v1alpha1¶

AddressPool¶

AddressPool is the Schema for the addresspools API.

Used by: AddressPoolList.items.

AddressPoolSpec¶

AddressPoolStatus¶

AddressPoolList¶

AddressPoolList contains a list of AddressPool.

AllocationClaim¶

AllocationClaim is the Schema for the allocationclaims API.

Used by: AllocationClaimList.items.

AllocationClaimSpec¶

AllocationClaimStatus¶

AllocationClaimList¶

AllocationClaimList contains a list of AllocationClaim.

AllocationLease¶

AllocationLease is the Schema for the allocationleases API.

Used by: AllocationLeaseList.items.

AllocationLeaseSpec¶

AllocationLeaseStatus¶

AllocationLeaseList¶

AllocationLeaseList contains a list of AllocationLease.

AllocationPool¶

AllocationPool is the Schema for the allocationpools API.

Used by: AllocationPoolList.items.

AllocationPoolSpec¶

AllocationPoolStatus¶

AllocationPoolList¶

AllocationPoolList contains a list of AllocationPool.

BGPAdvertisement¶

BGPAdvertisement is the Schema for the bgpadvertisements API.

Used by: BGPAdvertisementList.items.

BGPAdvertisementSpec¶

BGPAdvertisementStatus¶

BGPAdvertisementList¶

BGPAdvertisementList contains a list of BGPAdvertisement.

BGPNodeState¶

BGPNodeState is the Schema for the bgpnodestates API.

Used by: BGPNodeStateList.items.

BGPNodeStateSpec¶

BGPNodeStateStatus¶

BGPNodeStateList¶

BGPNodeStateList contains a list of BGPNodeState.

BGPPeer¶

BGPPeer is the Schema for the bgppeers API.

Used by: BGPPeerList.items.

BGPPeerSpec¶

BGPPeerStatus¶

BGPPeerList¶

BGPPeerList contains a list of BGPPeer.

ElasticIP¶

ElasticIP is the Schema for the elasticips API.

Used by: ElasticIPList.items.

ElasticIPSpec¶

ElasticIPStatus¶

ElasticIPAttachment¶

ElasticIPAttachment is the Schema for the elasticipattachments API.

Used by: ElasticIPAttachmentList.items.

ElasticIPAttachmentSpec¶

ElasticIPAttachmentStatus¶

ElasticIPAttachmentList¶

ElasticIPAttachmentList contains a list of ElasticIPAttachment.

ElasticIPList¶

ElasticIPList contains a list of ElasticIP.

ExternalNetwork¶

ExternalNetwork is the Schema for the externalnetworks API.

Used by: ExternalNetworkList.items.

ExternalNetworkSpec¶

ExternalNetworkStatus¶

ExternalNetworkAttachment¶

ExternalNetworkAttachment is the Schema for the externalnetworkattachments API.

Used by: ExternalNetworkAttachmentList.items.

ExternalNetworkAttachmentSpec¶

ExternalNetworkAttachmentStatus¶

ExternalNetworkAttachmentList¶

ExternalNetworkAttachmentList contains a list of ExternalNetworkAttachment.

ExternalNetworkList¶

ExternalNetworkList contains a list of ExternalNetwork.

NATGateway¶

NATGateway is the Schema for the natgateways API.

Used by: NATGatewayList.items.

NATGatewaySpec¶

NATGatewayStatus¶

NATGatewayList¶

NATGatewayList contains a list of NATGateway.

NetworkACL¶

NetworkACL is the Schema for the networkacls API.

Used by: NetworkACLList.items.

NetworkACLSpec¶

NetworkACLStatus¶

NetworkACLList¶

NetworkACLList contains a list of NetworkACL.

NetworkEndpoint¶

NetworkEndpoint is the Schema for the networkendpoints API.

Used by: NetworkEndpointList.items.

NetworkEndpointSpec¶

NetworkEndpointStatus¶

NetworkEndpointList¶

NetworkEndpointList contains a list of NetworkEndpoint.

NetworkInterface¶

NetworkInterface is the Schema for the networkinterfaces API.

Used by: NetworkInterfaceList.items.

NetworkInterfaceSpec¶

NetworkInterfaceStatus¶

NetworkInterfaceList¶

NetworkInterfaceList contains a list of NetworkInterface.

RouteTable¶

RouteTable is the Schema for the routetables API.

Used by: RouteTableList.items.

RouteTableSpec¶

RouteTableStatus¶

RouteTableList¶

RouteTableList contains a list of RouteTable.

SecurityGroup¶

SecurityGroup is the Schema for the securitygroups API.

Used by: SecurityGroupList.items.

SecurityGroupSpec¶

SecurityGroupStatus¶

SecurityGroupList¶

SecurityGroupList contains a list of SecurityGroup.

ServiceLoadBalancer¶

ServiceLoadBalancer is the Schema for Juneau-managed Service LoadBalancer state. Each resource normalises the desired and observed state derived from a Kubernetes Service so that the controller, daemon, BGP speaker, and CLI tooling do not each re-interpret Service annotations independently.

Used by: ServiceLoadBalancerList.items.

ServiceLoadBalancerSpec¶

ServiceLoadBalancerStatus¶

ServiceLoadBalancerList¶

ServiceLoadBalancerList contains a list of ServiceLoadBalancer.

ServiceNATAttachment¶

ServiceNATAttachment is the Schema for the servicenatattachments API.
One ServiceNATAttachment exists per (Node, provider Vpc) pair and represents the SNAT source IP that traffic from cross-VPC callers takes when reaching shared Services in the provider Vpc. Resources are owned by the provider Vpc and fanned out by the VpcReconciler for every Vpc that sets spec.service.provider.natSourceSubnet.

Used by: ServiceNATAttachmentList.items.

ServiceNATAttachmentSpec¶

ServiceNATAttachmentStatus¶

ServiceNATAttachmentList¶

ServiceNATAttachmentList contains a list of ServiceNATAttachment.

Subnet¶

Subnet is the Schema for the subnets API.

Used by: SubnetList.items.

SubnetSpec¶

SubnetStatus¶

SubnetList¶

SubnetList contains a list of Subnet.

TraceSession¶

TraceSession is the Schema for the tracesessions API.

Used by: TraceSessionList.items.

TraceSessionSpec¶

TraceSessionStatus¶

TraceSessionList¶

TraceSessionList contains a list of TraceSession.

Vpc¶

Vpc is the Schema for the vpcs API.

Used by: VpcList.items.

VpcSpec¶

VpcStatus¶

VpcList¶

VpcList contains a list of Vpc.

AddressPoolSpec¶

AddressPoolSpec defines the desired state of AddressPool.

Used by: AddressPool.spec.

AllocationClaimSpec¶

AllocationClaimSpec defines the desired state of AllocationClaim.

Used by: AllocationClaim.spec.

AllocationClaimStatus¶

AllocationClaimStatus defines the observed state of AllocationClaim.

Used by: AllocationClaim.status.

AllocationLeaseSpec¶

AllocationLeaseSpec defines the desired state of AllocationLease.
AllocationLease records a single (pool, value) reservation that survives the deletion of its owning AllocationClaim. While a lease exists no other claim can take the same value, and a claim re-created with the same ReuseKey will inherit the recorded value. Leases are managed entirely by the AllocationClaim controller; consumers of the allocation framework should never create or modify AllocationLease objects directly.

Used by: AllocationLease.spec.

AllocationLeaseStatus¶

AllocationLeaseStatus defines the observed state of AllocationLease.

Used by: AllocationLease.status.

AllocationPoolSpec¶

AllocationPoolSpec defines the desired state of AllocationPool.

Used by: AllocationPool.spec.

AllocationPoolStatus¶

AllocationPoolStatus defines the observed state of AllocationPool.

Used by: AllocationPool.status.

BGPAdvertisementSpec¶

BGPAdvertisementSpec defines the desired state of BGPAdvertisement.

Used by: BGPAdvertisement.spec.

BGPNodeStateStatus¶

BGPNodeStateStatus defines the observed state of BGPNodeState.

Used by: BGPNodeState.status.

BGPPeerSpec¶

BGPPeerSpec defines the desired state of BGPPeer.

Used by: BGPPeer.spec.

ElasticIPAttachmentSpec¶

ElasticIPAttachmentSpec defines the desired state of ElasticIPAttachment.

Used by: ElasticIPAttachment.spec.

ElasticIPAttachmentStatus¶

ElasticIPAttachmentStatus defines the observed state of ElasticIPAttachment.

Used by: ElasticIPAttachment.status.

ElasticIPSpec¶

ElasticIPSpec defines the desired state of ElasticIP.

Used by: ElasticIP.spec.

ElasticIPStatus¶

ElasticIPStatus defines the observed state of ElasticIP.

Used by: ElasticIP.status.

ExternalNetworkAttachmentSpec¶

ExternalNetworkAttachmentSpec defines the desired state of ExternalNetworkAttachment.

Used by: ExternalNetworkAttachment.spec.

ExternalNetworkAttachmentStatus¶

ExternalNetworkAttachmentStatus defines the observed state of ExternalNetworkAttachment.

Used by: ExternalNetworkAttachment.status.

ExternalNetworkSpec¶

ExternalNetworkSpec defines the desired state of ExternalNetwork.

Used by: ExternalNetwork.spec.

NATGatewaySpec¶

NATGatewaySpec defines the desired state of NATGateway.

Used by: NATGateway.spec.

NATGatewayStatus¶

NATGatewayStatus defines the observed state of NATGateway.

Used by: NATGateway.status.

NetworkACLSpec¶

NetworkACLSpec defines the desired state of NetworkACL.
Semantics:
- A NetworkACL is scoped to exactly one Vpc. Cross-Vpc references are rejected by webhook validation. - Each direction (Ingress, Egress) is independently configured: - nil (the field is omitted entirely) → default-allow for that direction. The Subnet boundary applies no policy and packets fall through to SecurityGroup unchanged. - non-nil empty list ([]) → default-deny. With no rules to match, every packet hits the implicit terminal deny. - non-empty list → rules evaluated in priority order; the first match's Action wins. Packets that match no rule fall to the implicit terminal deny. - The nil-vs-[] convention mirrors SecurityGroup so operators can reason about both layers consistently. - A Subnet attaches at most one NetworkACL via Subnet.spec.networkACL. Use rule priorities to compose multiple intents inside a single ACL rather than chaining several ACLs onto one Subnet.

Used by: NetworkACL.spec.

NetworkACLStatus¶

NetworkACLStatus reports observed state.

Used by: NetworkACL.status.

NetworkEndpointSpec¶

NetworkEndpointSpec defines the desired state of NetworkEndpoint.

Used by: NetworkEndpoint.spec.

NetworkEndpointStatus¶

NetworkEndpointStatus defines the observed state of NetworkEndpoint.

Used by: NetworkEndpoint.status.

NetworkInterfaceSpec¶

NetworkInterfaceSpec defines the desired state of NetworkInterface.

Used by: NetworkInterface.spec.

NetworkInterfaceStatus¶

NetworkInterfaceStatus defines the observed state of NetworkInterface.

Used by: NetworkInterface.status.

RouteTableSpec¶

RouteTableSpec defines the desired state of RouteTable.

Used by: RouteTable.spec.

RouteTableStatus¶

RouteTableStatus defines the observed state of RouteTable.

Used by: RouteTable.status.

SecurityGroupSpec¶

SecurityGroupSpec defines the desired state of SecurityGroup.
Semantics:
- A SecurityGroup is scoped to exactly one Vpc. Cross-Vpc references are rejected by webhook validation. - Ingress is implicitly deny-all; rules whitelist what is admitted. - When Egress is nil (the field is omitted), egress is implicitly allow-all (AWS-compatible default). When Egress is set (even as an empty list), egress flips to deny-by-default + allow-list.

Used by: SecurityGroup.spec.

SecurityGroupStatus¶

SecurityGroupStatus reports observed state.

Used by: SecurityGroup.status.

ServiceLoadBalancerSpec¶

ServiceLoadBalancerSpec describes the desired LoadBalancer state derived from a Kubernetes Service.
A ServiceLoadBalancer is owned by exactly one Service in the same namespace. The controller uses ServiceRef.Name plus the resource's own namespace to resolve the parent Service; the resource is named deterministically from the parent Service so that multiple reconcilers can converge without racing on creation.

Used by: ServiceLoadBalancer.spec.

ServiceLoadBalancerStatus¶

ServiceLoadBalancerStatus reports the observed state derived from the parent Service, EndpointSlices, and the allocation pipeline.

Used by: ServiceLoadBalancer.status.

ServiceNATAttachmentSpec¶

ServiceNATAttachmentSpec defines the desired state of ServiceNATAttachment.
One ServiceNATAttachment exists per (Node, provider Vpc) pair: each provider Vpc (a Vpc with spec.service.provider.natSourceSubnet set) allocates one SNAT source IP per Node so that cross-VPC callers reaching shared Services in that Vpc receive replies over the provider Vpc's fabric back to the originating Node.

Used by: ServiceNATAttachment.spec.

ServiceNATAttachmentStatus¶

ServiceNATAttachmentStatus defines the observed state of ServiceNATAttachment.

Used by: ServiceNATAttachment.status.

SubnetSpec¶

SubnetSpec defines the desired state of Subnet.

Used by: Subnet.spec.

SubnetStatus¶

SubnetStatus defines the observed state of Subnet.

Used by: Subnet.status.

TraceSessionSpec¶

TraceSessionSpec is the desired state of a trace session.

Used by: TraceSession.spec.

TraceSessionStatus¶

TraceSessionStatus is observed state.

Used by: TraceSession.status.

VpcSpec¶

VpcSpec defines the desired state of Vpc.

Used by: Vpc.spec.

VpcStatus¶

VpcStatus defines the observed state of Vpc.

Used by: Vpc.status.

AddressPoolAdvertiseMode¶

Used by: AddressPoolSpec.advertiseMode.

AllocationClaimPhase¶

Used by: AllocationClaimStatus.phase.

AllocationFilter¶

Used by: AllocationClaimSpec.allocationFilter.

AllocationLeasePhase¶

Used by: AllocationLeaseStatus.phase.

AllocationPoolIPSpec¶

Used by: AllocationPoolSpec.ip.

AllocationPoolNumberSpec¶

Used by: AllocationPoolSpec.number.

AllocationPoolReference¶

Used by: AllocationClaimSpec.poolRefs, and AllocationLeaseSpec.poolRef.

AllocationResourceReference¶

Used by: AllocationClaimSpec.resourceRef, and AllocationLeaseSpec.reuseKey.

AllocationStrategy¶

Used by: AllocationPoolSpec.strategy.

AllocationType¶

Used by: AllocationPoolSpec.type.

AllocationValue¶

Used by: AllocationClaimStatus.value, and AllocationLeaseSpec.value.

BGPNodeStateAdvertisement¶

Used by: BGPNodeStateStatus.advertisements.

BGPNodeStateError¶

Used by: BGPNodeStateStatus.errors.

BGPNodeStateSession¶

Used by: BGPNodeStateStatus.bgpSessions.

ElasticIPAttachmentElasticIPRef¶

Used by: ElasticIPAttachmentSpec.elasticIPRef.

ElasticIPAttachmentPhase¶

Used by: ElasticIPAttachmentStatus.phase.

ElasticIPAttachmentTargetRef¶

Used by: ElasticIPAttachmentSpec.targetRef.

ElasticIPPhase¶

Used by: ElasticIPStatus.phase.

EndpointKind¶

EndpointKind enumerates the kinds of network endpoints that can join an L2 segment (Subnet) on the data plane.
The data plane reconcilers (arp/fdb/pod-iface/attacher) are kind-agnostic; Kind exists for observability, validation (kind-specific required fields), and provider-specific bookkeeping (e.g. PodRef back-pointer for Kind=Pod).

Used by: NetworkEndpointSpec.kind.

ExternalNetworkType¶

Used by: ExternalNetworkSpec.type.

NetworkACLRule¶

NetworkACLRule is a single ordered rule applied at the Subnet boundary.
Unlike SecurityGroup, NetworkACL rules carry an explicit Priority and Action: rules run in priority order (low number first) and the first match decides the verdict. Peers are CIDR-only — Subnet-level ACLs describe address-based scopes; per-Pod identity matching belongs to SecurityGroup, which sits one stage downstream.

Used by: NetworkACLSpec.egress, and NetworkACLSpec.ingress.

NetworkEndpointAttachment¶

NetworkEndpointAttachment describes the local kernel iface that realizes this endpoint on Spec.NodeName. Populated by the daemon running on Spec.NodeName after the veth is created. Other nodes' daemons read the rest of Spec but ignore Attachment (ifindex is meaningless across nodes).

Used by: NetworkEndpointSpec.attachment.

NetworkEndpointPodReference¶

Used by: NetworkEndpointSpec.podRef.

NetworkInterfaceEffectiveSG¶

NetworkInterfaceEffectiveSG is a single resolved SecurityGroup reference. Daemon-side maps key off GroupID, never the name.

Used by: NetworkInterfaceStatus.effectiveSecurityGroups.

NetworkInterfacePhase¶

Used by: NetworkInterfaceStatus.phase.

NetworkInterfacePodReference¶

Used by: NetworkInterfaceSpec.podRef.

NetworkRoute¶

Used by: NetworkInterfaceStatus.routes.

Route¶

Used by: RouteTableSpec.routes, and RouteTableStatus.routes.

SecurityGroupAttachedInterface¶

SecurityGroupAttachedInterface identifies a NetworkInterface that references this SecurityGroup.

Used by: SecurityGroupStatus.attachedInterfaces.

SecurityGroupEgressRule¶

SecurityGroupEgressRule mirrors SecurityGroupIngressRule but for egress. The "to" side semantics are identical to "from".

Used by: SecurityGroupSpec.egress.

SecurityGroupIngressRule¶

SecurityGroupIngressRule allows ingress traffic that matches the (peer × protocol × ports) cross-product. Multiple ingress rules are ORed together.

Used by: SecurityGroupSpec.ingress.

ServiceLoadBalancerBackendSummary¶

ServiceLoadBalancerBackendSummary is a small aggregate of backend endpoint state. It exists so kubectl-juneau and dashboards can surface fleet health without re-listing EndpointSlices.

Used by: ServiceLoadBalancerStatus.backendSummary.

ServiceLoadBalancerPhase¶

ServiceLoadBalancerPhase summarises the high-level lifecycle state.
The phase is informational and is intended for human consumption (kubectl printer columns and dashboards). Programmatic logic should use Conditions, which carry stable reason/status semantics.

Used by: ServiceLoadBalancerStatus.phase.

ServiceLoadBalancerPort¶

ServiceLoadBalancerPort mirrors the Service port that this LoadBalancer exposes externally. The port list is recomputed every reconcile from the parent Service so it stays in sync.

Used by: ServiceLoadBalancerStatus.ports.

ServiceLoadBalancerServiceReference¶

ServiceLoadBalancerServiceReference identifies the parent Service.
The reference is intentionally minimal: ServiceLoadBalancer is always co-located with its Service, so the API does not surface a Namespace or Group/Kind field that could drift from reality.

Used by: ServiceLoadBalancerSpec.serviceRef.

SubnetNetworkACLRef¶

SubnetNetworkACLRef carries the resolved view of a Subnet's NetworkACL attachment that the daemon needs to program the BPF subnet_map. Distinct from spec.networkACL because it folds in fields (ACLID, RulesetVersion) that the controller resolves at reconcile time and that the daemon cannot recompute from the spec alone.

Used by: SubnetStatus.networkACL.

TraceCaptureConfig¶

TraceCaptureConfig controls what events the dataplane emits. Defaults to a low-overhead "Decision" capture suitable for live debugging. Operators can opt in to extra detail at the cost of ringbuf pressure.

Used by: TraceSessionSpec.capture.

TraceEndpoint¶

TraceEndpoint identifies one side of a trace session.
Exactly one of PodRef, ServiceRef or IP must be set. The webhook enforces this invariant; daemons treat a missing selector as a programming error and skip the session.
Protocol and Port are interpreted relative to the destination side only; on the source side they are ignored (a source pod's ephemeral port is not known until traffic flows).

Used by: TraceSessionSpec.destination, and TraceSessionSpec.source.

TraceMode¶

TraceSession is a temporary, cluster-scoped coordination object that activates dataplane tracing across every juneaud node for a single debugging session. The object is created by kubectl juneau trace for the lifetime of the trace and deleted on exit; daemons watch TraceSession resources, program local BPF trace maps, stream events to kubectl, and remove their dataplane state on delete or expiry.
TraceSession is intentionally ephemeral. The default workflow keeps detailed events out of CRD status entirely — events flow over a dedicated debug gRPC channel directly from the daemon to kubectl. Status only carries coarse coordination state (phase, observed nodes) so reconciliation stays cheap even with many concurrent sessions.
spec.expiresAt is mandatory: it bounds dataplane state if kubectl crashes between create and delete. Daemons treat any session past its expiry time as deleted and tear down local trace state even if the CRD has not yet been garbage-collected by the API server.
TraceMode selects whether a trace session injects probe traffic or only observes existing traffic that matches the configured tuples.

Used by: TraceSessionSpec.mode.

TraceSessionPhase¶

TraceSessionPhase reflects the controller-perceived state of the session. Daemons do not write Phase; they only append to ObservedNodes and bump LastObservedAt.

Used by: TraceSessionStatus.phase.

TraceTuple¶

TraceTuple is a five-tuple plus VPC scope. kubectl pre-computes the initial tuples it expects to see and stores them on the spec so daemons can program their BPF trace_tuple_map without re-resolving CRDs.

Used by: TraceSessionSpec.initialTuples.

VpcServiceSpec¶

VpcServiceSpec configures the Service-routing behaviour of a VPC, including its participation in cross-VPC shared Services.
Setting either Provider or Consume enables Service routing for this VPC: the controller injects a Service-typed route into every RouteTable belonging to it so that Pods can reach ClusterIPs.

Used by: VpcSpec.service.

NetworkACLAction¶

NetworkACLAction is the verdict of a matching rule.
Rules are evaluated in priority order; the first matching rule's action is final. When no rule matches, the direction's default applies (see NetworkACLSpec for the nil-vs-[] convention).

Used by: NetworkACLRule.action.

NetworkACLPort¶

NetworkACLPort selects an L4 destination port (or range).
Either Port or PortRange must be set, never both. Webhook validation enforces this invariant. The struct mirrors SecurityGroupPort but is kept distinct so an accidental cross-kind assignment fails to compile.

Used by: NetworkACLRule.ports.

NetworkACLProtocol¶

NetworkACLProtocol selects which IP protocol a rule matches.
"all" is a wildcard that suppresses any L4 port match (ports list must be empty). icmp accepts only protocol-level matching; ICMP type/code is not expressed by NetworkACL rules in v1alpha1.
The values intentionally line up with SecurityGroupProtocol so the same BPF matching primitives (policy_match.h) handle both layers. The Go types are kept separate so mixing an SG rule with an ACL rule fails at compile time rather than at the BPF write path.

Used by: NetworkACLRule.protocol.

RouteVia¶

Used by: Route.via.

SecurityGroupPeer¶

SecurityGroupPeer expresses a single source/destination scope.
Exactly one of CIDR or SecurityGroupRef must be set. Webhook validation enforces this invariant; the controller assumes it during expansion.

Used by: SecurityGroupEgressRule.to, and SecurityGroupIngressRule.from.

SecurityGroupPort¶

SecurityGroupPort selects an L4 destination port (or range).
Either Port or PortRange must be set, never both. Webhook validation enforces this invariant.

Used by: SecurityGroupEgressRule.ports, and SecurityGroupIngressRule.ports.

SecurityGroupProtocol¶

SecurityGroupProtocol selects which IP protocol a rule matches.
"all" is a wildcard that suppresses any L4 port match (ports list must be empty). icmp accepts only protocol-level matching; ICMP type/code is not expressed by SecurityGroup rules in v1alpha1.

Used by: SecurityGroupEgressRule.protocol, and SecurityGroupIngressRule.protocol.

TraceCaptureLevel¶

TraceCaptureLevel selects how much detail the dataplane emits per matched packet. Verbose levels increase ringbuf pressure and are intended for short, targeted runs.

Used by: TraceCaptureConfig.level.

TracePodReference¶

TracePodReference identifies a Pod by namespace + name. Pod UID is resolved at session creation by kubectl and not stored in the CRD, so a Pod restart between create and observation does not invalidate the session.

Used by: TraceEndpoint.podRef.

TraceProtocol¶

TraceProtocol selects the IP protocol matched by the session's tuples and probe. Mirrors the values used by NetworkACL and SecurityGroup so operators can reason about both layers consistently.

Used by: TraceEndpoint.protocol, and TraceTuple.protocol.

TraceServiceReference¶

TraceServiceReference identifies a Kubernetes Service by namespace Service's ClusterIP at admission time.

Used by: TraceEndpoint.serviceRef.

TraceTupleScope¶

TraceTupleScope qualifies the keyspace a tuple lives in.
- Host: tuple is meaningful only on the underlay / host network namespace (NAPT outside-side, host-network Service backends). - VPC: tuple is scoped to a Juneau VPC; vpcID must be set.

Used by: TraceTuple.scope.

VpcServiceProviderSpec¶

VpcServiceProviderSpec configures the cross-VPC provider role of a VPC.

Used by: VpcServiceSpec.provider.

NetworkACLPortRange¶

NetworkACLPortRange specifies an inclusive [From,To] port range. To must be >= From.

Used by: NetworkACLPort.portRange.

RouteViaType¶

Used by: RouteVia.type.

SecurityGroupPeerRef¶

SecurityGroupPeerRef names a peer SecurityGroup. The reference is resolved at admission time and re-resolved by the controller; rules that point at deleted SGs are dropped from the effective ruleset.

Used by: SecurityGroupPeer.securityGroupRef.

SecurityGroupPortRange¶

SecurityGroupPortRange specifies an inclusive [From,To] port range. To must be >= From.

Used by: SecurityGroupPort.portRange.