kube_schema 1.4.3 → 1.4.5

data/guides/schema-versions/readme.md

@@ -0,0 +1,31 @@
+# Schema Versions
+
+This guide covers working with different Kubernetes schema versions.
+
+## Bundled Schemas
+
+Bundled schemas ship with the gem for Kubernetes 1.19 through 1.35. Updated automatically via CI.
+
+## Setting a Version
+
+```ruby
+Kube::Schema.schema_version = "1.31"
+Kube::Schema["Deployment"]  # uses 1.31
+```
+
+## Discovery
+
+```ruby
+Kube::Schema.schema_versions    # => ["1.19", "1.20", ..., "1.35"]
+Kube::Schema.latest_version     # => "1.35"
+
+Kube::Schema["1.34"].list_resources
+# => ["Binding", "CSIDriver", "ConfigMap", "Deployment", ...]
+```
+
+## Version-Specific Access
+
+```ruby
+Kube::Schema["1.34"]["Deployment"]
+Kube::Schema["1.31"]["Pod"]
+```

data/guides/validation/readme.md

@@ -0,0 +1,31 @@
+# Validation
+
+This guide covers schema validation against the full Kubernetes OpenAPI spec.
+
+## Basic Validation
+
+```ruby
+deploy.valid?   # => true
+
+bad = Kube::Schema["Deployment"].new {
+  self.apiVersion = 12345
+}
+
+bad.valid?   # => false
+
+bad.valid!
+# Kube::ValidationError: Schema validation failed for Deployment:
+#   - apiVersion = 12345 -- expected string, got Integer
+```
+
+## Serialization Safety
+
+`to_yaml` refuses to serialize invalid resources:
+
+```ruby
+bad.to_yaml  # raises Kube::ValidationError
+```
+
+## Error Messages
+
+Validation errors render annotated YAML with color-coded diagnostics. Error lines are highlighted in red, missing required keys are injected inline, and each problem gets a clear explanation.

data/kube_schema.gemspec

@@ -20,7 +20,7 @@ Gem::Specification.new do |spec|
 
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = spec.homepage
-  spec.metadata["documentation_uri"] = spec.homepage
+  spec.metadata["documentation_uri"] = "https://general-intelligence-systems.github.io/kube_schema/"
   spec.metadata["rubygems_mfa_required"] = "true"
 
   spec.files = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }

data/lib/kube/monkey_patches.rb

@@ -33,4 +33,22 @@ class Hash
   def self.vivify(&block)
     new.tap { |h| h.instance_exec(&block) }
   end
+
+  # Deep-stringify keys so symbol keys don't leak into YAML as `:key:`.
+  def to_yaml(*)
+    Hash._deep_stringify_keys(self).then { |h| Psych.dump(h) }
+  end
+
+  def self._deep_stringify_keys(obj)
+    case obj
+    when Hash
+      obj.each_with_object({}) do |(k, v), result|
+        result[k.to_s] = _deep_stringify_keys(v)
+      end
+    when Array
+      obj.map { |v| _deep_stringify_keys(v) }
+    else
+      obj
+    end
+  end
 end

data/lib/kube/schema/version.rb

@@ -2,6 +2,6 @@
 
 module Kube
   module Schema
-    VERSION = "1.4.3"
+    VERSION = "1.4.5"
   end
 end

data/readme.md

@@ -0,0 +1,28 @@
+# kube_schema
+
+Ruby objects for every Kubernetes resource. Validated against the real OpenAPI spec. No YAML. No hash literals. Just Ruby blocks that know their schema.
+
+## Usage
+
+Please see the [project documentation](https://general-intelligence-systems.github.io/kube_schema/) for more details.
+
+  - [Getting Started](https://general-intelligence-systems.github.io/kube_schema/guides/getting-started/index) - This guide walks you through installing kube_schema and creating your first Kubernetes resource object.
+
+  - [The Block DSL](https://general-intelligence-systems.github.io/kube_schema/guides/block-dsl/index) - This guide covers the block DSL for defining Kubernetes resources with nested attributes.
+
+  - [Validation](https://general-intelligence-systems.github.io/kube_schema/guides/validation/index) - This guide covers schema validation against the full Kubernetes OpenAPI spec.
+
+  - [Manifests](https://general-intelligence-systems.github.io/kube_schema/guides/manifests/index) - This guide covers grouping resources into multi-document YAML manifests.
+
+  - [Schema Versions](https://general-intelligence-systems.github.io/kube_schema/guides/schema-versions/index) - This guide covers working with different Kubernetes schema versions.
+
+## Related Projects
+
+- [kube_cluster](https://github.com/general-intelligence-systems/kube_cluster) -- OOP resource management with dirty tracking and persistence
+- [kube_kubectl](https://github.com/general-intelligence-systems/kube_ctl) -- Ruby DSL that compiles to kubectl and helm commands
+- [kube_kit](https://github.com/general-intelligence-systems/kube_kit) -- Generators for kube_cluster projects
+- [kube_engine](https://github.com/general-intelligence-systems/kube_engine) -- Kubernetes engine
+
+## License
+
+Apache-2.0

data/schemas/crd-definitions.json

@@ -233115,7 +233115,7 @@
                 "type": "boolean"
               },
               "procMount": {
-                "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.",
+                "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.",
                 "type": "string"
               },
               "readOnlyRootFilesystem": {
@@ -238016,7 +238016,7 @@
                               "type": "boolean"
                             },
                             "procMount": {
-                              "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.",
+                              "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.",
                               "type": "string"
                             },
                             "readOnlyRootFilesystem": {
@@ -239294,7 +239294,7 @@
                               "type": "boolean"
                             },
                             "procMount": {
-                              "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.",
+                              "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.",
                               "type": "string"
                             },
                             "readOnlyRootFilesystem": {
@@ -239660,7 +239660,7 @@
                     "type": "boolean"
                   },
                   "hostUsers": {
-                    "description": "Use the host's user namespace.\nOptional: Default to true.\nIf set to true or not present, the pod will be run in the host user namespace, useful\nfor when the pod needs a feature only available to the host user namespace, such as\nloading a kernel module with CAP_SYS_MODULE.\nWhen set to false, a new userns is created for the pod. Setting false is useful for\nmitigating container breakout vulnerabilities even allowing users to run their\ncontainers as root without actually having root privileges on the host.\nThis field is alpha-level and is only honored by servers that enable the UserNamespacesSupport feature.",
+                    "description": "Use the host's user namespace.\nOptional: Default to true.\nIf set to true or not present, the pod will be run in the host user namespace, useful\nfor when the pod needs a feature only available to the host user namespace, such as\nloading a kernel module with CAP_SYS_MODULE.\nWhen set to false, a new userns is created for the pod. Setting false is useful for\nmitigating container breakout vulnerabilities even allowing users to run their\ncontainers as root without actually having root privileges on the host.",
                     "type": "boolean"
                   },
                   "hostname": {
@@ -240599,7 +240599,7 @@
                               "type": "boolean"
                             },
                             "procMount": {
-                              "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.",
+                              "description": "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nNote that this field cannot be set when spec.os.name is windows.",
                               "type": "string"
                             },
                             "readOnlyRootFilesystem": {
@@ -240987,7 +240987,7 @@
                     "description": "ResourceClaims defines which ResourceClaims must be allocated\nand reserved before the Pod is allowed to start. The resources\nwill be made available to those containers which consume them\nby name.\n\nThis is a stable field but requires that the\nDynamicResourceAllocation feature gate is enabled.\n\nThis field is immutable.",
                     "type": "array",
                     "items": {
-                      "description": "PodResourceClaim references exactly one ResourceClaim, either directly\nor by naming a ResourceClaimTemplate which is then turned into a ResourceClaim\nfor the pod.\n\nIt adds a name to it that uniquely identifies the ResourceClaim inside the Pod.\nContainers that need access to the ResourceClaim reference it with this name.",
+                      "description": "PodResourceClaim references exactly one ResourceClaim, either directly\nor by naming a ResourceClaimTemplate which is then turned into a ResourceClaim\nfor the pod.\n\nIt adds a name to it that uniquely identifies the ResourceClaim inside the Pod.\nContainers that need access to the ResourceClaim reference it with this name.\n\nWhen the DRAWorkloadResourceClaims feature gate is enabled and this Pod\nbelongs to a PodGroup, a PodResourceClaim is matched to a\nPodGroupResourceClaim if all of their fields are equal (Name,\nResourceClaimName, and ResourceClaimTemplateName). A matched claim references\na single ResourceClaim shared across all Pods in the PodGroup, reserved for\nthe PodGroup in ResourceClaimStatus.ReservedFor rather than for individual\nPods.",
                       "type": "object",
                       "required": [
                         "name"
@@ -241002,7 +241002,7 @@
                           "type": "string"
                         },
                         "resourceClaimTemplateName": {
-                          "description": "ResourceClaimTemplateName is the name of a ResourceClaimTemplate\nobject in the same namespace as this pod.\n\nThe template will be used to create a new ResourceClaim, which will\nbe bound to this pod. When this pod is deleted, the ResourceClaim\nwill also be deleted. The pod name and resource name, along with a\ngenerated component, will be used to form a unique name for the\nResourceClaim, which will be recorded in pod.status.resourceClaimStatuses.\n\nThis field is immutable and no changes will be made to the\ncorresponding ResourceClaim by the control plane after creating the\nResourceClaim.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must\nbe set.",
+                          "description": "ResourceClaimTemplateName is the name of a ResourceClaimTemplate\nobject in the same namespace as this pod.\n\nThe template will be used to create a new ResourceClaim, which will\nbe bound to this pod. When this pod is deleted, the ResourceClaim\nwill also be deleted. The pod name and resource name, along with a\ngenerated component, will be used to form a unique name for the\nResourceClaim, which will be recorded in pod.status.resourceClaimStatuses.\n\nWhen the DRAWorkloadResourceClaims feature gate is enabled and the pod\nbelongs to a PodGroup that defines a PodGroupResourceClaim with the same\nName and ResourceClaimTemplateName, this PodResourceClaim resolves to the\nResourceClaim generated for the PodGroup. All pods in the group that\ndefine an equivalent PodResourceClaim matching the\nPodGroupResourceClaim's Name and ResourceClaimTemplateName share the same\ngenerated ResourceClaim. ResourceClaims generated for a PodGroup are\nowned by the PodGroup and their lifecycles are tied to the PodGroup\ninstead of any individual pod.\n\nThis field is immutable and no changes will be made to the\ncorresponding ResourceClaim by the control plane after creating the\nResourceClaim.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must\nbe set.",
                           "type": "string"
                         }
                       }
@@ -241092,6 +241092,16 @@
                     ],
                     "x-kubernetes-list-type": "map"
                   },
+                  "schedulingGroup": {
+                    "description": "SchedulingGroup provides a reference to the immediate scheduling runtime\ngrouping object that this Pod belongs to.\nThis field is used by the scheduler to identify the group and apply the\ncorrect group scheduling policies. The association with a group also\nimpacts other lifecycle aspects of a Pod that are relevant in a wider context\nof scheduling like preemption, resource attachment, etc. If not specified,\nthe Pod is treated as a single unit in all of these aspects.\nThe group object referenced by this field may not exist at the time the\nPod is created.\nThis field is immutable, but a group object with the same name may be\nrecreated with different policies. Doing this during pod scheduling\nmay result in the placement not conforming to the expected policies.",
+                    "type": "object",
+                    "properties": {
+                      "podGroupName": {
+                        "description": "PodGroupName specifies the name of the standalone PodGroup object\nthat represents the runtime instance of this group.\nMust be a DNS subdomain.",
+                        "type": "string"
+                      }
+                    }
+                  },
                   "securityContext": {
                     "description": "SecurityContext holds pod-level security attributes and common container settings.\nOptional: Defaults to empty.  See type description for default values of each field.",
                     "type": "object",
@@ -242080,7 +242090,7 @@
                           }
                         },
                         "image": {
-                          "description": "image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine.\nThe volume is resolved at pod startup depending on which PullPolicy value is provided:\n\n- Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.\n- Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.\n- IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.\n\nThe volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation.\nA failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.\nThe types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.\nThe OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.\nThe volume will be mounted read-only (ro) and non-executable files (noexec).\nSub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.\nThe field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.",
+                          "description": "image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine.\nThe volume is resolved at pod startup depending on which PullPolicy value is provided:\n\n- Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.\n- Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.\n- IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.\n\nThe volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation.\nA failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.\nThe types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.\nThe OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.\nThe volume will be mounted read-only (ro).\nSub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.\nThe field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.",
                           "type": "object",
                           "properties": {
                             "pullPolicy": {
@@ -242221,7 +242231,7 @@
                           }
                         },
                         "portworxVolume": {
-                          "description": "portworxVolume represents a portworx volume attached and mounted on kubelets host machine.\nDeprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type\nare redirected to the pxd.portworx.com CSI driver when the CSIMigrationPortworx feature-gate\nis on.",
+                          "description": "portworxVolume represents a portworx volume attached and mounted on kubelets host machine.\nDeprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type\nare redirected to the pxd.portworx.com CSI driver.",
                           "type": "object",
                           "required": [
                             "volumeID"
@@ -242809,28 +242819,6 @@
                       "name"
                     ],
                     "x-kubernetes-list-type": "map"
-                  },
-                  "workloadRef": {
-                    "description": "WorkloadRef provides a reference to the Workload object that this Pod belongs to.\nThis field is used by the scheduler to identify the PodGroup and apply the\ncorrect group scheduling policies. The Workload object referenced\nby this field may not exist at the time the Pod is created.\nThis field is immutable, but a Workload object with the same name\nmay be recreated with different policies. Doing this during pod scheduling\nmay result in the placement not conforming to the expected policies.",
-                    "type": "object",
-                    "required": [
-                      "name",
-                      "podGroup"
-                    ],
-                    "properties": {
-                      "name": {
-                        "description": "Name defines the name of the Workload object this Pod belongs to.\nWorkload must be in the same namespace as the Pod.\nIf it doesn't match any existing Workload, the Pod will remain unschedulable\nuntil a Workload object is created and observed by the kube-scheduler.\nIt must be a DNS subdomain.",
-                        "type": "string"
-                      },
-                      "podGroup": {
-                        "description": "PodGroup is the name of the PodGroup within the Workload that this Pod\nbelongs to. If it doesn't match any existing PodGroup within the Workload,\nthe Pod will remain unschedulable until the Workload object is recreated\nand observed by the kube-scheduler. It must be a DNS label.",
-                        "type": "string"
-                      },
-                      "podGroupReplicaKey": {
-                        "description": "PodGroupReplicaKey specifies the replica key of the PodGroup to which this\nPod belongs. It is used to distinguish pods belonging to different replicas\nof the same pod group. The pod group policy is applied separately to each replica.\nWhen set, it must be a DNS label.",
-                        "type": "string"
-                      }
-                    }
                   }
                 }
               }
@@ -254672,14 +254660,13 @@
                 "description": "Pulumi configures this store to sync secrets using the Pulumi provider",
                 "type": "object",
                 "required": [
-                  "accessToken",
                   "environment",
                   "organization",
                   "project"
                 ],
                 "properties": {
                   "accessToken": {
-                    "description": "AccessToken is the access tokens to sign in to the Pulumi Cloud Console.",
+                    "description": "AccessToken is the access tokens to sign in to the Pulumi Cloud Console.\n\nDeprecated: Use auth.accessToken instead.",
                     "type": "object",
                     "properties": {
                       "secretRef": {
@@ -254715,6 +254702,101 @@
                     "description": "APIURL is the URL of the Pulumi API.",
                     "type": "string"
                   },
+                  "auth": {
+                    "description": "Auth configures how the Operator authenticates with the Pulumi API.\nEither auth or the deprecated accessToken field must be specified.",
+                    "type": "object",
+                    "properties": {
+                      "accessToken": {
+                        "description": "AccessToken authenticates using a Pulumi access token stored in a Kubernetes Secret.",
+                        "type": "object",
+                        "properties": {
+                          "secretRef": {
+                            "description": "SecretRef is a reference to a secret containing the Pulumi API token.",
+                            "type": "object",
+                            "properties": {
+                              "key": {
+                                "description": "A key in the referenced Secret.\nSome instances of this field may be defaulted, in others it may be required.",
+                                "type": "string",
+                                "maxLength": 253,
+                                "minLength": 1,
+                                "pattern": "^[-._a-zA-Z0-9]+$"
+                              },
+                              "name": {
+                                "description": "The name of the Secret resource being referred to.",
+                                "type": "string",
+                                "maxLength": 253,
+                                "minLength": 1,
+                                "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+                              },
+                              "namespace": {
+                                "description": "The namespace of the Secret resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
+                                "type": "string",
+                                "maxLength": 63,
+                                "minLength": 1,
+                                "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$"
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "oidcConfig": {
+                        "description": "OIDCConfig authenticates using Kubernetes ServiceAccount tokens via OIDC.",
+                        "type": "object",
+                        "required": [
+                          "organization",
+                          "serviceAccountRef"
+                        ],
+                        "properties": {
+                          "expirationSeconds": {
+                            "description": "ExpirationSeconds sets the token validity duration for service account and OIDC token.\nDefaults to 10 minutes.",
+                            "type": "integer",
+                            "format": "int64",
+                            "minimum": 600
+                          },
+                          "organization": {
+                            "description": "Organization is the name of the Pulumi organization configured for OIDC authentication.",
+                            "type": "string"
+                          },
+                          "serviceAccountRef": {
+                            "description": "ServiceAccountRef specifies the Kubernetes ServiceAccount to use for authentication.",
+                            "type": "object",
+                            "required": [
+                              "name"
+                            ],
+                            "properties": {
+                              "audiences": {
+                                "description": "Audience specifies the `aud` claim for the service account token\nIf the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity\nthen this audiences will be appended to the list",
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                }
+                              },
+                              "name": {
+                                "description": "The name of the ServiceAccount resource being referred to.",
+                                "type": "string",
+                                "maxLength": 253,
+                                "minLength": 1,
+                                "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+                              },
+                              "namespace": {
+                                "description": "Namespace of the resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
+                                "type": "string",
+                                "maxLength": 63,
+                                "minLength": 1,
+                                "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$"
+                              }
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "x-kubernetes-validations": [
+                      {
+                        "message": "Exactly one of 'accessToken' or 'oidcConfig' must be specified",
+                        "rule": "(has(self.accessToken) && !has(self.oidcConfig)) || (!has(self.accessToken) && has(self.oidcConfig))"
+                      }
+                    ]
+                  },
                   "environment": {
                     "description": "Environment are YAML documents composed of static key-value pairs, programmatic expressions,\ndynamically retrieved values from supported providers including all major clouds,\nand other Pulumi ESC environments.\nTo create a new environment, visit https://www.pulumi.com/docs/esc/environments/ for more information.",
                     "type": "string"
@@ -254727,7 +254809,13 @@
                     "description": "Project is the name of the Pulumi ESC project the environment belongs to.",
                     "type": "string"
                   }
-                }
+                },
+                "x-kubernetes-validations": [
+                  {
+                    "message": "Exactly one of 'auth' or deprecated 'accessToken' must be specified",
+                    "rule": "(has(self.auth) && !has(self.accessToken)) || (!has(self.auth) && has(self.accessToken))"
+                  }
+                ]
               },
               "scaleway": {
                 "description": "Scaleway configures this store to sync secrets using the Scaleway provider.",
@@ -261918,14 +262006,13 @@
                 "description": "Pulumi configures this store to sync secrets using the Pulumi provider",
                 "type": "object",
                 "required": [
-                  "accessToken",
                   "environment",
                   "organization",
                   "project"
                 ],
                 "properties": {
                   "accessToken": {
-                    "description": "AccessToken is the access tokens to sign in to the Pulumi Cloud Console.",
+                    "description": "AccessToken is the access tokens to sign in to the Pulumi Cloud Console.\n\nDeprecated: Use auth.accessToken instead.",
                     "type": "object",
                     "properties": {
                       "secretRef": {
@@ -261961,6 +262048,101 @@
                     "description": "APIURL is the URL of the Pulumi API.",
                     "type": "string"
                   },
+                  "auth": {
+                    "description": "Auth configures how the Operator authenticates with the Pulumi API.\nEither auth or the deprecated accessToken field must be specified.",
+                    "type": "object",
+                    "properties": {
+                      "accessToken": {
+                        "description": "AccessToken authenticates using a Pulumi access token stored in a Kubernetes Secret.",
+                        "type": "object",
+                        "properties": {
+                          "secretRef": {
+                            "description": "SecretRef is a reference to a secret containing the Pulumi API token.",
+                            "type": "object",
+                            "properties": {
+                              "key": {
+                                "description": "A key in the referenced Secret.\nSome instances of this field may be defaulted, in others it may be required.",
+                                "type": "string",
+                                "maxLength": 253,
+                                "minLength": 1,
+                                "pattern": "^[-._a-zA-Z0-9]+$"
+                              },
+                              "name": {
+                                "description": "The name of the Secret resource being referred to.",
+                                "type": "string",
+                                "maxLength": 253,
+                                "minLength": 1,
+                                "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+                              },
+                              "namespace": {
+                                "description": "The namespace of the Secret resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
+                                "type": "string",
+                                "maxLength": 63,
+                                "minLength": 1,
+                                "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$"
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "oidcConfig": {
+                        "description": "OIDCConfig authenticates using Kubernetes ServiceAccount tokens via OIDC.",
+                        "type": "object",
+                        "required": [
+                          "organization",
+                          "serviceAccountRef"
+                        ],
+                        "properties": {
+                          "expirationSeconds": {
+                            "description": "ExpirationSeconds sets the token validity duration for service account and OIDC token.\nDefaults to 10 minutes.",
+                            "type": "integer",
+                            "format": "int64",
+                            "minimum": 600
+                          },
+                          "organization": {
+                            "description": "Organization is the name of the Pulumi organization configured for OIDC authentication.",
+                            "type": "string"
+                          },
+                          "serviceAccountRef": {
+                            "description": "ServiceAccountRef specifies the Kubernetes ServiceAccount to use for authentication.",
+                            "type": "object",
+                            "required": [
+                              "name"
+                            ],
+                            "properties": {
+                              "audiences": {
+                                "description": "Audience specifies the `aud` claim for the service account token\nIf the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity\nthen this audiences will be appended to the list",
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                }
+                              },
+                              "name": {
+                                "description": "The name of the ServiceAccount resource being referred to.",
+                                "type": "string",
+                                "maxLength": 253,
+                                "minLength": 1,
+                                "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+                              },
+                              "namespace": {
+                                "description": "Namespace of the resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
+                                "type": "string",
+                                "maxLength": 63,
+                                "minLength": 1,
+                                "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$"
+                              }
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "x-kubernetes-validations": [
+                      {
+                        "message": "Exactly one of 'accessToken' or 'oidcConfig' must be specified",
+                        "rule": "(has(self.accessToken) && !has(self.oidcConfig)) || (!has(self.accessToken) && has(self.oidcConfig))"
+                      }
+                    ]
+                  },
                   "environment": {
                     "description": "Environment are YAML documents composed of static key-value pairs, programmatic expressions,\ndynamically retrieved values from supported providers including all major clouds,\nand other Pulumi ESC environments.\nTo create a new environment, visit https://www.pulumi.com/docs/esc/environments/ for more information.",
                     "type": "string"
@@ -261973,7 +262155,13 @@
                     "description": "Project is the name of the Pulumi ESC project the environment belongs to.",
                     "type": "string"
                   }
-                }
+                },
+                "x-kubernetes-validations": [
+                  {
+                    "message": "Exactly one of 'auth' or deprecated 'accessToken' must be specified",
+                    "rule": "(has(self.auth) && !has(self.accessToken)) || (!has(self.auth) && has(self.accessToken))"
+                  }
+                ]
               },
               "scaleway": {
                 "description": "Scaleway configures this store to sync secrets using the Scaleway provider.",

data/schemas/kubevirt-definitions.json

@@ -1526,7 +1526,7 @@
     ],
     "properties": {
       "claimName": {
-        "description": "ClaimName needs to be provided from the list vmi.spec.resourceClaims[].name where this device is allocated",
+        "description": "ClaimName references the name of an entry in the VMI's spec.resourceClaims[] array. The referenced entry may use either resourceClaimName or resourceClaimTemplateName.",
         "type": "string"
       },
       "deviceName": {
@@ -1539,7 +1539,7 @@
         "default": ""
       },
       "requestName": {
-        "description": "RequestName needs to be provided from resourceClaim.spec.devices.requests[].name where this device is requested",
+        "description": "RequestName specifies which request from the ResourceClaim/ResourceClaimTemplate spec.devices.requests array this claim request corresponds to.",
         "type": "string"
       },
       "tag": {
@@ -1632,7 +1632,7 @@
     ],
     "properties": {
       "claimName": {
-        "description": "ClaimName needs to be provided from the list vmi.spec.resourceClaims[].name where this device is allocated",
+        "description": "ClaimName references the name of an entry in the VMI's spec.resourceClaims[] array. The referenced entry may use either resourceClaimName or resourceClaimTemplateName.",
         "type": "string"
       },
       "deviceName": {
@@ -1644,7 +1644,7 @@
         "default": ""
       },
       "requestName": {
-        "description": "RequestName needs to be provided from resourceClaim.spec.devices.requests[].name where this device is requested",
+        "description": "RequestName specifies which request from the ResourceClaim/ResourceClaimTemplate spec.devices.requests array this claim request corresponds to.",
         "type": "string"
       },
       "tag": {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kube_schema
 version: !ruby/object:Gem::Version
-  version: 1.4.3
+  version: 1.4.5
 platform: ruby
 authors:
 - Nathan K
@@ -91,6 +91,7 @@ extra_rdoc_files: []
 files:
 - ".envrc"
 - ".github/workflows/convert-schemas.yml"
+- ".github/workflows/gh-pages.yml"
 - ".github/workflows/update-crds-catalog.yml"
 - ".github/workflows/update-schema-index.yml"
 - ".github/workflows/update-schemas.yml"
@@ -98,7 +99,7 @@ files:
 - ".rubocop.yml"
 - Gemfile
 - Gemfile.lock
-- README.md
+- LICENSE
 - Rakefile
 - assets/validation-error.png
 - bin/console
@@ -117,6 +118,12 @@ files:
 - examples/vcluster.rb
 - flake.lock
 - flake.nix
+- guides/block-dsl/readme.md
+- guides/getting-started/readme.md
+- guides/links.yaml
+- guides/manifests/readme.md
+- guides/schema-versions/readme.md
+- guides/validation/readme.md
 - kube_schema.gemspec
 - lib/kube/errors.rb
 - lib/kube/monkey_patches.rb
@@ -127,6 +134,7 @@ files:
 - lib/kube/schema/sub_spec.rb
 - lib/kube/schema/version.rb
 - lib/kube/schema/version.rb.erb
+- readme.md
 - schemas/crd-definitions.json
 - schemas/kubevirt-definitions.json
 - schemas/loft-definitions.json
@@ -144,7 +152,7 @@ licenses:
 metadata:
   homepage_uri: https://github.com/general-intelligence-systems/kube_schema
   source_code_uri: https://github.com/general-intelligence-systems/kube_schema
-  documentation_uri: https://github.com/general-intelligence-systems/kube_schema
+  documentation_uri: https://general-intelligence-systems.github.io/kube_schema/
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: