    +

    Name: run-as-non-root.

    +
    +
    +

    Indicates when containers are not set to runAsNonRoot.

    +
    +
    +
    Remediation
    +
    +

    Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext. +Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.

    +
    +
    +
    +
    +

    sensitive-host-mounts

    +
    +

    Name: sensitive-host-mounts.

    +
    +
    +

    Alert on deployments with sensitive host system directories mounted in containers.

    +
    +
    +
    Remediation
    +
    +

    Ensure sensitive host system directories are not mounted in containers by removing those Volumes and VolumeMounts.

    +
    +
    +
    +
    +

    unsafe-proc-mount

    +
    +

    Name: unsafe-proc-mount.

    +
    +
    +

    Alert on deployments with unsafe /proc mount (procMount=Unmasked) that will bypass the default masking behavior of the container runtime

    +
    +
    +
    Remediation
    +
    +

    Ensure container does not unsafely exposes parts of /proc by setting procMount=Default. +Unmasked ProcMount bypasses the default masking behavior of the container runtime. +See https://kubernetes.io/docs/concepts/security/pod-security-standards/ for more details.

    +
    +
    +
    +
    +

    unsafe-sysctls

    +
    +

    Name: unsafe-sysctls.

    +
    +
    +

    Alert on deployments specifying unsafe sysctls that may lead to severe problems like wrong behavior of containers

    +
    +
    +
    Remediation
    +
    +

    Ensure container does not allow unsafe allocation of system resources by removing unsafe sysctls configurations. +For more details see https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ +https://docs.docker.com/engine/reference/commandline/run/#configure-namespaced-kernel-parameters-sysctls-at-runtime.

    +
    +
    +
    +
    +

    use-namespace

    +
    +

    Name: use-namespace.

    +
    +
    +

    Indicates when a resource is deployed to the default namespace. +CIS Benchmark 5.7.1: Create administrative boundaries between resources using namespaces. +CIS Benchmark 5.7.4: The default namespace should not be used.

    +
    +
    +
    Remediation
    +
    +

    Create namespaces for objects in your deployment.

    +
    +
    +
    +
    +

    wildcard-in-rules

    +
    +

    Name: wildcard-in-rules.

    +
    +
    +

    Indicate when a wildcard is used in Role or ClusterRole rules. +CIS Benchmark 5.1.3 Use of wildcards is not optimal from a security perspective as it may allow for inadvertent access to be granted when new resources are added to the Kubernetes API either as CRDs or in later versions of the product.

    +
    +
    +
    Remediation
    +
    +

    Where possible replace any use of wildcards in clusterroles and roles with specific objects or actions.

    +
    +
    +
    +
    +

    writable-host-mount

    +
    +

    Name: writable-host-mount.

    +
    +
    +

    Indicates when containers mount a host path as writable.

    +
    +
    +
    Remediation
    +
    +

    Set containers to mount host paths as readOnly, if you need to access files on the host.

    +
    +
    +
    +
    +
    +
    +
    +

    Write your own rule

    +
    +
    +

    To write your own rule you have to implement and add to bundlebee (core) classpath a CDI bean implementing LintingCheck - or SynchronousLintingCheck which can be easier to implement.

    +
    +
    +

    Synchronous or not

    +
    +

    The generic LintingCheck uses CompletionStage because it is possible to use validation rules which connect to a cluster (the bundlebee configured one) and using KubeClient - or any other logic - you can do checks against a particular cluster (does role exists for example). +CompletionStage enable to run validations in parallel easily.

    +
    +
    +

    When not needed, just go with the SynchronousLintingCheck base interface or one of its children.

    +
    +
    +
    +

    Anatomy of a check

    +
    +

    A check is composed of:

    +
    +
    +
      +
    • +

      A name which enables to disable/force the check to run,

      +
      • +
    • +

      A remediation string which explains how to fix the violation when it happens,

      +
      • +
    • +

      A decription explaining the validation,

      +
      • +
    • +

      A validate (or sync flavor) method doing validation when a descriptor is visited,

      +
      • +
    • +

      Sometimes an afterAll method doing validations after all descriptors were seen (for joins accross desriptors for example).

      +
      • +
    +
    +
    +
    +

    JSON, JSON, JSON

    +
    +

    Yaml descriptors are converted to JsonObject and descriptors containing a list are flattened.

    +
    +
    +

    What does it means is that you always validate a single descriptor which is an object in check code which makes it easier to work with.

    +
    +
    +
    +
    +
    +

    Going further

    +
    +
    +

    It is not yet possible to define custom rules, it is not very complicated to do it technically but the language (must be JSON based) is challenging. +Here are the current evaluated options:

    +
    +
    +
      +
    • +

      Custom DSL: likely the most powerful and consistent option since we could define it in manifest.json but requires to learn yet another language,

      +
      • +
    • +

      JSON-Logic: a very good option but requires a lot of operators and resulting DSL is not that friendly/simple,

      +
      • +
    • +

      Template based: idea there is to define a few options ("check this value at this JSON pointer", "check this chain of json pointer", …​) but this becomes quite hard to have a relevant dictionary set without making it overcomplex,

      +
      • +
    • +

      Scripting based: we can run jruby/jython/js engine rules but they all required to embed a script manager runtime and they tend to be fatty for this need and not all are graalvm friendly to convert bundlebee to native mode.

      +
      • +
    +
    +
    +

    So as of today, since we didn’t find a compromise making us happy we didn’t enable to define JSON DSL based rules. +Since it is easy to add custom rules in Java (and using the maven plugin), this is not blocking but we’d like to tackle it if we can come up with a better idea. +Don’t hesistate to propose something on bundlebee github project if you have an idea or a common need.

    +
    +
    +
    + +
    +
    +
    +

    Navigation

    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + diff --git a/maven/apply.html b/maven/apply.html index 23b5b2f5..48ee673a 100644 --- a/maven/apply.html +++ b/maven/apply.html @@ -219,7 +219,7 @@

    Configuration

    kubeImplicitlyDroppedAttributes (String)
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    kubeLogDescriptorOnParsingError (boolean)
    diff --git a/maven/bundlebee-maven-plugin.html b/maven/bundlebee-maven-plugin.html index 85917e46..4aef117e 100644 --- a/maven/bundlebee-maven-plugin.html +++ b/maven/bundlebee-maven-plugin.html @@ -120,7 +120,7 @@

    Goals

    inspect: inspect an alveolus, i.e. list the descriptors to apply.

  • -

    lint: do common validations on descriptors. As of today mainly cpu/memory resources definition.

    +

    lint: do common validations on descriptors. As of today mainly cpu/memory resources definition. include::content/_partials/generated/documentation/lint.checks.adoc[leveloffset=+1]

  • list-lint-rules: list available linting rules (ease exclusions for ex).

    diff --git a/maven/check-update.html b/maven/check-update.html index ac77c9bd..3907bdac 100644 --- a/maven/check-update.html +++ b/maven/check-update.html @@ -203,7 +203,7 @@

    Configuration

    • kubeImplicitlyDroppedAttributes (String)
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    kubeLogDescriptorOnParsingError (boolean)
    diff --git a/maven/completion.html b/maven/completion.html index fab27eee..8ffc43b4 100644 --- a/maven/completion.html +++ b/maven/completion.html @@ -187,7 +187,7 @@

    Configuration

    kubeImplicitlyDroppedAttributes (String)
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    kubeLogDescriptorOnParsingError (boolean)
    diff --git a/maven/delete.html b/maven/delete.html index c2a47730..f1cac62c 100644 --- a/maven/delete.html +++ b/maven/delete.html @@ -219,7 +219,7 @@

    Configuration

    kubeImplicitlyDroppedAttributes (String)
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    kubeLogDescriptorOnParsingError (boolean)
    diff --git a/maven/deploy.html b/maven/deploy.html index f855d75a..0c4ec6e2 100644 --- a/maven/deploy.html +++ b/maven/deploy.html @@ -211,7 +211,7 @@

    Configuration

    kubeImplicitlyDroppedAttributes (String)
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    kubeLogDescriptorOnParsingError (boolean)
    diff --git a/maven/http.html b/maven/http.html index 5aa92c7d..c026bcc3 100644 --- a/maven/http.html +++ b/maven/http.html @@ -195,7 +195,7 @@

    Configuration

    kubeImplicitlyDroppedAttributes (String)
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    kubeLogDescriptorOnParsingError (boolean)
    diff --git a/maven/inspect.html b/maven/inspect.html index 08a2b41e..693ba55a 100644 --- a/maven/inspect.html +++ b/maven/inspect.html @@ -203,7 +203,7 @@

    Configuration

    kubeImplicitlyDroppedAttributes (String)
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    kubeLogDescriptorOnParsingError (boolean)
    diff --git a/maven/lint.html b/maven/lint.html index c20c6469..250885a8 100644 --- a/maven/lint.html +++ b/maven/lint.html @@ -77,7 +77,7 @@

    bundlebee:lint

    -

    Do common validations on descriptors. As of today mainly cpu/memory resources definition.

    +

    Do common validations on descriptors. As of today mainly cpu/memory resources definition. include::content/_partials/generated/documentation/lint.checks.adoc[leveloffset=+1]

    @@ -149,6 +149,10 @@

    Configuration

    If true, an exception is throw if there is at least one error. Default value: ERROR. Property: ${bundlebee.lint.failLevel}.

    +
    forcedRules (List)
    +
    +

    Comma separated list of rules to use (others being ignored). all means use all discovered rules. Default value: all. Property: ${bundlebee.lint.forcedRules}.

    +
    from (String)

    Root dependency to download to get the manifest. If set to auto it is assumed to be present in current classpath. Default value: auto. Property: ${bundlebee.lint.from}.

    @@ -215,7 +219,7 @@

    Configuration

    kubeImplicitlyDroppedAttributes (String)
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    kubeLogDescriptorOnParsingError (boolean)
    diff --git a/maven/list-lint-rules.html b/maven/list-lint-rules.html index 843a4016..a8e06788 100644 --- a/maven/list-lint-rules.html +++ b/maven/list-lint-rules.html @@ -129,138 +129,10 @@

    Configuration

    -
    awaiterRetryInterval (long)
    -
    -

    How often to retry for a descriptor condition. Increasing it will reduce the pressure on the Kubernetes REST API (rate limiting for example). Default value: 500. Property: ${bundlebee.awaiter.retryInterval}.

    -
    customPlaceholders (Map)

    Custom properties injected in the main, it is often used for placeholders. If the key (tag in pom) starts with bundlebee-placeholder-import then the value is resolved as a properties file which is injected in the resulting placeholders (indirect placeholders). Property: ${bundlebee.list-lint-rules.customPlaceholders}.

    -
    httpclientConnectTimeout (String)
    -
    -

    The HTTP client connect timeout (in java Duration format), none can be used to ignore this setting. Default value: none. Property: ${bundlebee.httpclient.connectTimeout}.

    -
    -
    httpclientFollowRedirects (String)
    -
    -

    The HTTP client redirect policy. Default to NORMAL, can be set to ALWAYS or NEVER. Default value: NORMAL. Property: ${bundlebee.httpclient.followRedirects}.

    -
    -
    httpclientForcedHttpVersion (String)
    -
    -

    The HTTP client version, none mean the JVM default (v2), HTTP_1_1 v1.1 and HTTP_2 v2.0. Default value: none. Property: ${bundlebee.httpclient.forcedHttpVersion}.

    -
    -
    httpclientThreads (int)
    -
    -

    How many threads are allocated to async HTTP client, negative or zero value means to use common pool. Default value: -1. Property: ${bundlebee.httpclient.threads}.

    -
    -
    kubeApi (String)
    -
    -

    When kubeconfig is not set the base API endpoint. Default value: http://localhost:8080. Property: ${bundlebee.kube.api}.

    -
    -
    kubeContext (String)
    -
    -

    When kubeconfig (explicit or not) is used, the context to use. If not set it is taken from the kubeconfig itself. Default value: <unset>. Property: ${bundlebee.kube.context}.

    -
    -
    kubeCustomMetadataInjectionPoint (String)
    -
    -

    When using custom metadata (bundlebee ones or timestamp to force a rollout), where to inject them. Default uses labels since it enables to query them later on but you can switch it to annotations. Default value: labels. Property: ${bundlebee.kube.customMetadataInjectionPoint}.

    -
    -
    kubeDefaultPropagationPolicy (String)
    -
    -

    Default value for deletions of propagationPolicy. Values can be Orphan, Foreground and Background. Default value: Foreground. Property: ${bundlebee.kube.defaultPropagationPolicy}.

    -
    -
    kubeDryRun (boolean)
    -
    -

    If true http requests/responses are skipped. Note that dry run implies verbose=true for the http client. Note that as of today, all responses are mocked by a HTTP 200 and an empty JSON payload. Default value: false. Property: ${bundlebee.kube.dryRun}.

    -
    -
    kubeFiltersStatefulesetSpecAllowed (Set)
    -
    -

    Should YAML/JSON be logged when it can’t be parsed. Default value: replicas,template,updateStrategy,persistentVolumeClaimRetentionPolicy,minReadySeconds,serviceName,selector. Property: ${bundlebee.kube.filters.statefuleset.spec.allowed}.

    -
    -
    kubeForce (boolean)
    -
    -

    By default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself and for cases it is not enough, you can set force to true to delete the descriptor before applying it again (move from clusterip to nodeport or the opposite in a serice for ex). Note that you can set it to true in a descriptor annotation io.yupiik.bundlebee/force too to not be global. Default value: false. Property: ${bundlebee.kube.force}.

    -
    -
    kubeHttpTimeout (long)
    -
    -

    HTTP timeout in ms, ignored if ⇐ 0. Default value: 60000. Property: ${bundlebee.kube.http.timeout}.

    -
    -
    kubeImplicitlyDroppedAttributes (String)
    -
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    -
    -
    kubeLogDescriptorOnParsingError (boolean)
    -
    -

    Should YAML/JSON be logged when it can’t be parsed. Default value: true. Property: ${bundlebee.kube.logDescriptorOnParsingError}.

    -
    -
    kubeNamespace (String)
    -
    -

    When kubeconfig is not set the namespace to use. Default value: default. Property: ${bundlebee.kube.namespace}.

    -
    -
    kubePutOnUpdate (boolean)
    -
    -

    By default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself. Default value: false. Property: ${bundlebee.kube.putOnUpdate}.

    -
    -
    kubeResourceMapping (String)
    -
    -

    Enables to define resource mapping, syntax uses propeties one: ` s = /apis/…​.. Default value: `. Property: ${bundlebee.kube.resourceMapping}.

    -
    -
    kubeSkipDryRunForGet (boolean)
    -
    -

    If true GET http requests are not skipped when dryRun is true. Default value: false. Property: ${bundlebee.kube.skipDryRunForGet}.

    -
    -
    kubeSkipUpdateForKinds (String)
    -
    -

    List of kind of descriptors updates can be skipped, it is often useful for PersistentVolumeClaim. Default value: PersistentVolumeClaim. Property: ${bundlebee.kube.skipUpdateForKinds}.

    -
    -
    kubeToken (String)
    -
    -

    When kubeconfig is set to explicit, the bearer token to use (if set). Default value: <unset>. Property: ${bundlebee.kube.token}.

    -
    -
    kubeValidateSSL (boolean)
    -
    -

    Should SSL connector be validated or not. Default value: true. Property: ${bundlebee.kube.validateSSL}.

    -
    -
    kubeVerbose (boolean)
    -
    -

    If true http requests/responses to Kubernetes will be logged. Default value: false. Property: ${bundlebee.kube.verbose}.

    -
    -
    kubeconfig (String)
    -
    -

    Kubeconfig location. If set to auto it will try to guess from your $HOME/.kube/config file until you set it so explicit where it will use other bundlebee.kube properties to create the client. The content can also be set inline!. Default value: auto. Property: ${kubeconfig}.

    -
    -
    mavenCache (String)
    -
    -

    Where to cache maven dependencies. If set to auto, $HOME/.m2/repository is used. Default value: auto. Property: ${bundlebee.maven.cache}.

    -
    -
    mavenForceCustomSettingsXml (boolean)
    -
    -

    If true we only use cache value and never fallback on default maven settings.xml location. Default value: false. Property: ${bundlebee.maven.forceCustomSettingsXml}.

    -
    -
    mavenHttpConnectTimeout (int)
    -
    -

    When fetching a dependency using HTTP, the connection timeout for this dependency. Default value: 30000. Property: ${bundlebee.maven.http.connectTimeout}.

    -
    -
    mavenPreferCustomSettingsXml (boolean)
    -
    -

    If false we first try to read settings.xml file(s) in cache location before the default one. Default value: true. Property: ${bundlebee.maven.preferCustomSettingsXml}.

    -
    -
    mavenRepositoriesDownloadsEnabled (boolean)
    -
    -

    Enable the download, i.e. ensure it runs only with local maven repository. Default value: false. Property: ${bundlebee.maven.repositories.downloads.enabled}.

    -
    -
    mavenRepositoriesHttpHeaders (String)
    -
    -

    Properties to define the headers to set per repository, syntax is host1=headerName headerValue and it supports as much lines as used repositories. Note that you can use maven ~/.m2/settings.xml servers (potentially ciphered) username/password pairs. In this last case the server id must be bundlebee. `. Still in settings.xml case, if the username is null the password value is used as raw `Authorization header else username/password is encoded as a basic header. Default value: <unset>. Property: ${bundlebee.maven.repositories.httpHeaders}.

    -
    -
    mavenRepositoriesRelease (String)
    -
    -

    Default release repository. Default value: https://repo.maven.apache.org/maven2/. Property: ${bundlebee.maven.repositories.release}.

    -
    -
    mavenRepositoriesSnapshot (String)
    -
    -

    Default snapshot repository, not set by default. Default value: <unset>. Property: ${bundlebee.maven.repositories.snapshot}.

    -
    packaging (String)

    Current module packaging. Default value: ${project.packaging}. Property: ``.

    diff --git a/maven/process.html b/maven/process.html index 4bccc84a..33025820 100644 --- a/maven/process.html +++ b/maven/process.html @@ -219,7 +219,7 @@

    Configuration

    kubeImplicitlyDroppedAttributes (String)
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    kubeLogDescriptorOnParsingError (boolean)
    diff --git a/maven/rollback.html b/maven/rollback.html index c9a1b7c5..758518c9 100644 --- a/maven/rollback.html +++ b/maven/rollback.html @@ -207,7 +207,7 @@

    Configuration

    kubeImplicitlyDroppedAttributes (String)
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    kubeLogDescriptorOnParsingError (boolean)
    diff --git a/maven/versions.html b/maven/versions.html index dda5759d..426107bc 100644 --- a/maven/versions.html +++ b/maven/versions.html @@ -195,7 +195,7 @@

    Configuration

    kubeImplicitlyDroppedAttributes (String)
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    kubeLogDescriptorOnParsingError (boolean)
    diff --git a/maven/yaml2json.html b/maven/yaml2json.html index 6b2de0a3..a6668436 100644 --- a/maven/yaml2json.html +++ b/maven/yaml2json.html @@ -191,7 +191,7 @@

    Configuration

    kubeImplicitlyDroppedAttributes (String)
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules. Property: ${bundlebee.kube.implicitlyDroppedAttributes}.

    kubeLogDescriptorOnParsingError (boolean)
    diff --git a/operator.html b/operator.html index e6db5596..c48809b1 100644 --- a/operator.html +++ b/operator.html @@ -247,7 +247,7 @@

    Global configuration

    BUNDLEBEE_KUBE_IMPLICITLYDROPPEDATTRIBUTES
    -

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema

    +

    Enables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema|/$bundlebeeIgnoredLintingRules

    BUNDLEBEE_KUBE_LOGDESCRIPTORONPARSINGERROR
    diff --git a/search.json b/search.json index b45f3406..cccc940f 100644 --- a/search.json +++ b/search.json @@ -1 +1 @@ -[{"lang":"en","lvl2":"Configuration","text":"Name: add-alveolus.\nAdds a service to the alveoli available in the defined folder. It is a skaffolding command.\nAlveolus name.\nDeployment image.\nManifest to add the aveolus inside. Default value: ./bundlebee/manifest.json\nIf false, generated files already existing will be skipped. Default value: false\nAlveolus/template type. web will create a ConfigMap, Deployment and Service. Default value: web","title":"Add-alveolus","url":"//www.yupiik.io/bundlebee/commands/add-alveolus.configuration.html"},{"lang":"en","text":"elasticsearch-local (io.yupiik.alveoli:elasticsearch-local:1.0.21-SNAPSHOT): setup \"elasticsearch-local\" which runs an Elasticsearch instance usable by other applications.\ngrafana-simple (io.yupiik.alveoli:grafana-simple:1.0.21-SNAPSHOT): simple Grafana instance, note we preconfigure it with Loki, Prometheus and grafana alveoli, ensure to override the configuration if you don’t use them.\nloki-simple (io.yupiik.alveoli:loki-simple:1.0.21-SNAPSHOT): loki setup to aggregate service logs using promtail, the prometheus for logs.\nStarting from 1.0.20, the Promtail descriptor moved from Deployment to DaemonSet.\nminio-local (io.yupiik.alveoli:minio-local:1.0.21-SNAPSHOT): setup \"minio-local\" which runs a MinIO instance usable by other applications.\nmonitoring-alveolus (io.yupiik.alveoli:monitoring-alveolus:1.0.21-SNAPSHOT): includes loki+prometheus+zipkin+grafana at once.\nYou can set --monitoring.namespace to deploy the full stack in a dedicated namespace.\nStarting from 1.0.20, we added the resource request/limit placeHolder with default in all the dependencies. You can remove them by patching the descriptor like:\nYou need to add this in all the descriptor dependencies.\npostgres-local (io.yupiik.alveoli:postgres-local:1.0.21-SNAPSHOT): setup \"postgres-local\" which runs a PostgreSQL instance usable by other applications.\nprometheus-simple (io.yupiik.alveoli:prometheus-simple:1.0.21-SNAPSHOT): prometheus local/dev setup. Will be available on http://$(PROMETHEUS_SERVICE_SERVICE_HOST):$(PROMETHEUS_SERVICE_SERVICE_PORT).\nzipkin-simple (io.yupiik.alveoli:zipkin-simple:1.0.21-SNAPSHOT): zipkin in memory setup. Will be available on http://$(ZIPKIN_SERVICE_SERVICE_HOST):$(ZIPKIN_SERVICE_SERVICE_PORT). For example http://$(ZIPKIN_SERVICE_SERVICE_HOST):$(ZIPKIN_SERVICE_SERVICE_PORT)/api/v2/spans to push spans through HTTP.","title":"Alveoli","url":"//www.yupiik.io/bundlebee/alveoli.html"},{"lang":"en","lvl2":"Configuration","lvl3":"Inherited Global Configuration","text":"Name: apply.\nApply/deploy a set of descriptors from a root one.\nAlveolus name to deploy. When set to auto, it will deploy all manifests found in the classpath. If you set manifest option, alveolus is set to auto and there is a single alveolus in it, this will default to it instead of using classpath deployment. Default value: auto\nFor descriptors with await = true the max duration the test can last. Default value: 60000\nEnables to exclude descriptors from the command line. none to ignore. Value is comma separated. Note that using this setting, location is set to * so only the name is matched. Default value: none\nEnables to exclude locations (descriptor is set to *) from the command line. none to ignore. Value is comma separated. Default value: none\nRoot dependency to download to get the manifest. If set to auto it is assumed to be present in current classpath. Default value: auto\nIf true, bundlebee.* labels will be injected into the descriptors. This is required for rollback command to work. Default value: true\nIf true, a bundlebee.timestamp label will be injected into the descritors with current date before applying the descriptor. Default value: true\nManifest to load to start to deploy (a file path or inline). This optional setting mainly enables to use dependencies easily. Ignored if set to skip. Default value: skip\nIf true, each descriptor installation awaits previous ones instead of being concurrent. Enable an easier debugging for errors. Default value: false\nfor these configurations, don’t hesitate to use ~/.bundlebeerc or --config-file (just remove the -- prefix from option keys).\nHow often to retry for a descriptor condition. Increasing it will reduce the pressure on the Kubernetes REST API (rate limiting for example). Default value: 500\nThe HTTP client connect timeout (in java Duration format), none can be used to ignore this setting. Default value: none\nThe HTTP client redirect policy. Default to NORMAL, can be set to ALWAYS or NEVER. Default value: NORMAL\nThe HTTP client version, none mean the JVM default (v2), HTTP_1_1 v1.1 and HTTP_2 v2.0. Default value: none\nHow many threads are allocated to async HTTP client, negative or zero value means to use common pool. Default value: -1\nWhen kubeconfig is not set the base API endpoint. Default value: http://localhost:8080\nWhen kubeconfig (explicit or not) is used, the context to use. If not set it is taken from the kubeconfig itself.\nWhen using custom metadata (bundlebee ones or timestamp to force a rollout), where to inject them. Default uses labels since it enables to query them later on but you can switch it to annotations. Default value: labels\nDefault value for deletions of propagationPolicy. Values can be Orphan, Foreground and Background. Default value: Foreground\nIf true http requests/responses are skipped. Note that dry run implies verbose=true for the http client. Note that as of today, all responses are mocked by a HTTP 200 and an empty JSON payload. Default value: false\nShould YAML/JSON be logged when it can’t be parsed. Default value: replicas,template,updateStrategy,persistentVolumeClaimRetentionPolicy,minReadySeconds,serviceName,selector\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself and for cases it is not enough, you can set force to true to delete the descriptor before applying it again (move from clusterip to nodeport or the opposite in a serice for ex). Note that you can set it to true in a descriptor annotation io.yupiik.bundlebee/force too to not be global. Default value: false\nHTTP timeout in ms, ignored if ⇐ 0. Default value: 60000\nEnables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema\nShould YAML/JSON be logged when it can’t be parsed. Default value: true\nWhen kubeconfig is not set the namespace to use. Default value: default\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself. Default value: false\nEnables to define resource mapping, syntax uses propeties one: s = /apis/….. Default value: ``\nIf true GET http requests are not skipped when dryRun is true. Default value: false\nList of kind of descriptors updates can be skipped, it is often useful for PersistentVolumeClaim. Default value: PersistentVolumeClaim\nWhen kubeconfig is set to explicit, the bearer token to use (if set).\nShould SSL connector be validated or not. Default value: true\nIf true http requests/responses to Kubernetes will be logged. Default value: false\nWhere to cache maven dependencies. If set to auto, $HOME/.m2/repository is used. Default value: auto\nIf true we only use cache value and never fallback on default maven settings.xml location. Default value: false\nWhen fetching a dependency using HTTP, the connection timeout for this dependency. Default value: 30000\nIf false we first try to read settings.xml file(s) in cache location before the default one. Default value: true\nEnable the download, i.e. ensure it runs only with local maven repository. Default value: false\nProperties to define the headers to set per repository, syntax is host1=headerName headerValue and it supports as much lines as used repositories. Note that you can use maven ~/.m2/settings.xml servers (potentially ciphered) username/password pairs. In this last case the server id must be bundlebee.. Still in settings.xml case, if the username is null the password value is used as raw Authorization header else username/password is encoded as a basic header.\nDefault release repository. Default value: https://repo.maven.apache.org/maven2/\nDefault snapshot repository, not set by default.\nKubeconfig location. If set to auto it will try to guess from your $HOME/.kube/config file until you set it so explicit where it will use other bundlebee.kube properties to create the client. The content can also be set inline!. Default value: auto","title":"Apply","url":"//www.yupiik.io/bundlebee/commands/apply.configuration.html"},{"lang":"en","lvl2":"Configuration","text":"Name: build.\nBuild a project.\nBundle artifactId.\nProject to build. Default value: target\nIf true it will be added to your local maven repository. Default value: true\nProject to build. Default value: .\nBundle groupId.\nBundle version.","title":"Build","url":"//www.yupiik.io/bundlebee/commands/build.configuration.html"},{"lang":"en","lvl2":"Installation\nConfiguration\nDelete/Apply an alveolus\nAppendix, all in one installation","lvl3":"Global configuration","text":"this module is new and can change.\nBundlebee operator provides a Kubernetes operator which creates a custom resource of type Alveolus. This way you can deploy directly an alveolus and the operator will take care to deploy it. Similarly, if you delete the alveolus, the operator will delete it all.\nin current version there is no catch up logic so if the deletion fails you should re-run it or finish to clean up the data manually (this is on the roadmap).\nas of today, the image is not yet available on docker hub (>= 1.0.14) so you will need to build it yourself. This can be done 1. cloning the project, 2. building it with mvn install -DskipTests -Pdocker, 3. push the yupiik/bundlebee/operator: on your kubernetes image registry.\nYou can install the Bundlebee operator using bundlebee client on your machine (or the maven plugin/fat jar if you prefer): bundlebee --from io.yupiik:bundlebee-operator: --alveolis io.yupiik:bundlebee-operator:. See all in one descriptor.\nif you don’t install it in default namespace, don’t hesitate to customize KUBECONFIG value in the all in one descriptor or use placeholders for the bundlebee installation. You can also desire to customize the roles affected to the ServiceAccount mounted in the operator Deployment to give it more or less permissions on what it can deploy/delete.\nThe operator configuration is globally the same than standard Bundlebee with a small difference: the global configuration is configured once - in the Deployment of the installation part - and only command configuration can be set in the Alveolus descriptors.\nWhere to store the internal operator state to not restart from scratch when restarting. Default value: /opt/yupiik/state/bundlebee-operator.\nHow often to retry for a descriptor condition. Increasing it will reduce the pressure on the Kubernetes REST API (rate limiting for example). Default value: 500\nThe HTTP client connect timeout (in java Duration format), none can be used to ignore this setting. Default value: none\nThe HTTP client redirect policy. Default to NORMAL, can be set to ALWAYS or NEVER. Default value: NORMAL\nThe HTTP client version, none mean the JVM default (v2), HTTP_1_1 v1.1 and HTTP_2 v2.0. Default value: none\nHow many threads are allocated to async HTTP client, negative or zero value means to use common pool. Default value: -1\nWhen kubeconfig is not set the base API endpoint. Default value: http://localhost:8080\nWhen kubeconfig (explicit or not) is used, the context to use. If not set it is taken from the kubeconfig itself.\nWhen using custom metadata (bundlebee ones or timestamp to force a rollout), where to inject them. Default uses labels since it enables to query them later on but you can switch it to annotations. Default value: labels\nDefault value for deletions of propagationPolicy. Values can be Orphan, Foreground and Background. Default value: Foreground\nIf true http requests/responses are skipped. Note that dry run implies verbose=true for the http client. Note that as of today, all responses are mocked by a HTTP 200 and an empty JSON payload. Default value: false\nShould YAML/JSON be logged when it can’t be parsed. Default value: replicas,template,updateStrategy,persistentVolumeClaimRetentionPolicy,minReadySeconds,serviceName,selector\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself and for cases it is not enough, you can set force to true to delete the descriptor before applying it again (move from clusterip to nodeport or the opposite in a serice for ex). Note that you can set it to true in a descriptor annotation io.yupiik.bundlebee/force too to not be global. Default value: false\nHTTP timeout in ms, ignored if ⇐ 0. Default value: 60000\nEnables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema\nShould YAML/JSON be logged when it can’t be parsed. Default value: true\nWhen kubeconfig is not set the namespace to use. Default value: default\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself. Default value: false\nEnables to define resource mapping, syntax uses propeties one: s = /apis/….. Default value: ``\nIf true GET http requests are not skipped when dryRun is true. Default value: false\nList of kind of descriptors updates can be skipped, it is often useful for PersistentVolumeClaim. Default value: PersistentVolumeClaim\nWhen kubeconfig is set to explicit, the bearer token to use (if set).\nShould SSL connector be validated or not. Default value: true\nIf true http requests/responses to Kubernetes will be logged. Default value: false\nWhere to cache maven dependencies. If set to auto, $HOME/.m2/repository is used. Default value: auto\nIf true we only use cache value and never fallback on default maven settings.xml location. Default value: false\nWhen fetching a dependency using HTTP, the connection timeout for this dependency. Default value: 30000\nIf false we first try to read settings.xml file(s) in cache location before the default one. Default value: true\nEnable the download, i.e. ensure it runs only with local maven repository. Default value: false\nProperties to define the headers to set per repository, syntax is host1=headerName headerValue and it supports as much lines as used repositories. Note that you can use maven ~/.m2/settings.xml servers (potentially ciphered) username/password pairs. In this last case the server id must be bundlebee.. Still in settings.xml case, if the username is null the password value is used as raw Authorization header else username/password is encoded as a basic header.\nDefault release repository. Default value: https://repo.maven.apache.org/maven2/\nDefault snapshot repository, not set by default.\nKubeconfig location. If set to auto it will try to guess from your $HOME/.kube/config file until you set it so explicit where it will use other bundlebee.kube properties to create the client. The content can also be set inline!. Default value: auto\nTo apply a custmo Alveolus you can write a descriptor like:\nUse apiVersion bundlebee.yupiik.io/v1,\nUse kind Alveolus,\nmetadata object is a standard one so you can set a name, labels, etc…,\nargs are the options of the apply command for this deployment (without the global configuration indeed).\nyou can check apply documentation to see all the options available.","title":"Bundlebee K8s Operator","url":"//www.yupiik.io/bundlebee/operator.html"},{"lang":"en","lvl2":"Goals","text":"BundleBee command executable from Maven environment.\nadd-alveolus: adds a service to the alveoli available in the defined folder. It is a skaffolding command.\napply: apply/deploy a set of descriptors from a root one.\nbuild: build a project.\ncheck-update: check if a new version is available. IMPORTANT: this command only works for amd64 linux machines.\ncipher-password: cipher a password to put it in ~/.m2/settings.xml servers (useful for deploy command for example).\ncompletion: execute bash completion. Should be setup in your ~/.bashrc or ~/.profile file to be active. The result will be the list of proposal you can inject into COMPREPLY array. To set it up you can add this snippet to your .bashrc (assumes you uses the bundlebee linux binary and it is in your $PATH otherwise replace bundlebee by your own launching script): [source,bash] ---- complete -o default -o nospace -C \"bundlebee completion\" bundlebee ----\ncreate-master-password: generate a master password if none exist (in ~/.m2/settings-security.xml)\ndelete: delete an alveolus deployment by deleting all related descriptors. bundlebee.delete.propagationPolicy can be set in descriptor(s) metadata to force default CLI behavior for this descriptor.\ndeploy: build and deploy a project. It inherits from most configuration of build command and adds remote repository settings.\nhttp: execute a HTTP request over Kubernetes client. This is mainly for not yet existing commands and to reuse all the client auto-configuration.\ninspect: inspect an alveolus, i.e. list the descriptors to apply.\nlint: do common validations on descriptors. As of today mainly cpu/memory resources definition.\nlist-lint-rules: list available linting rules (ease exclusions for ex).\nnew: creates a new project.\nprocess: process all descriptors - as in an apply command - from a root descriptor. If output is set, it dumps the descriptors in this directory. Don’t forget to set --kubeconfig explicit to ignore kube setup.\nrollback: rollback an alveolus deployment. The strategy is the following one:\nLoad current alveolus (recursively) to list all descriptors in \"current\" version\nFind previous version if not explicit (by choosing the first previous on in the list of available version on maven repository)\nRun delete command for current version\nRun apply command for previous version IMPORTANT: this command only uses releases when it guesses the versions, it does not handles SNAPSHOTs. If you want to rollback to a snapshot, ensure to configure previous* properties. TIP: this is equivalent to apply and delete commands successfully. For now it is recommended to do both manually.\nversion: shows the application version.\nversions: list versions for an artifact to know which ones are available.\nyaml2json: convert yaml files of a directory to json. This command is useful to transform Kubernetes yaml files to json to write Bundlebee descriptors.","title":"Bundlebee Maven Plugin","url":"//www.yupiik.io/bundlebee/maven/bundlebee-maven-plugin.html"},{"lang":"en","lvl2":"Configuration","lvl3":"Inherited Global Configuration","text":"Name: check-update.\nCheck if a new version is available.\nthis command only works for amd64 linux machines.\nBundlebee binary artifactId. Default value: bundlebee-core\nBundlebee binary classifier. Default value: Linux-amd64\nBundlebee binary groupId. Default value: io.yupiik\nWhere to install bundlebee if update is true. Default value: {{user.home}}/.yupiik/bundlebee/bin/bundlebee\nRepository bundlebee is supposed to be, generally Apache Maven central. Default value: https://repo.maven.apache.org/maven2\nBundlebee binary type (extension) in maven coordinates. Default value: bin\nIf a new version is available, should it update installLocation. Default value: false\nfor these configurations, don’t hesitate to use ~/.bundlebeerc or --config-file (just remove the -- prefix from option keys).\nHow often to retry for a descriptor condition. Increasing it will reduce the pressure on the Kubernetes REST API (rate limiting for example). Default value: 500\nThe HTTP client connect timeout (in java Duration format), none can be used to ignore this setting. Default value: none\nThe HTTP client redirect policy. Default to NORMAL, can be set to ALWAYS or NEVER. Default value: NORMAL\nThe HTTP client version, none mean the JVM default (v2), HTTP_1_1 v1.1 and HTTP_2 v2.0. Default value: none\nHow many threads are allocated to async HTTP client, negative or zero value means to use common pool. Default value: -1\nWhen kubeconfig is not set the base API endpoint. Default value: http://localhost:8080\nWhen kubeconfig (explicit or not) is used, the context to use. If not set it is taken from the kubeconfig itself.\nWhen using custom metadata (bundlebee ones or timestamp to force a rollout), where to inject them. Default uses labels since it enables to query them later on but you can switch it to annotations. Default value: labels\nDefault value for deletions of propagationPolicy. Values can be Orphan, Foreground and Background. Default value: Foreground\nIf true http requests/responses are skipped. Note that dry run implies verbose=true for the http client. Note that as of today, all responses are mocked by a HTTP 200 and an empty JSON payload. Default value: false\nShould YAML/JSON be logged when it can’t be parsed. Default value: replicas,template,updateStrategy,persistentVolumeClaimRetentionPolicy,minReadySeconds,serviceName,selector\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself and for cases it is not enough, you can set force to true to delete the descriptor before applying it again (move from clusterip to nodeport or the opposite in a serice for ex). Note that you can set it to true in a descriptor annotation io.yupiik.bundlebee/force too to not be global. Default value: false\nHTTP timeout in ms, ignored if ⇐ 0. Default value: 60000\nEnables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema\nShould YAML/JSON be logged when it can’t be parsed. Default value: true\nWhen kubeconfig is not set the namespace to use. Default value: default\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself. Default value: false\nEnables to define resource mapping, syntax uses propeties one: s = /apis/….. Default value: ``\nIf true GET http requests are not skipped when dryRun is true. Default value: false\nList of kind of descriptors updates can be skipped, it is often useful for PersistentVolumeClaim. Default value: PersistentVolumeClaim\nWhen kubeconfig is set to explicit, the bearer token to use (if set).\nShould SSL connector be validated or not. Default value: true\nIf true http requests/responses to Kubernetes will be logged. Default value: false\nWhere to cache maven dependencies. If set to auto, $HOME/.m2/repository is used. Default value: auto\nIf true we only use cache value and never fallback on default maven settings.xml location. Default value: false\nWhen fetching a dependency using HTTP, the connection timeout for this dependency. Default value: 30000\nIf false we first try to read settings.xml file(s) in cache location before the default one. Default value: true\nEnable the download, i.e. ensure it runs only with local maven repository. Default value: false\nProperties to define the headers to set per repository, syntax is host1=headerName headerValue and it supports as much lines as used repositories. Note that you can use maven ~/.m2/settings.xml servers (potentially ciphered) username/password pairs. In this last case the server id must be bundlebee.. Still in settings.xml case, if the username is null the password value is used as raw Authorization header else username/password is encoded as a basic header.\nDefault release repository. Default value: https://repo.maven.apache.org/maven2/\nDefault snapshot repository, not set by default.\nKubeconfig location. If set to auto it will try to guess from your $HOME/.kube/config file until you set it so explicit where it will use other bundlebee.kube properties to create the client. The content can also be set inline!. Default value: auto","title":"Check-update","url":"//www.yupiik.io/bundlebee/commands/check-update.configuration.html"},{"lang":"en","lvl2":"Configuration","text":"Name: cipher-password.\nCipher a password to put it in ~/.m2/settings.xml servers (useful for deploy command for example).\nPassword value to cipher (auto generates a random one). Default value: auto","title":"Cipher-password","url":"//www.yupiik.io/bundlebee/commands/cipher-password.configuration.html"},{"lang":"en","text":"add-alveolus: adds a service to the alveoli available in the defined folder. It is a skaffolding command.\napply: apply/deploy a set of descriptors from a root one.\nbuild: build a project.\ncheck-update: check if a new version is available.\ncipher-password: cipher a password to put it in ~/.m2/settings.xml servers (useful for deploy command for example).\ncompletion: execute bash completion. Should be setup in your ~/.bashrc or ~/.profile file to be active.\ncreate-master-password: generate a master password if none exist (in ~/.m2/settings-security.xml).\ndelete: delete an alveolus deployment by deleting all related descriptors.\ndeploy: build and deploy a project. It inherits from most configuration of build command and adds remote repository settings.\nhelm: converts an alveolus deployment to a simple helm chart.\"// end of short description Note you will loose some features doing that but in case some rigid rules force to use helm it enables to still rely on bundlebee setup and share a helm chart to ops. Note that this conversion has some limitation in placeholder syntax for example (ensure no conflict under a key).\nhelp: print help for all available commands.\nhttp: execute a HTTP request over Kubernetes client. This is mainly for not yet existing commands and to reuse all the client auto-configuration.\ninspect: inspect an alveolus, i.e. list the descriptors to apply.\nlint: do common validations on descriptors. As of today mainly cpu/memory resources definition.\nlist-lint-rules: list available linting rules (ease exclusions for ex).\nnew: creates a new project.\nprocess: process all descriptors - as in an apply command - from a root descriptor. If output is set, it dumps the descriptors in this directory. Don’t forget to set --kubeconfig explicit to ignore kube setup.\nrollback: rollback an alveolus deployment.\nrun: tries to run the recipe as plain forks on the host. In this mode, Bundlebee is used as the orchestrator. It is highly recommended to only do that with application matching the bundlebee command environment.\nversion: shows the application version.\nversions: list versions for an artifact to know which ones are available.\nyaml2json: convert yaml files of a directory to json. This command is useful to transform Kubernetes yaml files to json to write Bundlebee descriptors.","title":"Commands","url":"//www.yupiik.io/bundlebee/commands.html"},{"lang":"en","lvl2":"Configuration","lvl3":"Inherited Global Configuration","text":"Name: completion.\nExecute bash completion. Should be setup in your ~/.bashrc or ~/.profile file to be active. The result will be the list of proposal you can inject into COMPREPLY array.\nTo set it up you can add this snippet to your .bashrc (assumes you uses the bundlebee linux binary and it is in your $PATH otherwise replace bundlebee by your own launching script):\nMatches bash COMP_LINE environment variable, represents the current command line.\nMatches bash COMP_POINT environment variable, represents the index of the cursor position. Default value: -1\nIf true logger will be used instead of stdout. Default value: false\nfor these configurations, don’t hesitate to use ~/.bundlebeerc or --config-file (just remove the -- prefix from option keys).\nHow often to retry for a descriptor condition. Increasing it will reduce the pressure on the Kubernetes REST API (rate limiting for example). Default value: 500\nThe HTTP client connect timeout (in java Duration format), none can be used to ignore this setting. Default value: none\nThe HTTP client redirect policy. Default to NORMAL, can be set to ALWAYS or NEVER. Default value: NORMAL\nThe HTTP client version, none mean the JVM default (v2), HTTP_1_1 v1.1 and HTTP_2 v2.0. Default value: none\nHow many threads are allocated to async HTTP client, negative or zero value means to use common pool. Default value: -1\nWhen kubeconfig is not set the base API endpoint. Default value: http://localhost:8080\nWhen kubeconfig (explicit or not) is used, the context to use. If not set it is taken from the kubeconfig itself.\nWhen using custom metadata (bundlebee ones or timestamp to force a rollout), where to inject them. Default uses labels since it enables to query them later on but you can switch it to annotations. Default value: labels\nDefault value for deletions of propagationPolicy. Values can be Orphan, Foreground and Background. Default value: Foreground\nIf true http requests/responses are skipped. Note that dry run implies verbose=true for the http client. Note that as of today, all responses are mocked by a HTTP 200 and an empty JSON payload. Default value: false\nShould YAML/JSON be logged when it can’t be parsed. Default value: replicas,template,updateStrategy,persistentVolumeClaimRetentionPolicy,minReadySeconds,serviceName,selector\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself and for cases it is not enough, you can set force to true to delete the descriptor before applying it again (move from clusterip to nodeport or the opposite in a serice for ex). Note that you can set it to true in a descriptor annotation io.yupiik.bundlebee/force too to not be global. Default value: false\nHTTP timeout in ms, ignored if ⇐ 0. Default value: 60000\nEnables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema\nShould YAML/JSON be logged when it can’t be parsed. Default value: true\nWhen kubeconfig is not set the namespace to use. Default value: default\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself. Default value: false\nEnables to define resource mapping, syntax uses propeties one: s = /apis/….. Default value: ``\nIf true GET http requests are not skipped when dryRun is true. Default value: false\nList of kind of descriptors updates can be skipped, it is often useful for PersistentVolumeClaim. Default value: PersistentVolumeClaim\nWhen kubeconfig is set to explicit, the bearer token to use (if set).\nShould SSL connector be validated or not. Default value: true\nIf true http requests/responses to Kubernetes will be logged. Default value: false\nWhere to cache maven dependencies. If set to auto, $HOME/.m2/repository is used. Default value: auto\nIf true we only use cache value and never fallback on default maven settings.xml location. Default value: false\nWhen fetching a dependency using HTTP, the connection timeout for this dependency. Default value: 30000\nIf false we first try to read settings.xml file(s) in cache location before the default one. Default value: true\nEnable the download, i.e. ensure it runs only with local maven repository. Default value: false\nProperties to define the headers to set per repository, syntax is host1=headerName headerValue and it supports as much lines as used repositories. Note that you can use maven ~/.m2/settings.xml servers (potentially ciphered) username/password pairs. In this last case the server id must be bundlebee.. Still in settings.xml case, if the username is null the password value is used as raw Authorization header else username/password is encoded as a basic header.\nDefault release repository. Default value: https://repo.maven.apache.org/maven2/\nDefault snapshot repository, not set by default.\nKubeconfig location. If set to auto it will try to guess from your $HOME/.kube/config file until you set it so explicit where it will use other bundlebee.kube properties to create the client. The content can also be set inline!. Default value: auto","title":"Completion","url":"//www.yupiik.io/bundlebee/commands/completion.configuration.html"},{"lang":"en","lvl2":"Create your first template\nUse your first template","text":"feature available since Bundlebee 1.0.14.\nA template is an alveolus which is not intended to be installed by itself in general - even if it is possible. It relies on placeholders to be contextualized and, in general, placeholders are provided in the context if a contextual alveolus which represents the consumer.\nBut why using templates? Most of the time, the Kubernetes flavor you are using (OpenShift for example or a cloud specific instance or with a particular service mesh stack) is relying on specific metadata/labels etc… Your company can also standardize the way to write kubernetes descriptors. All that make it quite hard to define generic and maintainable descriptors generally speaking but it also makes it quite repetitive to write it for each microservice in your own context.\nTo solve that issue, Bundlebee enables you to write a generic contextual alveolus (a deployment, a service etc…) and bind placeholders from another alveolus.\nthe context is the alveolus and not the dependency to ensure the binding is more obvious and not ultra nested. it can require you to split a bit the definition in the manifest.json but it is to simplify the maintenance.\nTo create a template, just define a standard alveolus with placeholders in descriptors. For example:\nHere we can see we just defined an alveolus requiring the placeholders:\nservice.name,\nservice.app,\nservice.type,\nservice.port.\nthis is a valid alveolus, if you provide all the placeholders you can install it directly but it is not recommended to ensure it is reproducible.\nTo use the template previously defined, just define another alveolus which binds the required placeholders in its definition:\nimport the template in the alveolus,\nBinds the placeholders of the imported template.\nif your alveolus imports a dependency reimporting the template, the placeholders nesting will be respected which means the context is always the deepest one.","title":"Create your own templates","url":"//www.yupiik.io/bundlebee/template.html"},{"lang":"en","lvl2":"Configuration","text":"Name: create-master-password.\nGenerate a master password if none exist (in ~/.m2/settings-security.xml)\nMaster password value, if auto it will be generated. Default value: auto","title":"Create-master-password","url":"//www.yupiik.io/bundlebee/commands/create-master-password.configuration.html"},{"lang":"en","lvl2":"Configuration","lvl3":"Inherited Global Configuration","text":"Name: delete.\nDelete an alveolus deployment by deleting all related descriptors. bundlebee.delete.propagationPolicy can be set in descriptor(s) metadata to force default CLI behavior for this descriptor.\nAlveolus name to rollback (in currently deployed version). When set to auto, it will look up all manifests found in the classpath (it is not recommended until you perfectly know what you do). If you set manifest option, alveolus is set to auto and there is a single alveolus in it, this will default to it instead of using classpath deployment. Default value: auto\nIf an integer > 0, how long (ms) to await for the actual deletion of components, default does not await.\nFor descriptors with await = true the max duration the test can last. It is per descriptor with await true and independent of awaitTimeout. Default value: 60000\nEnables to exclude descriptors from the command line. none to ignore. Value is comma separated. Note that using this setting, location is set to * so only the name is matched. Default value: none\nEnables to exclude locations (descriptor is set to *) from the command line. none to ignore. Value is comma separated. Default value: none\nRoot dependency to download to get the manifest. If set to auto it is assumed to be present in current classpath. Default value: auto\nIf set it will be added on REST calls to force a custom grace period (in seconds). Setting it to 0 enables to delete faster objects.\nManifest to load to start to find the alveolus. This optional setting mainly enables to use dependencies easily. Ignored if set to skip. Default value: skip\nfor these configurations, don’t hesitate to use ~/.bundlebeerc or --config-file (just remove the -- prefix from option keys).\nHow often to retry for a descriptor condition. Increasing it will reduce the pressure on the Kubernetes REST API (rate limiting for example). Default value: 500\nThe HTTP client connect timeout (in java Duration format), none can be used to ignore this setting. Default value: none\nThe HTTP client redirect policy. Default to NORMAL, can be set to ALWAYS or NEVER. Default value: NORMAL\nThe HTTP client version, none mean the JVM default (v2), HTTP_1_1 v1.1 and HTTP_2 v2.0. Default value: none\nHow many threads are allocated to async HTTP client, negative or zero value means to use common pool. Default value: -1\nWhen kubeconfig is not set the base API endpoint. Default value: http://localhost:8080\nWhen kubeconfig (explicit or not) is used, the context to use. If not set it is taken from the kubeconfig itself.\nWhen using custom metadata (bundlebee ones or timestamp to force a rollout), where to inject them. Default uses labels since it enables to query them later on but you can switch it to annotations. Default value: labels\nDefault value for deletions of propagationPolicy. Values can be Orphan, Foreground and Background. Default value: Foreground\nIf true http requests/responses are skipped. Note that dry run implies verbose=true for the http client. Note that as of today, all responses are mocked by a HTTP 200 and an empty JSON payload. Default value: false\nShould YAML/JSON be logged when it can’t be parsed. Default value: replicas,template,updateStrategy,persistentVolumeClaimRetentionPolicy,minReadySeconds,serviceName,selector\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself and for cases it is not enough, you can set force to true to delete the descriptor before applying it again (move from clusterip to nodeport or the opposite in a serice for ex). Note that you can set it to true in a descriptor annotation io.yupiik.bundlebee/force too to not be global. Default value: false\nHTTP timeout in ms, ignored if ⇐ 0. Default value: 60000\nEnables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema\nShould YAML/JSON be logged when it can’t be parsed. Default value: true\nWhen kubeconfig is not set the namespace to use. Default value: default\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself. Default value: false\nEnables to define resource mapping, syntax uses propeties one: s = /apis/….. Default value: ``\nIf true GET http requests are not skipped when dryRun is true. Default value: false\nList of kind of descriptors updates can be skipped, it is often useful for PersistentVolumeClaim. Default value: PersistentVolumeClaim\nWhen kubeconfig is set to explicit, the bearer token to use (if set).\nShould SSL connector be validated or not. Default value: true\nIf true http requests/responses to Kubernetes will be logged. Default value: false\nWhere to cache maven dependencies. If set to auto, $HOME/.m2/repository is used. Default value: auto\nIf true we only use cache value and never fallback on default maven settings.xml location. Default value: false\nWhen fetching a dependency using HTTP, the connection timeout for this dependency. Default value: 30000\nIf false we first try to read settings.xml file(s) in cache location before the default one. Default value: true\nEnable the download, i.e. ensure it runs only with local maven repository. Default value: false\nProperties to define the headers to set per repository, syntax is host1=headerName headerValue and it supports as much lines as used repositories. Note that you can use maven ~/.m2/settings.xml servers (potentially ciphered) username/password pairs. In this last case the server id must be bundlebee.. Still in settings.xml case, if the username is null the password value is used as raw Authorization header else username/password is encoded as a basic header.\nDefault release repository. Default value: https://repo.maven.apache.org/maven2/\nDefault snapshot repository, not set by default.\nKubeconfig location. If set to auto it will try to guess from your $HOME/.kube/config file until you set it so explicit where it will use other bundlebee.kube properties to create the client. The content can also be set inline!. Default value: auto","title":"Delete","url":"//www.yupiik.io/bundlebee/commands/delete.configuration.html"},{"lang":"en","lvl2":"Configuration","lvl3":"Inherited Global Configuration","text":"Name: deploy.\nBuild and deploy a project. It inherits from most configuration of build command and adds remote repository settings.\nBundle artifactId.\nWhere to build (for build/temp files). Default value: target\nIf true it will be added to your local maven repository too. Default value: true\nProject to build. Default value: .\nIf true it enables to upload an artifact even if already present. When auto it enables it for snapshots but not for releases. Default value: auto\nBundle groupId.\nIf not skip it will deploy the artifact on a remote repository (nexus v2 or v3). Syntax must be a URL pointing to the REST API (base URL). If you don’t set the userinfo (username:password) in the URL it will be looked up in your settings.xml - potentially ciphered - using the hostname as serverId until you force it with --serverId. Default value: skip\nNexus repository. It is the repository name the artifact(s) will be uploaded to. If auto, it will be maven-releases if the version is a release one and maven-snapshots otherwise. Default value: auto\nServerId to lookup from your maven settings.xml for remote deployment if enabled (nexus authentication).\nBundle version.\nfor these configurations, don’t hesitate to use ~/.bundlebeerc or --config-file (just remove the -- prefix from option keys).\nHow often to retry for a descriptor condition. Increasing it will reduce the pressure on the Kubernetes REST API (rate limiting for example). Default value: 500\nThe HTTP client connect timeout (in java Duration format), none can be used to ignore this setting. Default value: none\nThe HTTP client redirect policy. Default to NORMAL, can be set to ALWAYS or NEVER. Default value: NORMAL\nThe HTTP client version, none mean the JVM default (v2), HTTP_1_1 v1.1 and HTTP_2 v2.0. Default value: none\nHow many threads are allocated to async HTTP client, negative or zero value means to use common pool. Default value: -1\nWhen kubeconfig is not set the base API endpoint. Default value: http://localhost:8080\nWhen kubeconfig (explicit or not) is used, the context to use. If not set it is taken from the kubeconfig itself.\nWhen using custom metadata (bundlebee ones or timestamp to force a rollout), where to inject them. Default uses labels since it enables to query them later on but you can switch it to annotations. Default value: labels\nDefault value for deletions of propagationPolicy. Values can be Orphan, Foreground and Background. Default value: Foreground\nIf true http requests/responses are skipped. Note that dry run implies verbose=true for the http client. Note that as of today, all responses are mocked by a HTTP 200 and an empty JSON payload. Default value: false\nShould YAML/JSON be logged when it can’t be parsed. Default value: replicas,template,updateStrategy,persistentVolumeClaimRetentionPolicy,minReadySeconds,serviceName,selector\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself and for cases it is not enough, you can set force to true to delete the descriptor before applying it again (move from clusterip to nodeport or the opposite in a serice for ex). Note that you can set it to true in a descriptor annotation io.yupiik.bundlebee/force too to not be global. Default value: false\nHTTP timeout in ms, ignored if ⇐ 0. Default value: 60000\nEnables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema\nShould YAML/JSON be logged when it can’t be parsed. Default value: true\nWhen kubeconfig is not set the namespace to use. Default value: default\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself. Default value: false\nEnables to define resource mapping, syntax uses propeties one: s = /apis/….. Default value: ``\nIf true GET http requests are not skipped when dryRun is true. Default value: false\nList of kind of descriptors updates can be skipped, it is often useful for PersistentVolumeClaim. Default value: PersistentVolumeClaim\nWhen kubeconfig is set to explicit, the bearer token to use (if set).\nShould SSL connector be validated or not. Default value: true\nIf true http requests/responses to Kubernetes will be logged. Default value: false\nWhere to cache maven dependencies. If set to auto, $HOME/.m2/repository is used. Default value: auto\nIf true we only use cache value and never fallback on default maven settings.xml location. Default value: false\nWhen fetching a dependency using HTTP, the connection timeout for this dependency. Default value: 30000\nIf false we first try to read settings.xml file(s) in cache location before the default one. Default value: true\nEnable the download, i.e. ensure it runs only with local maven repository. Default value: false\nProperties to define the headers to set per repository, syntax is host1=headerName headerValue and it supports as much lines as used repositories. Note that you can use maven ~/.m2/settings.xml servers (potentially ciphered) username/password pairs. In this last case the server id must be bundlebee.. Still in settings.xml case, if the username is null the password value is used as raw Authorization header else username/password is encoded as a basic header.\nDefault release repository. Default value: https://repo.maven.apache.org/maven2/\nDefault snapshot repository, not set by default.\nKubeconfig location. If set to auto it will try to guess from your $HOME/.kube/config file until you set it so explicit where it will use other bundlebee.kube properties to create the client. The content can also be set inline!. Default value: auto","title":"Deploy","url":"//www.yupiik.io/bundlebee/commands/deploy.configuration.html"},{"lang":"en","lvl2":"Installation\nCreate your first alveolus\nGoing futher (K8s operator)\nDefine custom templates\nTesting your alveoli with JUnit 5","lvl3":"Java Mode\nBinary\nPre-requisite\nStart with a maven project\nStart from scratch (without Java and Maven)","text":"Ensure to use java >= 11.0.7 (previous Java 11 versions can work but have an issue with TLS HTTP client you can hit).\nDownload the bundlebee-core fat jar on https://repo.maven.apache.org/maven2/io/yupiik/bundlebee-core/ (ensure to take -fat.jar artifact).\nYou can now run it with the command: java -jar bundlebee-core--fat.jar.\nas of today, no release of BundleBee are on central yet so this script does not yet work.\nthis only works for linux amd64 computers.\nsince 1.0.3, once installed this way (and your PATH variable updated to include bundlebee) you can use check-update command to check if a new version is available: bundlebee check-update [--update true]. The --update true option enables to automatically replace the binary if needed, not specifying it will just log if a new version can be downloaded.\nBundleBee assumes it is installed itself indeed but depending how you package your alveolus it can require Java (>= 8) and Maven. If they are not installed on your system, we encourage you to use sdkman to do so.\nthis can be replaced by any zip packager and is not a strong requirement.\nThere are a ton of ways to create a maven projects but here is the simplest one:\nThen you can go in my-app-alveolus/. You can run mvn package to ensure your java/maven setup is correct.\nAt that stage we can start working on our alveolus but if you want to be \"purist\" you can clean up the default skaffolded project: rm -Rf src/test/ src/main/java/.\nTo start working on our alveolus, we will create src/main/resources/bundlebee folder: mkdir -p src/main/resources/bundlebee.\nAt that stage your project should look like:\nTo describe an application, you have to create a manifest.json file in this bundlebee folder:\nCreates an alveolus named \"hello\",\n\"hello\" alveolus will use as descriptor (.yaml) \"hello-world.yaml\" which will be found in src/main/resources/bundlebee/kubernetes,\nReferences Bundlebee base folder because we are deploying in exploded mode (and not in a packaged jar).\nThen add the referenced Kubernetes descriptor in kubernetes subfolder:\nHere nothing changes from a \"normal\" .yaml used with kubectl.\nNow you can deploy this executing bundlebee apply --alveolus hello --manifest ./src/main/resources/bundlebee/manifest.json.\nAnd that’s it, now hello world application should be up and running in your Kubernetes cluster.\nit is more than encouraged to name the kubernetes descriptor based on the project unique identifier. For example ...yaml. It will avoid conflicts when multiple alveolus are in the same classpath using native java mode and not file driven mode.\nYou could also have used the bundlebee-maven-plugin, simply add it in the plugins section of the pom.xml :\nThen you can deploy this executing mvn bundlebee:apply@hello-world.\nIn this part we will reuse the descriptors of Start with maven section so we will just show how to bundle without Java/Maven the alveolus.\nThe overall goal is to create a zip containing the manifest.json and the Kubernetes descriptor. Here is a small script helping to do that:\nThe name of the project (will create a root directory with this name)\nCreate the alveolus structure\nNow you can copy the descriptors as in Start with maven section in my-app-alveolus/bundlebee/ folder.\nOnce done we just have to bundle it as a zip. One option on UNIx system is to use this command:\nReuse the same setup than in previous script\nCreate a zip containing the alveolus structure using zip command\nAnd that’s it.\nthis trick to create a zip can be adapted to any language (javascript, typescript, go, python, ruby, …) and enables to bundle an alveolus in any build tool very easily.\nTo learn how to deploy directly an Alveolus on Kubernetes you can check out our Operator documentation.\nYou can use an alveolus as a template for others providing contextual placeholders. Learn more about this in template documentation.\nBundlebee provides a light testing framework integrated with JUnit 5 to ease the validation of alveoli. Learn more about this in junit5 documentation.","title":"Getting Started","url":"//www.yupiik.io/bundlebee/getting-started.html"},{"lang":"en","lvl2":"Configuration","lvl3":"Inherited Global Configuration","text":"Name: helm.\nConverts an alveolus deployment to a simple helm chart.\"// end of short description Note you will loose some features doing that but in case some rigid rules force to use helm it enables to still rely on bundlebee setup and share a helm chart to ops. Note that this conversion has some limitation in placeholder syntax for example (ensure no conflict under a key).\nAlveolus name to deploy. When set to auto, it will deploy all manifests found in the classpath. If you set manifest option, alveolus is set to auto and there is a single alveolus in it, this will default to it instead of using classpath deployment. Default value: auto\nHelm chart app version.\nHelm chart description.\nShould -SNAPSHOT be removed from the version if present. Default value: true\nHelm chart name, if auto it will be the alveolus name if a single one is selected else it is alveolus. Default value: auto\nHelm chart version.\nEnables to exclude descriptors from the command line. none to ignore. Value is comma separated. Note that using this setting, location is set to * so only the name is matched. Default value: none\nEnables to exclude locations (descriptor is set to *) from the command line. none to ignore. Value is comma separated. Default value: none\nRoot dependency to download to get the manifest. If set to auto it is assumed to be present in current classpath. Default value: auto\nManifest to load to start to deploy (a file path or inline). This optional setting mainly enables to use dependencies easily. Ignored if set to skip. Default value: skip\nWhere to create helm chart. Default value: none\nAn optional file path to a properties file where the keys are placeholders and the value some description to inject in values.yaml. Default value: true\nfor these configurations, don’t hesitate to use ~/.bundlebeerc or --config-file (just remove the -- prefix from option keys).\nHow often to retry for a descriptor condition. Increasing it will reduce the pressure on the Kubernetes REST API (rate limiting for example). Default value: 500\nThe HTTP client connect timeout (in java Duration format), none can be used to ignore this setting. Default value: none\nThe HTTP client redirect policy. Default to NORMAL, can be set to ALWAYS or NEVER. Default value: NORMAL\nThe HTTP client version, none mean the JVM default (v2), HTTP_1_1 v1.1 and HTTP_2 v2.0. Default value: none\nHow many threads are allocated to async HTTP client, negative or zero value means to use common pool. Default value: -1\nWhen kubeconfig is not set the base API endpoint. Default value: http://localhost:8080\nWhen kubeconfig (explicit or not) is used, the context to use. If not set it is taken from the kubeconfig itself.\nWhen using custom metadata (bundlebee ones or timestamp to force a rollout), where to inject them. Default uses labels since it enables to query them later on but you can switch it to annotations. Default value: labels\nDefault value for deletions of propagationPolicy. Values can be Orphan, Foreground and Background. Default value: Foreground\nIf true http requests/responses are skipped. Note that dry run implies verbose=true for the http client. Note that as of today, all responses are mocked by a HTTP 200 and an empty JSON payload. Default value: false\nShould YAML/JSON be logged when it can’t be parsed. Default value: replicas,template,updateStrategy,persistentVolumeClaimRetentionPolicy,minReadySeconds,serviceName,selector\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself and for cases it is not enough, you can set force to true to delete the descriptor before applying it again (move from clusterip to nodeport or the opposite in a serice for ex). Note that you can set it to true in a descriptor annotation io.yupiik.bundlebee/force too to not be global. Default value: false\nHTTP timeout in ms, ignored if ⇐ 0. Default value: 60000\nEnables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema\nShould YAML/JSON be logged when it can’t be parsed. Default value: true\nWhen kubeconfig is not set the namespace to use. Default value: default\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself. Default value: false\nEnables to define resource mapping, syntax uses propeties one: s = /apis/….. Default value: ``\nIf true GET http requests are not skipped when dryRun is true. Default value: false\nList of kind of descriptors updates can be skipped, it is often useful for PersistentVolumeClaim. Default value: PersistentVolumeClaim\nWhen kubeconfig is set to explicit, the bearer token to use (if set).\nShould SSL connector be validated or not. Default value: true\nIf true http requests/responses to Kubernetes will be logged. Default value: false\nWhere to cache maven dependencies. If set to auto, $HOME/.m2/repository is used. Default value: auto\nIf true we only use cache value and never fallback on default maven settings.xml location. Default value: false\nWhen fetching a dependency using HTTP, the connection timeout for this dependency. Default value: 30000\nIf false we first try to read settings.xml file(s) in cache location before the default one. Default value: true\nEnable the download, i.e. ensure it runs only with local maven repository. Default value: false\nProperties to define the headers to set per repository, syntax is host1=headerName headerValue and it supports as much lines as used repositories. Note that you can use maven ~/.m2/settings.xml servers (potentially ciphered) username/password pairs. In this last case the server id must be bundlebee.. Still in settings.xml case, if the username is null the password value is used as raw Authorization header else username/password is encoded as a basic header.\nDefault release repository. Default value: https://repo.maven.apache.org/maven2/\nDefault snapshot repository, not set by default.\nKubeconfig location. If set to auto it will try to guess from your $HOME/.kube/config file until you set it so explicit where it will use other bundlebee.kube properties to create the client. The content can also be set inline!. Default value: auto","title":"Helm","url":"//www.yupiik.io/bundlebee/commands/helm.configuration.html"},{"lang":"en","lvl2":"Configuration","lvl3":"Inherited Global Configuration","text":"Name: help.\nPrint help for all available commands.\nIf false args are not shown, enable a lighter output. Default value: true\nWhich command to show help for. If not set it will show all commands.\nIf false shared configuration (by all commands) is not shown. Default value: true\nfor these configurations, don’t hesitate to use ~/.bundlebeerc or --config-file (just remove the -- prefix from option keys).\nHow often to retry for a descriptor condition. Increasing it will reduce the pressure on the Kubernetes REST API (rate limiting for example). Default value: 500\nThe HTTP client connect timeout (in java Duration format), none can be used to ignore this setting. Default value: none\nThe HTTP client redirect policy. Default to NORMAL, can be set to ALWAYS or NEVER. Default value: NORMAL\nThe HTTP client version, none mean the JVM default (v2), HTTP_1_1 v1.1 and HTTP_2 v2.0. Default value: none\nHow many threads are allocated to async HTTP client, negative or zero value means to use common pool. Default value: -1\nWhen kubeconfig is not set the base API endpoint. Default value: http://localhost:8080\nWhen kubeconfig (explicit or not) is used, the context to use. If not set it is taken from the kubeconfig itself.\nWhen using custom metadata (bundlebee ones or timestamp to force a rollout), where to inject them. Default uses labels since it enables to query them later on but you can switch it to annotations. Default value: labels\nDefault value for deletions of propagationPolicy. Values can be Orphan, Foreground and Background. Default value: Foreground\nIf true http requests/responses are skipped. Note that dry run implies verbose=true for the http client. Note that as of today, all responses are mocked by a HTTP 200 and an empty JSON payload. Default value: false\nShould YAML/JSON be logged when it can’t be parsed. Default value: replicas,template,updateStrategy,persistentVolumeClaimRetentionPolicy,minReadySeconds,serviceName,selector\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself and for cases it is not enough, you can set force to true to delete the descriptor before applying it again (move from clusterip to nodeport or the opposite in a serice for ex). Note that you can set it to true in a descriptor annotation io.yupiik.bundlebee/force too to not be global. Default value: false\nHTTP timeout in ms, ignored if ⇐ 0. Default value: 60000\nEnables to tolerate custom attributes in the descriptors. Typically used to drop /$schema attribute which enables a nice completion in editors. Values are | delimited and are either a JSON-Pointer (wrapped in a remove JSON-Patch) or directly a JSON-Patch. Default value: /$schema\nShould YAML/JSON be logged when it can’t be parsed. Default value: true\nWhen kubeconfig is not set the namespace to use. Default value: default\nBy default a descriptor update is done using PATCH with strategic merge patch logic, if set to true it will use a plain PUT. Note that io.yupiik.bundlebee/putOnUpdate annotations can be set to true to force that in the descriptor itself. Default value: false\nEnables to define resource mapping, syntax uses propeties one: s = /apis/….. Default value: ``\nIf true GET http requests are not skipped when dryRun is true. Default value: false\nList of kind of descriptors updates can be skipped, it is often useful for PersistentVolumeClaim. Default value: PersistentVolumeClaim\nWhen kubeconfig is set to explicit, the bearer token to use (if set).\nShould SSL connector be validated or not. Default value: true\nIf true http requests/responses to Kubernetes will be logged. Default value: false\nWhere to cache maven dependencies. If set to auto, $HOME/.m2/repository is used. Default value: auto\nIf true we only use cache value and never fallback on default maven settings.xml location. Default value: false\nWhen fetching a dependency using HTTP, the connection timeout for this dependency. Default value: 30000\nIf false we first try to read settings.xml file(s) in cache location before the default one. Default value: true\nEnable the download, i.e. ensure it runs only with local maven repository. Default value: false\nProperties to define the headers to set per repository, syntax is host1=headerName headerValue and it supports as much lines as used repositories. Note that you can use maven ~/.m2/settings.xml servers (potentially ciphered) username/password pairs. In this last case the server id must be bundlebee.. Still in settings.xml case, if the username is null the password value is used as raw Authorization header else username/password is encoded as a basic header.\nDefault release repository. Default value: https://repo.maven.apache.org/maven2/\nDefault snapshot repository, not set by default.\nKubeconfig location. If set to auto it will try to guess from your $HOME/.kube/config file until you set it so explicit where it will use other bundlebee.kube properties to create the client. The content can also be set inline!. Default value: auto","title":"Help","url":"//www.yupiik.io/bundlebee/commands/help.configuration.html"},{"lang":"en","lvl2":"Overall architecture\nManifest\nDeployment and Dependency Management\nCustomize descriptors\nDeploy a dependency (or descriptor) conditionally\nFilter manifest at command time\nWindows and CLI","lvl3":"Manifest Descriptor\nJSON-Schema\nMore placeholders","text":"One of the BundleBee goals is to inherit from the well known and supported Apache Maven infrastructure. In other words, the goal is to be able to reuse Maven registries (central, custom nexus, artifactory, …) to store application descriptors. It also leverage the well know java packaging (jar or zip) to ensure a strong storage reliability in these systems.\nOne direct benefit is that it becomes very easy to have an immutable system once deployed and therefore a better tracability of what is deployed.\nOverall, BundleBee will manipulate what we call alveolus which are basically just a set of descriptors. An alveolus is a zip or a jar which is structured this way:\nA bundlebee folder contains all the descriptors\nA manifest.json contains the list of application or library this alveolus provides\nA kubenetes folder contains the list of descriptors used by alveoli\nManifest is the central point of the system. It provides the unique identifier of your recipe (application/library) and what to do to set it up.\nHere is its configuration specification:\nBundleBee manifest descriptor.\nName\nJSON Name\nType\nDescription\ninterpolateAlveoli\nbool\nEnables to consider all alveoli have their interpolateDescriptors descriptor set to true, you can still set it to false if you want to disable it for one.\nManifest.alveoli\nalveoli\narray of object\nList of described applications/libraries.\nManifest.references\nreferences\nList of files referenced as other manifests. They are merged with this (main) manifest by appending requirements and alveoli. It is relative to this manifest location. Important: it is only about the same module references, external references are dependencies in an alveoli. It enables to split a huge manifest.json for an easier maintenance.\nManifest.requirements\nrequirements\nPre manifest execution checks (bundlebee version typically). Avoids to install using a bundlebee version not compatible with the alveoli. Can be fully omitted.\nchainDependencies\nShould dependencies be installed one after the other or in parallel (default). It is useful when you install a namespace for example which must be awaited before next dependencies are installed.\ninterpolateDescriptors\nEnables to consider all descriptors have their interpolate descriptor set to true, you can still set it to false if you want to disable it for one. If not set, interpolateAlveoli flag from the manifest.\nname\nstring\nName of the alveolus (recipe). It must be unique accross the whole classpath. Using maven style identifier, it is recommended to name it :: using maven filtering but it is not enforced.\nversion\nIf name does not follow :: naming (i.e. version can’t be extracted from the name) then you can specify the version there. Note that if set, this is used in priority (explicit versus deduced).\nAlveolus.dependencies\ndependencies\nDependencies of this alveolus. It is a way to import transitively a set of descriptors.\nAlveolus.descriptors\ndescriptors\nList of descriptors to install for this alveolus. This is required even if an empty array.\nAlveolus.excludedDescriptors\nexcludedDescriptors\nList of descriptors to ignore for this alveolus (generally coming from dependencies).\nAlveolus.patches\npatches\nPatches on descriptors. It enables to inject configuration in descriptors by patching (using JSON-Patch or plain interpolation with ${key} values) their JSON representation. The key is the descriptor name and each time the descriptor is found it will be applied.\nplaceholders\nobject\nLocal placeholders for this particular alveolus and its dependencies. It is primarly intended to be able to create a template alveolus and inject the placeholders inline.\nlocation\nWhere to find the alveolus. Note it will ensure the jar is present on the local maven repository.\nAlveolus name.\nDescriptor.includeIf\nincludeIf\nConditions to include this dependency. Enables for example to have an environment variable enabling part of the stack (ex: MONITORING=true)\nawait\nIf set to true, apply/delete commands will await the actual creation of the resource (GET /x returns a HTTP 200) before continuing to process next resources. It is useful for namespaces for example to ensure applications can be created in the newly created namespace. It avoids to run and rerun apply command in practise. For more advanced tests, use awaitConditions.\nawaitOnDelete\nOn delete we rarely want to check the resource exists before but in these rare case you can set this toggle to true.\ninterpolate\nIf set to true, it will interpolate the descriptor just before applying it - i.e. after it had been patched if needed. You can use -- to inject bindings set as {{config-key:-default value}}. If not set, interpolateDescriptors flag from the alveolus will be used.\nOptional, if coming from another manifest, the dependency to download to get the alveolus.\nName of the descriptor to install. For kubernetes descriptors you can omit the .yaml extension.\ntype\nType of this descriptor. For now only kubernetes is supported. It also defines in which folder under bundlebee the descriptor(s) are looked for from its name.\nDescriptor.awaitConditions\nawaitConditions\nTest to do on created/destroyed resources, enables to synchronize and await kubernetes actually starts some resource. For apply and delete commands, descriptorAwaitTimeout is still applied. Note that if you use multiple array entries for the same command it will be evaluated with an AND.\nConditions to include this descriptor.\noperator\nOperator to combine the conditions. Potential values: ANY (At least one condition must match.),ALL (All conditions must match.).\nConditions.conditions\nconditions\nList of condition to match according operator.\nkey\nExpected key. If empty/null condition is ignored. If read value is null it defaults to an empty string.\nnegate\nShould the condition be reversed (ie \"not in this case\").\nType of condition. Potential values: ENV (Key is read is process environment variables.),SYSTEM_PROPERTY (Key is read is process system properties.).\nvalue\nExpected value. If empty/null, true is assumed. Note that empty is allowed.\ncommand\nCommand to apply these conditions to, if not set it will be applied on apply command only. Note that for now only apply and delete commands are supported, others will be ignored.\nAwaitConditions.conditions\nconditionType\nWhen condition type is STATUS_CONDITION it is the expected type of the condition. This is ignored when condition type is JSON_POINTER.\noperatorType\nThe operation to evaluate if this condition is true or not. (for type=JSON_POINTER). Potential values: EXISTS (JSON Pointer exists model.),MISSING (JSON Pointer does not exist in the resource model.),EQUALS (JSON Pointer value is equal to (stringified comparison) value.),NOT_EQUALS (JSON Pointer is different from the provided value.),EQUALS_IGNORE_CASE (JSON Pointer value is equal (ignoring case) to (stringified comparison) value.),NOT_EQUALS_IGNORE_CASE (JSON Pointer is different (ignoring case) from the provided value.),CONTAINS (JSON Pointer contains the configured value.).\npointer\nJSON Pointer to read from the resource. It can for example be on /status/phase to await a namespace creation. (for type=JSON_POINTER).\nType of condition. Potential values: JSON_POINTER (JSON Pointer evaluation (fully custom).),STATUS_CONDITION (Evaluate items in /status/conditions.).\nWhen condition type is JSON_POINTER and operatorType needs a value (EQUALS for example), the related value. It can be Active if you test namespace /status/phase for example. When condition type is STATUS_CONDITION it is the expected status.\nThe container of the descriptor (maven coordinates generally).\nName of the descriptor (as declared, ie potentially without the extension).\ndescriptorName\nThe descriptor to patch. It can be any descriptor, including transitive ones. It can be * to patch all descriptors (/metadata/label/app for example) or regex: to match descriptor names with a regex.\nIf set to true, it will interpolate the patch from the execution configuration which means you can use -- to inject bindings too. An interesting interpolation is the ability to extract the ip/host of the host machine (minikube ip equivalent) using the kubeconfig file. Syntax is the following one: {{kubeconfig.cluster.minikube.ip}} or more generally {{kubeconfig.cluster..ip}}. You can also await for some secret with this syntax {{kubernetes..serviceaccount..secrets..data.[.]}}. This is particular useful to access freshly created service account tokens for example.\npatch\nJSON-Patch to apply on the JSON representation of the descriptor. It enables to inject configuration in descriptors for example, or changing some name/application.\nConditions to include this patch. Enables for example to have an environment variable enabling part of the stack (ex: MONITORING=true)\npath\nRelative or absolute - starting by a / - location (referenced to the base directory of manifest.json). For example my-manifest.json will resolve to /path/to/bundlebee/my-manifest.json in a folder and /bundlebee/my-manifest.json in a jar. Important: for resources (jar/classpath), the classloader is used so ensure your name is unique accross your classpath (we recommend you to prefix it with the module name, ex :`/bundlebee/my-module.sub-manifest.json` or use a dedicated subfolder (/bundlebee/my-module/sub.json).\nmaxBundlebeeVersion\nMinimum bundlebee version, use `*`to replace any digit in a segment. Note that snapshot is ignored in the comparison for convenience. It is an inclusive comparison.\nminBundlebeeVersion\nMinimum bundlebee version, use * to replace any digit in a segment. Note that snapshot is ignored in the comparison for convenience. It is an inclusive comparison.\nforbiddenVersions\narray of string\nList of forbidden version (due to a bug or equivalent). Here too snapshot suffix is ignored. is usable there too to replace any digit in a segment (ex: 1..). Note that 1. would NOT match 1.., version are always 3 segments.\nmanifest content can be wrapped in a bundlebee key (you wrap the whole content) which enables you to add other metadata in the manifest and still reuse BundleeBee JSON-Schema for the validation (by composition).\nIf you use JSON-Schema facilities in your preferred editor, here is the raw JSON-Schema for the manifest descriptor:\nyou can also use last version from this link.\nA manifest can reference descriptors in other alveoli, it just requires to reference them to let bundlebee find them.\nThere are mainly two ways to deploy an alveolus:\nClasspath mode: you put all your zip/jar in the classpath. This mode requires there is no conflict between descriptor names (which is the recommended practise) and it will never look for external descriptors. It is typically a recommended mode to avoid network I/O except with the Kubernetes cluster.\nFetch mode: in this mode, a missing descriptor in the classpath will look for descriptor.location and lookup the jar/zip referenced by this location (generally a maven coordinate in the form groupId:artifactId:version). It will first use your local Maven repository but can download the jar/zip if missing locally. Then the jar/zip is read and descriptors are looked up from there. This mode is nicer when depending on a lot of external alveoli but requires I/O to grab the dependencies.\nIndeed, you can bundle all your stack and hardcode your configuration or create one alveolus per environment. This is one option which works well and enable to version its configuration.\nHowever, for testing purposes, it is also neat to be able to patch descriptors on the fly. For that you can use descriptor.patches in the manifest which will transitively enable to patch the descriptors - even the ones you don’t own - using JSON-Patch and interpolations.\nHere are some examples.\nWe add to the alveolus a list of patches to apply on some descriptors\nWe reference the descriptor to patch\nWe enable interpolation from Microprofile Config (which include CLI args)\nWe define the JSON-Patch to use (optional, interpolation will also interpolate the descriptor if designed to be interpolated)\nWe use an interpolation in the configuration in the JSON-Patch replace operation which replaces the data of the referenced ConfigMap\nthis mecanism is very useful for ConfigMap descriptors but also PersistenceVolume since you can now patch `/spec/hostPath `easily too.\nIn some case it can be neat to be able to not deploy part of the stack. It is typically the case when you wrote a monitoring-full alveolus (ie with some optional services functionally). In such a case you can condition dependencies and descriptor deployment:\nused on descriptors and using a complete set of conditions for descriptors you can handle environments this way (ENV=preprod for descriptor preprod.configmap for example).\nIn some case it can be needed to evaluate some values of the manifest when executing the command. Even if not recommended it can be done using {{xxx}} placeholders - read from environment variables and system properties.\nWith this manifest you can value project.version and bundlebee.version using the command line:\nPlaceholders can use some keywords to get some particular values:\nbundlebee-strip:: strips the provided value,\nbundlebee-strip-leading:: strips the provided value at the beginning,\nbundlebee-strip-trailing:: strips the provided value at the end,\nbundlebee-indent::: indents a value with the provided space size, it is generally combined with another interpolation (file ones in particular) as value, ex {{bundlebee-indent:8:{{bundlebee-inline-file:myfile.txt}}}},\nbundlebee-inline-file:: load the file content as value,\nbundlebee-base64-file:: converts the file in base64 (useful to write data:xxxx, values for ex keeping the raw file in the filesystem, very helpful for images),\nbundlebee-base64:: encodes in base64 the text,\nbundlebee-digest:BASE64|HEX,,: computes the digest of the text encoded in base64 or hexa format (useful to read files like ConfigMap or Secret and inject their digest value in a Deployment annotations to force its reload for example),\nbundlebee-quote-escaped-inline-file:: load the file content as a quoted value,\nbundlebee-json-inline-file:: load the file content as a JSON string value - without quotes,\nbundlebee-json-string:content: escapes a string to be a JSON string (useful when you inject with bundlebee-json-inline-file a string in another string like in JSON ConfigMap in a JSON configuration),\nbundlebee-maven-server-username:: extract from your maven settings.xml a server username (see configuration for a custom settings.xml location),\nbundlebee-maven-server-password:: extract from your maven settings.xml a server password (potentially deciphered),\nbundlebee-kubernetes-namespace: the Kubernetes namespace defined in the HttpKubeClient,\nkubeconfig.cluster..ip: extract cluster IP from your kubeconfig,\ntimestamp: current time in milliseconds (since epoch),\ntimestampSec: current time in seconds (since epoch),\nnow: OffsetDateTime.now() value,\ndate:: format OffsetDateTime.now() value using the provided pattern,\nnowUTC: OffsetDateTime.now() value with UTC ZoneId,\nkubernetes..serviceaccount..secrets..data.[.]: secret value looked up through Kubernetes API.\njsr223: