Packages CR (v1alpha1)

Packages

Field	Type	Description
spec	Spec

Spec

Field	Type	Description
network	Network	Network configuration for the package
monitor	Monitor[]	Create Service or Pod Monitor configurations
sso	Sso[]	Create SSO client configurations
caBundle	CaBundle	CA bundle configuration for the package

Network

Field	Type	Description
expose	Expose[]	Expose a service through UDS Core managed ingress. HTTP entries use Istio; UDP entries use Envoy Gateway.
allow	Allow[]	Allow specific traffic (namespace will have a default-deny policy)
serviceMesh	ServiceMesh	Service Mesh configuration for the package

Expose

Field	Type	Description
description	string	A description of this expose entry, this will become part of the generated resource name
protocol	string (enum): HTTP UDP	The routing protocol for this expose entry. When set to `UDP`, the entry routes through Envoy Gateway instead of Istio. Hostname routing fields (`host`, `domain`, `advancedHTTP`, `match`) are invalid for UDP entries. UDP traffic is not protected by Istio AuthorizationPolicy or mTLS.
host	string	The hostname to expose the service on
gateway	string	The name of the gateway to expose the service on. HTTP defaults to tenant when omitted. UDP uses the UDS Core managed default Gateway when omitted. For UDP user-managed Gateways, this value is used as both the Gateway name and namespace, and that namespace must be deployed via a Zarf package (for the private registry image pull secret) and enrolled in the cluster's service mesh (for the mTLS-protected connection to the Envoy Gateway controller); otherwise the managed proxy will fail to start.
domain	string	The domain to expose the service on, only valid for additional gateways (not tenant, admin, or passthrough)
service	string	The name of the service to expose
port	number	The port number to expose
selector		Selector for Pods targeted by the selected Services (so the NetworkPolicy can be generated correctly).
targetPort	number	The service targetPort. This defaults to port and is only required if the service port is different from the target port (so the NetworkPolicy can be generated correctly).
advancedHTTP	AdvancedHTTP	Advanced HTTP settings for the route.
match	Match[]	Match conditions to be satisfied for the rule to be activated. Not permitted when using the passthrough gateway.
podLabels		Deprecated: use selector
uptime	Uptime	Uptime monitoring configuration for this exposed service. Presence of checks.paths enables monitoring.
annotations		Consumer-extensible per-endpoint metadata. Keys should be namespaced (e.g. 'portal.uds.dev/visible', 'uds.dev/title', etc.).

AdvancedHTTP

Field	Type	Description
corsPolicy	CorsPolicy	Cross-Origin Resource Sharing policy (CORS).
directResponse	DirectResponse	A HTTP rule can either return a direct_response, redirect or forward (default) traffic.
headers	Headers
match	Match[]	Match conditions to be satisfied for the rule to be activated. Not permitted when using the passthrough gateway.
redirect	Redirect	A HTTP rule can either return a direct_response, redirect or forward (default) traffic.
retries	Retries	Retry policy for HTTP requests.
rewrite	Rewrite	Rewrite HTTP URIs and Authority headers.
timeout	string	Timeout for HTTP requests, default is disabled.

CorsPolicy

Field	Type	Description
allowCredentials	boolean	Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials.
allowHeaders	string[]	List of HTTP headers that can be used when requesting the resource.
allowMethods	string[]	List of HTTP methods allowed to access the resource.
allowOrigin	string[]
allowOrigins	AllowOrigins[]	String patterns that match allowed origins.
exposeHeaders	string[]	A list of HTTP headers that the browsers are allowed to access.
maxAge	string	Specifies how long the results of a preflight request can be cached.
unmatchedPreflights	string (enum): UNSPECIFIED FORWARD IGNORE	Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. Valid Options: FORWARD, IGNORE

AllowOrigins

Field	Type	Description
exact	string
prefix	string
regex	string	[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).

DirectResponse

Field	Type	Description
body	Body	Specifies the content of the response body.

Body

Field	Type	Description
bytes	string	response body as base64 encoded bytes.
string	string

Headers

Field	Type	Description
request	Request
response	Response

Request

Field	Type	Description
add
remove	string[]
set

Response

Field	Type	Description
add
remove	string[]
set

Match

Field	Type	Description
ignoreUriCase	boolean	Flag to specify whether the URI matching should be case-insensitive.
method	Method	HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).
name	string	The name assigned to a match.
queryParams		Query parameters for matching.
uri	Uri	URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).

Method

Field	Type	Description
exact	string
prefix	string
regex	string	[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).

Uri

Field	Type	Description
exact	string
prefix	string
regex	string	[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).

Redirect

Field	Type	Description
authority	string	On a redirect, overwrite the Authority/Host portion of the URL with this value.
derivePort	string (enum): FROM_PROTOCOL_DEFAULT FROM_REQUEST_PORT	On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT
port	integer	On a redirect, overwrite the port portion of the URL with this value.
redirectCode	integer	On a redirect, Specifies the HTTP status code to use in the redirect response.
scheme	string	On a redirect, overwrite the scheme portion of the URL with this value.
uri	string	On a redirect, overwrite the Path portion of the URL with this value.

Retries

Field	Type	Description
attempts	integer	Number of retries to be allowed for a given request.
backoff	string	Specifies the minimum duration between retry attempts.
perTryTimeout	string	Timeout per attempt for a given request, including the initial call and any retries.
retryIgnorePreviousHosts	boolean	Flag to specify whether the retries should ignore previously tried hosts during retry.
retryOn	string	Specifies the conditions under which retry takes place.
retryRemoteLocalities	boolean	Flag to specify whether the retries should retry to other localities.

Rewrite

Field	Type	Description
authority	string	rewrite the Authority/Host header with this value.
uri	string	rewrite the path (or the prefix) portion of the URI with this value.
uriRegexRewrite	UriRegexRewrite	rewrite the path portion of the URI with the specified regex.

UriRegexRewrite

Field	Type	Description
match	string	[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).
rewrite	string	The string that should replace into matching portions of original URI.

Match

Field	Type	Description
ignoreUriCase	boolean	Flag to specify whether the URI matching should be case-insensitive.
method	Method	HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).
name	string	The name assigned to a match.
queryParams		Query parameters for matching.
uri	Uri	URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).

Method

Field	Type	Description
exact	string
prefix	string
regex	string	[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).

Uri

Field	Type	Description
exact	string
prefix	string
regex	string	[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).

Uptime

Field	Type	Description
checks	Checks	HTTP probe checks configuration for blackbox-exporter. Defining paths enables uptime monitoring.

Checks

Field	Type	Description
paths	string[]	List of paths to check for uptime monitoring, appended to the host.

Allow

Field	Type	Description
labels		The labels to apply to the policy
description	string	A description of the policy, this will become part of the policy name
direction	string (enum): Ingress Egress	The direction of the traffic
selector		Labels to match pods in the namespace to apply the policy to. Leave empty to apply to all pods in the namespace
remoteNamespace	string	The remote namespace to allow traffic to/from. Use * or empty string to allow all namespaces
remoteSelector		The remote pod selector labels to allow traffic to/from
remoteGenerated	string (enum): KubeAPI KubeNodes IntraNamespace CloudMetadata Anywhere	Custom generated remote selector for the policy
remoteCidr	string	Custom generated policy CIDR
remoteHost	string	Remote host to allow traffic out to
remoteProtocol	string (enum): TLS HTTP TCP UDP	The protocol for this Allow entry. When using `remoteHost`, prefer `TLS` or `HTTP`; `TLS` is the default if omitted. For all other remotes, use `TCP` or `UDP` based on the connection type; `TCP` is the default if omitted. `UDP` cannot be combined with `remoteHost`.
port	number	The port to allow (transport protocol defaults to TCP unless `remoteProtocol` is set)
ports	number[]	A list of ports to allow (transport protocol defaults to TCP unless `remoteProtocol` is set)
remoteServiceAccount	string	The remote service account to restrict incoming traffic from within the remote namespace. Only valid for Ingress rules.
serviceAccount	string	The service account to restrict outgoing traffic from within the package namespace. Only valid for Egress rules.
podLabels		Deprecated: use selector
remotePodLabels		Deprecated: use remoteSelector

ServiceMesh

Field	Type	Description
mode	string (enum): sidecar ambient	Set the service mesh mode for this package (namespace), defaults to ambient

Monitor

Field	Type	Description
description	string	A description of this monitor entry, this will become part of the ServiceMonitor name
portName	string	The port name for the serviceMonitor
targetPort	number	The service targetPort. This is required so the NetworkPolicy can be generated correctly.
selector		Selector for Services that expose metrics to scrape
podSelector		Selector for Pods targeted by the selected Services (so the NetworkPolicy can be generated correctly). Defaults to `selector` when not specified.
path	string	HTTP path from which to scrape for metrics, defaults to `/metrics`
kind	string (enum): PodMonitor ServiceMonitor	The type of monitor to create; PodMonitor or ServiceMonitor. ServiceMonitor is the default.
fallbackScrapeProtocol	string (enum): OpenMetricsText0.0.1 OpenMetricsText1.0.0 PrometheusProto PrometheusText0.0.4 PrometheusText1.0.0	The protocol for Prometheus to use if a scrape returns a blank, unparsable, or otherwise invalid Content-Type
authorization	Authorization	Authorization settings.

Authorization

Field	Type	Description
credentials	Credentials	Selects a key of a Secret in the namespace that contains the credentials for authentication.
type	string	Defines the authentication type. The value is case-insensitive. "Basic" is not a supported value. Default: "Bearer"

Credentials

Field	Type	Description
key	string	The key of the secret to select from. Must be a valid secret key.
name	string	Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional	boolean	Specify whether the Secret or its key must be defined

Sso

Field	Type	Description
enableAuthserviceSelector		Labels to match pods to automatically protect with authservice. Leave empty to disable authservice protection
secretConfig	SecretConfig	Configuration for the generated Kubernetes Secret
clientId	string	The client identifier registered with the identity provider.
secret	string	The OAuth/OIDC client secret value sent to Keycloak. Typically left blank and auto-generated by Keycloak. Not to be confused with secretConfig, which configures the Kubernetes Secret resource.
secretName	string	Deprecated: use secretConfig.name
secretLabels		Deprecated: use secretConfig.labels
secretAnnotations		Deprecated: use secretConfig.annotations
secretTemplate		Deprecated: use secretConfig.template
name	string	Specifies display name of the client
description	string	A description for the client, can be a URL to an image to replace the login logo
baseUrl	string	Default URL to use when the auth server needs to redirect or link back to the client.
adminUrl	string	This URL will be used for every binding to both the SP's Assertion Consumer and Single Logout Services.
protocol	string (enum): openid-connect saml	Specifies the protocol of the client, either 'openid-connect' or 'saml'
attributes		Specifies attributes for the client.
protocolMappers	ProtocolMappers[]	Protocol Mappers to configure on the client
rootUrl	string	Root URL appended to relative URLs
redirectUris	string[]	Valid URI pattern a browser can redirect to after a successful login. Simple wildcards are allowed. For example, a wildcard may follow the path prefix 'https://unicorns.uds.dev/'
webOrigins	string[]	Allowed CORS origins. To permit all origins of Valid Redirect URIs, add '+'. This does not include the '*' wildcard though. To permit all origins, explicitly add '*'.
enabled	boolean	Whether the SSO client is enabled
alwaysDisplayInConsole	boolean	Always list this client in the Account UI, even if the user does not have an active session.
fullScopeAllowed	boolean	Controls which roles Keycloak includes in tokens for this client. When enabled, Keycloak includes all roles assigned to the authenticated subject. When disabled, Keycloak limits roles according to the client's role scope mappings and linked client scopes. When omitted, UDS Core preserves Keycloak's normal behavior. Set this to false whenever possible to limit role scope and harden security.
standardFlowEnabled	boolean	Enables the standard OpenID Connect redirect based authentication with authorization code.
serviceAccountsEnabled	boolean	Enables the client credentials grant based authentication via OpenID Connect protocol.
publicClient	boolean	Defines whether the client requires a client secret for authentication
clientAuthenticatorType	string (enum): client-secret client-jwt	The client authenticator type
defaultClientScopes	string[]	Default client scopes
groups	Groups	The client SSO group type

SecretConfig

Field	Type	Description
name	string	The name of the secret to store the client secret
labels		Additional labels to apply to the generated secret, can be used for pod reloading
annotations		Additional annotations to apply to the generated secret, can be used for pod reloading with a selector
template		A template for the generated secret

ProtocolMappers

Field	Type	Description
name	string	Name of the mapper
protocol	string (enum): openid-connect saml	Protocol of the mapper
protocolMapper	string	Protocol Mapper type of the mapper
consentRequired	boolean	Whether user consent is required for this mapper
config		Configuration options for the mapper.

Groups

Field	Type	Description
anyOf	string[]	List of groups allowed to access the client

CaBundle

Field	Type	Description
configMap	ConfigMap	ConfigMap configuration for CA bundle

ConfigMap

Field	Type	Description
name	string	The name of the ConfigMap to create (default: uds-trust-bundle)
key	string	The key name inside the ConfigMap (default: ca-bundle.pem)
labels		Additional labels to apply to the generated ConfigMap (default: {})
annotations		Additional annotations to apply to the generated ConfigMap (default: {})