common.DaemonSetOptions

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/main/json-schema/palo-alto-networks-common-daemon-set-options-schema.json",
  "title": "common.DaemonSetOptions",
  "description": "DaemonSetOptions are options for creating the daemonset install script for defenders",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/palo-alto-networks-defenders-api-openapi.yml#/components/schemas/common.DaemonSetOptions",
  "properties": {
    "annotations": {
      "additionalProperties": {
        "$ref": "#/$defs/string"
      },
      "description": "Annotations is mapping of key-value pairs of annotations metadata - optional.\n",
      "type": "object"
    },
    "bottlerocket": {
      "description": "Bottlerocket indicates whether to be deployed on a Bottlerocket Linux OS.\n",
      "type": "boolean"
    },
    "cluster": {
      "description": "Cluster is the kubernetes or ecs cluster name.\n",
      "type": "string"
    },
    "clusterNameResolvingMethod": {
      "description": "ClusterNameResolvingMethod is the method used to resolve the cluster name, could be default, manual or api-server.\n",
      "type": "string"
    },
    "collectPodLabels": {
      "description": "CollectPodLabels indicates whether to collect pod related labels resource labels.\n",
      "type": "boolean"
    },
    "consoleAddr": {
      "description": "ConsoleAddr is the console address for defender communication.\n",
      "type": "string"
    },
    "containerRuntime": {
      "$ref": "#/$defs/common.ContainerRuntime"
    },
    "cpuLimit": {
      "description": "CPULimit is the cpu limit for the defender deamonset - optional.\n",
      "type": "integer"
    },
    "credentialID": {
      "description": "CredentialID is the name of the credential used.\n",
      "type": "string"
    },
    "dockerSocketPath": {
      "description": "DockerSocketPath is the path of the docker socket file.\n",
      "type": "string"
    },
    "gkeAutopilot": {
      "description": "GKEAutopilot indicates the deployment is requested for GKE Autopilot.\n",
      "type": "boolean"
    },
    "image": {
      "description": "Image is the full daemonset image name.\n",
      "type": "string"
    },
    "istio": {
      "description": "MonitorIstio indicates whether to monitor Istio.\n",
      "type": "boolean"
    },
    "memoryLimit": {
      "description": "MemoryLimit is a memory limit for the defender deamonset - optional.\n",
      "type": "integer"
    },
    "namespace": {
      "description": "Namespace is the target deamonset namespaces.\n",
      "type": "string"
    },
    "nftablesEnabled": {
      "description": "NftablesEnabled indicates whether defender will use nftables instead of iptable.\n",
      "type": "boolean"
    },
    "nodeSelector": {
      "description": "NodeSelector is a key/value node selector.\n",
      "type": "string"
    },
    "orchestration": {
      "description": "Orchestration is the orchestration type.\n",
      "type": "string"
    },
    "priorityClassName": {
      "description": "PriorityClassName is the name of the priority class for the defender - optional.\n",
      "type": "string"
    },
    "privileged": {
      "description": "Privileged indicates whether to run defenders as privileged.\n",
      "type": "boolean"
    },
    "projectID": {
      "description": "ProjectID is the kubernetes cluster project ID.\n",
      "type": "string"
    },
    "proxy": {
      "$ref": "#/$defs/common.DefenderProxyOpt"
    },
    "region": {
      "description": "Region is the kubernetes cluster location region.\n",
      "type": "string"
    },
    "roleARN": {
      "description": "RoleARN is the role's ARN to associate with the created service account - optional.\n",
      "type": "string"
    },
    "secretsname": {
      "description": "SecretsName is the name of the secret to pull.\n",
      "type": "string"
    },
    "selinux": {
      "description": "SelinuxEnforced indicates whether selinux is enforced on the target host.\n",
      "type": "boolean"
    },
    "serviceaccounts": {
      "description": "MonitorServiceAccounts indicates whether to monitor service accounts.\n",
      "type": "boolean"
    },
    "talos": {
      "description": "Talos indicates if the daemonset is to be deployed on a Talos Linux k8s cluster.\n",
      "type": "boolean"
    },
    "tolerations": {
      "description": "Tolerations is a list of tolerations for the defender deamonset - optional.\n",
      "items": {
        "$ref": "#/$defs/common.Toleration"
      },
      "type": "array"
    },
    "uniqueHostname": {
      "description": "UniqueHostname indicates whether to assign unique hostnames.\n",
      "type": "boolean"
    }
  },
  "type": "object",
  "$defs": {
    "common.ContainerRuntime": {
      "description": "ContainerRuntime represents the supported container runtime types",
      "enum": [
        [
          "docker",
          "containerd",
          "crio"
        ]
      ],
      "type": "string"
    },
    "common.DefenderProxyOpt": {
      "description": "DefenderProxyOpt holds options for defender proxy configuration\nIt embeds ProxySettings but override it's Password field with a simple string\nThis is needed in order to avoid Secret's MarshalJSON method, which depends on existence of master key file",
      "properties": {
        "ca": {
          "description": "Proxy's CA for Defender to trust. Required when using TLS intercept proxies.\n",
          "type": "string"
        },
        "httpProxy": {
          "description": "Proxy address.\n",
          "type": "string"
        },
        "noProxy": {
          "description": "List of addresses for which the proxy should not be used.\n",
          "type": "string"
        },
        "password": {
          "description": ".\n",
          "type": "string"
        },
        "user": {
          "description": "Username to authenticate with the proxy.\n",
          "type": "string"
        }
      },
      "type": "object"
    },
    "common.Toleration": {
      "description": "Toleration holds options for pod toleration\nref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/\ncode ref: k8s.io/api/core/v1/types.go",
      "properties": {
        "effect": {
          "description": "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.\n+optional.\n",
          "type": "string"
        },
        "key": {
          "description": "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.\n+optional.\n",
          "type": "string"
        },
        "operator": {
          "description": "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\n+optional.\n",
          "type": "string"
        },
        "tolerationSeconds": {
          "description": "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.\n+optional.\n",
          "format": "int64",
          "type": "integer"
        },
        "value": {
          "description": "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.\n+optional.\n",
          "type": "string"
        }
      },
      "type": "object"
    },
    "string": {
      "type": "string"
    }
  }
}