API Reference

API Reference

API Reference

Packages

authorization.cci.vmware.com/v1alpha1

Resource Types

ProjectRole

ProjectRole defines a set of permissions that can be assigned to users or groups within a Project through ProjectRoleBinding resources. ProjectRoles are cluster-scoped and can be reused across multiple projects to provide consistent RBAC policies.

Field Description Default Validation

apiVersion string

authorization.cci.vmware.com/v1alpha1

kind string

ProjectRole

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec ProjectRoleSpec

ProjectRoleSpec defines the configuration and metadata for the role.

ProjectRoleBinding

ProjectRoleBinding grants the permissions defined in a ProjectRole to a set of users or groups within a specific project namespace. This provides fine-grained access control by associating subjects (users/groups) with roles at the project level.

Field Description Default Validation

apiVersion string

authorization.cci.vmware.com/v1alpha1

kind string

ProjectRoleBinding

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

subjects ProjectRoleBindingSubjectsItem array

Subjects holds references to the users or groups being granted the role.
Each subject represents an identity that will receive the permissions.

roleRef ProjectRoleBindingRoleRef

RoleRef specifies the ProjectRole being bound to the subjects.
This reference is immutable after creation.

ProjectRoleBindingRoleRef

RoleRef specifies the ProjectRole being bound to the subjects. This reference is immutable after creation.

Appears In:
Field Description Default Validation

apiGroup string

API group of the referenced role.
For ProjectRole resources, this should be 'authorization.cci.vmware.com'.

MaxLength: 253
MinLength: 1

kind string

Kind of the referenced role resource.
Should be 'ProjectRole' for project-level role bindings.

MaxLength: 253
MinLength: 1

name string

Name of the ProjectRole to bind.
Must reference an existing ProjectRole resource.

MaxLength: 253
MinLength: 1
Required: true

ProjectRoleBindingSubjectsItem

Appears In:
Field Description Default Validation

kind string

Kind of the subject. Typically 'User' or 'Group'.
Determines how the name field is interpreted.

MaxLength: 253
MinLength: 1
Required: true

name string

Name of the subject (user or group).
For users, this is typically an email address or username.
For groups, this is the group identifier from the identity provider.

MaxLength: 253
MinLength: 1
Required: true

ProjectRoleSpec

ProjectRoleSpec defines the configuration and metadata for the role.

Appears In:
Field Description Default Validation

description string

Human-readable description of the role’s purpose and the permissions it grants.
This helps administrators understand what access level this role provides.
Maximum length is 2000 characters.

blueprint.cci.vmware.com/v1alpha1

Resource Types

Blueprint

Blueprint represents a deployable template for cloud resources. It defines the desired state of infrastructure and applications, enabling consistent and automated provisioning. Blueprints can include virtual machines, networks, storage, and software components, orchestrating their deployment and configuration across various cloud environments.

Field Description Default Validation

apiVersion string

blueprint.cci.vmware.com/v1alpha1

kind string

Blueprint

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec BlueprintSpec

Spec defines the desired state of the Blueprint. This includes the blueprint content itself and any other configuration parameters required for its deployment.

Required: true

status BlueprintStatus

Blueprint status

BlueprintExportRequest

BlueprintExportRequest represents a request to export a blueprint from the system as an OVA package. This resource orchestrates the packaging of a blueprint, its associated components, and optionally its VM images into a portable format for transfer and later import into another system or environment.

Field Description Default Validation

apiVersion string

blueprint.cci.vmware.com/v1alpha1

kind string

BlueprintExportRequest

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec BlueprintExportRequestSpec

BlueprintExportRequestSpec defines what blueprint and images to export.
Lifecycle workflow:
1. CREATE: POST request creates a BlueprintExportRequest with
source configuration (blueprintId and optional version) and
image inclusion policy (All/None/Custom).
2. PROCESS: System retrieves the blueprint, resolves all
dependencies, and optionally downloads VM images from
content libraries based on includeImages setting.
3. VALIDATE: Images are validated for compatibility and
availability. Validation results appear in
status.blueprintImages with any warnings or errors.
4. PACKAGE: Blueprint content and images are packaged into an
OVA format and uploaded to temporary storage.
5. MONITOR: GET requests retrieve status to track
exportTaskProgress (0-100%) and wait for ovaURL population.
6. DOWNLOAD: Once status.ovaURL is populated, clients download
the OVA package before ovaURLExpiryAt timestamp.
7. UPDATE: Optional PATCH requests can modify the request (e.g.
change image selection) before export completes.
8. CLEANUP: DELETE request removes the export request and may
trigger cleanup of temporary storage.

Required: true

status BlueprintExportRequestStatus

BlueprintExportRequestStatus contains the export progress and result information.
This is populated by the system as the export operation progresses.

BlueprintExportRequestSpec

BlueprintExportRequestSpec defines what blueprint and images to export. Lifecycle workflow: 1. CREATE: POST request creates a BlueprintExportRequest with source configuration (blueprintId and optional version) and image inclusion policy (All/None/Custom). 2. PROCESS: System retrieves the blueprint, resolves all dependencies, and optionally downloads VM images from content libraries based on includeImages setting. 3. VALIDATE: Images are validated for compatibility and availability. Validation results appear in status.blueprintImages with any warnings or errors. 4. PACKAGE: Blueprint content and images are packaged into an OVA format and uploaded to temporary storage. 5. MONITOR: GET requests retrieve status to track exportTaskProgress (0-100%) and wait for ovaURL population. 6. DOWNLOAD: Once status.ovaURL is populated, clients download the OVA package before ovaURLExpiryAt timestamp. 7. UPDATE: Optional PATCH requests can modify the request (e.g. change image selection) before export completes. 8. CLEANUP: DELETE request removes the export request and may trigger cleanup of temporary storage.

Appears In:
Field Description Default Validation

source BlueprintExportRequestSpecSource

Source information identifying the blueprint to export.
Specifies which blueprint and version should be packaged into the OVA.

Required: true

images BlueprintExportRequestSpecImages array

Specific VM images to include in the export when includeImages is set to 'Custom'.
This allows selective export of only required images rather than all images
referenced by the blueprint.

includeImages string

Strategy for including VM images in the export package:
- All: Export all VM images referenced by the blueprint (largest size, fully portable)
- None: Export only the blueprint definition without images (smallest size, requires images to exist in target)
- Custom: Export only the images specified in the 'images' array (balanced approach)

All

BlueprintExportRequestSpecImages

Appears In:
Field Description Default Validation

name string

VMI (Virtual Machine Image) identifier of the image to include.
Must match an image referenced in the
blueprint definition. Use status.blueprintImages to
discover available images before specifying custom selection.

Required: true

BlueprintExportRequestSpecSource

Source information identifying the blueprint to export. Specifies which blueprint and version should be packaged into the OVA.

Appears In:
Field Description Default Validation

blueprintId string

UUID identifier of the blueprint to export.
Must be a valid UUID format referencing an existing blueprint.

Required: true

blueprintVersion string

Version of the blueprint to export.
If not specified, the draft version is used.

BlueprintExportRequestStatus

BlueprintExportRequestStatus contains the export progress and result information. This is populated by the system as the export operation progresses.

Appears In:
Field Description Default Validation

exportTaskProgress integer

Progress percentage of the export task (0-100).
Indicates how much of the export operation has completed.

ovaURL string

URL to download the exported OVA file.
This URL is generated when the export completes successfully. The URL expires
after the time specified in ovaURLExpiryAt.

ovaURLExpiryAt string

Expiry time of the download URL in ISO-8601 format.
After this time, the URL will no longer be valid and a new export
request must be created to obtain a fresh download link.

blueprintImages BlueprintExportRequestStatusBlueprintImages array

Detailed information about images referenced by the
blueprint. Includes validation status for each image,
indicating whether the image is available, compatible, and
can be exported. Use this to review images before setting
includeImages policy.

conditions BlueprintExportRequestStatusConditions array

Detailed condition tracking for the export request lifecycle.
Conditions provide granular status information about the export progress
and any errors encountered.

BlueprintExportRequestStatusBlueprintImages

Appears In:
Field Description Default Validation

name string

VMI identifier of the image in the system. Format:
vmi-{hash}. Used as the key for specifying custom
image selection.

Required: true

displayName string

Human-readable name of the image, typically the
content library item name or VM template name.
Helps users identify images when making
custom selections.

Required: true

message string

Validation or status message for this image. May
indicate successful validation, warnings about
compatibility issues, or errors preventing export
(e.g., "Image not found in content library").

severity string

Severity of the validation message. "Error" means the
image cannot be exported and will block completion if
included. "Warning" indicates potential issues but
allows export. "Info" provides advisory information.

BlueprintExportRequestStatusConditions

Appears In:
Field Description Default Validation

type string

Type of condition.

Required: true

status string

Status of the condition.
- True: Condition is active/satisfied
- False: Condition is not active/satisfied
- Unknown: Condition state cannot be determined

Required: true

reason string

Short machine-readable reason code in CamelCase.

message string

Human-readable message providing detailed information about the condition.

lastTransitionTime string

Timestamp when this condition last changed status.

Required: true

BlueprintImportRequest

BlueprintImportRequest represents a request to import a blueprint into the system from an OVA/OVF package. This resource facilitates the process of uploading blueprint content and associated VM images, validating them, and creating a new blueprint resource within the platform.

Field Description Default Validation

apiVersion string

blueprint.cci.vmware.com/v1alpha1

kind string

BlueprintImportRequest

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec BlueprintImportRequestSpec

Specification for importing a blueprint from an OVA/OVF package.
Lifecycle workflow:
1. CREATE: POST request creates a BlueprintImportRequest with
target configuration (blueprint name, optional content library
ID for images).
2. UPLOAD: POST to /{name}/upload endpoint uploads the OVA/OVF
content and optional image files. The system validates the
content and extracts blueprint definitions.
3. MONITOR: GET requests retrieve the status, tracking upload
progress, image processing, validation results, and overall
conditions.
4. UPDATE: Optional PATCH/PUT requests can modify the request
configuration before or during processing.
5. COMPLETE: Once all validations pass and images are uploaded
to the content library (if includeImages=true), the blueprint
is created with the specified name and blueprintId is populated
in status.
6. CLEANUP: DELETE request removes the import request and
associated temporary resources.

Required: true

status BlueprintImportRequestStatus

BlueprintImportRequestStatus contains the import progress and validation results.
This is populated by the system as the import operation progresses.

BlueprintImportRequestSpec

Specification for importing a blueprint from an OVA/OVF package. Lifecycle workflow: 1. CREATE: POST request creates a BlueprintImportRequest with target configuration (blueprint name, optional content library ID for images). 2. UPLOAD: POST to /{name}/upload endpoint uploads the OVA/OVF content and optional image files. The system validates the content and extracts blueprint definitions. 3. MONITOR: GET requests retrieve the status, tracking upload progress, image processing, validation results, and overall conditions. 4. UPDATE: Optional PATCH/PUT requests can modify the request configuration before or during processing. 5. COMPLETE: Once all validations pass and images are uploaded to the content library (if includeImages=true), the blueprint is created with the specified name and blueprintId is populated in status. 6. CLEANUP: DELETE request removes the import request and associated temporary resources.

Appears In:
Field Description Default Validation

target BlueprintImportRequestSpecTarget

Target configuration defining where and how the imported
blueprint should be created in the system.

Required: true

BlueprintImportRequestSpecTarget

Target configuration defining where and how the imported blueprint should be created in the system.

Appears In:
Field Description Default Validation

contentLibraryId string

Content library ID where VM images from the
OVA/OVF will be uploaded. Required only when
includeImages is true. The content library must exist
and be accessible. Images are uploaded as content
library items and their new identifiers are tracked in
status.contentLibraryItems.

blueprintName string

Name for the blueprint that will be created from this import request.

MaxLength: 253
MinLength: 1
Required: true

includeImages boolean

Indicates whether VM images from the OVA should be uploaded to the content library.
- true: Extract and upload images to contentLibraryId (requires contentLibraryId)
- false: Import only the blueprint definition, assuming images already exist

False

additionalConfig BlueprintImportRequestSpecTargetAdditionalConfig array

Additional configuration key-value pairs for customizing the import behavior.
This extensible field allows passing import-specific options and overrides.

BlueprintImportRequestSpecTargetAdditionalConfig

Appears In:
Field Description Default Validation

name string

Key name for the configuration property.

MinLength: 1

value interface{}

Value for the configuration property.

BlueprintImportRequestStatus

BlueprintImportRequestStatus contains the import progress and validation results. This is populated by the system as the import operation progresses.

Appears In:
Field Description Default Validation

containsBlueprint boolean

Indicates whether the OVA package contains a valid blueprint definition.

contentLibraryItems BlueprintImportRequestStatusContentLibraryItems array

List of content library items created during the image upload process.
Each item represents a VM image being transferred to the content library.
Populated when includeImages is true.

blueprintId string

ID of the successfully imported blueprint.

validations BlueprintImportRequestStatusValidations array

Validation results for all artifacts processed during
import. Each validation captures issues with blueprint
structure, image compatibility, or resource requirements.
Check severity to determine if issues are blocking.

images BlueprintImportRequestStatusImages array

Summary of images discovered in the OVA/OVF package.
Provides visibility into what images are available for
upload before includeImages decision is made.

conditions BlueprintImportRequestStatusConditions array

Detailed condition tracking for the import request lifecycle.
Standard condition types include: "Ready"
(import completed successfully), "Uploading" (content
upload in progress), "Validating" (validation checks
running), "Failed" (terminal error occurred). Check the
most recent condition with status='True' to determine
current state.

BlueprintImportRequestStatusConditions

Appears In:
Field Description Default Validation

type string

Type of condition.

Required: true

status string

Status of the condition.

Required: true

reason string

Short machine-readable reason code in CamelCase.

message string

Human-readable message providing detailed information.

lastTransitionTime string

Timestamp when this condition last changed status.

Required: true

BlueprintImportRequestStatusContentLibraryItems

Appears In:
Field Description Default Validation

id string

Content library item ID assigned after item creation.
Used to track and reference the uploaded image.

name string

Name of the created content library item.

filesURL string

URL for accessing the list of files expected for this content library item.

progress integer

Upload progress percentage (0-100) for preparing the images for consumption.

imageName string

Newly created VMI (Virtual Machine Image) identifier after successful import.

blueprintImageName string

Original image identifier from the OVF descriptor or
blueprint definition. Used to map old image references
to new imageName values during blueprint
transformation.

BlueprintImportRequestStatusImages

Appears In:
Field Description Default Validation

name string

Image name or identifier extracted from the OVF descriptor or
manifest file.

BlueprintImportRequestStatusValidations

Appears In:
Field Description Default Validation

name string

Name of the artifact that was validated.

type string

Type of artifact being validated (e.g., "Blueprint",
"Image", "Resource", "Configuration"). Helps
categorize validation results.

message string

Detailed validation message explaining the issue or status.

severity string

Severity level of the import validation result.

BlueprintResourceType

BlueprintResourceType defines the schema and properties for a specific type of resource that can be included within a blueprint. These resource types provide a structured way to represent and manage various infrastructure or application components, ensuring consistency and validation across blueprint definitions.

Field Description Default Validation

apiVersion string

blueprint.cci.vmware.com/v1alpha1

kind string

BlueprintResourceType

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec BlueprintResourceTypeSpec

Spec defines the desired state of the BlueprintResourceType. This includes the schema that describes the structure and validation rules for resources of this type, along with an optional human-readable description.

Required: true

BlueprintResourceTypeSpec

Spec defines the desired state of the BlueprintResourceType. This includes the schema that describes the structure and validation rules for resources of this type, along with an optional human-readable description.

Appears In:
Field Description Default Validation

description string

Blueprint resource type Description

schema interface{}

Arbitrary JSON schema describing this resource type.

Required: true

BlueprintSpec

Spec defines the desired state of the Blueprint. This includes the blueprint content itself and any other configuration parameters required for its deployment.

Appears In:
Field Description Default Validation

content string

Blueprint YAML content

Required: true

description string

Blueprint description

MaxLength: 2000

BlueprintStatus

Blueprint status

Appears In:
Field Description Default Validation

conditions BlueprintStatusConditions array

Conditions describes the current condition information of the Blueprint.

validationMessages BlueprintStatusValidationMessages array

Validation messages

BlueprintStatusConditions

Appears In:
Field Description Default Validation

lastTransitionTime string

Last time the condition transitioned from one status to another. This
should be when the underlying condition changed. If that is not known,
then using the time when the API field changed is acceptable.

message string

A human readable message indicating details about the transition. This
field may be empty.

reason string

The reason for the condition’s last transition in CamelCase. The specific
API may choose whether or not this field is considered a guaranteed API.
This field may not be empty.

severity string

Severity provides an explicit classification of Reason code, so the users
or machines can immediately understand the current situation and act
accordingly. The Severity field MUST be set only when Status=False.

status string

Status of the condition, one of True, False, Unknown.

type string

Type of condition in CamelCase or in foo.example.com/CamelCase. Many
.condition.type values are consistent across resources like Available
but because arbitrary conditions can be useful
(see .node.status.conditions), the ability to disambiguate is important.

BlueprintStatusValidationMessages

Appears In:
Field Description Default Validation

message string

Validation message

path string

Validation path

resourceName string

Name of the resource

type string

Message type

BlueprintVersion

Field Description Default Validation

apiVersion string

blueprint.cci.vmware.com/v1alpha1

kind string

BlueprintVersion

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec BlueprintVersionSpec

Blueprint version specification

Required: true

status BlueprintVersionStatus

Blueprint version status

BlueprintVersionSpec

Blueprint version specification

Appears In:
Field Description Default Validation

blueprintName string

Blueprint name

Required: true

version string

Blueprint version

MaxLength: 100
Required: true

publishToCatalog boolean

Indicates whether the blueprint version should be published to the catalog

False

BlueprintVersionStatus

Blueprint version status

Appears In:
Field Description Default Validation

description string

Description of the blueprint version

content string

Content of the blueprint version

catalog.cci.vmware.com/v1alpha1

Resource Types

CatalogItem

Field Description Default Validation

apiVersion string

catalog.cci.vmware.com/v1alpha1

kind string

CatalogItem

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec CatalogItemSpec

Specification of the desired behavior of the CatalogItem. Defines the catalog item’s description and configurable properties that users can provide when requesting this item

status CatalogItemStatus

Observed state of the CatalogItem including version history metadata

CatalogItemSpec

Specification of the desired behavior of the CatalogItem. Defines the catalog item’s description and configurable properties that users can provide when requesting this item

Appears In:
Field Description Default Validation

description string

Human-readable description of what changed or what this version provides

schema interface{}

Complete JSON schema for this specific version of the catalog item

CatalogItemStatus

Observed state of the CatalogItem including version history metadata

Appears In:
Field Description Default Validation

additionalVersionsExist boolean

Additional versions of this catalog item exist

CatalogItemVersion

Field Description Default Validation

apiVersion string

catalog.cci.vmware.com/v1alpha1

kind string

CatalogItemVersion

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec CatalogItemVersionSpec

Specification of a specific version of a CatalogItem, including its full schema definition

CatalogItemVersionSpec

Specification of a specific version of a CatalogItem, including its full schema definition

Appears In:
Field Description Default Validation

version string

Version identifier

Required: true

description string

Human-readable description of what changed or what this version provides

Required: true

schema interface{}

Complete JSON schema for this specific version of the catalog item

Required: true

createdAt string

Timestamp when this version was created

default boolean

Indicates whether this version is currently the default used if no version is specified

Instance

Field Description Default Validation

apiVersion string

catalog.cci.vmware.com/v1alpha1

kind string

Instance

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec InstanceSpec

Instance specification

Required: true

status InstanceStatus

Instance status

InstanceActions

InstanceActions represents the actions available for a Instance resource

Field Description Default Validation

apiVersion string

catalog.cci.vmware.com/v1alpha1

kind string

InstanceActions

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

items InstanceActionsItemsItem array

List of available Instance actions

InstanceActionsItemsItem

Instance actions

Appears In:
Field Description Default Validation

actionType string

Type of action

description string

Description of the action

displayName string

Display name of the action

id string

Identifier of the action

name string

Name of the action

valid boolean

Whether the action is valid for the current state of the Instance

InstanceRequests

InstanceRequests represents the requests of a Instance resource

Field Description Default Validation

apiVersion string

catalog.cci.vmware.com/v1alpha1

kind string

InstanceRequests

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

items InstanceRequestsItemsItem array

List of Instance requests

InstanceRequestsItemsItem

Instance request

Appears In:
Field Description Default Validation

actionId string

Identifier of the requested action

approvedAt string

Time at which the request was approved

completedTasks integer

The number of tasks completed while fulfilling this request

createdAt string

Time at which the request was created

details string

Details of the request

events invalid type array

List of Instance request events

inputs interface{}

Request inputs

name string

Name of the request

outputs interface{}

Request outputs

requestedBy string

User that initiated the request

status string

Overall status of the request

totalTasks integer

The total number of tasks need to be completed to fulfil this request

updatedAt string

Time at which the request was updated

InstanceResource

Field Description Default Validation

apiVersion string

catalog.cci.vmware.com/v1alpha1

kind string

InstanceResource

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec InstanceResourceSpec

Instance resource specification

Required: true

InstanceResourceSpec

Instance resource specification

Appears In:
Field Description Default Validation

instanceName string

Name of the instance this resource belongs to.

Required: true

resourceName string

Name of the resource within that instance.

Required: true

resourceType string

Type of the instance resource.

syncStatus string

Current sync status of the instance resource.

resourceProperties interface{}

Properties of this resource.

InstanceSpec

Instance specification

Appears In:
Field Description Default Validation

description string

Instance description

inputs object (keys:string, values:interface{})

Instance inputs

sourceRef InstanceSpecSourceRef

Source of the instance (blueprint, catalog item, …​)

Required: true

InstanceSpecSourceRef

Source of the instance (blueprint, catalog item, …​)

Appears In:
Field Description Default Validation

kind string

Kind of the source of the instance

Required: true

name string

Name of the source of the instance

Required: true

InstanceStatus

Instance status

Appears In:
Field Description Default Validation

leaseExpireAt string

Lease expiration time

leaseGracePeriodDays integer

Instance lease grace period before deletion in days

outputs interface{}

Instance outputs

status string

Status of the instance

InstanceUserEvents

InstanceUserEvents represents the user events of a Instance resource

Field Description Default Validation

apiVersion string

catalog.cci.vmware.com/v1alpha1

kind string

InstanceUserEvents

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

items InstanceUserEventsItemsItem array

List of Instance user events

InstanceUserEventsItemsItem

Instance user event

Appears In:
Field Description Default Validation

createdAt string

Time at which the event was created

details string

Details of the user event

inputs interface{}

User event inputs

name string

Name of the user event

outputs interface{}

User event outputs

requestedBy string

User that initiated the event

status string

Status of the user event

updatedAt string

Time at which the event was updated

image.cci.vmware.com/v1alpha1

Resource Types

Image

Field Description Default Validation

apiVersion string

image.cci.vmware.com/v1alpha1

kind string

Image

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec ImageSpec

Image specification

Required: true

status ImageStatus

Status

ImageSpec

Image specification

Appears In:
Field Description Default Validation

displayName string

Image display name

Required: true

description string

Image description

type string

Image type

contentLibraryName string

Name of the content library containing the image

Required: true

ImageStatus

Appears In:
Field Description Default Validation

status string

Image status

sizeInBytes integer

Image size in bytes

infrastructure.cci.vmware.com/v1alpha1

Resource Types

BootstrapConfiguration

BootstrapConfiguration contains a YAML manifest for configuring the CCI infrastructure during initial bootstrap or system reconfiguration. This resource is typically used by system administrators to apply declarative configuration changes to the infrastructure.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

BootstrapConfiguration

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec BootstrapConfigurationSpec

BootstrapConfigurationSpec contains the configuration manifest data.

Required: true

BootstrapConfigurationSpec

BootstrapConfigurationSpec contains the configuration manifest data.

Appears In:
Field Description Default Validation

manifest string

YAML-formatted manifest containing the bootstrap configuration.
This should be a valid YAML document with the infrastructure configuration.
The manifest size is limited to 64000 characters to prevent resource exhaustion.

MaxLength: 64000
MinLength: 1
Required: true

RegionInfraPolicy

RegionInfraPolicy defines infrastructure policies and constraints that can be applied to supervisor namespaces. Policies specify which regions and zones are compatible with the policy requirements, enabling infrastructure administrators to enforce placement, compliance, or capability requirements. Policies can be mandatory (automatically enforced) or optional (manually bound through RegionInfraPolicyBinding).

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

RegionInfraPolicy

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec RegionInfraPolicySpec

RegionInfraPolicySpec defines the policy requirements and compatible infrastructure.

Required: true

RegionInfraPolicyBinding

RegionInfraPolicyBinding associates a RegionInfraPolicy with a project namespace, applying the policy’s infrastructure constraints to supervisor namespaces created in that project. This enables projects to opt-in to specific infrastructure policies for compliance, capability, or placement requirements.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

RegionInfraPolicyBinding

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec RegionInfraPolicyBindingSpec

RegionInfraPolicyBindingSpec specifies which policy to bind to the project.

Required: true

RegionInfraPolicyBindingSpec

RegionInfraPolicyBindingSpec specifies which policy to bind to the project.

Appears In:
Field Description Default Validation

infraPolicyName string

Name of the RegionInfraPolicy resource to bind to this project.
Must reference an existing RegionInfraPolicy. Once bound, supervisor namespaces
in this project will be restricted to the regions and zones defined by the policy.

Required: true

RegionInfraPolicySpec

RegionInfraPolicySpec defines the policy requirements and compatible infrastructure.

Appears In:
Field Description Default Validation

compatibleRegionZones RegionInfraPolicySpecCompatibleRegionZones array

List of regions and their zones that meet this policy’s requirements.
Only resources in these regions/zones will be allowed when this policy is applied.
This enables administrators to restrict workloads to specific infrastructure
based on compliance, capability, or geographical requirements.

description string

Human-readable description explaining the policy’s purpose, requirements,
and what infrastructure characteristics it enforces. This helps users understand
why and when to use this policy.
Maximum length is 2000 characters.

mandatory boolean

Indicates whether this policy is automatically enforced on all supervisor namespaces
in compatible regions. When true, the policy is applied automatically without requiring
a RegionInfraPolicyBinding. When false, projects must explicitly bind the policy
through a RegionInfraPolicyBinding to use it.

False

RegionInfraPolicySpecCompatibleRegionZones

Appears In:
Field Description Default Validation

regionName string

Name of a region that is compatible with this policy.
Must reference an existing Region resource.

Required: true

zoneNames string array

List of zone names within the region that meet the policy requirements.
If empty, all zones in the region are considered compatible.
Each zone name must exist within the specified region.

Required: true

RegionMonitorTokenRequest

RegionMonitorTokenRequest is used to obtain authentication tokens for accessing monitoring and observability endpoints for a specific region. This resource provides a secure way to retrieve credentials for metrics, logs, and monitoring dashboards without exposing long-lived credentials.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

RegionMonitorTokenRequest

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

status RegionMonitorTokenRequestStatus

RegionMonitorTokenRequestStatus contains the generated monitoring token.
This is populated by the system when the request is processed.

RegionMonitorTokenRequestStatus

RegionMonitorTokenRequestStatus contains the generated monitoring token. This is populated by the system when the request is processed.

Appears In:
Field Description Default Validation

monitorToken string

Authentication token for accessing the region’s monitoring infrastructure.
This token should be used as a Bearer token in the Authorization header
when making requests to monitoring APIs or dashboards. Tokens are typically
time-limited and should be refreshed periodically by creating new requests.

RegionStorageClassQuota

RegionStorageClassQuota defines capacity limits and consumption tracking for a specific storage class within a region. This resource enables administrators to manage storage allocation across regions and provides visibility into storage utilization. Storage quotas help prevent resource exhaustion and enable capacity planning.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

RegionStorageClassQuota

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec RegionStorageClassQuotaSpec

RegionStorageClassQuotaSpec defines the storage capacity and zone constraints.

status RegionStorageClassQuotaStatus

RegionStorageClassQuotaStatus tracks the actual storage consumption.
This is updated by the system to reflect real-time usage.

RegionStorageClassQuotaSpec

RegionStorageClassQuotaSpec defines the storage capacity and zone constraints.

Appears In:
Field Description Default Validation

regionName string

Name of the region where this storage quota applies.
Must reference an existing Region resource.

zones RegionStorageClassQuotaSpecZones array

List of zones within the region where this storage class is available.
If specified, the storage class can only be used in these zones.
If empty, the storage class is available in all zones of the region.

storageClassName string

Name of the Kubernetes StorageClass for which this quota applies.
This should match a StorageClass available in the region’s infrastructure.
Examples include SSD-based, HDD-based, or performance-tiered storage.

storageCapacity string

Total storage capacity available for this storage class in the region.
Specified in bytes with optional unit suffix (e.g., '1Ti', '500Gi', '100000Mi').
This represents the maximum storage that can be provisioned for PersistentVolumes
using this storage class across all namespaces in the region.

RegionStorageClassQuotaSpecZones

Appears In:
Field Description Default Validation

name string

Zone name where the storage class is available.
Must reference a zone that exists in the specified region.

RegionStorageClassQuotaStatus

RegionStorageClassQuotaStatus tracks the actual storage consumption. This is updated by the system to reflect real-time usage.

Appears In:
Field Description Default Validation

storageConsumed string

Amount of storage currently consumed by PersistentVolumes using this storage class.
Specified in bytes with optional unit suffix.
This value is dynamically updated as PVCs are created and deleted.

RegionVirtualMachineClassQuota

RegionVirtualMachineClassQuota represents reservation limits and availability tracking for a specific VM class within a region and zone. VM reservations guarantee that resources are available for workloads that require specific VM sizes or configurations. This resource helps prevent overcommitment and enables capacity planning.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

RegionVirtualMachineClassQuota

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec RegionVirtualMachineClassQuotaSpec

RegionVirtualMachineClassQuotaSpec defines the reservation capacity for a VM class.

status RegionVirtualMachineClassQuotaStatus

RegionVirtualMachineClassQuotaStatus tracks reservation consumption.
This is updated by the system as reservations are allocated to namespaces.

RegionVirtualMachineClassQuotaSpec

RegionVirtualMachineClassQuotaSpec defines the reservation capacity for a VM class.

Appears In:
Field Description Default Validation

regionName string

Name of the region where this VM class quota applies.
Must reference an existing Region resource.

zoneName string

Name of the zone within the region where this VM class quota applies.
Must reference a zone that exists in the specified region.
VM class availability and quotas are zone-specific to handle capacity constraints.

vmClassName string

Name of the VirtualMachineClass for which this quota applies.
VM classes define the size and configuration of virtual machines (e.g., CPU, memory).
Examples: 'small' (2 vCPU, 4Gi memory), 'large' (8 vCPU, 32Gi memory).

totalReservationCount integer

Total number of VM instances of this class that can be reserved in this zone.
Reservations guarantee that sufficient physical resources are available
to run the specified number of VMs. This prevents overcommitment and ensures
workload performance guarantees can be met.

RegionVirtualMachineClassQuotaStatus

RegionVirtualMachineClassQuotaStatus tracks reservation consumption. This is updated by the system as reservations are allocated to namespaces.

Appears In:
Field Description Default Validation

availableReservationCount integer

Number of VM instance reservations still available for allocation.
Calculated as totalReservationCount minus reservations allocated to namespaces.
When this reaches zero, no additional reservations can be made until existing
ones are released.

RegionVirtualMachineClassSummary

RegionVirtualMachineClassSummary provides metadata about a VM class available in a region. It describes the resource characteristics (CPU, memory) and reservation requirements for a specific VM class. This information helps users select appropriate VM classes for their workloads and understand resource implications.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

RegionVirtualMachineClassSummary

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec RegionVirtualMachineClassSummarySpec

RegionVirtualMachineClassSummarySpec defines the VM class characteristics.

Required: true

RegionVirtualMachineClassSummarySpec

RegionVirtualMachineClassSummarySpec defines the VM class characteristics.

Appears In:
Field Description Default Validation

regionName string

Name of the region where this VM class is available.
Must reference an existing Region resource.

vmClassName string

Name of the VirtualMachineClass being described.
This identifies the VM size/configuration template.

cpuCount integer

Number of virtual CPUs allocated to VMs of this class.
This determines the compute capacity available to the VM.

memory string

Amount of memory allocated to VMs of this class.
Specified with unit suffix (e.g., '8Gi', '16Gi', '32Gi').
This determines the memory capacity available to the VM.

reservationRequired boolean

Indicates whether VMs of this class require explicit resource reservations.
When true, users must have allocated VM class reservations in their namespace
quotas before creating VMs. When false, VMs can be created without pre-allocated
reservations (best-effort scheduling). Reservation requirements typically apply
to guaranteed-performance VM classes.

False

ResourceMetricsRequest

ResourceMetricsRequest is used to obtain metrics and monitoring data for resources within a project. This resource provides access to time-series metrics, dashboards, and observability data for projects, supervisor namespaces, or specific resources within namespaces, enabling users to monitor resource utilization and performance.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

ResourceMetricsRequest

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec ResourceMetricsRequestSpec

ResourceMetricsRequestSpec specifies what metrics to retrieve and for which resource.

Required: true

status ResourceMetricsRequestStatus

ResourceMetricsRequestStatus contains the metrics query information.
This is populated by the system when the request is processed.

ResourceMetricsRequestSpec

ResourceMetricsRequestSpec specifies what metrics to retrieve and for which resource.

Appears In:
Field Description Default Validation

metricResourceType string

Type of resource for which metrics are requested. This determines the scope
and granularity of the metrics data returned.
- Project: Aggregate metrics for the entire project
- SupervisorNamespace: Metrics for a specific supervisor namespace
- SupervisorNamespaceResource: Metrics for a specific resource within a namespace

Required: true

supervisorNamespaceName string

Name of the supervisor namespace for which metrics are requested.
Required when metricResourceType is SupervisorNamespace or SupervisorNamespaceResource.
Must reference an existing SupervisorNamespace in the same project.

MaxLength: 63
MinLength: 1

resourceRef ResourceMetricsRequestSpecResourceRef

Reference to a specific resource within the supervisor namespace.
Required when metricResourceType is SupervisorNamespaceResource.
This identifies the exact resource (VM, pod, etc.) for which metrics are needed.

ResourceMetricsRequestSpecResourceRef

Reference to a specific resource within the supervisor namespace. Required when metricResourceType is SupervisorNamespaceResource. This identifies the exact resource (VM, pod, etc.) for which metrics are needed.

Appears In:
Field Description Default Validation

name string

Name of the resource within the supervisor namespace.

MaxLength: 253
MinLength: 1
Required: true

apiVersion string

API version of the resource (e.g., 'v1', 'vmoperator.vmware.com/v1alpha1').

MaxLength: 63
MinLength: 1
Required: true

kind string

Kind of the resource (e.g., 'VirtualMachine', 'Pod', 'PersistentVolumeClaim').

MaxLength: 63
MinLength: 1
Required: true

ResourceMetricsRequestStatus

ResourceMetricsRequestStatus contains the metrics query information. This is populated by the system when the request is processed.

Appears In:
Field Description Default Validation

metricsQueryParameters string

URL query parameters for accessing the metrics API or dashboard iframe.
These parameters can be appended to a metrics endpoint URL to retrieve
or visualize the requested metrics data. The format is typically key=value
pairs suitable for HTTP query strings.

SupervisorNamespaceCaptureRequest

SupervisorNamespaceCaptureRequest is used to capture the current state of a supervisor namespace and convert it into a reusable blueprint. This enables creating templates from existing, configured namespaces complete with VMs, networking, and storage. The capture process can create identical replicas or allow customization for different deployment scenarios. Captured blueprints can be deployed to other regions or projects, enabling standardization and rapid environment replication.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

SupervisorNamespaceCaptureRequest

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SupervisorNamespaceCaptureRequestSpec

SupervisorNamespaceCaptureRequestSpec defines what to capture and how to package it.

Required: true

status SupervisorNamespaceCaptureRequestStatus

SupervisorNamespaceCaptureRequestStatus contains capture progress and results.

SupervisorNamespaceCaptureRequestSpec

SupervisorNamespaceCaptureRequestSpec defines what to capture and how to package it.

Appears In:
Field Description Default Validation

source SupervisorNamespaceCaptureRequestSpecSource

Source identifies the supervisor namespace to capture.
The namespace must be in a ready state for capture to succeed.

Required: true

target SupervisorNamespaceCaptureRequestSpecTarget

Target configuration for the resulting blueprint and images.
Specifies where to store artifacts and how to package them.

SupervisorNamespaceCaptureRequestSpecSource

Source identifies the supervisor namespace to capture. The namespace must be in a ready state for capture to succeed.

Appears In:
Field Description Default Validation

supervisorNamespaceName string

Name of the supervisor namespace to capture.
Must reference an existing SupervisorNamespace in the same project.
The namespace should be in a stable, configured state before capture.

Required: true

SupervisorNamespaceCaptureRequestSpecTarget

Target configuration for the resulting blueprint and images. Specifies where to store artifacts and how to package them.

Appears In:
Field Description Default Validation

blueprintName string

Name for the blueprint that will be created from this capture.
Must be unique within the project. This blueprint can later be
deployed to create new supervisor namespaces.

Required: true

blueprintDescription string

Human-readable description for the captured blueprint.
Should explain what the blueprint contains and its intended use case.

contentLibraryId string

ID of the writable content library to which VM images will be synced. Must be a valid URN, e.g., urn:vcloud:contentLibrary:123e4567-e89b-12d3-a456-426614174000.

MaxLength: 2000

publishToCatalog boolean

Boolean property indicating if the generated blueprint should be released
to the organization’s catalog for broader consumption. When true, the
blueprint becomes available to other projects or teams based on catalog
sharing policies. When false, the blueprint remains private to the project.

False

preserveVMIdentity boolean

If true, an exact replica of the namespace is created,
retaining identical properties of all VMs like MAC, IPAddress, biosUUID etc.
If false, these properties will not be retained during capture.

False

additionalSettings object (keys:string, values:interface{})

Additional override configuration for advanced capture scenarios.
This extensible field allows passing capture-specific options.

vmCustomization SupervisorNamespaceCaptureRequestSpecTargetVmCustomization array

Per-VM customization settings defining how each VM should be captured
and parameterized. This allows fine-grained control over which aspects
of each VM can be customized during blueprint deployment.

SupervisorNamespaceCaptureRequestSpecTargetVmCustomization

Appears In:
Field Description Default Validation

vmName string

Name of the VM in the supervisor namespace to customize.

Required: true

requestTimeOverrides SupervisorNamespaceCaptureRequestSpecTargetVmCustomizationRequestTimeOverrides

Configuration for what aspects can be overridden when deploying
the blueprint. Allows users to choose different resources at
deployment time.

Required: true

guestCustomization SupervisorNamespaceCaptureRequestSpecTargetVmCustomizationGuestCustomization

Guest OS customization settings for the VM.
Defines how the operating system should be configured when deployed
from the blueprint (hostname, domain join, passwords, scripts).

SupervisorNamespaceCaptureRequestSpecTargetVmCustomizationGuestCustomization

Guest OS customization settings for the VM. Defines how the operating system should be configured when deployed from the blueprint (hostname, domain join, passwords, scripts).

Appears In:
Field Description Default Validation

hostName string

Computer name or hostname for the guest OS.
Can include variables for dynamic generation at deployment time.

bootstrapType string

Type of guest OS customization bootstrap method to use:
- CloudInit: Modern cloud-init for Linux systems
- SysPrep: Windows system preparation tool
- LinuxPrep: VMware Linux customization
- vAppConfig: OVF vApp properties-based configuration

Required: true

passwordType string

Method for setting the administrator/root password.
Not supported for vAppConfig bootstrap type.
- AutoGenerate: System generates a random password
- UserSpecified: User provides password at deployment time
- None: No password configuration

expirePasswordAfterNextLogin boolean

Whether to require password change on first login.
Only supported for SysPrep and LinuxPrep bootstrap types.
Enhances security by forcing users to set their own password.

False

domainName string

Active Directory domain name to join (e.g., 'corp.example.com').
Only supported for SysPrep bootstrap type (Windows only).

domainAdmin string

Domain administrator username for joining the domain.
Only supported for SysPrep bootstrap type (Windows only).

domainAdminPasswordSecretName string

Name of the Kubernetes secret containing the domain admin password.
Only supported for SysPrep bootstrap type (Windows only).
Secret must exist in the deployment namespace.

autoLogonCount integer

Number of times to automatically log on after customization.
Only supported for SysPrep bootstrap type (Windows only).
Cannot be used with passwordType 'None'.
Useful for running post-deployment scripts.

Minimum: 0

customiseOvfProperties boolean

Whether to allow customization of OVF/vApp properties.
Enables passing configuration to VMs that support vApp properties.

False

domainOU string

Organizational Unit (OU) path in Active Directory where the
computer account will be created. Only supported for SysPrep
bootstrap type (Windows only). Must be a valid LDAP distinguished
name path.

scriptText string

Custom script to execute during guest OS customization.
Only supported for SysPrep and LinuxPrep bootstrap types.
For Windows: PowerShell or batch script
For Linux: Bash or shell script
Maximum length is 65536 characters.

additionalSettings object (keys:string, values:interface{})

Additional guest customization options.

SupervisorNamespaceCaptureRequestSpecTargetVmCustomizationRequestTimeOverrides

Configuration for what aspects can be overridden when deploying the blueprint. Allows users to choose different resources at deployment time.

Appears In:
Field Description Default Validation

vmClasses boolean

Whether to allow request-time VM class selection.
When true, users can choose a different VM size when deploying
(e.g., small, medium, large). When false, the captured VM class is fixed.

False

Required: true

storageClasses boolean

Whether to allow request-time storage class selection.
When true, users can choose different storage tiers when deploying
(e.g., SSD, HDD, NVMe). When false, the captured storage class is fixed.

False

Required: true

extraOverrides object (keys:string, values:interface{})

Additional customization options for this VM.

SupervisorNamespaceCaptureRequestStatus

SupervisorNamespaceCaptureRequestStatus contains capture progress and results.

Appears In:
Field Description Default Validation

identicalCopySupported boolean

Indicates whether identical copy capture type is supported for this namespace.
Some namespace configurations may only support customized copy.

blueprintId string

ID of the successfully created blueprint.
This ID can be used to reference or deploy the blueprint.

catalogItemId string

ID of the catalog item if publishToCatalog was enabled.
This ID references the blueprint in the organization catalog.

autoDeletionTime string

Time when the capture request will be automatically deleted if not updated.
This is used to clean up stale requests and prevent resource accumulation.
Requests can be kept active by patching/updating them periodically.

validations SupervisorNamespaceCaptureRequestStatusValidations array

List of errors and warnings encountered during the capture process.
Reports compatibility issues, missing resources, or configuration problems.

resources SupervisorNamespaceCaptureRequestStatusResources array

List of captured resources with their properties and VMI identifiers.
Provides a summary of what was included in the capture (VMs, PVCs, Subnets, etc.).

conditions SupervisorNamespaceCaptureRequestStatusConditions array

Detailed condition tracking for the capture request lifecycle.
Conditions show progress through stages: Validating, Capturing, Complete, Failed.

SupervisorNamespaceCaptureRequestStatusConditions

Appears In:
Field Description Default Validation

type string

Type of condition indicating the current stage or state.

Required: true

status string

Status of the condition.

Required: true

reason string

Short machine-readable reason code in CamelCase.

message string

Human-readable message with detailed information.

lastTransitionTime string

Timestamp when this condition last changed status.

Required: true

SupervisorNamespaceCaptureRequestStatusResources

Appears In:
Field Description Default Validation

kind string

Type of the captured resource.

Required: true

name string

Name of the captured resource.

Required: true

resourceProperties object (keys:string, values:interface{})

Additional structured information about the resource such as:
- guestOS: Guest operating system type
- powerState: Current power state
- diskSize: Total disk size
- vmi: Virtual machine image identifier
- validationErrors: Any capture issues specific to this resource

Required: true

SupervisorNamespaceCaptureRequestStatusValidations

Appears In:
Field Description Default Validation

resourceKind string

Kind of the resource related to the validation issue (optional).

resourceName string

Name of the resource related to the validation issue (optional).

message string

Human-readable error or warning message.

Required: true

reason string

Single-word, CamelCase reason code for this validation issue.

Required: true

type string

Severity level of the export validation issue.
Errors prevent capture completion; warnings are informational.

Required: true

SupervisorNamespaceClassBinding

SupervisorNamespaceClassBinding associates a SupervisorNamespaceClass with a project namespace, making that class available for creating supervisor namespaces within the project. This enables administrators to control which namespace configurations are available to different projects, ensuring appropriate resource allocation and policy enforcement.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

SupervisorNamespaceClassBinding

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SupervisorNamespaceClassBindingSpec

SupervisorNamespaceClassBindingSpec identifies the class to bind.

Required: true

status SupervisorNamespaceClassBindingStatus

SupervisorNamespaceClassBindingStatus reflects the configuration from the bound class.
This is populated by the system from the referenced SupervisorNamespaceClass and its
associated SupervisorNamespaceClassConfig for quick reference.

SupervisorNamespaceClassBindingSpec

SupervisorNamespaceClassBindingSpec identifies the class to bind.

Appears In:
Field Description Default Validation

className string

Name of the SupervisorNamespaceClass to bind to this project.
Must reference an existing SupervisorNamespaceClass. Once bound, users in the
project can create supervisor namespaces using this class as a template.

Required: true

SupervisorNamespaceClassBindingStatus

SupervisorNamespaceClassBindingStatus reflects the configuration from the bound class. This is populated by the system from the referenced SupervisorNamespaceClass and its associated SupervisorNamespaceClassConfig for quick reference.

Appears In:
Field Description Default Validation

description string

Description of the bound namespace class, copied from the SupervisorNamespaceClass.

storageClasses SupervisorNamespaceClassBindingStatusStorageClasses array

List of storage classes available in namespaces created with this class.

vmClasses SupervisorNamespaceClassBindingStatusVmClasses array

List of VM classes available in namespaces created with this class.

contentSources SupervisorNamespaceClassBindingStatusContentSources array

List of content sources (e.g., content libraries) available in namespaces.

zones SupervisorNamespaceClassBindingStatusZones array

List of zones with their resource limits for namespaces created with this class.

SupervisorNamespaceClassBindingStatusContentSources

Appears In:
Field Description Default Validation

name string

Name of the content source.

type string

Type of content source (e.g., ContentLibrary)

SupervisorNamespaceClassBindingStatusStorageClasses

Appears In:
Field Description Default Validation

name string

Name of the storage class.

limit string

Default storage limit for this class.

SupervisorNamespaceClassBindingStatusVmClasses

Appears In:
Field Description Default Validation

name string

Name of the VM class.

SupervisorNamespaceClassBindingStatusZones

Appears In:
Field Description Default Validation

name string

Zone name.

cpuLimit string

CPU limit for the zone.

cpuReservation string

CPU reservation for the zone.

memoryLimit string

Memory limit for the zone.

memoryReservation string

Memory reservation for the zone.

vmClassReservations SupervisorNamespaceClassBindingStatusZonesVmClassReservations array

VM class reservations for the zone.

SupervisorNamespaceClassBindingStatusZonesVmClassReservations

VM class reservation.

Appears In:
Field Description Default Validation

vmClassName string

VM class name.

Required: true

count integer

Number of reserved instances.

Required: true

SupervisorNamespaceMetricsRequest

SupervisorNamespaceMetricsRequest retrieves current resource utilization metrics for one or more supervisor namespaces. This resource provides real-time visibility into CPU, memory, storage consumption, and VM class reservation usage across multiple namespaces, enabling capacity planning and resource optimization.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

SupervisorNamespaceMetricsRequest

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SupervisorNamespaceMetricsRequestSpec

SupervisorNamespaceMetricsRequestSpec specifies which namespaces to retrieve metrics for.

Required: true

status SupervisorNamespaceMetricsRequestStatus

SupervisorNamespaceMetricsRequestStatus contains the metrics data for each requested namespace.
This is populated by the system with current resource utilization information.

SupervisorNamespaceMetricsRequestSpec

SupervisorNamespaceMetricsRequestSpec specifies which namespaces to retrieve metrics for.

Appears In:
Field Description Default Validation

supervisorNamespaceRefs SupervisorNamespaceMetricsRequestSpecSupervisorNamespaceRefs array

List of references to supervisor namespaces for which metrics are requested.
Metrics will be retrieved for all specified namespaces and returned in the status.

MinItems: 1
Required: true

SupervisorNamespaceMetricsRequestSpecSupervisorNamespaceRefs

Appears In:
Field Description Default Validation

name string

Name of the supervisor namespace for which metrics are needed.

Required: true

namespace string

Project namespace containing the supervisor namespace.
This identifies which project the supervisor namespace belongs to.

Required: true

SupervisorNamespaceMetricsRequestStatus

SupervisorNamespaceMetricsRequestStatus contains the metrics data for each requested namespace. This is populated by the system with current resource utilization information.

Appears In:
Field Description Default Validation

items SupervisorNamespaceMetricsRequestStatusItems array

List of metrics results, one per requested supervisor namespace.
Each item contains resource utilization data for that namespace.

SupervisorNamespaceMetricsRequestStatusItems

Appears In:
Field Description Default Validation

name string

Name of the supervisor namespace these metrics apply to.

namespace string

Project namespace containing this supervisor namespace.

storageClasses SupervisorNamespaceMetricsRequestStatusItemsStorageClasses array

Storage utilization metrics per storage class in the namespace.

zones SupervisorNamespaceMetricsRequestStatusItemsZones array

Resource utilization metrics per zone in the namespace.

conditions SupervisorNamespaceMetricsRequestStatusItemsConditions array

Conditions indicating the state of the metrics request for this namespace.
Used to report errors or warnings if metrics cannot be retrieved.

SupervisorNamespaceMetricsRequestStatusItemsConditions

Appears In:
Field Description Default Validation

type string

Type of condition (e.g., 'MetricsAvailable', 'Error')

status string

Status of the condition

reason string

Machine-readable reason code

message string

Human-readable message with details

lastTransitionTime string

Last time this condition changed status

SupervisorNamespaceMetricsRequestStatusItemsStorageClasses

Storage class utilization information

Appears In:
Field Description Default Validation

name string

Name of the storage class

storageUsed string

Amount of storage currently consumed by PersistentVolumes using this class.

SupervisorNamespaceMetricsRequestStatusItemsZones

Zone utilization information

Appears In:
Field Description Default Validation

name string

Name of the zone

memoryUsed string

Amount of memory currently consumed in this zone.

cpuUsed string

Amount of CPU currently consumed in this zone.

vmClassReservations SupervisorNamespaceMetricsRequestStatusItemsZonesVmClassReservations array

VM class reservation usage in this zone.

SupervisorNamespaceMetricsRequestStatusItemsZonesVmClassReservations

VM class reservation information.

Appears In:
Field Description Default Validation

vmClassName string

Name of the VM class.

usedCount integer

Number of VM reservations currently in use.

SupervisorNamespaceRegionalOptionsRequest

SupervisorNamespaceRegionalOptionsRequest allows users to discover available configuration options when creating a SupervisorNamespace in a specific region with a specific class. Users create a request by specifying a regionName and className in the spec. The response (status) includes available zones, VM classes, storage classes, content sources, and maximum resource limits that can be used when creating a SupervisorNamespace with the specified class in the specified region. This resource enables users to understand what values are valid before attempting to create a SupervisorNamespace, reducing trial-and-error and providing clear visibility into available infrastructure resources.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

SupervisorNamespaceRegionalOptionsRequest

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SupervisorNamespaceRegionalOptionsRequestSpec

SupervisorNamespaceRegionalOptionsRequestSpec defines the request parameters for discovering
available SupervisorNamespace configuration options.

Required: true

status SupervisorNamespaceRegionalOptionsRequestStatus

SupervisorNamespaceRegionalOptionsRequestStatus contains the discovered available configuration
options for creating a SupervisorNamespace. This is populated by the extension server
and is read-only.

SupervisorNamespaceRegionalOptionsRequestSpec

SupervisorNamespaceRegionalOptionsRequestSpec defines the request parameters for discovering available SupervisorNamespace configuration options.

Appears In:
Field Description Default Validation

regionName string

Name of the region to query for available SupervisorNamespace options.
Must reference an existing Region resource.

MaxLength: 253
MinLength: 1
Required: true

className string

Name of the SupervisorNamespaceClass to query.
The response will include available options based on this class template.

MaxLength: 63
MinLength: 1

includeOptions string array

Optional list of specific fields to populate in the status.
If not specified, all fields will be populated.
Valid values: zones, vmClasses, storageClasses, contentSources, defaultZoneLimits, infraPolicies

limit integer

Maximum number of items to return per array in the response.
If not specified, defaults to 250. Maximum allowed value is 500.

250

Maximum: 500
Minimum: 1

continue string

Continuation token for paginated results. When a response contains more items
than the specified limit, a continue token is returned. Include this token in the
next query to retrieve the next page of results.

SupervisorNamespaceRegionalOptionsRequestStatus

SupervisorNamespaceRegionalOptionsRequestStatus contains the discovered available configuration options for creating a SupervisorNamespace. This is populated by the extension server and is read-only.

Appears In:
Field Description Default Validation

zones SupervisorNamespaceRegionalOptionsRequestStatusZones array

List of available zones in the region with maximum allowed resource limits
per zone. These limits represent the maximum values that can be specified
when creating a SupervisorNamespace.

vmClasses SupervisorNamespaceRegionalOptionsRequestStatusVmClasses array

List of VM classes available for use in SupervisorNamespaces created
with this class in this region. These define the available VM sizing options.
Limited by the spec.limit parameter. Use spec.continue for pagination.

storageClasses SupervisorNamespaceRegionalOptionsRequestStatusStorageClasses array

List of storage classes available with their maximum allowed limits.
Limited by the spec.limit parameter. Use spec.continue for pagination.

contentSources SupervisorNamespaceRegionalOptionsRequestStatusContentSources array

List of content sources (content libraries) available for use
in SupervisorNamespaces. These provide VM templates and images.
Limited by the spec.limit parameter. Use spec.continue for pagination.

infraPolicies SupervisorNamespaceRegionalOptionsRequestStatusInfraPolicies array

List of infrastructure policies available for use with SupervisorNamespaces.
Policies define security, network, or operational configurations that can be
applied to namespaces. Limited by the spec.limit parameter. Use spec.continue for pagination.

continue string

Continuation token to retrieve the next page of results when any array
has been truncated due to the limit. Include this token in the spec.continue
field of a subsequent query to get the next page. Empty if no more results.

SupervisorNamespaceRegionalOptionsRequestStatusContentSources

Available content source.

Appears In:
Field Description Default Validation

name string

Name of the content source.

MaxLength: 253
MinLength: 1
Required: true

type string

Type of content source. Currently only 'ContentLibrary' is supported.

Pattern: ContentLibrary
Required: true

SupervisorNamespaceRegionalOptionsRequestStatusInfraPolicies

Available infrastructure policy.

Appears In:
Field Description Default Validation

name string

Name of the infrastructure policy.

MaxLength: 253
MinLength: 1
Required: true

mandatory boolean

Indicates whether this policy is mandatory and will always be applied
to any namespace created in the compatible zones. If true, the policy
is automatically added and cannot be excluded.

Required: true

description string

Human-readable description of what the policy does and its purpose.

MaxLength: 2000

compatibleZones string array

List of zone names where this policy is available and can be applied.
If a namespace uses any of these zones, this policy can be attached.

Required: true

SupervisorNamespaceRegionalOptionsRequestStatusStorageClasses

Available storage class with maximum limit.

Appears In:
Field Description Default Validation

name string

Name of the storage class.

MaxLength: 253
MinLength: 1
Required: true

defaultLimit string

Default storage capacity limit for this storage class.
Format: numeric value with unit suffix (Mi, Gi, Ti).

Pattern: (\d+)([MGT]i)?
Required: true

maxLimit string

Maximum storage capacity limit that can be requested for this storage class.
Format: numeric value with unit suffix (Mi, Gi, Ti).

Pattern: (\d+)([MGT]i)?
Required: true

compatibleZones string array

List of zone names where this storage class is available.

Required: true

SupervisorNamespaceRegionalOptionsRequestStatusVmClasses

Available VM class with resource specifications.

Appears In:
Field Description Default Validation

name string

Name of the VM class available for workloads.

MaxLength: 253
MinLength: 1
Required: true

cpuCount integer

Number of CPUs for this VM class.

Minimum: 1
Required: true

memory string

Memory allocation for this VM class.
Format: numeric value with unit (Mi, Gi, Ti).

Pattern: (\d+)([MGT]i)?
Required: true

cpuReservation string

CPU reservation for this VM class.

Pattern: (\d+)([MG])?
Required: true

memoryReservation string

Memory reservation for this VM class.

Pattern: (\d+)([MGT]i)?
Required: true

reservationRequired boolean

Indicates whether this VM class requires explicit reservation before use.
If true, the VM class must be reserved in zone vmClassReservations before
VMs can be created using this class.

Required: true

SupervisorNamespaceRegionalOptionsRequestStatusZones

Zone availability information with maximum allowed limits.

Appears In:
Field Description Default Validation

name string

Name of the available zone.

MaxLength: 253
MinLength: 1
Required: true

compatibleZones string array array

Array of zone name sets that this zone is compatible with for multi-zone
configurations. Each element in the array represents a set of zones that
can be used together with this zone when creating a SupervisorNamespace.
Empty array means the zone can only be used alone.

Required: true

defaultCpuLimit string

Default CPU limit for this zone when creating a SupervisorNamespace.
Format: numeric value with optional unit (M for MHz, G for GHz).

Pattern: (\d+)([MG])?
Required: true

defaultMemoryLimit string

Default memory limit for this zone when creating a SupervisorNamespace.
Format: numeric value with unit (Mi, Gi, Ti).

Pattern: (\d+)([MGT]i)?
Required: true

defaultCpuReservation string

Default CPU reservation for this zone.

Pattern: (\d+)([MG])?
Required: true

defaultMemoryReservation string

Default memory reservation for this zone.

Pattern: (\d+)([MGT]i)?
Required: true

maxCpuLimit string

Maximum CPU limit that can be requested for this zone when creating
a SupervisorNamespace. Format: numeric value with optional unit (M for MHz, G for GHz).

Pattern: (\d+)([MG])?
Required: true

maxMemoryLimit string

Maximum memory limit that can be requested for this zone when creating
a SupervisorNamespace. Format: numeric value with unit (Mi, Gi, Ti).

Pattern: (\d+)([MGT]i)?
Required: true

maxCpuReservation string

Maximum CPU reservation that can be requested for this zone.
Must be less than or equal to maxCpuLimit.

Pattern: (\d+)([MG])?
Required: true

maxMemoryReservation string

Maximum memory reservation that can be requested for this zone.
Must be less than or equal to maxMemoryLimit.

Pattern: (\d+)([MGT]i)?
Required: true

vmClassReservations SupervisorNamespaceRegionalOptionsRequestStatusZonesVmClassReservations array

VM classes that can be reserved in this zone, with maximum counts and compatible groups.

SupervisorNamespaceRegionalOptionsRequestStatusZonesVmClassReservations

Available VM class reservation option.

Appears In:
Field Description Default Validation

vmClassName string

Name of the VM class that can be reserved.

MaxLength: 253
MinLength: 1
Required: true

maxCount integer

Maximum number of instances that can be reserved for this VM class.

Minimum: 1
Required: true

defaultCount integer

default number of instances to be reserved for this VM class.

compatibleGroups string array

List of compatible groups or resource pools where this VM class reservation
can be allocated. Empty array means no group restrictions.

Required: true

UtilizationMetricsRequest

UtilizationMetricsRequest is used to retrieve aggregated resource utilization statistics across different scopes (Organization, Project, or SupervisorNamespace). This resource enables administrators and users to understand resource consumption patterns, identify trends, and perform capacity planning. Results can be sorted to identify top consumers.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

UtilizationMetricsRequest

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec UtilizationMetricsRequestSpec

UtilizationMetricsRequestSpec specifies the scope and sorting for utilization metrics.

Required: true

status UtilizationMetricsRequestStatus

UtilizationMetricsRequestStatus contains the computed utilization statistics.
This is populated by the system when the request is processed.

UtilizationMetricsRequestSpec

UtilizationMetricsRequestSpec specifies the scope and sorting for utilization metrics.

Appears In:
Field Description Default Validation

resourceType string

Type of resource for which utilization metrics are being requested.
This determines the aggregation level and scope of the metrics.
- Organization: Metrics aggregated across the entire organization
- Project: Metrics aggregated per project
- SupervisorNamespace: Metrics for individual supervisor namespaces

Required: true

sortOrder string

Order in which to sort the utilization metrics response.
- DESCENDING: Sort from highest to lowest utilization (default, useful for finding top consumers)
- ASCENDING: Sort from lowest to highest utilization (useful for finding underutilized resources)

DESCENDING

UtilizationMetricsRequestStatus

UtilizationMetricsRequestStatus contains the computed utilization statistics. This is populated by the system when the request is processed.

Appears In:
Field Description Default Validation

stats interface{}

Aggregated utilization metrics organized by resource type.
The structure contains nested data with resource consumption metrics such as
CPU usage, memory usage, storage consumption, VM counts, and other relevant
statistics. The exact structure depends on the resourceType specified in the request.

VirtualMachineRemoteConsoleRequest

VirtualMachineRemoteConsoleRequest is used to obtain console access credentials for a virtual machine running in a supervisor namespace. This resource provides secure, time-limited URLs and tickets for accessing VM consoles through web browsers or VMRC (VMware Remote Console) clients, enabling troubleshooting and interactive access.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

VirtualMachineRemoteConsoleRequest

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec VirtualMachineRemoteConsoleRequestSpec

VirtualMachineRemoteConsoleRequestSpec identifies the target VM for console access.

Required: true

status VirtualMachineRemoteConsoleRequestStatus

VirtualMachineRemoteConsoleRequestStatus contains the generated console access credentials.
This is populated by the system when the request is successfully processed.

VirtualMachineRemoteConsoleRequestSpec

VirtualMachineRemoteConsoleRequestSpec identifies the target VM for console access.

Appears In:
Field Description Default Validation

supervisorNamespaceName string

Name of the supervisor namespace containing the virtual machine.
Must reference an existing SupervisorNamespace in the same project.

MaxLength: 63
MinLength: 1
Required: true

virtualMachineName string

Name of the VirtualMachine resource for which console access is requested.
Must reference an existing VM in the specified supervisor namespace.

MaxLength: 253
MinLength: 1
Required: true

VirtualMachineRemoteConsoleRequestStatus

VirtualMachineRemoteConsoleRequestStatus contains the generated console access credentials. This is populated by the system when the request is successfully processed.

Appears In:
Field Description Default Validation

host string

Hostname or IP address of the infrastructure hosting the VM console service.
This is used in conjunction with the ticket for establishing console connections.

ticket string

Time-limited authentication ticket for console access.
This ticket is used to authenticate the console session and expires after
a short period for security. Tickets are single-use in most cases.

webConsoleUrl string

Complete URL for accessing the VM console through a web browser.
This URL includes the embedded authentication ticket and can be opened
directly in a browser to establish a console session. The URL is time-limited.

vmrcUrl string

Complete URL for accessing the VM console through VMware Remote Console (VMRC).
This URL uses the vmrc:// protocol and can be opened with the VMRC desktop
application for enhanced console features. The URL includes authentication credentials.

VksCredentialRequest

VksCredentialRequest is used to obtain temporary authentication credentials for accessing VMware Kubernetes Service (VKS) clusters. This resource provides a secure mechanism to retrieve time-limited JWT tokens scoped to specific clusters, enabling secure cluster access without long-lived credentials.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha1

kind string

VksCredentialRequest

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec VksCredentialRequestSpec

VksCredentialRequestSpec specifies which VKS cluster to generate credentials for.

Required: true

status VksCredentialRequestStatus

VksCredentialRequestStatus contains the generated credentials and metadata.
This is populated by the system when the request is successfully processed.

VksCredentialRequestSpec

VksCredentialRequestSpec specifies which VKS cluster to generate credentials for.

Appears In:
Field Description Default Validation

clusterId string

Kubernetes UUID of the VKS Cluster resource for which credentials are requested.
This is the unique identifier from the cluster’s metadata.uid field.
Must be a valid UUID format.

MaxLength: 36
MinLength: 1
Required: true

clusterName string

Name of the VKS Cluster resource for which credentials are requested.
This is the human-readable name from the cluster’s metadata.name field.
Must reference an existing VKS cluster in the infrastructure.

MaxLength: 253
MinLength: 1
Required: true

VksCredentialRequestStatus

VksCredentialRequestStatus contains the generated credentials and metadata. This is populated by the system when the request is successfully processed.

Appears In:
Field Description Default Validation

token string

JWT (JSON Web Token) scoped to the specified VKS cluster.
This token should be used for authentication when accessing the cluster’s
Kubernetes API server. The token is time-limited and should be refreshed
before expiration by creating a new credential request.

tokenExpirationTimestamp string

ISO-8601 formatted UTC timestamp indicating when the token expires.
After this time, the token will no longer be accepted for authentication
and a new credential request must be created to obtain a fresh token.
Format: YYYY-MM-DDTHH:MM:SSZ

infrastructure.cci.vmware.com/v1alpha2

Resource Types

SupervisorNamespace

SupervisorNamespace (v1alpha2 - DEPRECATED) represents a namespace within a Supervisor cluster. This version is deprecated and will be removed in a future release. Please migrate to v1alpha3 which includes enhanced networking features (VPC, SEG, shared subnets). A SupervisorNamespace provides isolation, resource quotas, and access control for workloads. It includes VM classes, storage classes, content libraries, and per-zone resource allocations.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha2

kind string

SupervisorNamespace

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SupervisorNamespaceSpec

Required: true

status SupervisorNamespaceStatus

Observed state of the SupervisorNamespace, populated by the system.

SupervisorNamespaceClass

SupervisorNamespaceClass defines a template or tier for supervisor namespaces, specifying default configurations such as storage classes, VM classes, content sources, and resource limits. Classes enable administrators to provide standardized namespace configurations (e.g., 'development', 'production', 'gpu-enabled') that users can instantiate without needing to specify all details. This promotes consistency and simplifies namespace creation.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha2

kind string

SupervisorNamespaceClass

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SupervisorNamespaceClassSpec

SupervisorNamespaceClassSpec defines the template configuration.

Required: true

SupervisorNamespaceClassConfig

SupervisorNamespaceClassConfig defines the detailed resource configuration for a SupervisorNamespaceClass. It specifies the exact resources (storage classes, VM classes, content sources) and default resource limits that will be applied to supervisor namespaces created from the class. This separation between Class (metadata) and Config (detailed settings) enables flexible management and versioning of namespace templates.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha2

kind string

SupervisorNamespaceClassConfig

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SupervisorNamespaceClassConfigSpec

SupervisorNamespaceClassConfigSpec defines the resource configuration details.

Required: true

SupervisorNamespaceClassConfigSpec

SupervisorNamespaceClassConfigSpec defines the resource configuration details.

Appears In:
Field Description Default Validation

storageClasses SupervisorNamespaceClassConfigSpecStorageClasses array

List of storage classes that will be available in namespaces created with this config.
At least one storage class must be specified.

MinItems: 1
Required: true

vmClasses SupervisorNamespaceClassConfigSpecVmClasses array

List of VM classes that will be available in namespaces created with this config.
At least one VM class must be specified.

MinItems: 1
Required: true

contentSources SupervisorNamespaceClassConfigSpecContentSources array

List of content sources (e.g., content libraries) that will be
available in namespaces created with this config. Content sources provide
VM templates and images for deployment.

defaultLimits SupervisorNamespaceClassConfigSpecDefaultLimits

Default resource limits that will be applied per zone in namespaces created
with this config. These can be overridden when creating namespaces.

zones SupervisorNamespaceClassConfigSpecZones array

List of specific zone configurations that override defaultLimits for particular zones.
If not specified, defaultLimits apply to all zones.

SupervisorNamespaceClassConfigSpecContentSources

Appears In:
Field Description Default Validation

name string

Name of the content source to make available.

MaxLength: 253
MinLength: 1
Required: true

type string

Type of content source. Currently only 'ContentLibrary' is supported.

Pattern: ContentLibrary
Required: true

SupervisorNamespaceClassConfigSpecDefaultLimits

Default resource limits that will be applied per zone in namespaces created with this config. These can be overridden when creating namespaces.

Appears In:
Field Description Default Validation

cpuLimit string

Default CPU limit per zone for supervisor namespace creation.
Specified in cores or millicores (e.g., '10', '5000m', '10G' for GHz).

Pattern: (\d+)([MG])?
Required: true

memoryLimit string

Default memory limit per zone for supervisor namespace creation.
Specified in bytes with optional unit suffix (e.g., '64Gi', '128Gi').

Pattern: (\d+)([MGT]i)?
Required: true

cpuReservation string

Default CPU reservation per zone for supervisor namespace creation.
Specified in cores or millicores (e.g., '4', '2000m').

Pattern: (\d+)([MG])?
Required: true

memoryReservation string

Default memory reservation per zone for supervisor namespace creation.
Specified in bytes with optional unit suffix (e.g., '32Gi', '64Gi').

Pattern: (\d+)([MGT]i)?
Required: true

SupervisorNamespaceClassConfigSpecStorageClasses

Appears In:
Field Description Default Validation

name string

Name of the storage class to make available in the namespace.
Must correspond to an actual StorageClass in the infrastructure.

MaxLength: 253
MinLength: 1
Required: true

limit string

Default storage limit for this storage class in created namespaces.
Specified in bytes with optional unit suffix (e.g., '100Gi', '1Ti').
Users can override this when creating namespaces if permitted.

Pattern: (\d+)([MGT]i)?
Required: true

SupervisorNamespaceClassConfigSpecVmClasses

Appears In:
Field Description Default Validation

name string

Name of the VM class to make available in the namespace.
Must correspond to an actual VirtualMachineClass in the region.

MaxLength: 253
MinLength: 1
Required: true

SupervisorNamespaceClassConfigSpecZones

Appears In:
Field Description Default Validation

name string

Name of the zone for which these specific limits apply.

MaxLength: 253
MinLength: 1
Required: true

cpuLimit string

CPU limit for this specific zone.

Pattern: (\d+)([MG])?
Required: true

cpuReservation string

CPU reservation for this specific zone.

Pattern: (\d+)([MG])?
Required: true

memoryLimit string

Memory limit for this specific zone.

Pattern: (\d+)([MGT]i)?
Required: true

memoryReservation string

Memory reservation for this specific zone.

Pattern: (\d+)([MGT]i)?
Required: true

vmClassReservations SupervisorNamespaceClassConfigSpecZonesVmClassReservations array

VM class reservations to allocate by default in this zone for
namespaces created with this config.

SupervisorNamespaceClassConfigSpecZonesVmClassReservations

VM class reservation configuration.

Appears In:
Field Description Default Validation

vmClassName string

Name of the VM class to reserve instances for.

MaxLength: 253
MinLength: 1
Required: true

count integer

Number of VM instances to reserve for this class.

Minimum: 1
Required: true

SupervisorNamespaceClassSpec

SupervisorNamespaceClassSpec defines the template configuration.

Appears In:
Field Description Default Validation

description string

Human-readable description of the namespace class, explaining its intended use case,
included resources, and any special characteristics. This helps users select the
appropriate class for their workloads.
Maximum length is 2000 characters.

MaxLength: 2000

SupervisorNamespaceSpec

Appears In:
Field Description Default Validation

description string

Human-readable description of the supervisor namespace’s purpose.

MaxLength: 2000

regionName string

Name of the region where the supervisor namespace will be created.
Must reference an existing Region with available capacity.

MaxLength: 253
MinLength: 1
Required: true

className string

Name of the SupervisorNamespaceClass template for creating the namespace.
The class defines default VM classes, storage classes, and resource limits.

MaxLength: 63
MinLength: 1
Required: true

vpcName string

Name of the VPC (Virtual Private Cloud) to associate with the namespace.
Provides network isolation for the supervisor namespace.

MaxLength: 253

initialClassConfigOverrides SupervisorNamespaceSpecInitialClassConfigOverrides

Configuration overrides to apply when creating the namespace.
These override the defaults from the SupervisorNamespaceClass.

SupervisorNamespaceSpecInitialClassConfigOverrides

Configuration overrides to apply when creating the namespace. These override the defaults from the SupervisorNamespaceClass.

Appears In:
Field Description Default Validation

zones SupervisorNamespaceSpecInitialClassConfigOverridesZones array

Zone-specific resource allocations. Maximum 3 zones for high availability.

MaxItems: 3

storageClasses SupervisorNamespaceSpecInitialClassConfigOverridesStorageClasses array

Storage classes to make available in the namespace with their limits.

SupervisorNamespaceSpecInitialClassConfigOverridesStorageClasses

Appears In:
Field Description Default Validation

name string

Name of the storage class.

MaxLength: 253
MinLength: 1
Required: true

limit string

Maximum storage capacity for this storage class.

Pattern: (\d+)([MGT]i)?
Required: true

SupervisorNamespaceSpecInitialClassConfigOverridesZones

Zone configuration with resource limits and reservations

Appears In:
Field Description Default Validation

name string

Name of the zone where resources will be allocated.

MaxLength: 253
MinLength: 1
Required: true

memoryLimit string

Maximum memory allocation for this zone.
Format: numeric value with optional unit (Mi, Gi, Ti).

Pattern: (\d+)([MGT]i)?
Required: true

memoryReservation string

Guaranteed memory reservation for this zone.
Must be less than or equal to memoryLimit.

Pattern: (\d+)([MGT]i)?
Required: true

cpuLimit string

Maximum CPU allocation for this zone.
Format: numeric value with optional unit (M for MHz, G for GHz).

Pattern: (\d+)([MG])?
Required: true

cpuReservation string

Guaranteed CPU reservation for this zone.
Must be less than or equal to cpuLimit.

Pattern: (\d+)([MG])?
Required: true

SupervisorNamespaceStatus

Observed state of the SupervisorNamespace, populated by the system.

Appears In:
Field Description Default Validation

vmClasses SupervisorNamespaceStatusVmClasses array

List of VM classes available in this namespace.

storageClasses SupervisorNamespaceStatusStorageClasses array

List of storage classes with their current limits.

contentLibraries SupervisorNamespaceStatusContentLibraries array

List of content libraries available in this namespace.

zones SupervisorNamespaceStatusZones array

Actual zone configurations and current resource usage.

phase string

Current lifecycle phase of the namespace.
Common values: Pending, Creating, Ready, Updating, Deleting, Failed

namespaceEndpointURL string

Kubernetes API endpoint URL for accessing this supervisor namespace.

conditions SupervisorNamespaceStatusConditions array

Detailed conditions tracking namespace lifecycle and health.

SupervisorNamespaceStatusConditions

Namespace condition

Appears In:
Field Description Default Validation

lastTransitionTime string

Timestamp of the last status transition.

message string

Human-readable message with details about the condition.

reason string

Machine-readable reason code

severity string

Severity level (Info, Warning, Error)

status string

Condition status (True, False, Unknown)

Required: true

type string

Condition type identifier

Required: true

SupervisorNamespaceStatusContentLibraries

Appears In:
Field Description Default Validation

name string

Name of the content library.

Required: true

SupervisorNamespaceStatusStorageClasses

Appears In:
Field Description Default Validation

name string

Name of the storage class.

Required: true

limit string

Storage limit for this class.

Required: true

SupervisorNamespaceStatusVmClasses

Appears In:
Field Description Default Validation

name string

Name of the VM class.

Required: true

SupervisorNamespaceStatusZones

Zone resource status.

Appears In:
Field Description Default Validation

name string

Name of the zone

Required: true

memoryLimit string

Configured memory limit.

Required: true

memoryReservation string

Configured memory reservation.

Required: true

cpuLimit string

Configured CPU limit.

Required: true

cpuReservation string

Configured CPU reservation.

Required: true

vmClassReservations SupervisorNamespaceStatusZonesVmClassReservations array

VM class reservations allocated in this zone.

SupervisorNamespaceStatusZonesVmClassReservations

Configured VM class reservation.

Appears In:
Field Description Default Validation

vmClassName string

VM class name.

Required: true

count integer

Number of reserved instances.

Required: true

infrastructure.cci.vmware.com/v1alpha3

Resource Types

SupervisorNamespace

SupervisorNamespace (v1alpha3) represents a namespace within a Supervisor cluster, providing isolated environments for running Kubernetes workloads. Key capabilities: - Multi-zone resource allocation with CPU and memory quotas - Storage class management with capacity limits - VM class selection for workload sizing - Content library integration for VM templates and images - Network isolation through VPC, shared subnets, and Service Engine Groups (SEG) - Project-level access control and resource governance SupervisorNamespaces are created from SupervisorNamespaceClass templates which define default configurations, but can be customized through classConfigOverrides.

Field Description Default Validation

apiVersion string

infrastructure.cci.vmware.com/v1alpha3

kind string

SupervisorNamespace

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SupervisorNamespaceSpec

Required: true

status SupervisorNamespaceStatus

SupervisorNamespaceStatus reflects the observed state of the namespace.
All fields are populated by the system and are read-only.

SupervisorNamespaceSpec

Appears In:
Field Description Default Validation

className string

Name of the SupervisorNamespaceClass template for creating the namespace.
The class provides base configuration including VM classes, storage classes,
content sources, and default resource limits.

MaxLength: 63
MinLength: 1
Required: true

classConfigOverrides SupervisorNamespaceSpecClassConfigOverrides

Configuration overrides to customize the namespace beyond class defaults.
Allows fine-tuning of resources, zones, and access without modifying the class.

description string

Human-readable description of the supervisor namespace’s purpose.

MaxLength: 2000

regionName string

Name of the region where the namespace will be created.
Must reference an existing Region with available capacity and compatible zones.

MaxLength: 253
MinLength: 1
Required: true

vpcName string

Name of the VPC (Virtual Private Cloud) to associate with the namespace.
Provides network isolation and routing for the supervisor namespace.
If not specified, default networking is used.

MaxLength: 253

sharedSubnetNames string array

List of subnet names created outside the Supervisor to associate with this namespace.
Enables connectivity to existing network infrastructure or shared services.
Subnets must exist in the VPC and be compatible with the region.

segName string

Service Engine Group (SEG) name to associate with the namespace.
SEGs provide load balancing services for applications in the namespace.
Used with NSX Advanced Load Balancer (formerly Avi).

MaxLength: 253

infraPolicyNames string array

List of Non-mandatory Infra Policies to be associated with this Supervisor Namespace

SupervisorNamespaceSpecClassConfigOverrides

Configuration overrides to customize the namespace beyond class defaults. Allows fine-tuning of resources, zones, and access without modifying the class.

Appears In:
Field Description Default Validation

contentSources SupervisorNamespaceSpecClassConfigOverridesContentSources array

Content sources (content libraries) available in the namespace.
Provides VM templates and images for deployment.

storageClasses SupervisorNamespaceSpecClassConfigOverridesStorageClasses array

Storage classes to make available with their capacity limits.
At least one storage class is required if specified.

MinItems: 1

vmClasses SupervisorNamespaceSpecClassConfigOverridesVmClasses array

VM classes (sizing profiles) to make available in the namespace.
At least one VM class is required if specified.

MinItems: 1

zones SupervisorNamespaceSpecClassConfigOverridesZones array

Zone-specific resource allocations for high availability and capacity management.
Maximum 3 zones supported for optimal HA configuration.

SupervisorNamespaceSpecClassConfigOverridesContentSources

Content source configuration

Appears In:
Field Description Default Validation

name string

Name of the content library.

MaxLength: 253
MinLength: 1
Required: true

type string

Type of content source. Currently only 'ContentLibrary' is supported.

Pattern: ContentLibrary
Required: true

SupervisorNamespaceSpecClassConfigOverridesStorageClasses

Storage class configuration.

Appears In:
Field Description Default Validation

name string

Name of the Kubernetes StorageClass.

MaxLength: 253
MinLength: 1
Required: true

limit string

Maximum storage capacity for this storage class.
Format: numeric value with unit suffix (Mi, Gi, Ti).

Pattern: (\d+)([MGT]i)?
Required: true

SupervisorNamespaceSpecClassConfigOverridesVmClasses

VM class configuration.

Appears In:
Field Description Default Validation

name string

Name of the VirtualMachineClass defining CPU/memory configuration.

MaxLength: 253
MinLength: 1
Required: true

SupervisorNamespaceSpecClassConfigOverridesZones

Zone resource configuration.

Appears In:
Field Description Default Validation

name string

Name of the zone for resource allocation.

MaxLength: 253
MinLength: 1
Required: true

memoryLimit string

Maximum memory allocation for this zone.
Format: numeric value with unit (Mi, Gi, Ti).

Pattern: ^[1-9][0-9]*([MGT]i)?$
Required: true

memoryReservation string

Guaranteed memory reservation for this zone.
Ensures resources are available under contention.

Pattern: (\d+)([MGT]i)?
Required: true

cpuLimit string

Maximum CPU allocation for this zone.
Format: numeric cores, optionally with unit (M for MHz, G for GHz).

Pattern: ^[1-9][0-9]*([MG])?$
Required: true

cpuReservation string

Guaranteed CPU reservation for this zone.

Pattern: (\d+)([MG])?
Required: true

vmClassReservations SupervisorNamespaceSpecClassConfigOverridesZonesVmClassReservations array

Pre-allocated VM class reservations for this zone.

SupervisorNamespaceSpecClassConfigOverridesZonesVmClassReservations

Guaranteed VM class reservation.

Appears In:
Field Description Default Validation

vmClassName string

VM class to reserve instances for.

Required: true

count integer

Number of instances to reserve.

Required: true

SupervisorNamespaceStatus

SupervisorNamespaceStatus reflects the observed state of the namespace. All fields are populated by the system and are read-only.

Appears In:
Field Description Default Validation

contentLibraries SupervisorNamespaceStatusContentLibraries array

Content libraries currently available in the namespace.

storageClasses SupervisorNamespaceStatusStorageClasses array

Storage classes with their configured limits.

vmClasses SupervisorNamespaceStatusVmClasses array

VM classes available for workload deployment.

vpcName string

VPC associated with the namespace (from spec).

sharedSubnetNames string array

Shared subnets associated with the namespace.

segName string

Service Engine Group associated with the namespace.

infraPolicies SupervisorNamespaceStatusInfraPolicies array

List of Infra Policies associated with the Supervisor Namespace

zones SupervisorNamespaceStatusZones array

Zone configurations and current state.

phase string

Current lifecycle phase of the namespace.
Values: Pending, Creating, Ready, Updating, Deleting, Failed, Error

namespaceEndpointURL string

Kubernetes API server endpoint URL for this supervisor namespace.
Use this endpoint with kubectl or API clients to manage workloads.

conditions SupervisorNamespaceStatusConditions array

Detailed conditions tracking namespace health and lifecycle events.

SupervisorNamespaceStatusConditions

Namespace condition.

Appears In:
Field Description Default Validation

lastTransitionTime string

Timestamp when the condition last changed.

message string

Human-readable message with details about the condition.

reason string

Machine-readable CamelCase reason code.

severity string

Severity level: Info, Warning, Error

status string

Condition status: True, False, Unknown

Required: true

type string

Condition type identifier (e.g., Ready, ResourcesAllocated, NetworkConfigured)

Required: true

SupervisorNamespaceStatusContentLibraries

Content library status.

Appears In:
Field Description Default Validation

name string

Name of the content library.

Required: true

type string

Type of content source.

Required: true

SupervisorNamespaceStatusInfraPolicies

Infra Policy information

Appears In:
Field Description Default Validation

name string

Name of the Infra Policy

mandatory boolean

Infra policy is auto enforced on the Namespace if mandatory

SupervisorNamespaceStatusStorageClasses

Storage class status.

Appears In:
Field Description Default Validation

name string

Name of the storage class.

Required: true

limit string

Configured storage limit.

Required: true

SupervisorNamespaceStatusVmClasses

VM class status.

Appears In:
Field Description Default Validation

name string

Name of the VM class.

Required: true

SupervisorNamespaceStatusZones

Zone status information.

Appears In:
Field Description Default Validation

name string

Zone name.

Required: true

memoryLimit string

Configured memory limit

Required: true

memoryReservation string

Configured memory reservation.

Required: true

cpuLimit string

Configured CPU limit.

Required: true

cpuReservation string

Configured CPU reservation.

Required: true

vmClassReservations SupervisorNamespaceStatusZonesVmClassReservations array

VM class reservations in this zone.

markedForRemoval boolean

Indicates if this zone is scheduled for removal during a scale-down operation.

SupervisorNamespaceStatusZonesVmClassReservations

VM class reservation details.

Appears In:
Field Description Default Validation

vmClassName string

VM class name.

Required: true

count integer

VM class reservation count.

Required: true

operations.cci.vmware.com/v1alpha1

Resource Types

PriceEstimateRequest

PriceEstimateRequest is used to calculate the estimated cost of deploying resources within a supervisor namespace or region. This resource enables users to understand pricing implications before provisioning infrastructure, supporting budgeting and cost optimization decisions. The estimate includes compute, storage, and additional charges broken down by resource type.

Field Description Default Validation

apiVersion string

operations.cci.vmware.com/v1alpha1

kind string

PriceEstimateRequest

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec PriceEstimateRequestSpec

PriceEstimateRequestSpec defines the resources for which pricing is requested.

Required: true

status PriceEstimateRequestStatus

PriceEstimateRequestStatus contains the computed pricing information.
This is populated by the system after the pricing calculation completes,
including total cost, currency details, and per-resource breakdowns.

PriceEstimateRequestSpec

PriceEstimateRequestSpec defines the resources for which pricing is requested.

Appears In:
Field Description Default Validation

supervisorNamespaceName string

The name of the Supervisor Namespace in which the pricing request is scoped.
This links the request to a specific namespace within the supervisor cluster,
ensuring pricing is calculated based on the namespace’s region and policies.
If specified, regionName is typically derived from the namespace’s configuration.

regionName string

Name of the region where resources will be deployed.
Region-specific pricing rates and policies are applied based on this value.
Required if supervisorNamespaceName is not provided.

resources PriceEstimateRequestSpecResources array

List of resource configuration objects included in the pricing request.
Each object defines a resource (VirtualMachine, Cluster, etc.) with its
attributes such as VM class, storage class, and quantity. The pricing engine
calculates costs based on these specifications.

Required: true

PriceEstimateRequestSpecResources

Appears In:
Field Description Default Validation

name string

The name of the resource for identification in pricing breakdown.
Examples: VM instance name, cluster name, storage volume name.

Required: true

kind string

The type of resource being priced.
Common values: VirtualMachine, Cluster, PersistentVolumeClaim, LoadBalancer.

Required: true

additionalProperties interface{}

Additional key-value attributes specific to the resource type.
For VirtualMachines: vmClass, storageClass, diskSize, count
For Clusters: nodeCount, nodeClass, storagePerNode
For PVCs: storageClass, size

Required: true

PriceEstimateRequestStatus

PriceEstimateRequestStatus contains the computed pricing information. This is populated by the system after the pricing calculation completes, including total cost, currency details, and per-resource breakdowns.

Appears In:
Field Description Default Validation

totalPrice float

The total aggregated price of all resources in the request.
This is the sum of compute, storage, and additional charges across
all specified resources. Price is typically expressed as cost per month
or per hour depending on the pricing model.

currencyDetails PriceEstimateRequestStatusCurrencyDetails

Details of the currency in which pricing is calculated.
Currency is determined by the organization’s billing configuration
or region-specific defaults.

priceDetails PriceEstimateRequestStatusPriceDetails array

Breakdown of pricing per resource, showing individual costs
for compute, storage, and additional charges. This detailed view
helps users understand cost distribution across their resources.

PriceEstimateRequestStatusCurrencyDetails

Details of the currency in which pricing is calculated. Currency is determined by the organization’s billing configuration or region-specific defaults.

Appears In:
Field Description Default Validation

name string

Full name of the currency.

Required: true

code string

Standard ISO 4217 three-letter currency code.

Required: true

symbol string

Currency symbol for display purposes.

Required: true

PriceEstimateRequestStatusPriceDetails

Appears In:
Field Description Default Validation

name string

Name of the resource matching the spec.resources[].name field.

kind string

The resource type matching the spec.resources[].kind field.

computePrice float

Price related to compute usage including vCPU and memory.
This reflects the cost of processing power allocated to the resource.

storagePrice float

Price related to storage usage including persistent volumes and disks.
Different storage classes (SSD, HDD, NVMe) have different pricing rates.

additionalPrice float

Any additional charges for the resource such as:
- Operating system licensing (Windows, RHEL, etc.)
- Software licenses (databases, applications)
- Premium support add-ons

project.cci.vmware.com/v1alpha2

Resource Types

Project

Project represents a logical grouping of resources and users in the CCI infrastructure. Projects provide multi-tenancy capabilities by isolating resources and managing access control. Each project can contain supervisor namespaces, role bindings, and other project-scoped resources.

Field Description Default Validation

apiVersion string

project.cci.vmware.com/v1alpha2

kind string

Project

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec ProjectSpec

ProjectSpec defines the desired state of the Project.
It contains configuration and metadata about the project.

ProjectSpec

ProjectSpec defines the desired state of the Project. It contains configuration and metadata about the project.

Appears In:
Field Description Default Validation

description string

Human-readable description of the project’s purpose and contents.
This field helps users understand what the project is used for and who should access it.
Maximum length is 2000 characters.

MaxLength: 2000

topology.cci.vmware.com/v1alpha1

Resource Types

RegionBinding

RegionBinding associates a Region with a project namespace, granting the project access to create resources in that region. This enables multi-region deployments by explicitly controlling which regions are available to each project.

Field Description Default Validation

apiVersion string

topology.cci.vmware.com/v1alpha1

kind string

RegionBinding

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec RegionBindingSpec

RegionBindingSpec defines which region is bound to the project.

status RegionBindingStatus

RegionBindingStatus reflects the current state and properties of the bound region.
This is populated by the system from the referenced Region resource.

RegionBindingSpec

RegionBindingSpec defines which region is bound to the project.

Appears In:
Field Description Default Validation

regionName string

Name of the Region resource to bind to this project namespace.
Must reference an existing Region resource. Once bound, project members
can create supervisor namespaces and other resources in this region.

Required: true

RegionBindingStatus

RegionBindingStatus reflects the current state and properties of the bound region. This is populated by the system from the referenced Region resource.

Appears In:
Field Description Default Validation

description string

Description of the bound region, copied from the Region resource.
Provides context about the region’s location or purpose.

loadBalancerType string

Type of load balancer infrastructure available in the bound region.
Copied from the Region resource for quick reference.

Zone

Zone represents a failure domain or availability zone within a Region. Zones provide resource isolation and high availability by distributing workloads across different physical infrastructure within a region. Each zone has resource quotas for CPU and memory that limit the total allocation for supervisor namespaces.

Field Description Default Validation

apiVersion string

topology.cci.vmware.com/v1alpha1

kind string

Zone

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec ZoneSpec

ZoneSpec defines the desired resource limits and topology configuration for the Zone.

status ZoneStatus

ZoneStatus defines the observed resource utilization state of the Zone.
These values are populated by the system and reflect actual usage.

ZoneSpec

ZoneSpec defines the desired resource limits and topology configuration for the Zone.

Appears In:
Field Description Default Validation

regionName string

Name of the parent Region to which this Zone belongs.
Must reference an existing Region resource.

Required: true

zoneName string

Name identifier of the zone within the region.
This typically corresponds to the underlying infrastructure zone identifier.

Required: true

memoryLimit string

Total memory capacity available in this zone for allocation to supervisor namespaces.
Specified in bytes with optional unit suffix (e.g., '100Gi', '500Mi').
This represents the maximum memory that can be allocated across all namespaces in the zone.

Required: true

memoryReservation string

Total memory reserved in this zone across all supervisor namespaces.
Memory reservations guarantee that resources are available even under contention.
Specified in bytes with optional unit suffix (e.g., '50Gi', '256Mi').

Required: true

cpuLimit string

Total CPU capacity available in this zone for allocation to supervisor namespaces.
Specified in millicores or cores (e.g., '100', '50000m', '100G' for GHz).
This represents the maximum CPU that can be allocated across all namespaces in the zone.

Required: true

cpuReservation string

Total CPU reserved in this zone across all supervisor namespaces.
CPU reservations guarantee that resources are available even under contention.
Specified in millicores or cores (e.g., '50', '25000m', '50G' for GHz).

Required: true

ZoneStatus

ZoneStatus defines the observed resource utilization state of the Zone. These values are populated by the system and reflect actual usage.

Appears In:
Field Description Default Validation

memoryUsed string

Amount of memory currently allocated across all supervisor namespaces in this zone.
Specified in bytes with optional unit suffix.

memoryReservationUsed string

Amount of memory currently reserved across all supervisor namespaces in this zone.
This tracks the sum of all namespace memory reservations.

cpuUsed string

Amount of CPU currently allocated across all supervisor namespaces in this zone.
Specified in millicores or cores.

cpuReservationUsed string

Amount of CPU currently reserved across all supervisor namespaces in this zone.
This tracks the sum of all namespace CPU reservations.

topology.cci.vmware.com/v1alpha2

Resource Types

Region

Region represents a geographic or logical datacenter location in the CCI topology. Regions contain zones and provide infrastructure isolation and locality. Each region has specific infrastructure capabilities and load balancer configurations.

Field Description Default Validation

apiVersion string

topology.cci.vmware.com/v1alpha2

kind string

Region

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec RegionSpec

RegionSpec defines the desired state of the Region.
It contains configuration and metadata about the region.

status RegionStatus

RegionStatus defines the observed state of the Region.
This is populated by the system and reflects the actual runtime state.

RegionSpec

RegionSpec defines the desired state of the Region. It contains configuration and metadata about the region.

Appears In:
Field Description Default Validation

description string

Human-readable description of the region’s location, purpose, or characteristics.
This helps users understand the geographic location or intended use of the region.
Maximum length is 1000 characters.

MaxLength: 1000

RegionStatus

RegionStatus defines the observed state of the Region. This is populated by the system and reflects the actual runtime state.

Appears In:
Field Description Default Validation

loadBalancerType string

The type of load balancer infrastructure available in this region.
This indicates the load balancing technology deployed.

vpc.nsx.vmware.com/v1alpha1

Resource Types

AdvertisedNetworks

AdvertisedNetworks is a subresource of TGWAttachment that represents the list of networks advertised from the TransitGateway to a Provider Gateway through the specified TGWAttachment.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

AdvertisedNetworks

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

advertisedNetworks AdvertisedNetworksAdvertisedNetworksItem array

AdvertisedNetworksAdvertisedNetworksItem

Appears In:
Field Description Default Validation

network string

The CIDR block of the advertised network (e.g., "10.0.0.0/24").

Required: true

ruleFilterType string

The type of rule filter applied when advertising this network. Indicates how the network is selected or filtered for advertisement.

Required: true

status string

The current advertisement status of the network to the connected gateway.

Required: true

DistributedVLANConnection

DistributedVLANConnection defines a connectivity specification to a VLAN.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

DistributedVLANConnection

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec DistributedVLANConnectionSpec

status DistributedVLANConnectionStatus

DistributedVLANConnection status

DistributedVLANConnectionSpec

Appears In:
Field Description Default Validation

associatedIPBlockNames string array

The names of IP blocks associated with the distributed vlan connection.

gatewayAddresses string array

The gateway addresses of this VLAN in the format of network address and prefix length, e.g. 192.168.0.1/24.

regionName string

The name of the region that the connection is placed in.

Required: true

subnetExtensionConnection string

SubnetExtensionConnection controls the connectivity mode for VPC Subnets referencing this distributed VLAN connection. This property determines whether VPC Subnets can use this distributed VLAN connection and the type of connectivity allowed. Valid values: Disabled (default), EnabledL2, and EnabledL2AndL3.

vlanID integer

VLAN ID for external gateway traffic.

0

Required: true

DistributedVLANConnectionStatus

Appears In:
Field Description Default Validation

conditions DistributedVLANConnectionStatusConditions array

Current DistributedVLANConnection conditions.

DistributedVLANConnectionStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

FirewallPolicy

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

FirewallPolicy

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec FirewallPolicySpec

status FirewallPolicyStatus

FirewallPolicy status

FirewallPolicySpec

Appears In:
Field Description Default Validation

applicationConnectivityStrategy FirewallPolicySpecApplicationConnectivityStrategy array

ApplicationConnectivityStrategy indicates the application connectivity policy for the firewall policy. This field is a list of application connectivity strategies.

appliedTo FirewallPolicySpecAppliedTo

category string

Pre-defined categories for classifying a security policy. These are the pre-defined categories for classifying a firewall policy - "Infrastructure" , "Environment" and "Application".

connectivityPreference string

ConnectivityPreference indicates the default connectivity policy for the firewall policy.

description string

Description for the firewall policy.

isDefault boolean

A flag to indicate whether rule is a default rule

False

locked boolean

Locked indicates whether a security policy should be locked

False

priority integer

This field is used to resolve conflicts between multiple Rules under Security or Gateway Policy for a Domain. If no priority is specified in the payload, a value of 0 is assigned by default.

0

regionName string

The name of the region that the Firewall Profile is placed in. RegionName cannot be changed after policy is created.

Required: true

rules FirewallPolicySpecRules array

Rules that are a part of this FirewallPolicy

stateful boolean

Stateful or Stateless nature of security policy is enforced on all rules in this security policy. When it is stateful, the state of the network connects are tracked and a stateful packet inspection is performed.

False

systemOwned boolean

SystemOwned indicates system owned resource

False

tcpStrict boolean

Ensures that a 3 way TCP handshake is done before the data packets are sent. tcp_strict=true is supported only for stateful security policies. If the tcp_strict flag is not specified and the security policy is stateful, then tcp_strict will be set to true.

False

FirewallPolicySpecApplicationConnectivityStrategy

ApplicationConnectivityStrategy defines the application connectivity strategy for firewall policies.

Appears In:
Field Description Default Validation

applicationConnectivityStrategy string

ApplicationConnectivityStrategy specifies the app connectivity strategy.

defaultApplicationRuleId integer

DefaultApplicationRuleId is the rule id internally assigned by the system for the default rule.

loggingEnabled boolean

LoggingEnabled is a flag to enable packet logging. Default is deactivated.

FirewallPolicySpecAppliedTo

Appears In:
Field Description Default Validation

groupNames string array

The list of group paths where the rules in this policy will get applied. Policy level AppliedTo will take precedence over rule level AppliedTo.

FirewallPolicySpecRules

Appears In:
Field Description Default Validation

action string

Action to be applied to all the services

appliedTo FirewallPolicySpecRulesAppliedTo

destinationsExcluded boolean

DestinationsExcluded indicates that the rule applies to all destinations except those specified in the 'To' field. When true, the 'To' field acts as an exclusion list.

direction string

Direction defines direction of traffic.

disabled boolean

Disabled indicates if the rule is enabled/disabled.

False

from FirewallPolicySpecRulesFrom array

From defines the source of the traffic. If empty, it defaults to "Any", matching all sources. This behavior is inverted if 'SourcesExcluded' is set to true, in which case this field acts as an exclusion list.

ipProtocol string

IpProtocol indicates type of IP packet that should be matched while enforcing the rule. Only IPV_4 protocol is supported for new rules, IPV4_IPV6 is only allowed for default rules.

isDefault boolean

IsDefault is a flag to indicate whether rule is a default rule.

False

log boolean

Log indicates if traffic matching this rule should be logged.

name string

Name for the rule. Must be unique within the policy.

Required: true

notes string

Notes for the rule.

services FirewallPolicySpecRulesServices array

Services specifies the network services (protocols and ports) to which this rule applies. If empty or null ,it defaults to "Any" , then this rule applies to all services.

sourcesExcluded boolean

SourcesExcluded indicates that the rule applies to all sources except those specified in the 'From' field. When true, the 'From' field acts as an exclusion list.

systemOwned boolean

SystemOwned indicates if the system owns the resource

False

tag string

Tag applied on the rule.

to FirewallPolicySpecRulesTo array

To defines the destination of the traffic. If empty, it defaults to "Any", matching all destinations. This behavior is inverted if 'DestinationsExcluded' is set to true, in which case this field acts as an exclusion list.

FirewallPolicySpecRulesAppliedTo

Appears In:
Field Description Default Validation

gatewayAttachmentNames string array

This field is only applicable when the rule is defined for Transit Gateway Firewall policy

gatewayNames string array

This field is only applicable when the rule is defined for Transit Gateway Firewall policy

groupNames string array

This field is only applicable when the rule is defined for Distributed Firewall policy

FirewallPolicySpecRulesFrom

Appears In:
Field Description Default Validation

groupName string

ipAddress string

FirewallPolicySpecRulesServices

Appears In:
Field Description Default Validation

l4PortSet FirewallPolicySpecRulesServicesL4PortSet

L4PortSetServiceEntry is a ServiceEntry that represents TCP or UDP protocol.

networkServiceName string

FirewallPolicySpecRulesServicesL4PortSet

L4PortSetServiceEntry is a ServiceEntry that represents TCP or UDP protocol.

Appears In:
Field Description Default Validation

destinationPorts string array

DestinationPorts defines the destination port or port range to match. For example: ["443"], ["8080-8090"]. If empty, matches any destination port.

l4Protocol string

L4Protocol specifies the Layer 4 protocol (TCP or UDP).

Required: true

sourcePorts string array

SourcePorts defines the source port or port range to match. For example: ["80"], ["1000-2000"]. If empty, matches any source port.

FirewallPolicySpecRulesTo

Appears In:
Field Description Default Validation

groupName string

ipAddress string

FirewallPolicyStatus

Appears In:
Field Description Default Validation

conditions FirewallPolicyStatusConditions array

Current TGWFirewallPolicy conditions.

ruleCount integer

The number of rules defined for the policy

0

FirewallPolicyStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

GatewayConnection

GatewayConnection defines a connectivity specification to a Provider Gateway.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

GatewayConnection

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec GatewayConnectionSpec

status GatewayConnectionStatus

GatewayConnection status

GatewayConnectionSpec

Appears In:
Field Description Default Validation

advertiseOutboundNetworks GatewayConnectionSpecAdvertiseOutboundNetworks

inboundRemoteNetworks string array

List of inbound remote network routes for TransitGateways. 0.0.0.0/0 will be used if it’s not configured. For multiple attachments on a TransitGateway, only one GatewayConnection can support the default route. Other GatewayConnections must have InboundRemoteNetworks configured.

natConfig GatewayConnectionSpecNatConfig

regionName string

The name of the region that the connection is placed in.

Required: true

GatewayConnectionSpecAdvertiseOutboundNetworks

Appears In:
Field Description Default Validation

allowExternalBlockNames string array

The names of the external IPBlocks used in the advertisement filter to advertise prefixes from TransitGateways.

allowPrivate boolean

Setting to true allows tenants to advertise prefixes from private-TGW IPBlocks from TransitGateways. If it is set to true, the GatewayConnection can’t be used in multiple TransitGateways. If it is set to true, EnableSNAT in NATConfig will not be true.

GatewayConnectionSpecNatConfig

Appears In:
Field Description Default Validation

enableSNAT boolean

EnableSNAT indicates if provider-managed SNAT is enabled. When enabled, traffic will be translated using an IP allocated from the IPBlock specified by IPBlockName. If it is set to true, AllowPrivate in AdvertiseOutboundNetworks will not be true.

ipBlockName string

The name of the IPBlock used to allocate translated IP for the provider-managed SNAT rules.

GatewayConnectionStatus

Appears In:
Field Description Default Validation

conditions GatewayConnectionStatusConditions array

Current GatewayConnection conditions.

GatewayConnectionStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

IPAddressAllocation

An IPAddressAllocation represents an allocation of IP addresses or CIDRs from IPBlocks in a given region.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

IPAddressAllocation

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec IPAddressAllocationSpec

IPAddressAllocationSpec

Appears In:
Field Description Default Validation

allocationIPs string

The specific IP addresses from IPBlock that needs to be requested. If specified, it should be passed like 192.168.0.0/24 or 192.168.0.1/32. The field AllocationIPs and AllocationSize cannot be provided together, either AllocationIPs or AllocationSize is needed.

allocationSize integer

Allocation IP address size for auto allocating IPs from IPBlock. The IP addresses will be auto allocated from unused IP addresses based on allocation size. If specified, its value must be 1.

ipBlockName string

IPBlock name for allocating IP address. Only IP address block of 'External' visibility type is supported.

Required: true

regionName string

The name of the region that the IPAddressAllocation is placed in.

Required: true

systemOwned boolean

Flag to indicate that the IPAddressAllocation is system-owned. It’s readonly.

False

IPBlock

An IPBlock represents a CIDR block that can be used for IP address allocation. An IPBlock with a name starting with ":" (e.g. ":ipblock-1") is a shared resource managed by the network provider. It is available for use but cannot be modified by users.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

IPBlock

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec IPBlockSpec

status IPBlockStatus

IPBlock status

IPBlockAllocationState

IPBlockAllocationState represents the allocation state of all CIDRs allocated from an IPBlock.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

IPBlockAllocationState

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

allocationStates IPBlockAllocationStateAllocationStatesItem array

State of each CIDR allocated from an IPBlock.

regionName string

RegionName specifies the name of the region where the IPBlock is located.

visibility string

Visibility of IPBlock. Must be External or Private.

IPBlockAllocationStateAllocationStatesItem

IPAddressBlockAllocationStateForCIDR represents the state for a CIDR allocated from an IPBlock. The CIDR can be a single IP which is represented as a /32. Or it can be a larger CIDR.

Appears In:
Field Description Default Validation

cidr string

Allocated CIDR from an IPBlock.

Required: true

consumerVPCName string

The VPC that the CIDR is allocated to.

ipAddressAllocationName string

The name of the IP Address Allocation object. Only one of IPAddressAllocationName or VPCIPAddressAllocationName will be set at a time. This field is not set when the allocation is used for WorkloadAllocatedIP or WorkloadStaticIP.

usedBy invalid type array

The service or VM using this allocated CIDR.

vpcIPAddressAllocationName string

The name of the VPC-level IP Address Allocation object. Only one of IPAddressAllocationName or VPCIPAddressAllocationName will be set at a time. This field is also set for IPAddressAllocations created in Supervisor Namespaces. This field is not set when the allocation is used for WorkloadAllocatedIP or WorkloadStaticIP.

IPBlockSpec

Appears In:
Field Description Default Validation

cidr string

A contiguous IP address space represented by network address and prefix length. Represents a network address and the prefix length which will be associated with a layer-2 broadcast domain. Support IPv4 and IPv6 CIDR. Deprecated: Use CIDRs or Ranges instead.

cidrs string array

An array of contiguous IP address spaces represented by network address and prefix length. Represents a list of CIDRs. Maximum supported: 10 CIDRs per IPBlock.

excludedIPs IPBlockSpecExcludedIps array

An array of contiguous IP address space represented by start and end IPs. Represents a list of excluded IP address in the form of start and end IPs.

ipAddressType string

Type of IP address. Must be IPv4 or IPv6. Read-only.

ranges IPBlockSpecRanges array

An array of contiguous IP address space represented by start and end IPs. Represents a list of IP address ranges in the form of start and end IPs. Maximum supported: 10 ranges per IPBlock.

regionName string

The name of the region that the IPBlock is placed in.

Required: true

subnetExclusive boolean

Flag to indicate that the IPBlock is reserved for direct VLAN extension use case. Read-only.

False

systemOwned boolean

Flag to indicate that the IPBlock is system-owned. Only Private IPBlocks not owned by the system can be used as the PrivateTGW IPBlocks in a VPCConnectivityProfile. System-owned Private IPBlocks are automatically created when Private IPs are specified during VPC creation and can only be used within that VPC. Read-only.

False

visibility string

Visibility of IPBlock. Must be External or Private.

IPBlockSpecExcludedIps

A set of IPv4 or IPv6 addresses defined by a start and end address.

Appears In:
Field Description Default Validation

end string

The end IP Address of the IP Range. format: IP.

Required: true

start string

The start IP Address of the IP Range. format: IP.

Required: true

IPBlockSpecRanges

A set of IPv4 or IPv6 addresses defined by a start and end address.

Appears In:
Field Description Default Validation

end string

The end IP Address of the IP Range. format: IP.

Required: true

start string

The start IP Address of the IP Range. format: IP.

Required: true

IPBlockStatus

Appears In:
Field Description Default Validation

conditions IPBlockStatusConditions array

Current IPBlock conditions.

totalSize string

The total allocation size of the IPBlock. Read-only.

usagePercentage float

The percentage of the IPBlock that is allocated. Read-only.

usedSize string

The total number of IPs in the IPBlock that is allocated. Read-only.

IPBlockStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

IPBlockUsage

IPBlockUsage is the usage information of an IPBlock. It contains used IP ranges and available IP ranges statistics of an IPBlock.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

IPBlockUsage

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

availableIPRanges string array

Available IP ranges in an IPBlock.

availableIPsCount string

Available IP count in an IPBlock.

cidrUsages IPBlockUsageCidrUsagesItem array

CIDR usage details for each CIDR in an IPBlock.

overallIPsCount string

Total count of IPs which are present in this block.

rangeUsages IPBlockUsageRangeUsagesItem array

Range usage details for each IP Range in an IPBlock.

regionName string

RegionName specifies the name of the region where the IPBlockUsage is located.

usedIPRanges string array

Used IP ranges in an IPBlock.

usedIPsCount string

Used IPs count in an IPBlock.

visibility string

Visibility of IPBlock. Must be External or Private.

IPBlockUsageCidrUsagesItem

Represents used and available IP statistics for CIDRs in an IPBlock.

Appears In:
Field Description Default Validation

availableIPRanges string array

Represents free IP ranges from the CIDR or IP Range.

availableIPsCount string

Represents free IP count in the CIDR or IP Range.

cidr string

One CIDR in an IPBlock CIDRList.

overallUsedIPRanges string array

Represent the overall IP ranges allocated from the CIDR or IP Range across all tenants.

overallUsedIPsCount string

Represent the overall IP count allocated from the CIDR or IP Range across all tenants.

usedIPRanges string array

Represents IP ranges that are allocated from the CIDR or IP Range in the tenant scope.

usedIPsCount string

Represents IP count that are allocated from the CIDR or IP Range in the tenant scope.

IPBlockUsageRangeUsagesItem

Represents used and available IP statistics for IP Ranges in an IPBlock.

Appears In:
Field Description Default Validation

availableIPRanges string array

Represents free IP ranges from the CIDR or IP Range.

availableIPsCount string

Represents free IP count in the CIDR or IP Range.

cidr string

One range in an IPBlock RangeList.

overallUsedIPRanges string array

Represent the overall IP ranges allocated from the CIDR or IP Range across all tenants.

overallUsedIPsCount string

Represent the overall IP count allocated from the CIDR or IP Range across all tenants.

usedIPRanges string array

Represents IP ranges that are allocated from the CIDR or IP Range in the tenant scope.

usedIPsCount string

Represents IP count that are allocated from the CIDR or IP Range in the tenant scope.

IPSecVPN

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

IPSecVPN

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec IPSecVPNSpec

status IPSecVPNStatus

IPSecVPN status

IPSecVPNDPDProfile

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

IPSecVPNDPDProfile

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec IPSecVPNDPDProfileSpec

status IPSecVPNDPDProfileStatus

IPSecVPNDPDProfile status

IPSecVPNDPDProfileSpec

Appears In:
Field Description Default Validation

dpdProbeInterval integer

DPD probe interval in seconds. Valid ranges depend on mode: Periodic: 3-360 (default 60) OnDemand: 1-10 (default 10)

dpdProbeMode string

Probe mode determines how liveliness checks are performed. Defaults to Periodic.

enabled boolean

Enable DPD functionality (default true). When disabled, no probes are sent.

regionName string

The name of the region that the IPSecVPNDPDProfile is placed in.

Required: true

retryCount integer

Maximum retry attempts for DPD messages (1-100, default 10)

IPSecVPNDPDProfileStatus

Appears In:
Field Description Default Validation

conditions IPSecVPNDPDProfileStatusConditions array

Current IPSecVPNDPDProfile conditions.

IPSecVPNDPDProfileStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

IPSecVPNIKEProfile

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

IPSecVPNIKEProfile

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec IPSecVPNIKEProfileSpec

status IPSecVPNIKEProfileStatus

IPSecVPNIKEProfile status

IPSecVPNIKEProfileSpec

Appears In:
Field Description Default Validation

dhGroups string array

Diffie-Hellman groups used if PFS is enabled. Default is [Group14].

digestAlgorithms string array

Algorithms for message digest during IKE negotiation. [SHA2_256] is default when encryption algorithms include AES_128 or AES_256.

encryptionAlgorithms string array

Encryption algorithms for IKE negotiation. Default is [AES_128].

ikeVersion string

IKEVersion represents the IKE protocol version. Possible values are: - "IKE_V1": Use IKE version 1 only. - "IKE_V2": Use IKE version 2 only (default). - "IKE_FLEX": Initiates with IKE V2 and responds to both V1 and V2 requests.

regionName string

The name of the region that the IPSecVPNIKEProfile is placed in.

Required: true

saLifeTime integer

Security association (SA) lifetime in seconds. Defaults to 86400 (1 day), must be between 21600 and 31536000.

IPSecVPNIKEProfileStatus

Appears In:
Field Description Default Validation

conditions IPSecVPNIKEProfileStatusConditions array

Current IPSecVPNIKEProfile conditions.

IPSecVPNIKEProfileStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

IPSecVPNLocalEndpoint

IPSecVPNLocalEndpoint represents a local endpoint of an IPSecVPN.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

IPSecVPNLocalEndpoint

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec IPSecVPNLocalEndpointSpec

Required: true

status IPSecVPNLocalEndpointStatus

IPSecVPNLocalEndpoint status

IPSecVPNLocalEndpointSpec

Appears In:
Field Description Default Validation

certificateName string

Certificate name. Name referencing site certificate.

localAddress string

IPv4 or IPv6 Address of local endpoint.

Required: true

localID string

Local identifier.

regionName string

RegionName specifies the name of the region where the IPSecVPNLocalEndpoint is located.

transitGatewayName string

The name of the TransitGateway that the IPSecVPN service is placed in.

Required: true

trustCANames string array

Certificate authority (CA) names. List of names referencing certificate authority (CA) to verify peer certificates.

trustCRLNames string array

Certificate revocation list (CRL) names. List of names referencing certificate revocation list (CRL) to peer certificates.

IPSecVPNLocalEndpointStatus

Appears In:
Field Description Default Validation

conditions IPSecVPNLocalEndpointStatusConditions array

Current IPSecVPNLocalEndpoint conditions.

IPSecVPNLocalEndpointStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

IPSecVPNSession

IPSecVPNSession represents a session of an IPSecVPN.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

IPSecVPNSession

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec IPSecVPNSessionSpec

Required: true

status IPSecVPNSessionStatus

IPSecVPNSession status

IPSecVPNSessionSpec

Appears In:
Field Description Default Validation

authenticationMode string

Peer authentication mode. Supported values: - PSK: In this mode a secret key shared between local and peer sites is to be used for authentication. The secret key can be a string with a maximum length of 128 characters. (Default) - Certificate: In this mode a certificate defined at the global level is to be used for authentication.

complianceSuite string

Compliance suite. Default is "NONE".

connectionInitiationMode string

Connection initiation mode used by local endpoint to establish IKE connections with peer site. Default is "Initiator". Initiator - In this mode local endpoint initiates tunnel setup and will also respond to incoming tunnel setup requests from peer gateway. RespondOnly - In this mode, local endpoint shall only respond to incoming tunnel setup requests. It shall not initiate the tunnel setup. OnDemand - In this mode local endpoint will initiate tunnel creation once first packet matching the policy rule is received and will also respond to incoming initiation request.

description string

The description of the IPSecVPNSession.

dpdProfileName string

Name referencing Dead Peer Detection (DPD) profile. Default is set to system default profile.

enabled boolean

Enable/Disable IPSec VPN session. Defaults to true if not specified.

ikeProfileName string

Name referencing IKE profile to be used. Default is set according to system default profile.

localEndpointName string

Name referencing Local endpoint.

peerAddress string

Public IPV4 or IPV6 address of the remote device terminating the VPN connection.

peerID string

Peer ID to uniquely identify the peer site. The peer ID is the public IP address of the remote device terminating the VPN tunnel. When NAT is configured for the peer, enter the private IP address of the peer.

psk string

IPSec Pre-shared key. Maximum length of this field is 128 characters.

regionName string

RegionName specifies the name of the region where the IPSecVPNSession is located.

rules IPSecVPNSessionSpecRules array

Rules defines protection rules matching local and peer subnets. Only available for PolicyBasedIPSecVPNSession. Minimum 1 item required.

tcpMSSClamping IPSecVPNSessionSpecTcpMssclamping

transitGatewayName string

The name of the TransitGateway that the IPSecVPN service is placed in.

Required: true

tunnelInterfaces IPSecVPNSessionSpecTunnelInterfaces array

TunnelInterfaces defines IP tunnel interfaces. Only available for RouteBasedIPSecVPNSession. Exactly 1 item required (minItems/maxItems=1).

tunnelProfileName string

Name referencing Tunnel profile to be used. Default is set to system default profile.

type string

Type of IPSecVPNSession - PolicyBased IPSecVPNSession requires to define protect rules that match local and peer subnets.
IPSec security associations is negotiated for each pair of local and peer subnet.
- RouteBased IPSecVPNSession is more flexible, more powerful and recommended over policy based VPN.
IP Tunnel port is created and all traffic routed via tunnel port is protected.
Routes can be configured statically or can be learned through BGP.
A route based VPN is must for establishing redundant VPN session to remote site.

Required: true

IPSecVPNSessionSpecRules

Appears In:
Field Description Default Validation

action string

Action to be applied (Protect/Bypass - read-only)

destinations IPSecVPNSessionSpecRulesDestinations array

Destination list (max 256 IPv4/IPv6 subnets, defaults to 0.0.0.0/0 and ::/0)

enabled boolean

Enable/disable the rule (default: true if unset)

id string

Unique identifier of IPSecVPNRule

Required: true

logged boolean

Logging flag for this rule (default false)

sequenceNumber integer

Sequence number determines priority (0 or higher)

sources IPSecVPNSessionSpecRulesSources array

Source list (max 256 IPv4/IPv6 subnets, defaults to 0.0.0.0/0 and ::/0)

IPSecVPNSessionSpecRulesDestinations

Appears In:
Field Description Default Validation

subnet string

Subnet used in policy rule (IPv4/IPv6 CIDR format, required)

Required: true

IPSecVPNSessionSpecRulesSources

Appears In:
Field Description Default Validation

subnet string

Subnet used in policy rule (IPv4/IPv6 CIDR format, required)

Required: true

IPSecVPNSessionSpecTcpMssclamping

Appears In:
Field Description Default Validation

direction string

Specifies the traffic direction for which to apply MSS Clamping. Default: None

maxSegmentSize integer

MSS defines the maximum amount of data that a host is willing to accept in a single TCP segment. Supported range 216-8902.

IPSecVPNSessionSpecTunnelInterfaces

Appears In:
Field Description Default Validation

ipSubnets IPSecVPNSessionSpecTunnelInterfacesIpSubnets array

IP Tunnel interface subnet. Supports assigning both IPv4 and IPV6 subnets to VTI. If two IPs are provided for VTI, both cannot be of same IP versions.

Required: true

IPSecVPNSessionSpecTunnelInterfacesIpSubnets

Appears In:
Field Description Default Validation

ipAddresses string array

IPv4 or IPv6 Addresses

Required: true

prefixLength integer

Subnet Prefix Length maximum prefixlen for IPv4 address - 31, IPv6 address - 127.

0

Required: true

IPSecVPNSessionStatistics

IPSecVPNSessionStatistics represents statistics of an IPSecVPNSession.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

IPSecVPNSessionStatistics

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

aggregateTrafficCounters IPSecVPNSessionStatisticsAggregateTrafficCounters

alarm IPSecVPNSessionStatisticsAlarm

ikeStatus IPSecVPNSessionStatisticsIkeStatus

lastUpdateTimestamp integer

Timestamp when the data was last updated.

policyStatistics IPSecVPNSessionStatisticsPolicyStatisticsItem array

Policy traffic statistics including aggregated and individual tunnel stats.

regionName string

RegionName specifies the name of the region where the IPSecVPNSession is located.

transitGatewayName string

The name of the TransitGateway that the IPSecVPN service is placed in.

IPSecVPNSessionStatisticsAggregateTrafficCounters

Appears In:
Field Description Default Validation

bytesIn integer

Total number of traffic bytes received on inbound security association

0

Required: true

bytesOut integer

Total number of traffic bytes sent on outbound security association

0

Required: true

droppedPacketsIn integer

Total number of incoming packets dropped on inbound security association

0

Required: true

droppedPacketsOut integer

Total number of outgoing packets dropped on outbound security association

0

Required: true

packetsIn integer

Total number of packets received on inbound security association

0

Required: true

packetsOut integer

Total number of packets sent on outbound security association

0

Required: true

IPSecVPNSessionStatisticsAlarm

Appears In:
Field Description Default Validation

errorID string

Alarm error id.

Required: true

message string

Error message describing the issue.

Required: true

IPSecVPNSessionStatisticsIkeStatus

Appears In:
Field Description Default Validation

failReason string

Reason for failure if IKE session is down.

ikeSessionState string

IKE session service status Up/Down/Negotiating.

Required: true

IPSecVPNSessionStatisticsPolicyStatisticsItem

Appears In:
Field Description Default Validation

aggregateTrafficCounters invalid type

Required: true

tunnelStatistics invalid type array

Individual tunnel statistics under policy.

IPSecVPNSessionStatus

Appears In:
Field Description Default Validation

conditions IPSecVPNSessionStatusConditions array

Current IPSecVPNSession conditions.

IPSecVPNSessionStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

IPSecVPNSpec

Appears In:
Field Description Default Validation

bypassRules IPSecVPNSpecBypassRules array

Bypass policy rules (higher priority than protect rules for all sessions)

enabled boolean

Enable IPSecVPN service (default: true if unset)

haSync boolean

Flag to enable IPSec HA State Sync (default: true if unset)

ikeLogLevel string

Internet key exchange (IKE) log level (Debug/Info/Warn/Error/Emergency. Default: Info)

regionName string

The name of the region that the IPSecVPN is placed in.

transitGatewayName string

The name of the TransitGateway that the IPSecVPN service is placed in.

Required: true

IPSecVPNSpecBypassRules

Appears In:
Field Description Default Validation

action string

Action to be applied (Protect/Bypass - read-only)

destinations IPSecVPNSpecBypassRulesDestinations array

Destination list (max 256 IPv4/IPv6 subnets, defaults to 0.0.0.0/0 and ::/0)

enabled boolean

Enable/disable the rule (default: true if unset)

id string

Unique identifier of IPSecVPNRule

Required: true

logged boolean

Logging flag for this rule (default false)

sequenceNumber integer

Sequence number determines priority (0 or higher)

sources IPSecVPNSpecBypassRulesSources array

Source list (max 256 IPv4/IPv6 subnets, defaults to 0.0.0.0/0 and ::/0)

IPSecVPNSpecBypassRulesDestinations

Appears In:
Field Description Default Validation

subnet string

Subnet used in policy rule (IPv4/IPv6 CIDR format, required)

Required: true

IPSecVPNSpecBypassRulesSources

Appears In:
Field Description Default Validation

subnet string

Subnet used in policy rule (IPv4/IPv6 CIDR format, required)

Required: true

IPSecVPNStatus

Appears In:
Field Description Default Validation

conditions IPSecVPNStatusConditions array

Current IPSecVPN conditions.

IPSecVPNStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

IPSecVPNSummary

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

IPSecVPNSummary

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

aggregateTrafficCounters IPSecVPNSummaryAggregateTrafficCounters

lastUpdateTimestamp integer

Timestamp when the data was last updated.

regionName string

The name of the region that the IPSecVPN is placed in.

sessionSummary IPSecVPNSummarySessionSummary

trafficSummaryPerSession IPSecVPNSummaryTrafficSummaryPerSessionItem array

Provides the IPSec tunnel statistics for an individual IPSec VPN session for a specific IPSec VPN service. It includes the incoming/outgoing/dropped packet counters since the tunnels are UP.

transitGatewayName string

The name of the TransitGateway that the IPSecVPN service is placed in.

IPSecVPNSummaryAggregateTrafficCounters

Appears In:
Field Description Default Validation

bytesIn integer

Total number of traffic bytes received on inbound security association

0

Required: true

bytesOut integer

Total number of traffic bytes sent on outbound security association

0

Required: true

droppedPacketsIn integer

Total number of incoming packets dropped on inbound security association

0

Required: true

droppedPacketsOut integer

Total number of outgoing packets dropped on outbound security association

0

Required: true

packetsIn integer

Total number of packets received on inbound security association

0

Required: true

packetsOut integer

Total number of packets sent on outbound security association

0

Required: true

IPSecVPNSummarySessionSummary

Appears In:
Field Description Default Validation

degradedSessions integer

The number of degraded IPSec VPN sessions.

0

Required: true

establishedSessions integer

The number of established IPSec VPN sessions.

0

Required: true

failedSessions integer

The number of failed IPSec VPN sessions.

0

Required: true

negotiatingSessions integer

The number of negotiating IPSec VPN sessions.

0

Required: true

totalSessions integer

The total number of IPSec VPN sessions configured.

0

Required: true

IPSecVPNSummaryTrafficSummaryPerSessionItem

Appears In:
Field Description Default Validation

ipSecVPNSessionName string

Reference to the IPSec VPN session

trafficCounters invalid type

Required: true

IPSecVPNTunnelProfile

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

IPSecVPNTunnelProfile

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec IPSecVPNTunnelProfileSpec

status IPSecVPNTunnelProfileStatus

IPSecVPNTunnelProfile status

IPSecVPNTunnelProfileSpec

Appears In:
Field Description Default Validation

dfPolicy string

Policy for handling defragmentation bit (Copy or Clear)

dhGroups string array

Diffie-Hellman groups used if PFS is enabled (default [Group14])

digestAlgorithms string array

Algorithms for message digest verification (SHA1/SHA2 variants)

enablePerfectForward boolean

Enable perfect forward secrecy (default: true)

encryptionAlgorithms string array

Encryption algorithms for tunnel negotiation (default [AES_GCM_128])

extendedAttributes IPSecVPNTunnelProfileSpecExtendedAttributes array

Extended attributes holding type-specific properties. Read-only.

regionName string

The name of the region that the IPSecVPNTunnelProfile is placed in.

Required: true

saLifeTime integer

Security association (SA) lifetime in seconds. Defaults to 86400 (1 day), must be between 21600 and 31536000.

IPSecVPNTunnelProfileSpecExtendedAttributes

AttributeVal represents extended attributes of realized entities

Appears In:
Field Description Default Validation

dataType string

Data type of the attribute (String/Date/Integer/Boolean)

key string

Key identifier for the attribute value

multivalue boolean

Indicates if attribute has multiple values

values string array

List of attribute values (strings)

IPSecVPNTunnelProfileStatus

Appears In:
Field Description Default Validation

conditions IPSecVPNTunnelProfileStatusConditions array

Current IPSecVPNTunnelProfile conditions.

IPSecVPNTunnelProfileStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

Limit

Limit represents a constraint that applies to VPCs. A Limit with a name starting with ":" (e.g. ":limit-1") is a global constraint managed by the network provider that applies to all VPCs in the region and is read-only. Otherwise, a Limit applies only to VPCs associated with it.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

Limit

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec LimitSpec

LimitSpec

Appears In:
Field Description Default Validation

quota LimitSpecQuota

regionName string

The name of the region that the limit is placed in.

Required: true

LimitSpecQuota

Appears In:
Field Description Default Validation

ipBlockAddressType string

Type of IPBlock address. Must be IPv4 or IPv6. One IPv4 block and another IPv6 block cannot be specified within the same quota.

Required: true

ipBlockNames string array

IPBlock names in quota.

ipBlockVisibility string

Visibility of IPBlock on which the quota will be applied. Must be External or Private.

Required: true

otherCIDRs LimitSpecQuotaOtherCidrs

IPBlock quota limits defined on CIDRs that are not single IPs.

singleIPCIDRs integer

Single IP quota count. If SingleIPCIDRs is -1, it means there is no single IP restriction and any number is allowed. An empty value represents that there is no single IP restriction like -1 when used in the Limit resource, or that the restriction is not in effect for the VPC when used in the VPCLimitState resource.

LimitSpecQuotaOtherCidrs

IPBlock quota limits defined on CIDRs that are not single IPs.

Appears In:
Field Description Default Validation

mask string

The largest size CIDR mask that is allowed. The mask specifies the largest size subnet that can be carved. Any subnet that is of size ⇐ the mask, and which is not single IPs can be carved out of the IP block. CIDR mask must be in the format "/<cidr>". For example, for IPv4, it could be "/28", cannot be "/32". An empty value("") represents that there is no Mask restriction of subnets and any size of subnet is allowed when used in the Limit resource, or that the restriction is not in effect for the VPC when used in the VPCLimitState resource.

totalCount integer

Total count of CIDRs allowed. The total number of subnets that can be carved from the IPBlock and whose size is less than or equal to the mask. If TotalCount is -1, it means there is no total number of subnets restriction and any number of subnets is allowed. An empty value represents that there is no TotalCount restriction like -1 when used in the Limit resource, or that the restriction is not in effect for the VPC when used in the VPCLimitState resource.

LimitState

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

LimitState

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

quota LimitStateQuota

IPBlock quota limit state. Represents the IPBlock quota usage details for consumers, where a consumer can be either an entire region or a specific VPC.

regionName string

RegionName specifies the name of the region where the quota limit state is located

LimitStateQuota

IPBlock quota limit state. Represents the IPBlock quota usage details for consumers, where a consumer can be either an entire region or a specific VPC.

Appears In:
Field Description Default Validation

ipBlockAddressType string

Type of IPBlock address. Must be IPv4 or IPv6. One IPv4 block and another IPv6 block cannot be specified within the same quota.

Required: true

ipBlockNames string array

IPBlock names in quota.

ipBlockVisibility string

Visibility of IPBlock on which the quota will be applied. Must be External or Private.

Required: true

otherCIDRs LimitStateQuotaOtherCidrs

IPBlock quota limits defined on CIDRs that are not single IPs.

singleIPCIDRs integer

Single IP quota count. If SingleIPCIDRs is -1, it means there is no single IP restriction and any number is allowed. An empty value represents that there is no single IP restriction like -1 when used in the Limit resource, or that the restriction is not in effect for the VPC when used in the VPCLimitState resource.

usage LimitStateQuotaUsage array

The consumption details for consumer of the IPBlock quota

LimitStateQuotaOtherCidrs

IPBlock quota limits defined on CIDRs that are not single IPs.

Appears In:
Field Description Default Validation

mask string

The largest size CIDR mask that is allowed. The mask specifies the largest size subnet that can be carved. Any subnet that is of size ⇐ the mask, and which is not single IPs can be carved out of the IP block. CIDR mask must be in the format "/<cidr>". For example, for IPv4, it could be "/28", cannot be "/32". An empty value("") represents that there is no Mask restriction of subnets and any size of subnet is allowed when used in the Limit resource, or that the restriction is not in effect for the VPC when used in the VPCLimitState resource.

totalCount integer

Total count of CIDRs allowed. The total number of subnets that can be carved from the IPBlock and whose size is less than or equal to the mask. If TotalCount is -1, it means there is no total number of subnets restriction and any number of subnets is allowed. An empty value represents that there is no TotalCount restriction like -1 when used in the Limit resource, or that the restriction is not in effect for the VPC when used in the VPCLimitState resource.

LimitStateQuotaUsage

Appears In:
Field Description Default Validation

cidrsConsumed integer

Number of CIDRs allocated to the consumer.

consumerVPCName string

singleIPsConsumed integer

Number of single IPs allocated to the consumer.

LoadBalancer

LoadBalancer represents a NSX Load Balancer of a VPC. The vpc.nsx.vmware.com/allow-auto-relocation annotation can be specified on a LoadBalancer to indicate that if there is no enough capacity on the current VPC’s allocated edge nodes, LB creation or update will trigger VPC edge auto-relocation according to LB size. It may bring traffic disruption for the services on the VPC, so please make sure to perform the operation in the maintenance window. The annotation is ephemeral and will not be saved to storage.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

LoadBalancer

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec LoadBalancerSpec

status LoadBalancerStatus

LoadBalancer status

LoadBalancerSpec

Appears In:
Field Description Default Validation

regionName string

RegionName specifies the name of the region where the Load Balancer is located.

vpcName string

The name of the VPC that the Load Balancer is placed in.

Required: true

LoadBalancerStatus

Appears In:
Field Description Default Validation

conditions LoadBalancerStatusConditions array

Current LoadBalancer conditions.

LoadBalancerStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

NetworkSecurityGroup

NetworkSecurityGroup includes different objects that are added both statically and dynamically, and can be used as the source, destination, and appliedTo of a firewall rule. It can be configured to contain a combination of VMs, Pods (PodVMs), IPBlocks, and other NetworkSecurityGroups.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

NetworkSecurityGroup

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec NetworkSecurityGroupSpec

NetworkSecurityGroupSpec defines the desired members of a NetworkSecurityGroup.
Constraints on selectors: - The total number of VMSelectors and PodSelectors must not exceed 5. - The total number of expressions across all VMSelectors and PodSelectors must not exceed 35.
- Each key in MatchLabels counts as one expression.
- Each entry in MatchExpressions counts as one expression.
- A LabelSelector, a NamespaceSelector, or a combination of both consumes one additional expression (in addition to
any expressions defined within them) and must be included in the overall 35-expression limit.

status NetworkSecurityGroupStatus

NetworkSecurityGroup status

NetworkSecurityGroupIPMembers

NetworkSecurityGroupIPMembers is a subresource of NetworkSecurityGroup that provides the list of effective member IP addresses.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

NetworkSecurityGroupIPMembers

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

ipAddresses string array

List of effective member IP addresses. Each entry can be a single IP address, an IP range, or a subnet in CIDR notation. Examples: "192.168.1.10", "192.168.1.1-192.168.1.100", "192.168.1.0/24".

NetworkSecurityGroupSpec

NetworkSecurityGroupSpec defines the desired members of a NetworkSecurityGroup. Constraints on selectors: - The total number of VMSelectors and PodSelectors must not exceed 5. - The total number of expressions across all VMSelectors and PodSelectors must not exceed 35. - Each key in MatchLabels counts as one expression. - Each entry in MatchExpressions counts as one expression. - A LabelSelector, a NamespaceSelector, or a combination of both consumes one additional expression (in addition to any expressions defined within them) and must be included in the overall 35-expression limit.

Appears In:
Field Description Default Validation

ipAddresses string array

List of IPs or CIDRs to be included in this NetworkSecurityGroup. Each entry can be a single IP address, an IP range, or a subnet in CIDR notation. Examples: "192.168.1.10", "192.168.1.1-192.168.1.100", "192.168.1.0/24".

networkSecurityGroupNames string array

List of NetworkSecurityGroup names that will be included in this NetworkSecurityGroup.

podSelectors NetworkSecurityGroupSpecPodSelectors array

List of Pod selectors that will dynamically select Pods to include in this NetworkSecurityGroup.

regionName string

The name of the region that the group is placed in.

Required: true

systemOwned boolean

Flag to indicate that the group is system-owned. It’s readonly.

False

vmSelectors NetworkSecurityGroupSpecVmSelectors array

List of Virtual Machine selectors that will dynamically select VMs to include in this NetworkSecurityGroup.

vms NetworkSecurityGroupSpecVms array

List of Virtual Machine references that will be included in this NetworkSecurityGroup.

vpcNames string array

List of VPC names that will be included in this NetworkSecurityGroup. Cannot be used together with other member types.

NetworkSecurityGroupSpecPodSelectors

PodSelector defines criteria for dynamically selecting Pods based on labels and Namespaces. At least one selector field must be specified. A Pod must satisfy all specified selectors to be included in the result.

Appears In:
Field Description Default Validation

labelSelector NetworkSecurityGroupSpecPodSelectorsLabelSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

namespaceSelector NetworkSecurityGroupSpecPodSelectorsNamespaceSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

NetworkSecurityGroupSpecPodSelectorsLabelSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

Appears In:
Field Description Default Validation

matchExpressions NetworkSecurityGroupSpecPodSelectorsLabelSelectorMatchExpressions array

matchExpressions is a list of label selector requirements. The requirements are ANDed.

matchLabels interface{}

matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

NetworkSecurityGroupSpecPodSelectorsLabelSelectorMatchExpressions

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Appears In:
Field Description Default Validation

key string

key is the label key that the selector applies to.

Required: true

operator string

operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

Required: true

values string array

values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

NetworkSecurityGroupSpecPodSelectorsNamespaceSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

Appears In:
Field Description Default Validation

matchExpressions NetworkSecurityGroupSpecPodSelectorsNamespaceSelectorMatchExpressions array

matchExpressions is a list of label selector requirements. The requirements are ANDed.

matchLabels interface{}

matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

NetworkSecurityGroupSpecPodSelectorsNamespaceSelectorMatchExpressions

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Appears In:
Field Description Default Validation

key string

key is the label key that the selector applies to.

Required: true

operator string

operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

Required: true

values string array

values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

NetworkSecurityGroupSpecVmSelectors

VMSelector defines criteria for dynamically selecting VMs based on labels, Namespaces, and VM properties. At least one selector field must be specified. A VM must satisfy all specified selectors to be included in the result.

Appears In:
Field Description Default Validation

labelSelector NetworkSecurityGroupSpecVmSelectorsLabelSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

namespaceSelector NetworkSecurityGroupSpecVmSelectorsNamespaceSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

propertySelector NetworkSecurityGroupSpecVmSelectorsPropertySelector

PropertySelector represents a set of conditions on VM properties. All MatchExpressions are ANDed; a VM must satisfy all expressions to match.

NetworkSecurityGroupSpecVmSelectorsLabelSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

Appears In:
Field Description Default Validation

matchExpressions NetworkSecurityGroupSpecVmSelectorsLabelSelectorMatchExpressions array

matchExpressions is a list of label selector requirements. The requirements are ANDed.

matchLabels interface{}

matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

NetworkSecurityGroupSpecVmSelectorsLabelSelectorMatchExpressions

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Appears In:
Field Description Default Validation

key string

key is the label key that the selector applies to.

Required: true

operator string

operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

Required: true

values string array

values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

NetworkSecurityGroupSpecVmSelectorsNamespaceSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

Appears In:
Field Description Default Validation

matchExpressions NetworkSecurityGroupSpecVmSelectorsNamespaceSelectorMatchExpressions array

matchExpressions is a list of label selector requirements. The requirements are ANDed.

matchLabels interface{}

matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

NetworkSecurityGroupSpecVmSelectorsNamespaceSelectorMatchExpressions

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Appears In:
Field Description Default Validation

key string

key is the label key that the selector applies to.

Required: true

operator string

operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

Required: true

values string array

values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

NetworkSecurityGroupSpecVmSelectorsPropertySelector

PropertySelector represents a set of conditions on VM properties. All MatchExpressions are ANDed; a VM must satisfy all expressions to match.

Appears In:
Field Description Default Validation

matchExpressions NetworkSecurityGroupSpecVmSelectorsPropertySelectorMatchExpressions array

MatchExpressions is a list of property selector requirements. Each requirement consists of a key, operator, and value.

NetworkSecurityGroupSpecVmSelectorsPropertySelectorMatchExpressions

PropertySelectorRequirement defines a single property-based condition for selecting VMs.

Appears In:
Field Description Default Validation

key string

Key is the VM property to match. Valid keys are Name, OSName and ComputerName.

Required: true

operator string

Operator defines how the Key is compared against Value. Valid operators are Equals, Contains, StartsWith, EndsWith and NotEquals.

Required: true

value string

Value is the target value to match against the VM property.

Required: true

NetworkSecurityGroupSpecVms

VMReference uniquely identifies a Virtual Machine.

Appears In:
Field Description Default Validation

instanceUUID string

InstanceUUID of the VM being referenced.

Required: true

NetworkSecurityGroupStatus

Appears In:
Field Description Default Validation

conditions NetworkSecurityGroupStatusConditions array

Current NetworkSecurityGroup conditions.

NetworkSecurityGroupStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

NetworkService

NetworkService defines a reusable specification for matching network traffic, such as protocol and port combinations. It can be referenced by firewall rules.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

NetworkService

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec NetworkServiceSpec

status NetworkServiceStatus

NetworkService status

NetworkServiceSpec

Appears In:
Field Description Default Validation

description string

The description of the NetworkService.

serviceEntries NetworkServiceSpecServiceEntries array

Service entries of the NetworkService.

NetworkServiceSpecServiceEntries

ServiceEntry defines a network service entry used to match network traffic. Exactly one of the entries should be set.

Appears In:
Field Description Default Validation

alg NetworkServiceSpecServiceEntriesAlg

ALGTypeServiceEntry is a ServiceEntry that represents an ALG protocol.

icmp NetworkServiceSpecServiceEntriesIcmp

ICMPTypeServiceEntry is a ServiceEntry that represents an ICMP protocol.

igmp interface{}

IGMPTypeServiceEntry is a ServiceEntry that represents IGMP protocol. IGMP supports no extra properties.

ipProtocol NetworkServiceSpecServiceEntriesIpProtocol

IPProtocolServiceEntry is a ServiceEntry that represents an IP protocol. This allows matching arbitrary IP protocols beyond TCP/UDP/ICMP.

l4PortSet NetworkServiceSpecServiceEntriesL4PortSet

L4PortSetServiceEntry is a ServiceEntry that represents TCP or UDP protocol.

NetworkServiceSpecServiceEntriesAlg

ALGTypeServiceEntry is a ServiceEntry that represents an ALG protocol.

Appears In:
Field Description Default Validation

alg string

ALG specifies the Application Layer Gateway protocol.

destinationPorts string array

DestinationPorts defines the destination port or port range to match. For example: ["443"], ["8080-8090"]. If empty, matches any destination port.

sourcePorts string array

SourcePorts defines the source port or port range to match. For example: ["80"], ["1000-2000"]. If empty, matches any source port.

NetworkServiceSpecServiceEntriesIcmp

ICMPTypeServiceEntry is a ServiceEntry that represents an ICMP protocol.

Appears In:
Field Description Default Validation

icmpCode integer

ICMPCode specifies the ICMP code to match within the ICMP type. If unset, matches any ICMP code.

Maximum: 255
Minimum: 0

icmpType integer

ICMPType specifies the ICMP type to match (e.g., 8 for Echo Request). If unset, matches any ICMP type.

Maximum: 255
Minimum: 0

protocol string

Protocol specifies whether ICMPv4 or ICMPv6 should be matched.

NetworkServiceSpecServiceEntriesIpProtocol

IPProtocolServiceEntry is a ServiceEntry that represents an IP protocol. This allows matching arbitrary IP protocols beyond TCP/UDP/ICMP.

Appears In:
Field Description Default Validation

protocolNumber integer

ProtocolNumber specifies the IP protocol number to match. For example: 6 = TCP, 17 = UDP, 1 = ICMP.

Maximum: 255
Minimum: 0

NetworkServiceSpecServiceEntriesL4PortSet

L4PortSetServiceEntry is a ServiceEntry that represents TCP or UDP protocol.

Appears In:
Field Description Default Validation

destinationPorts string array

DestinationPorts defines the destination port or port range to match. For example: ["443"], ["8080-8090"]. If empty, matches any destination port.

l4Protocol string

L4Protocol specifies the Layer 4 protocol (TCP or UDP).

Required: true

sourcePorts string array

SourcePorts defines the source port or port range to match. For example: ["80"], ["1000-2000"]. If empty, matches any source port.

NetworkServiceStatus

Appears In:
Field Description Default Validation

conditions NetworkServiceStatusConditions array

Current NetworkService conditions.

NetworkServiceStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

RegionNetworkingCapabilities

RegionNetworkingCapabilities defines the set of networking capabilities available in a specific Region. The resource name corresponds to the Region name.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

RegionNetworkingCapabilities

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

capabilities RegionNetworkingCapabilitiesCapabilitiesItem array

Capabilities contains all defined networking capabilities. Each capability entry contains the capability type, whether it is currently enabled, and the reason of the current state.

RegionNetworkingCapabilitiesCapabilitiesItem

Capability describes the status of a specific networking capability. For example, if IPSecVPN is not supported in a Region because the NSX version is too old, the Capability object may look like: { "type": "IPSecVPN", "state": false, "reason": "UnsupportedByNSXVersion", "message": "IPSec VPN requires NSX version 9.1 or later" }

Appears In:
Field Description Default Validation

message string

Message is a human-readable description providing more details about the capability’s current state.

reason string

Reason is a short, machine-readable explanation for the capability’s current state. It must be provided when the state is false.

state boolean

State indicates whether this capability is currently supported in the Region.

False

Required: true

type string

Type identifies the specific networking capability.

Required: true

SecurityProfile

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

SecurityProfile

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SecurityProfileSpec

status SecurityProfileStatus

SecurityProfile status

SecurityProfileAttachment

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

SecurityProfileAttachment

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SecurityProfileAttachmentSpec

SecurityProfileAttachmentSpec

Appears In:
Field Description Default Validation

regionName string

The name of the region that the attachment is placed in. RegionName cannot be changed after attachment is created.

Required: true

securityProfileName string

Security profile to attach

Required: true

vpcName string

Name of the VPC to attach the profile

Required: true

SecurityProfileSpec

Appears In:
Field Description Default Validation

description string

The description of the SecurityProfile.

eastWestFirewall SecurityProfileSpecEastWestFirewall

isDefault boolean

IsDefault indicates if this is a default profile

False

Required: true

northSouthFirewall SecurityProfileSpecNorthSouthFirewall

regionName string

The name of the region that the Security Profile is placed in. RegionName cannot be changed after securityProfile is created.

Required: true

SecurityProfileSpecEastWestFirewall

Appears In:
Field Description Default Validation

securityStrategies string array

Security strategies attached with the security profile. Valid values: none, vpc-isolation, vpc-secure-connection, vpc-isolation-with-essential-services, vpc-external-connectivity

SecurityProfileSpecNorthSouthFirewall

Appears In:
Field Description Default Validation

enabled boolean

Flag to enable/disable gateway firewall. Default is false.

SecurityProfileStatus

Appears In:
Field Description Default Validation

conditions SecurityProfileStatusConditions array

Current SecurityProfile conditions.

SecurityProfileStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

SecurityStrategy

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

SecurityStrategy

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SecurityStrategySpec

SecurityStrategySpec represents the detailed definition of a security strategy.

SecurityStrategySpec

SecurityStrategySpec represents the detailed definition of a security strategy.

Appears In:
Field Description Default Validation

description string

Description of the strategy

ruleTemplates SecurityStrategySpecRuleTemplates array

RuleTemplates contains the list of firewall rules that define this security strategy. This field is optional. If this field is omitted, no specific rules will be associated with the strategy.

SecurityStrategySpecRuleTemplates

Appears In:
Field Description Default Validation

action string

Action to be applied to all the services

appliedTo SecurityStrategySpecRuleTemplatesAppliedTo

destinationsExcluded boolean

DestinationsExcluded indicates that the rule applies to all destinations except those specified in the 'To' field. When true, the 'To' field acts as an exclusion list.

direction string

Direction defines direction of traffic.

disabled boolean

Disabled indicates if the rule is enabled/disabled.

False

from SecurityStrategySpecRuleTemplatesFrom array

From defines the source of the traffic. If empty, it defaults to "Any", matching all sources. This behavior is inverted if 'SourcesExcluded' is set to true, in which case this field acts as an exclusion list.

ipProtocol string

IpProtocol indicates type of IP packet that should be matched while enforcing the rule. Only IPV_4 protocol is supported for new rules, IPV4_IPV6 is only allowed for default rules.

isDefault boolean

IsDefault is a flag to indicate whether rule is a default rule.

False

log boolean

Log indicates if traffic matching this rule should be logged.

name string

Name for the rule. Must be unique within the policy.

Required: true

notes string

Notes for the rule.

services SecurityStrategySpecRuleTemplatesServices array

Services specifies the network services (protocols and ports) to which this rule applies. If empty or null ,it defaults to "Any" , then this rule applies to all services.

sourcesExcluded boolean

SourcesExcluded indicates that the rule applies to all sources except those specified in the 'From' field. When true, the 'From' field acts as an exclusion list.

systemOwned boolean

SystemOwned indicates if the system owns the resource

False

tag string

Tag applied on the rule.

to SecurityStrategySpecRuleTemplatesTo array

To defines the destination of the traffic. If empty, it defaults to "Any", matching all destinations. This behavior is inverted if 'DestinationsExcluded' is set to true, in which case this field acts as an exclusion list.

SecurityStrategySpecRuleTemplatesAppliedTo

Appears In:
Field Description Default Validation

gatewayAttachmentNames string array

This field is only applicable when the rule is defined for Transit Gateway Firewall policy

gatewayNames string array

This field is only applicable when the rule is defined for Transit Gateway Firewall policy

groupNames string array

This field is only applicable when the rule is defined for Distributed Firewall policy

SecurityStrategySpecRuleTemplatesFrom

Appears In:
Field Description Default Validation

groupName string

ipAddress string

SecurityStrategySpecRuleTemplatesServices

Appears In:
Field Description Default Validation

l4PortSet SecurityStrategySpecRuleTemplatesServicesL4PortSet

L4PortSetServiceEntry is a ServiceEntry that represents TCP or UDP protocol.

networkServiceName string

SecurityStrategySpecRuleTemplatesServicesL4PortSet

L4PortSetServiceEntry is a ServiceEntry that represents TCP or UDP protocol.

Appears In:
Field Description Default Validation

destinationPorts string array

DestinationPorts defines the destination port or port range to match. For example: ["443"], ["8080-8090"]. If empty, matches any destination port.

l4Protocol string

L4Protocol specifies the Layer 4 protocol (TCP or UDP).

Required: true

sourcePorts string array

SourcePorts defines the source port or port range to match. For example: ["80"], ["1000-2000"]. If empty, matches any source port.

SecurityStrategySpecRuleTemplatesTo

Appears In:
Field Description Default Validation

groupName string

ipAddress string

Subnet

A Subnet in a VPC represents an independent layer 2 broadcast domain.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

Subnet

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SubnetSpec

status SubnetStatus

Subnet status

SubnetBinding

The SubnetBinding binds a VPC Subnet to a specific namespace (project). It allows the project to create workloads under the bound subnet.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

SubnetBinding

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SubnetBindingSpec

status SubnetBindingStatus

SubnetBinding status

SubnetBindingSpec

Appears In:
Field Description Default Validation

subnetName string

SubnetName specifies the name of the VPC Subnet that will be bound to a specific namespace (project).

Required: true

SubnetBindingStatus

Appears In:
Field Description Default Validation

conditions SubnetBindingStatusConditions array

Current SubnetBinding conditions.

description string

The description of the bound subnet.

regionName string

The name of the region of the bound subnet.

SubnetBindingStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Bound.

Required: true

SubnetSpec

Appears In:
Field Description Default Validation

accessMode string

AccessMode defines the access mode for a VPC Subnet. Defaults to Private. Supported values: - Public: Subnet is accessible from external networks. IPs are allocated from the VPC’s external IPBlocks unless
explicitly specified.
- PrivateTGW: Subnet is accessible via a connected Transit Gateway (TGW). IPs are allocated from the VPC’s
private-TGW IPBlocks unless explicitly specified.
- Private: Subnet is only accessible within the VPC. IPs are allocated from the VPC’s private IPBlocks unless
explicitly specified.

advancedConfig SubnetSpecAdvancedConfig

description string

The description of the Subnet.

ipAddresses string array

ipAddresses defines the list of IPv4 addresses (in CIDR format) assigned to the VPC Subnet. - If the IPAddresses field is provided, the IPv4SubnetSize field is ignored. - If the IPAddresses field is not provided, IPs will be automatically assigned based on the IPv4SubnetSize field.

ipBlockNames string array

IPBlockNames specifies the IPBlocks used for Subnet IP allocation. The IPBlock should belong to one of the following sources: 1) The VPC’s private IPBlock 2) The VPCConnectivityProfile’s external IPBlock 3) The VPCConnectivityProfile’s private-TGW IPBlock

ipv4SubnetSize integer

IPv4SubnetSize specifies the size of the VPC Subnet in terms of IP address count. The value must be a power of 2 between 8 and 65,536 (inclusive). Defaults to 64. - If the IPAddresses field is not provided, this value will be used to allocate IPs from the IP block defined in the parent VPC. - If the IPAddresses field is provided, this field is ignored. This field is immutable and cannot be changed after the VPC Subnet is created.

regionName string

The name of the region that the Subnet is placed in.

subnetDHCPConfig SubnetSpecSubnetDhcpconfig

systemOwned boolean

Flag to indicate that the Subnet is system-owned. It’s readonly.

False

vlanConnectionName string

The name of distributed VLAN connection.

vpcName string

The name of the VPC that the Subnet is placed in.

Required: true

SubnetSpecAdvancedConfig

Appears In:
Field Description Default Validation

connectivityState string

Connectivity status of the Subnet from other Subnets to the VPC. Defaults to Connected. If this Subnet is used for VLAN extension, connectivity state must follow the configuration of subnet exclusive config at the DistributedVLANConnection.

dhcpServerAddresses string array

DHCPServerAddresses is an array of DHCP server addresses in IPv4 CIDR format. At most one address may be provided.

gatewayAddresses string array

GatewayAddresses is an array of gateway addresses in IPv4 CIDR format. At most one address may be provided.

staticIPAllocation SubnetSpecAdvancedConfigStaticIpallocation

SubnetSpecAdvancedConfigStaticIpallocation

Appears In:
Field Description Default Validation

enabled boolean

Activate or deactivate static IP allocation for VPC Subnet Ports. If the DHCP mode is DHCPDeactivated or not set, its default value is true. If the DHCP mode is DHCPServer or DHCPRelay, its default value is false. The value cannot be set to true when the DHCP mode is DHCPServer or DHCPRelay.

SubnetSpecSubnetDhcpconfig

Appears In:
Field Description Default Validation

dhcpServerAdditionalConfig SubnetSpecSubnetDhcpconfigDhcpServerAdditionalConfig

mode string

SubnetSpecSubnetDhcpconfigDhcpServerAdditionalConfig

Appears In:
Field Description Default Validation

reservedIPRanges string array

ReservedIPRanges specifies IP ranges that are reserved and excluded from being assigned by the DHCP server to clients. These reserved IPs must not overlap with system-reserved addresses, including the gateway IP, network IP, DHCP server IP, and broadcast IP, and they must belong to the defined subnet CIDR. The reserved IPs can be provided as either a single IP address or an IP address range. Only IPv4 addresses are supported. Example: ["192.168.1.5", "192.168.1.10-192.168.1.100"].

SubnetStatus

Appears In:
Field Description Default Validation

conditions SubnetStatusConditions array

Current Subnet conditions.

SubnetStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

TGWAttachment

TGWAttachment represents an attachment of a TransitGateway to a Connection.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

TGWAttachment

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec TGWAttachmentSpec

TGWAttachmentSpec is the specification of a TGWAttachment. One and only one of GatewayConnectionName and DistributedVLANConnectionName should be set.

status TGWAttachmentStatus

TGWAttachment status

TGWAttachmentSpec

TGWAttachmentSpec is the specification of a TGWAttachment. One and only one of GatewayConnectionName and DistributedVLANConnectionName should be set.

Appears In:
Field Description Default Validation

distributedVLANConnectionName string

DistributedVLANConnectionName specifies the name of the DistributedVLANConnection associated with the TransitGateway.

gatewayConnectionName string

GatewayConnectionName specifies the name of the GatewayConnection associated with the TransitGateway.

regionName string

The name of the region that the attachment is placed in.

Required: true

routeAdvertisementRules TGWAttachmentSpecRouteAdvertisementRules array

RouteAdvertisementRules defines the routes advertised by the TransitGateway to the associated connection. When not specified, a route advertisement rule of type "Public" will be created by default.

transitGatewayName string

TransitGatewayName specifies the name of the TransitGateway that is being attached.

Required: true

TGWAttachmentSpecRouteAdvertisementRules

Appears In:
Field Description Default Validation

routeAdvertisementType string

RouteAdvertisementType controls routes advertised by the TransitGateway. Possible values are: - Public: Advertise all public subnets and NAT IPs. - TGWPrivate: Advertises all TGW Private subnets.

TGWAttachmentStatus

Appears In:
Field Description Default Validation

conditions TGWAttachmentStatusConditions array

Current TGWAttachment conditions.

TGWAttachmentStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

TGWCentralizedConfig

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

TGWCentralizedConfig

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec TGWCentralizedConfigSpec

status TGWCentralizedConfigStatus

TGWCentralizedConfig status

TGWCentralizedConfigSpec

Appears In:
Field Description Default Validation

haMode string

High-availability mode for the transit gateway centralized services (gateway connections, VPN).

Required: true

regionName string

The name of the region that the centralized config is placed in.

Required: true

transitGatewayName string

TransitGatewayName specifies the name of the TransitGateway that is being attached.

Required: true

TGWCentralizedConfigStatus

Appears In:
Field Description Default Validation

conditions TGWCentralizedConfigStatusConditions array

Current TGWCentralizedConfig conditions.

TGWCentralizedConfigStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

TGWFirewallPolicy

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

TGWFirewallPolicy

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec TGWFirewallPolicySpec

status TGWFirewallPolicyStatus

TGWFirewallPolicy status

TGWFirewallPolicySpec

Appears In:
Field Description Default Validation

category string

Pre-defined categories for classifying a Transit Gateway Firewall policy.There are two pre-defined categories. They are "LocalGatewayRules" and "Default".

description string

Description for the firewall policy.

isDefault boolean

A flag to indicate whether rule is a default rule

False

locked boolean

Locked indicates whether a security policy should be locked

False

priority integer

This field is used to resolve conflicts between multiple Rules under Security or Gateway Policy for a Domain. If no priority is specified in the payload, a value of 0 is assigned by default.

0

regionName string

The name of the region that the Firewall Profile is placed in. RegionName cannot be changed after policy is created.

Required: true

rules TGWFirewallPolicySpecRules array

Rules that are a part of this FirewallPolicy

stateful boolean

Stateful or Stateless nature of security policy is enforced on all rules in this security policy. When it is stateful, the state of the network connects are tracked and a stateful packet inspection is performed.

False

systemOwned boolean

SystemOwned indicates system owned resource

False

tcpStrict boolean

Ensures that a 3 way TCP handshake is done before the data packets are sent. tcp_strict=true is supported only for stateful security policies. If the tcp_strict flag is not specified and the security policy is stateful, then tcp_strict will be set to true.

False

TGWFirewallPolicySpecRules

Appears In:
Field Description Default Validation

action string

Action to be applied to all the services

appliedTo TGWFirewallPolicySpecRulesAppliedTo

destinationsExcluded boolean

DestinationsExcluded indicates that the rule applies to all destinations except those specified in the 'To' field. When true, the 'To' field acts as an exclusion list.

direction string

Direction defines direction of traffic.

disabled boolean

Disabled indicates if the rule is enabled/disabled.

False

from TGWFirewallPolicySpecRulesFrom array

From defines the source of the traffic. If empty, it defaults to "Any", matching all sources. This behavior is inverted if 'SourcesExcluded' is set to true, in which case this field acts as an exclusion list.

ipProtocol string

IpProtocol indicates type of IP packet that should be matched while enforcing the rule. Only IPV_4 protocol is supported for new rules, IPV4_IPV6 is only allowed for default rules.

isDefault boolean

IsDefault is a flag to indicate whether rule is a default rule.

False

log boolean

Log indicates if traffic matching this rule should be logged.

name string

Name for the rule. Must be unique within the policy.

Required: true

notes string

Notes for the rule.

services TGWFirewallPolicySpecRulesServices array

Services specifies the network services (protocols and ports) to which this rule applies. If empty or null ,it defaults to "Any" , then this rule applies to all services.

sourcesExcluded boolean

SourcesExcluded indicates that the rule applies to all sources except those specified in the 'From' field. When true, the 'From' field acts as an exclusion list.

systemOwned boolean

SystemOwned indicates if the system owns the resource

False

tag string

Tag applied on the rule.

to TGWFirewallPolicySpecRulesTo array

To defines the destination of the traffic. If empty, it defaults to "Any", matching all destinations. This behavior is inverted if 'DestinationsExcluded' is set to true, in which case this field acts as an exclusion list.

TGWFirewallPolicySpecRulesAppliedTo

Appears In:
Field Description Default Validation

gatewayAttachmentNames string array

This field is only applicable when the rule is defined for Transit Gateway Firewall policy

gatewayNames string array

This field is only applicable when the rule is defined for Transit Gateway Firewall policy

groupNames string array

This field is only applicable when the rule is defined for Distributed Firewall policy

TGWFirewallPolicySpecRulesFrom

Appears In:
Field Description Default Validation

groupName string

ipAddress string

TGWFirewallPolicySpecRulesServices

Appears In:
Field Description Default Validation

l4PortSet TGWFirewallPolicySpecRulesServicesL4PortSet

L4PortSetServiceEntry is a ServiceEntry that represents TCP or UDP protocol.

networkServiceName string

TGWFirewallPolicySpecRulesServicesL4PortSet

L4PortSetServiceEntry is a ServiceEntry that represents TCP or UDP protocol.

Appears In:
Field Description Default Validation

destinationPorts string array

DestinationPorts defines the destination port or port range to match. For example: ["443"], ["8080-8090"]. If empty, matches any destination port.

l4Protocol string

L4Protocol specifies the Layer 4 protocol (TCP or UDP).

Required: true

sourcePorts string array

SourcePorts defines the source port or port range to match. For example: ["80"], ["1000-2000"]. If empty, matches any source port.

TGWFirewallPolicySpecRulesTo

Appears In:
Field Description Default Validation

groupName string

ipAddress string

TGWFirewallPolicyStatus

Appears In:
Field Description Default Validation

conditions TGWFirewallPolicyStatusConditions array

Current TGWFirewallPolicy conditions.

ruleCount integer

The number of rules defined for the policy

0

TGWFirewallPolicyStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

TGWNATRule

TGWNATRule represents a NAT rule between source and destination for a given TransitGateway.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

TGWNATRule

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec TGWNATRuleSpec

status TGWNATRuleStatus

TGWNATRule status

TGWNATRuleSpec

Appears In:
Field Description Default Validation

action string

Action represents action of NAT Rule. Valid values: SNAT, DNAT, Reflexive, NoSNAT and NoDNAT.

Required: true

destinationNetwork string

DestinationNetwork represents the destination network. The value can be a single IPv4 address or CIDR, or a comma separated list of IPv4 addresses. Empty value for this field represents ANY network. For action SNAT, the field is optional. For action NoSNAT, the field is optional. For action DNAT, the field is required and supports a single IPv4 address. For action NoDNAT, the field is required. For action Reflexive, the field should not be set.

enabled boolean

NAT Rule enabled flag Enabled indicates whether the NAT rule is enabled or disabled. The default is True.

firewallMatch string

FirewallMatch indicates how the firewall matches the address after NATing if firewall stage is not skipped. Enum: MatchExternalAddress, MatchInternalAddress, ByPass Default: "MatchInternalAddress"

logging boolean

NAT Rule logging flag Logging indicates whether the logging of NAT rule is enabled or disabled. The default is False.

regionName string

Name of the region that the NAT rule is placed in.

scope TGWNATRuleSpecScope

sequenceNumber integer

SequenceNumber decides the priority of a NAT rule. Valid range is [0, 2147481599]. Default is 0.

0

serviceEntry TGWNATRuleSpecServiceEntry

sourceNetwork string

SourceNetwork represents the source network address. The value can be a single IPv4 address or CIDR, or a comma separated list of IPv4 addresses. For action SNAT, the field is optional. For action NoSNAT, the field is required. For action DNAT, the field is optional. For action NoDNAT, the field is optional. For action Reflexive, the field is required and supports a single IPv4 address or CIDR.

systemOwned boolean

Flag to indicate that the NAT rule is system-owned. It’s readonly.

False

transitGatewayName string

The name of the TransitGateway that the NAT rule is placed in.

Required: true

translatedNetwork string

TranslatedNetwork represents the translated network address. The field is required and must contain a single IPv4 address for SNAT, DNAT and Reflexive. It must not be set for NoSNAT or NoDNAT.

Required: true

TGWNATRuleSpecScope

Appears In:
Field Description Default Validation

tgwAttachmentNames string array

Array of TransitGatewayAttachment names. Contains the list of names of TGW Attachments on which the NAT rule is applied.

TGWNATRuleSpecServiceEntry

Appears In:
Field Description Default Validation

destinationPorts string

The destination ports to match. If specified, it must be either a single port (e.g. "8080") or a port range (e.g. "8090-8095").

protocol string

Protocol supports TCP, UDP and ICMP v4.

Required: true

sourcePorts string

The source ports to match. If specified, it must be either a single port (e.g. "8080") or a port range (e.g. "8090-8095").

translatedPorts string

The translated ports. If specified, it must be either a single port (e.g. "8080") or a port range (e.g. "8090-8095").

TGWNATRuleStatus

Appears In:
Field Description Default Validation

conditions TGWNATRuleStatusConditions array

Current TGWNATRule conditions.

TGWNATRuleStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

TGWSecurityConfig

TGWSecurityConfig is a subresource of TransitGateway that represents the list of features and their status for the Transit Gateway.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

TGWSecurityConfig

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec TGWSecurityConfigSpec

TGWSecurityConfigSpec

Appears In:
Field Description Default Validation

features TGWSecurityConfigSpecFeatures array

Features is a list of gateway security features and their status

TGWSecurityConfigSpecFeatures

Appears In:
Field Description Default Validation

enabled boolean

Enabled indicates if the feature is enabled or not

False

Required: true

name string

Name of the security feature. Valid values: GatewayFirewall

Required: true

TGWStaticRoute

TGWStaticRoute is static routes configuration on TransitGateway.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

TGWStaticRoute

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec TGWStaticRouteSpec

status TGWStaticRouteStatus

TGWStaticRoute status

TGWStaticRouteSpec

Appears In:
Field Description Default Validation

network string

Network is address in CIDR format

Required: true

nextHops TGWStaticRouteSpecNextHops array

NextHops is list of TransitGatewayStaticRouteNextHop

Required: true

regionName string

Name of the region that the static route is placed in.

transitGatewayName string

The name of the TransitGateway that the static route is placed in.

Required: true

TGWStaticRouteSpecNextHops

Appears In:
Field Description Default Validation

adminDistance integer

AdminDistance is the cost associated with next hop route

Maximum: 255
Minimum: 1

scope TGWStaticRouteSpecNextHopsScope array

Scope is an array of names of attachments or VPNSessions

Required: true

TGWStaticRouteSpecNextHopsScope

Appears In:
Field Description Default Validation

ipsecVPNSessionName string

IPSecVPNSessionName is the name of IPSecVPNSession.

tgwAttachmentName string

TGWAttachmentName is the name of TransitGateway Attachment.

TGWStaticRouteStatus

Appears In:
Field Description Default Validation

conditions TGWStaticRouteStatusConditions array

Current TGWStaticRoute conditions.

TGWStaticRouteStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

TransitGateway

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

TransitGateway

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec TransitGatewaySpec

status TransitGatewayStatus

TransitGateway status

TransitGatewaySpec

Appears In:
Field Description Default Validation

description string

The description of the Transit Gateway.

isDefault boolean

Flag to indicate that the Transit Gateway is a default Transit Gateway. If true, then this is the default Transit Gateway. Users can modify it but cannot delete it. Read-only.

regionName string

The name of the region that the Transit Gateway is placed in.

Required: true

transitSubnets string array

IPv4 transit subnets. IPV4 CIDRs for internal VPC attachment networks.

TransitGatewayStatus

Appears In:
Field Description Default Validation

conditions TransitGatewayStatusConditions array

Current TransitGateway conditions.

TransitGatewayStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

VPC

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPC

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec VPCSpec

status VPCStatus

VPC status

VPCAttachment

VPCAttachment represents an attachment of a VPC to a VPC Connectivity Profile.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCAttachment

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec VPCAttachmentSpec

Required: true

status VPCAttachmentStatus

VPCAttachment status

VPCAttachmentSpec

Appears In:
Field Description Default Validation

preferredDefaultSNATIP string

PreferredDefaultSNATIP specifies the translated IP for VPC auto SNAT rules. The specified IP must be available. If the field is not specified, the system will allocate an IP from available external IP blocks to be the default SNAT IP.

regionName string

RegionName specifies the name of the region where the VPCAttachment is located.

vpcConnectivityProfileName string

VPCConnectivityProfileName specifies the name of the VPC Connectivity Profile associated with the VPC.

Required: true

vpcName string

VPCName specifies the name of the VPC that is being attached.

Required: true

VPCAttachmentStatus

Appears In:
Field Description Default Validation

conditions VPCAttachmentStatusConditions array

Current VPCAttachment conditions.

VPCAttachmentStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

VPCBinding

VPCBinding binds an existing VPC to a specific namespace (project). It allows the project to use the bound VPC to create SupervisorNamespaces.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCBinding

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec VPCBindingSpec

status VPCBindingStatus

VPCBinding status

VPCBindingSpec

Appears In:
Field Description Default Validation

vpcName string

The name of the VPC to be bound to the namespace (project).

Required: true

VPCBindingStatus

Appears In:
Field Description Default Validation

conditions VPCBindingStatusConditions array

Current VPCBinding conditions.

description string

The description of the bound VPC.

regionName string

The name of the region of the bound VPC.

VPCBindingStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Bound.

Required: true

VPCConnectivityProfile

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCConnectivityProfile

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec VPCConnectivityProfileSpec

Required: true

status VPCConnectivityProfileStatus

VPCConnectivityProfile status

VPCConnectivityProfileBinding

The VPCConnectivityProfileBinding binds a VPCConnectivityProfile to a specific namespace (project). It allows the project to use the connectivity settings defined in the profile to create VPCs.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCConnectivityProfileBinding

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec VPCConnectivityProfileBindingSpec

status VPCConnectivityProfileBindingStatus

VPCConnectivityProfileBinding status

VPCConnectivityProfileBindingSpec

Appears In:
Field Description Default Validation

vpcConnectivityProfileName string

VPCConnectivityProfileName specifies the name of the VPC Connectivity Profile that will be bound to a specific namespace (project).

Required: true

VPCConnectivityProfileBindingStatus

Appears In:
Field Description Default Validation

conditions VPCConnectivityProfileBindingStatusConditions array

Current VPCConnectivityProfileBinding conditions.

regionName string

The name of the region of the bound VPCConnectivityProfile.

VPCConnectivityProfileBindingStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Bound.

Required: true

VPCConnectivityProfileSpec

Appears In:
Field Description Default Validation

externalIPBlockNames string array

Name of External IP blocks.

isDefault boolean

Flag to indicate that the VPC Connectivity Profile is a default profile. If true, then this VPC Connectivity Profile is the default system created profile. Default profiles can be modified by users but cannot be deleted. Read-only.

False

privateTGWIPBlockNames string array

Name of Private TGW IP Blocks.

regionName string

Required: true

serviceGateway VPCConnectivityProfileSpecServiceGateway

VPCServiceGatewayConfig is VPC Service Gateway Configuration

transitGatewayName string

Transit Gateway name. Populated with default transit gateway for default project. Default is default.

VPCConnectivityProfileSpecServiceGateway

VPCServiceGatewayConfig is VPC Service Gateway Configuration

Appears In:
Field Description Default Validation

enable boolean

Enable indicates whether to activate or deactivate Service Router. The default value is true.

natConfig VPCConnectivityProfileSpecServiceGatewayNatConfig

VPCNATConfig is NAT Configuration

VPCConnectivityProfileSpecServiceGatewayNatConfig

VPCNATConfig is NAT Configuration

Appears In:
Field Description Default Validation

autoSNATIPBlockName string

The name of the IPBlock used to allocate translated IPs for the default SNAT rules.

enableDefaultSNAT boolean

EnableDefaultSNAT indicates whether to activate or deactivate default SNAT. It defaults to true for backward compatibility, which differs from the NSX API default (false).

VPCConnectivityProfileStatus

Appears In:
Field Description Default Validation

conditions VPCConnectivityProfileStatusConditions array

Current VPCConnectivityProfile conditions.

VPCConnectivityProfileStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

VPCGatewayFirewallPolicy

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCGatewayFirewallPolicy

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec VPCGatewayFirewallPolicySpec

status VPCGatewayFirewallPolicyStatus

VPCGatewayFirewallPolicy status

VPCGatewayFirewallPolicySpec

Appears In:
Field Description Default Validation

category string

Pre-defined categories for classifying a VPC Gateway Firewall policy.There are two pre-defined categories. They are "LocalGatewayRules" and "Default".

description string

Description for the firewall policy.

isDefault boolean

A flag to indicate whether rule is a default rule

False

locked boolean

Locked indicates whether a security policy should be locked

False

priority integer

This field is used to resolve conflicts between multiple Rules under Security or Gateway Policy for a Domain. If no priority is specified in the payload, a value of 0 is assigned by default.

0

regionName string

The name of the region that the Firewall Profile is placed in. RegionName cannot be changed after policy is created.

Required: true

rules VPCGatewayFirewallPolicySpecRules array

Rules that are a part of this FirewallPolicy

stateful boolean

Stateful or Stateless nature of security policy is enforced on all rules in this security policy. When it is stateful, the state of the network connects are tracked and a stateful packet inspection is performed.

False

systemOwned boolean

SystemOwned indicates system owned resource

False

tcpStrict boolean

Ensures that a 3 way TCP handshake is done before the data packets are sent. tcp_strict=true is supported only for stateful security policies. If the tcp_strict flag is not specified and the security policy is stateful, then tcp_strict will be set to true.

False

vpcName string

The name of the VPC that the VPC Gateway Firewall Policy is placed in.

Required: true

VPCGatewayFirewallPolicySpecRules

Appears In:
Field Description Default Validation

action string

Action to be applied to all the services

appliedTo VPCGatewayFirewallPolicySpecRulesAppliedTo

destinationsExcluded boolean

DestinationsExcluded indicates that the rule applies to all destinations except those specified in the 'To' field. When true, the 'To' field acts as an exclusion list.

direction string

Direction defines direction of traffic.

disabled boolean

Disabled indicates if the rule is enabled/disabled.

False

from VPCGatewayFirewallPolicySpecRulesFrom array

From defines the source of the traffic. If empty, it defaults to "Any", matching all sources. This behavior is inverted if 'SourcesExcluded' is set to true, in which case this field acts as an exclusion list.

ipProtocol string

IpProtocol indicates type of IP packet that should be matched while enforcing the rule. Only IPV_4 protocol is supported for new rules, IPV4_IPV6 is only allowed for default rules.

isDefault boolean

IsDefault is a flag to indicate whether rule is a default rule.

False

log boolean

Log indicates if traffic matching this rule should be logged.

name string

Name for the rule. Must be unique within the policy.

Required: true

notes string

Notes for the rule.

services VPCGatewayFirewallPolicySpecRulesServices array

Services specifies the network services (protocols and ports) to which this rule applies. If empty or null ,it defaults to "Any" , then this rule applies to all services.

sourcesExcluded boolean

SourcesExcluded indicates that the rule applies to all sources except those specified in the 'From' field. When true, the 'From' field acts as an exclusion list.

systemOwned boolean

SystemOwned indicates if the system owns the resource

False

tag string

Tag applied on the rule.

to VPCGatewayFirewallPolicySpecRulesTo array

To defines the destination of the traffic. If empty, it defaults to "Any", matching all destinations. This behavior is inverted if 'DestinationsExcluded' is set to true, in which case this field acts as an exclusion list.

VPCGatewayFirewallPolicySpecRulesAppliedTo

Appears In:
Field Description Default Validation

gatewayAttachmentNames string array

This field is only applicable when the rule is defined for Transit Gateway Firewall policy

gatewayNames string array

This field is only applicable when the rule is defined for Transit Gateway Firewall policy

groupNames string array

This field is only applicable when the rule is defined for Distributed Firewall policy

VPCGatewayFirewallPolicySpecRulesFrom

Appears In:
Field Description Default Validation

groupName string

ipAddress string

VPCGatewayFirewallPolicySpecRulesServices

Appears In:
Field Description Default Validation

l4PortSet VPCGatewayFirewallPolicySpecRulesServicesL4PortSet

L4PortSetServiceEntry is a ServiceEntry that represents TCP or UDP protocol.

networkServiceName string

VPCGatewayFirewallPolicySpecRulesServicesL4PortSet

L4PortSetServiceEntry is a ServiceEntry that represents TCP or UDP protocol.

Appears In:
Field Description Default Validation

destinationPorts string array

DestinationPorts defines the destination port or port range to match. For example: ["443"], ["8080-8090"]. If empty, matches any destination port.

l4Protocol string

L4Protocol specifies the Layer 4 protocol (TCP or UDP).

Required: true

sourcePorts string array

SourcePorts defines the source port or port range to match. For example: ["80"], ["1000-2000"]. If empty, matches any source port.

VPCGatewayFirewallPolicySpecRulesTo

Appears In:
Field Description Default Validation

groupName string

ipAddress string

VPCGatewayFirewallPolicyStatus

Appears In:
Field Description Default Validation

conditions VPCGatewayFirewallPolicyStatusConditions array

Current TGWFirewallPolicy conditions.

ruleCount integer

The number of rules defined for the policy

0

VPCGatewayFirewallPolicyStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

VPCIPAddressAllocation

A VPCIPAddressAllocation represents an allocation of IP addresses or CIDRs from IPBlocks in a VPC.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCIPAddressAllocation

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec VPCIPAddressAllocationSpec

VPCIPAddressAllocationSpec

Appears In:
Field Description Default Validation

allocationIPs string

The specific IP addresses from IPBlock that needs to be requested. If specified, it should be passed like 192.168.0.0/24 or 192.168.0.1/32. The field AllocationIPs and AllocationSize cannot be provided together, either AllocationIPs or AllocationSize is needed.

allocationSize integer

Allocation IP address size for auto allocating IPs from IPBlock. The IP addresses will be auto allocated from unused IP addresses based on allocation size. If specified, its value must be power of 2.

ipAddressBlockVisibility string

Visibility of IP address block. Must be External, Private or PrivateTGW. Note: the default Private Visibility is different from NSX API’s default External Visibility.

ipBlockName string

IPBlock name for allocating IP address.

regionName string

The name of the region that the VPCIPAddressAllocation is placed in.

Required: true

systemOwned boolean

Flag to indicate that the VPCIPAddressAllocation is system-owned. It’s readonly.

False

vpcName string

The name of the VPC that the VPCIPAddressAllocation is placed in.

Required: true

VPCIPAddressUsage

VPCIPAddressUsage is the usage information for IP addresses within a specific VPC. This information provides insights into the allocation and utilization of IP addresses by the VPC and its subnets.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCIPAddressUsage

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

ipBlocks VPCIPAddressUsageIpBlocksItem array

Array of policy VPC IP address block.

regionName string

RegionName specifies the name of the region where the VPCIPAddressUsage is located.

VPCIPAddressUsageIpBlocksItem

Policy VPC IP address block.

Appears In:
Field Description Default Validation

allocatedByVPC invalid type

Required: true

available integer

Available IP address space.

0

Required: true

cidr string

CIDR address for IP block. Deprecated: Use CIDRs instead.

cidrs string array

The list of CIDRs.

excludedIPs invalid type array

The list of excluded IP address in the form of start and end IPs

ipBlockName string

Required: true

percentageUsed string

Percentage of used IP address space.

Required: true

ranges invalid type array

The list of IP address ranges in the form of start and end IPs

total integer

Total IP address space.

0

Required: true

visibility string

Visibility of IP block. Must be External or Private.

VPCIPBlockAllocationState

VPCIPBlockAllocationState represents the allocation state of all CIDRs allocated from IPBlocks in a VPC.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCIPBlockAllocationState

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

ipBlockAllocationStates VPCIPBlockAllocationStateIpBlockAllocationStatesItem array

IPBlock allocation state in a VPC

regionName string

RegionName specifies the name of the region where the VPCIPBlockAllocationState is located.

VPCIPBlockAllocationStateIpBlockAllocationStatesItem

Appears In:
Field Description Default Validation

allocationStates invalid type array

State of each CIDR allocated from an IPBlock.

Required: true

ipBlockName string

The name of the IPBlock.

Required: true

visibility string

Visibility of IPBlock. Must be External or Private.

Required: true

VPCLimitState

VPCLimitState contains the usage details of all Limits applied to a VPC.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCLimitState

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

limitStateForVPCs VPCLimitStateLimitStateForVPCsItem array

IPBlock quota limit state in a VPC

regionName string

RegionName specifies the name of the region where the IPBlock quota limit state of the VPC is located

VPCLimitStateLimitStateForVPCsItem

Appears In:
Field Description Default Validation

limitName string

The name of the Limit being referenced.

quota invalid type

IPBlock quota limit state. Represents the IPBlock quota usage details for consumers, where a consumer can be either an entire region or a specific VPC.

VPCNATRule

VPCNATRule represents a NAT rule between source and destination for a given VPC.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCNATRule

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec VPCNATRuleSpec

status VPCNATRuleStatus

VPCNATRule status

VPCNATRuleSpec

Appears In:
Field Description Default Validation

action string

Action represents action of NAT Rule. Valid values: SNAT, DNAT, Reflexive, NoSNAT and NoDNAT.

Required: true

destinationNetwork string

DestinationNetwork represents the destination network. The value can be a single IPv4 address or CIDR, or a comma separated list of IPv4 addresses. Empty value for this field represents ANY network. For action SNAT, the field is optional. For action NoSNAT, the field is optional. For action DNAT, the field is required and supports a single IPv4 address. For action NoDNAT, the field is required. For action Reflexive, the field should not be set.

enabled boolean

NAT Rule enabled flag Enabled indicates whether the NAT rule is enabled or disabled. The default is True.

firewallMatch string

FirewallMatch indicates how the firewall matches the address after NATing if firewall stage is not skipped. Enum: MatchExternalAddress, MatchInternalAddress, ByPass Default: "MatchInternalAddress"

logging boolean

NAT Rule logging flag Logging indicates whether the logging of NAT rule is enabled or disabled. The default is False.

regionName string

Name of the region that the NAT rule is placed in.

sequenceNumber integer

SequenceNumber decides the priority of a NAT rule. Valid range is [0, 2147481599]. Default is 0.

0

serviceEntry VPCNATRuleSpecServiceEntry

sourceNetwork string

SourceNetwork represents the source network address. The value can be a single IPv4 address or CIDR, or a comma separated list of IPv4 addresses. For action SNAT, the field is optional. For action NoSNAT, the field is required. For action DNAT, the field is optional. For action NoDNAT, the field is optional. For action Reflexive, the field is required and supports a single IPv4 address or CIDR.

systemOwned boolean

Flag to indicate that the NAT rule is system-owned. It’s readonly.

False

translatedNetwork string

TranslatedNetwork represents the translated network address. The field is required and must contain a single IPv4 address for SNAT, DNAT and Reflexive. It must not be set for NoSNAT or NoDNAT.

Required: true

vpcName string

The name of the VPC that the NAT rule is placed in.

Required: true

VPCNATRuleSpecServiceEntry

Appears In:
Field Description Default Validation

destinationPorts string

The destination ports to match. If specified, it must be either a single port (e.g. "8080") or a port range (e.g. "8090-8095").

protocol string

Protocol supports TCP, UDP and ICMP v4.

Required: true

sourcePorts string

The source ports to match. If specified, it must be either a single port (e.g. "8080") or a port range (e.g. "8090-8095").

translatedPorts string

The translated ports. If specified, it must be either a single port (e.g. "8080") or a port range (e.g. "8090-8095").

VPCNATRuleStatus

Appears In:
Field Description Default Validation

conditions VPCNATRuleStatusConditions array

Current VPCNATRule conditions.

VPCNATRuleStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

VPCNetworkSecurityGroup

VPCNetworkSecurityGroup represents a collection of entities within a VPC that can be referenced in VPCGatewayFirewallPolicy rules as the source, destination, or appliedTo. Members can be added statically or dynamically, and may include VMs, Pods (PodVMs), IP addresses, and other VPCNetworkSecurityGroups.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCNetworkSecurityGroup

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec VPCNetworkSecurityGroupSpec

VPCNetworkSecurityGroupSpec defines the desired members of a VPCNetworkSecurityGroupSpec.
Constraints on selectors: - The total number of VMSelectors and PodSelectors must not exceed 5. - The total number of expressions across all VMSelectors and PodSelectors must not exceed 35.
- Each key in MatchLabels counts as one expression.
- Each entry in MatchExpressions counts as one expression.
- A LabelSelector, a NamespaceSelector, or a combination of both consumes one additional expression (in addition to
any expressions defined within them) and must be included in the overall 35-expression limit.

status VPCNetworkSecurityGroupStatus

VPCNetworkSecurityGroup status

VPCNetworkSecurityGroupIPMembers

VPCNetworkSecurityGroupIPMembers is a subresource of VPCNetworkSecurityGroup that provides the list of effective member IP addresses.

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCNetworkSecurityGroupIPMembers

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

ipAddresses string array

List of effective member IP addresses. Each entry can be a single IP address, an IP range, or a subnet in CIDR notation. Examples: "192.168.1.10", "192.168.1.1-192.168.1.100", "192.168.1.0/24".

VPCNetworkSecurityGroupSpec

VPCNetworkSecurityGroupSpec defines the desired members of a VPCNetworkSecurityGroupSpec. Constraints on selectors: - The total number of VMSelectors and PodSelectors must not exceed 5. - The total number of expressions across all VMSelectors and PodSelectors must not exceed 35. - Each key in MatchLabels counts as one expression. - Each entry in MatchExpressions counts as one expression. - A LabelSelector, a NamespaceSelector, or a combination of both consumes one additional expression (in addition to any expressions defined within them) and must be included in the overall 35-expression limit.

Appears In:
Field Description Default Validation

ipAddresses string array

List of IPs or CIDRs to be included in this VPCNetworkSecurityGroup. Each entry can be a single IP address, an IP range, or a subnet in CIDR notation. Examples: "192.168.1.10", "192.168.1.1-192.168.1.100", "192.168.1.0/24".

podSelectors VPCNetworkSecurityGroupSpecPodSelectors array

List of Pod label selectors that will dynamically select Pods to include in this VPCNetworkSecurityGroup.

regionName string

The name of the region that the group is placed in.

systemOwned boolean

Flag to indicate that the group is system-owned. It’s readonly.

False

vmSelectors VPCNetworkSecurityGroupSpecVmSelectors array

List of Virtual Machine label selectors that will dynamically select VMs to include in this VPCNetworkSecurityGroup.

vms VPCNetworkSecurityGroupSpecVms array

List of Virtual Machine references that will be included in this VPCNetworkSecurityGroup.

vpcName string

The name of the VPC that the group belongs to.

Required: true

vpcNetworkSecurityGroupNames string array

List of VPCNetworkSecurityGroup names that will be included in this VPCNetworkSecurityGroup.

VPCNetworkSecurityGroupSpecPodSelectors

PodSelector defines criteria for dynamically selecting Pods based on labels and Namespaces. At least one selector field must be specified. A Pod must satisfy all specified selectors to be included in the result.

Appears In:
Field Description Default Validation

labelSelector VPCNetworkSecurityGroupSpecPodSelectorsLabelSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

namespaceSelector VPCNetworkSecurityGroupSpecPodSelectorsNamespaceSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

VPCNetworkSecurityGroupSpecPodSelectorsLabelSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

Appears In:
Field Description Default Validation

matchExpressions VPCNetworkSecurityGroupSpecPodSelectorsLabelSelectorMatchExpressions array

matchExpressions is a list of label selector requirements. The requirements are ANDed.

matchLabels interface{}

matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

VPCNetworkSecurityGroupSpecPodSelectorsLabelSelectorMatchExpressions

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Appears In:
Field Description Default Validation

key string

key is the label key that the selector applies to.

Required: true

operator string

operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

Required: true

values string array

values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

VPCNetworkSecurityGroupSpecPodSelectorsNamespaceSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

Appears In:
Field Description Default Validation

matchExpressions VPCNetworkSecurityGroupSpecPodSelectorsNamespaceSelectorMatchExpressions array

matchExpressions is a list of label selector requirements. The requirements are ANDed.

matchLabels interface{}

matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

VPCNetworkSecurityGroupSpecPodSelectorsNamespaceSelectorMatchExpressions

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Appears In:
Field Description Default Validation

key string

key is the label key that the selector applies to.

Required: true

operator string

operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

Required: true

values string array

values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

VPCNetworkSecurityGroupSpecVmSelectors

VMSelector defines criteria for dynamically selecting VMs based on labels, Namespaces, and VM properties. At least one selector field must be specified. A VM must satisfy all specified selectors to be included in the result.

Appears In:
Field Description Default Validation

labelSelector VPCNetworkSecurityGroupSpecVmSelectorsLabelSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

namespaceSelector VPCNetworkSecurityGroupSpecVmSelectorsNamespaceSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

propertySelector VPCNetworkSecurityGroupSpecVmSelectorsPropertySelector

PropertySelector represents a set of conditions on VM properties. All MatchExpressions are ANDed; a VM must satisfy all expressions to match.

VPCNetworkSecurityGroupSpecVmSelectorsLabelSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

Appears In:
Field Description Default Validation

matchExpressions VPCNetworkSecurityGroupSpecVmSelectorsLabelSelectorMatchExpressions array

matchExpressions is a list of label selector requirements. The requirements are ANDed.

matchLabels interface{}

matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

VPCNetworkSecurityGroupSpecVmSelectorsLabelSelectorMatchExpressions

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Appears In:
Field Description Default Validation

key string

key is the label key that the selector applies to.

Required: true

operator string

operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

Required: true

values string array

values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

VPCNetworkSecurityGroupSpecVmSelectorsNamespaceSelector

A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

Appears In:
Field Description Default Validation

matchExpressions VPCNetworkSecurityGroupSpecVmSelectorsNamespaceSelectorMatchExpressions array

matchExpressions is a list of label selector requirements. The requirements are ANDed.

matchLabels interface{}

matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

VPCNetworkSecurityGroupSpecVmSelectorsNamespaceSelectorMatchExpressions

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Appears In:
Field Description Default Validation

key string

key is the label key that the selector applies to.

Required: true

operator string

operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

Required: true

values string array

values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

VPCNetworkSecurityGroupSpecVmSelectorsPropertySelector

PropertySelector represents a set of conditions on VM properties. All MatchExpressions are ANDed; a VM must satisfy all expressions to match.

Appears In:
Field Description Default Validation

matchExpressions VPCNetworkSecurityGroupSpecVmSelectorsPropertySelectorMatchExpressions array

MatchExpressions is a list of property selector requirements. Each requirement consists of a key, operator, and value.

VPCNetworkSecurityGroupSpecVmSelectorsPropertySelectorMatchExpressions

PropertySelectorRequirement defines a single property-based condition for selecting VMs.

Appears In:
Field Description Default Validation

key string

Key is the VM property to match. Valid keys are Name, OSName and ComputerName.

Required: true

operator string

Operator defines how the Key is compared against Value. Valid operators are Equals, Contains, StartsWith, EndsWith and NotEquals.

Required: true

value string

Value is the target value to match against the VM property.

Required: true

VPCNetworkSecurityGroupSpecVms

VMReference uniquely identifies a Virtual Machine.

Appears In:
Field Description Default Validation

instanceUUID string

InstanceUUID of the VM being referenced.

Required: true

VPCNetworkSecurityGroupStatus

Appears In:
Field Description Default Validation

conditions VPCNetworkSecurityGroupStatusConditions array

Current VPCNetworkSecurityGroup conditions.

VPCNetworkSecurityGroupStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

VPCServiceProfile

Field Description Default Validation

apiVersion string

vpc.nsx.vmware.com/v1alpha1

kind string

VPCServiceProfile

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec VPCServiceProfileSpec

Required: true

status VPCServiceProfileStatus

VPCServiceProfile status

VPCServiceProfileSpec

Appears In:
Field Description Default Validation

dhcpConfig VPCServiceProfileSpecDhcpConfig

Required: true

isDefault boolean

Flag to indicate that the VPC Service Profile is a default profile. If true, then this VPC Service Profile is the default system created profile. Default profiles can be modified by users but cannot be deleted. Read-only.

False

regionName string

VPCServiceProfileSpecDhcpConfig

Appears In:
Field Description Default Validation

dhcpRelayConfig VPCServiceProfileSpecDhcpConfigDhcpRelayConfig

dhcpServerConfig VPCServiceProfileSpecDhcpConfigDhcpServerConfig

VPCServiceProfileSpecDhcpConfigDhcpRelayConfig

Appears In:
Field Description Default Validation

serverAddresses string array

DHCP server IP addresses for DHCP relay configuration. Both IPv4 and IPv6 addresses are supported.

Required: true

VPCServiceProfileSpecDhcpConfigDhcpServerConfig

Appears In:
Field Description Default Validation

advancedConfig VPCServiceProfileSpecDhcpConfigDhcpServerConfigAdvancedConfig

dnsClientConfig VPCServiceProfileSpecDhcpConfigDhcpServerConfigDnsClientConfig

leaseTime integer

DHCP lease time in seconds. Value range is [60, 4294967295], default value is 86400.

0

Required: true

ntpServers string array

Hostname/IP list of NTP servers

VPCServiceProfileSpecDhcpConfigDhcpServerConfigAdvancedConfig

Appears In:
Field Description Default Validation

isDistributedDHCP boolean

Flag indicating the DHCP mode. - When set to true (default), the DHCP server dynamically assigns an IP address per VM port. - When set to false, the DHCP server operates in traditional mode, allocating IPs based on the VM’s MAC address.
This mode requires the VPC to be attached to a TransitGateway connected to a Provider Gateway.

Required: true

VPCServiceProfileSpecDhcpConfigDhcpServerConfigDnsClientConfig

Appears In:
Field Description Default Validation

dnsServerIPs string array

IPs of the DNS servers which need to be configured on the workload VMs

VPCServiceProfileStatus

Appears In:
Field Description Default Validation

conditions VPCServiceProfileStatusConditions array

Current VPCServiceProfile conditions.

VPCServiceProfileStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

VPCSpec

Appears In:
Field Description Default Validation

description string

The description of the VPC.

limitNames string array

The names of IPBlock quota limits applied on the VPC. Limits are used to add IPBlock quotas constraints within a VPC.

loadBalancerVPCEndpoint VPCSpecLoadBalancerVpcendpoint

privateIPs string array

Private IP CIDRs for the VPC private subnets. The user is expected to use this field to manage private IPv4 subnets. For each IPv4 CIDR specified in the PrivateIPs field, a private IP block will be automatically created. The maximum number of PrivateIPs is 5.

projectName string

The name of the project that the VPC is scoped to. When a project name is set, the VPC is scoped to the specified project and can only be assigned to a single Supervisor Namespace of the project.

regionName string

The name of the region that the VPC is placed in.

Required: true

VPCSpecLoadBalancerVpcendpoint

Appears In:
Field Description Default Validation

enabled boolean

Flag to indicate whether support for AVI Load Balancer is needed. Setting this flag to true causes allocation of private IPs from the private block associated with this VPC to be used by the Load Balancer.

VPCStatus

Appears In:
Field Description Default Validation

conditions VPCStatusConditions array

Current VPC conditions.

VPCStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true

avi.vmware.com/v1alpha1

Resource Types

RegionLBSetting

RegionLBSetting represents the load balancer configuration status for a region. This is a read-only resource that indicates whether LB setting are configured or not.

Field Description Default Validation

apiVersion string

avi.vmware.com/v1alpha1

kind string

RegionLBSetting

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

status RegionLBSettingStatus

Status contains the current state of LB setting for the region.

RegionLBSettingStatus

Status contains the current state of LB setting for the region.

Appears In:
Field Description Default Validation

lbSetting string

LBSetting indicates whether load balancer setting are configured for this region. Possible values: - "Enabled": Region has LB setting configured - "Disabled": Region does not have LB setting configured

Required: true

serviceEngineGroupMode string

ServiceEngineGroupMode indicates the service engine group mode for the tenant. Possible values: - "ProviderManaged": Service engine groups are managed by the provider - "TenantManaged": Service engine groups are managed by the tenant

SEG

Field Description Default Validation

apiVersion string

avi.vmware.com/v1alpha1

kind string

SEG

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SEGSpec

status SEGStatus

SEG status

SEGBinding

Field Description Default Validation

apiVersion string

avi.vmware.com/v1alpha1

kind string

SEGBinding

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec SEGBindingSpec

status SEGBindingStatus

SEGBinding status

SEGBindingSpec

Appears In:
Field Description Default Validation

seg string

Name of the SEG

SEGBindingStatus

Appears In:
Field Description Default Validation

conditions SEGBindingStatusConditions array

Current SEGBinding conditions.

SEGBindingStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value - Bound.

Required: true

SEGSpec

Appears In:
Field Description Default Validation

diskPerSE integer

Amount of disk space in GB for each of the Service Engine virtual machines.

enableCPUReserve boolean

Enables CPU reservation.

enableCPUSocketAffinity boolean

Allocate all the CPU cores for the Service Engine Virtual Machines on the same CPU socket.

enableMemoryReserve boolean

Enables Memory reservation.

haMode string

High Availability mode for all the Virtual Services using this Service Engine group. Possible values are: - HA_MODE_SHARED_PAIR - HA_MODE_SHARED - HA_MODE_LEGACY_ACTIVE_STANDBY

maxScaleoutPerVS integer

Maximum number of active Service Engines for the Virtual Service.

maxVSPerSE integer

Maximum number of Virtual Services that can be placed on a single Service Engine.

memoryPerSE integer

Amount of memory in MB for each of the Service Engine virtual machines. Changes to this setting do not affect existing SEs.

minScaleoutPerVS integer

Minimum number of active Service Engines for the Virtual Service.

numberOfvCPUsPerSE integer

Number of vcpus for each of the Service Engine virtual machines. Changes to this setting do not affect existing SEs.

region string

Name of the Region.

useHyperthreadedCores boolean

Enables the use of hyper-threaded cores in Service Engine. Requires SE Reboot.

zones string array

List of the Zones.

SEGStatus

Appears In:
Field Description Default Validation

conditions SEGStatusConditions array

Current SEG conditions.

serviceEngineCount integer

Count of the Service Engines using the service engine group

virtualServiceCount integer

Count of the Virtual service using the service engine group

SEGStatusConditions

Appears In:
Field Description Default Validation

message string

A human-readable message indicating details about the transition.

reason string

The reason for the condition’s last transition.

status string

Status of the condition, one of True, False, Unknown.

Required: true

type string

Type of the condition, currently supported value is Realized.

Required: true