{
  "description": "KubeletConfig describes a customized Kubelet configuration. \n Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).",
  "type": "object",
  "required": [
    "spec"
  ],
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "KubeletConfigSpec defines the desired state of KubeletConfig",
      "type": "object",
      "properties": {
        "autoSizingReserved": {
          "type": "boolean"
        },
        "kubeletConfig": {
          "description": "kubeletConfig fields are defined in kubernetes upstream. Please refer to the types defined in the version/commit used by OpenShift of the upstream kubernetes. It's important to note that, since the fields of the kubelet configuration are directly fetched from upstream the validation of those values is handled directly by the kubelet. Please refer to the upstream version of the relevant kubernetes for the valid values of these fields. Invalid values of the kubelet configuration fields may render cluster nodes unusable.",
          "type": "object",
          "x-kubernetes-preserve-unknown-fields": true
        },
        "logLevel": {
          "type": "integer",
          "format": "int32"
        },
        "machineConfigPoolSelector": {
          "description": "MachineConfigPoolSelector selects which pools the KubeletConfig shoud apply to. A nil selector will result in no pools being selected.",
          "type": "object",
          "properties": {
            "matchExpressions": {
              "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
              "type": "array",
              "items": {
                "description": "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
                "type": "object",
                "required": [
                  "key",
                  "operator"
                ],
                "properties": {
                  "key": {
                    "description": "key is the label key that the selector applies to.",
                    "type": "string"
                  },
                  "operator": {
                    "description": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
                    "type": "string"
                  },
                  "values": {
                    "description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  }
                },
                "additionalProperties": false
              }
            },
            "matchLabels": {
              "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
              "type": "object",
              "additionalProperties": {
                "type": "string"
              }
            }
          },
          "x-kubernetes-map-type": "atomic",
          "additionalProperties": false
        },
        "tlsSecurityProfile": {
          "description": "If unset, the default is based on the apiservers.config.openshift.io/cluster resource. Note that only Old and Intermediate profiles are currently supported, and the maximum available minTLSVersion is VersionTLS12.",
          "type": "object",
          "properties": {
            "custom": {
              "description": "custom is a user-defined TLS security profile. Be extremely careful using a custom profile as invalid configurations can be catastrophic. An example custom profile looks like this: \n ciphers: - ECDHE-ECDSA-CHACHA20-POLY1305 - ECDHE-RSA-CHACHA20-POLY1305 - ECDHE-RSA-AES128-GCM-SHA256 - ECDHE-ECDSA-AES128-GCM-SHA256 minTLSVersion: VersionTLS11",
              "type": "object",
              "properties": {
                "ciphers": {
                  "description": "ciphers is used to specify the cipher algorithms that are negotiated during the TLS handshake.  Operators may remove entries their operands do not support.  For example, to use DES-CBC3-SHA  (yaml): \n ciphers: - DES-CBC3-SHA",
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "minTLSVersion": {
                  "description": "minTLSVersion is used to specify the minimal version of the TLS protocol that is negotiated during the TLS handshake. For example, to use TLS versions 1.1, 1.2 and 1.3 (yaml): \n minTLSVersion: VersionTLS11 \n NOTE: currently the highest minTLSVersion allowed is VersionTLS12",
                  "type": "string",
                  "enum": [
                    "VersionTLS10",
                    "VersionTLS11",
                    "VersionTLS12",
                    "VersionTLS13"
                  ]
                }
              },
              "nullable": true,
              "additionalProperties": false
            },
            "intermediate": {
              "description": "intermediate is a TLS security profile based on: \n https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29 \n and looks like this (yaml): \n ciphers: - TLS_AES_128_GCM_SHA256 - TLS_AES_256_GCM_SHA384 - TLS_CHACHA20_POLY1305_SHA256 - ECDHE-ECDSA-AES128-GCM-SHA256 - ECDHE-RSA-AES128-GCM-SHA256 - ECDHE-ECDSA-AES256-GCM-SHA384 - ECDHE-RSA-AES256-GCM-SHA384 - ECDHE-ECDSA-CHACHA20-POLY1305 - ECDHE-RSA-CHACHA20-POLY1305 - DHE-RSA-AES128-GCM-SHA256 - DHE-RSA-AES256-GCM-SHA384 minTLSVersion: VersionTLS12",
              "type": "object",
              "nullable": true
            },
            "modern": {
              "description": "modern is a TLS security profile based on: \n https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility \n and looks like this (yaml): \n ciphers: - TLS_AES_128_GCM_SHA256 - TLS_AES_256_GCM_SHA384 - TLS_CHACHA20_POLY1305_SHA256 minTLSVersion: VersionTLS13 \n NOTE: Currently unsupported.",
              "type": "object",
              "nullable": true
            },
            "old": {
              "description": "old is a TLS security profile based on: \n https://wiki.mozilla.org/Security/Server_Side_TLS#Old_backward_compatibility \n and looks like this (yaml): \n ciphers: - TLS_AES_128_GCM_SHA256 - TLS_AES_256_GCM_SHA384 - TLS_CHACHA20_POLY1305_SHA256 - ECDHE-ECDSA-AES128-GCM-SHA256 - ECDHE-RSA-AES128-GCM-SHA256 - ECDHE-ECDSA-AES256-GCM-SHA384 - ECDHE-RSA-AES256-GCM-SHA384 - ECDHE-ECDSA-CHACHA20-POLY1305 - ECDHE-RSA-CHACHA20-POLY1305 - DHE-RSA-AES128-GCM-SHA256 - DHE-RSA-AES256-GCM-SHA384 - DHE-RSA-CHACHA20-POLY1305 - ECDHE-ECDSA-AES128-SHA256 - ECDHE-RSA-AES128-SHA256 - ECDHE-ECDSA-AES128-SHA - ECDHE-RSA-AES128-SHA - ECDHE-ECDSA-AES256-SHA384 - ECDHE-RSA-AES256-SHA384 - ECDHE-ECDSA-AES256-SHA - ECDHE-RSA-AES256-SHA - DHE-RSA-AES128-SHA256 - DHE-RSA-AES256-SHA256 - AES128-GCM-SHA256 - AES256-GCM-SHA384 - AES128-SHA256 - AES256-SHA256 - AES128-SHA - AES256-SHA - DES-CBC3-SHA minTLSVersion: VersionTLS10",
              "type": "object",
              "nullable": true
            },
            "type": {
              "description": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters. Old, Intermediate and Modern are TLS security profiles based on: \n https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations \n The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure.  Depending on precisely which ciphers are available to a process, the list may be reduced. \n Note that the Modern profile is currently not supported because it is not yet well adopted by common software libraries.",
              "type": "string",
              "enum": [
                "Old",
                "Intermediate",
                "Modern",
                "Custom"
              ]
            }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": false
    },
    "status": {
      "description": "KubeletConfigStatus defines the observed state of a KubeletConfig",
      "type": "object",
      "properties": {
        "conditions": {
          "description": "conditions represents the latest available observations of current state.",
          "type": "array",
          "items": {
            "description": "KubeletConfigCondition defines the state of the KubeletConfig",
            "type": "object",
            "properties": {
              "lastTransitionTime": {
                "description": "lastTransitionTime is the time of the last update to the current status object.",
                "type": "string",
                "format": "date-time",
                "nullable": true
              },
              "message": {
                "description": "message provides additional information about the current condition. This is only to be consumed by humans.",
                "type": "string"
              },
              "reason": {
                "description": "reason is the reason for the condition's last transition.  Reasons are PascalCase",
                "type": "string"
              },
              "status": {
                "description": "status of the condition, one of True, False, Unknown.",
                "type": "string"
              },
              "type": {
                "description": "type specifies the state of the operator's reconciliation functionality.",
                "type": "string"
              }
            },
            "additionalProperties": false
          }
        },
        "observedGeneration": {
          "description": "observedGeneration represents the generation observed by the controller.",
          "type": "integer",
          "format": "int64"
        }
      },
      "additionalProperties": false
    }
  }
}