@opensoha/contracts 0.1.27 → 0.1.29

package/openapi/soha-api.json

@@ -621,6 +621,18 @@
           "type": "integer"
         }
       },
+      "KubernetesExpectedWorkloadUID": {
+        "description": "Kubernetes UID observed in the workload list or detail. When supplied, deletion requires this identity and rejects a same-name replacement.",
+        "in": "query",
+        "name": "expectedUid",
+        "required": false,
+        "schema": {
+          "maxLength": 128,
+          "minLength": 1,
+          "pattern": "^[A-Za-z0-9._-]+$",
+          "type": "string"
+        }
+      },
       "KubernetesJobName": {
         "in": "path",
         "name": "jobName",
@@ -26483,6 +26495,11 @@
           "prometheusClusterLabel": {
             "type": "string"
           },
+          "prometheusClusterLabelValue": {
+            "description": "Exact value of prometheusClusterLabel for this cluster. Omitted updates preserve the saved value; an explicit empty string restores the legacy Soha cluster ID default. A non-empty value requires a valid label name.",
+            "maxLength": 1024,
+            "type": "string"
+          },
           "prometheusTransport": {
             "$ref": "#/components/schemas/KubernetesPrometheusTransport"
           },
@@ -27436,6 +27453,13 @@
             "minimum": 0,
             "type": "integer"
           },
+          "uid": {
+            "description": "Kubernetes object UID for identity-checked deletion. Omitted if unavailable.",
+            "maxLength": 128,
+            "minLength": 1,
+            "pattern": "^[A-Za-z0-9._-]+$",
+            "type": "string"
+          },
           "updatedReplicas": {
             "format": "int32",
             "minimum": 0,
@@ -27526,6 +27550,13 @@
           "strategy": {
             "type": "string"
           },
+          "uid": {
+            "description": "Kubernetes object UID for identity-checked deletion. Omitted if unavailable.",
+            "maxLength": 128,
+            "minLength": 1,
+            "pattern": "^[A-Za-z0-9._-]+$",
+            "type": "string"
+          },
           "updatedReplicas": {
             "format": "int32",
             "minimum": 0,
@@ -27583,12 +27614,21 @@
             },
             "type": "array"
           },
+          "matchesCurrentTemplate": {
+            "description": "When supplied, whether the retained ControllerRevision patch exactly matches the current DaemonSet Pod template. False is a confirmed mismatch; omission means this endpoint did not evaluate it.",
+            "type": "boolean",
+            "x-go-pointer": true
+          },
           "name": {
             "type": "string"
           },
           "namespace": {
             "type": "string"
           },
+          "podRevisionHash": {
+            "description": "Observed controller-revision-hash used by owned Pods; omitted when unavailable. Do not infer it from resource names.",
+            "type": "string"
+          },
           "readyReplicas": {
             "format": "int32",
             "minimum": 0,
@@ -29198,6 +29238,77 @@
         ],
         "type": "object"
       },
+      "KubernetesHelmReleaseValues": {
+        "additionalProperties": false,
+        "properties": {
+          "allowedActions": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "content": {
+            "type": "string"
+          },
+          "diffEnabled": {
+            "type": "boolean"
+          },
+          "editable": {
+            "type": "boolean"
+          },
+          "name": {
+            "type": "string"
+          },
+          "namespace": {
+            "type": "string"
+          },
+          "original": {
+            "type": "string"
+          },
+          "revision": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "namespace",
+          "content",
+          "editable",
+          "diffEnabled"
+        ],
+        "type": "object"
+      },
+      "KubernetesHelmReleaseValuesEnvelope": {
+        "additionalProperties": false,
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/KubernetesHelmReleaseValues"
+          }
+        },
+        "required": [
+          "data"
+        ],
+        "type": "object"
+      },
+      "KubernetesHelmReleaseValuesUpdateInput": {
+        "additionalProperties": false,
+        "properties": {
+          "content": {
+            "description": "Complete Helm values YAML.",
+            "type": "string"
+          },
+          "expectedRevision": {
+            "description": "Latest Helm revision observed by the editor. When supplied, a changed revision returns 409 and an Agent without conditional updates returns 501.",
+            "maximum": 2147483646,
+            "minimum": 1,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "content"
+        ],
+        "type": "object"
+      },
       "KubernetesHorizontalPodAutoscaler": {
         "additionalProperties": false,
         "properties": {
@@ -30114,6 +30225,22 @@
             "minimum": 0,
             "type": "integer"
           },
+          "completionTarget": {
+            "description": "Native spec.completions when specified; absence is not a zero completion target.",
+            "format": "int32",
+            "minimum": 0,
+            "type": "integer",
+            "x-go-pointer": true
+          },
+          "completionTime": {
+            "type": "string"
+          },
+          "conditions": {
+            "items": {
+              "$ref": "#/components/schemas/KubernetesWorkloadCondition"
+            },
+            "type": "array"
+          },
           "failed": {
             "format": "int32",
             "minimum": 0,
@@ -30125,10 +30252,17 @@
           "namespace": {
             "type": "string"
           },
+          "startTime": {
+            "type": "string"
+          },
           "succeeded": {
             "format": "int32",
             "minimum": 0,
             "type": "integer"
+          },
+          "suspend": {
+            "type": "boolean",
+            "x-go-pointer": true
           }
         },
         "required": [
@@ -30150,6 +30284,12 @@
             "minimum": 0,
             "type": "integer"
           },
+          "activeDeadlineSeconds": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer",
+            "x-go-pointer": true
+          },
           "allowedActions": {
             "items": {
               "type": "string"
@@ -30159,6 +30299,12 @@
           "annotations": {
             "$ref": "#/components/schemas/KubernetesStringMap"
           },
+          "backoffLimit": {
+            "format": "int32",
+            "minimum": 0,
+            "type": "integer",
+            "x-go-pointer": true
+          },
           "completionMode": {
             "type": "string"
           },
@@ -30167,9 +30313,22 @@
             "minimum": 0,
             "type": "integer"
           },
+          "completionTarget": {
+            "description": "Native spec.completions when specified; absence is not a zero completion target.",
+            "format": "int32",
+            "minimum": 0,
+            "type": "integer",
+            "x-go-pointer": true
+          },
           "completionTime": {
             "type": "string"
           },
+          "conditions": {
+            "items": {
+              "$ref": "#/components/schemas/KubernetesWorkloadCondition"
+            },
+            "type": "array"
+          },
           "createdAt": {
             "type": "string"
           },
@@ -30211,6 +30370,16 @@
             "format": "int32",
             "minimum": 0,
             "type": "integer"
+          },
+          "suspend": {
+            "type": "boolean",
+            "x-go-pointer": true
+          },
+          "ttlSecondsAfterFinished": {
+            "format": "int32",
+            "minimum": 0,
+            "type": "integer",
+            "x-go-pointer": true
           }
         },
         "required": [
@@ -31070,6 +31239,13 @@
           "internalIp": {
             "type": "string"
           },
+          "labels": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Kubernetes Node labels available to the current reader.",
+            "type": "object"
+          },
           "name": {
             "type": "string"
           },
@@ -31371,6 +31547,23 @@
         },
         "type": "object"
       },
+      "KubernetesObservedResourceYamlInput": {
+        "additionalProperties": false,
+        "properties": {
+          "content": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "requireObservedIdentity": {
+            "description": "Require the YAML to include the UID and resource version of the object read before editing. A changed or replaced object returns conflict.",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "content"
+        ],
+        "type": "object"
+      },
       "KubernetesPersistentVolume": {
         "additionalProperties": false,
         "properties": {
@@ -31676,6 +31869,13 @@
             },
             "type": "array"
           },
+          "containerStatuses": {
+            "description": "Init containers followed by ordinary containers in spec order, including unknown entries before status is reported. Restartable init containers have kind sidecar. Does not include ephemeral containers.",
+            "items": {
+              "$ref": "#/components/schemas/KubernetesPodContainerStatus"
+            },
+            "type": "array"
+          },
           "cpu": {
             "type": "string"
           },
@@ -31712,6 +31912,10 @@
           "podIp": {
             "type": "string"
           },
+          "qosClass": {
+            "description": "Kubernetes status.qosClass, omitted when not reported.",
+            "type": "string"
+          },
           "readyContainers": {
             "type": "string"
           },
@@ -31724,8 +31928,10 @@
             "type": "integer"
           },
           "uid": {
-            "description": "Immutable Pod identity. Required by clients restoring a saved live session; absent on older providers.",
+            "description": "Immutable Pod identity for restoring saved live sessions and identity-checked deletion. Older providers may omit it.",
+            "maxLength": 128,
             "minLength": 1,
+            "pattern": "^[A-Za-z0-9._-]+$",
             "type": "string"
           }
         },
@@ -31739,6 +31945,50 @@
         ],
         "type": "object"
       },
+      "KubernetesPodContainerStatus": {
+        "additionalProperties": false,
+        "properties": {
+          "exitCode": {
+            "description": "Present only when the current container state is terminated, including a successful zero exit code.",
+            "format": "int32",
+            "type": "integer",
+            "x-go-type-skip-optional-pointer": false
+          },
+          "kind": {
+            "enum": [
+              "init",
+              "sidecar",
+              "container"
+            ],
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "ready": {
+            "type": "boolean"
+          },
+          "reason": {
+            "type": "string"
+          },
+          "state": {
+            "enum": [
+              "running",
+              "waiting",
+              "terminated",
+              "unknown"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "kind",
+          "ready",
+          "state"
+        ],
+        "type": "object"
+      },
       "KubernetesPodDetail": {
         "additionalProperties": false,
         "properties": {
@@ -31809,8 +32059,10 @@
             "type": "string"
           },
           "uid": {
-            "description": "Immutable Pod identity. Required by clients restoring a saved live session; absent on older providers.",
+            "description": "Immutable Pod identity for restoring saved live sessions and identity-checked deletion. Older providers may omit it.",
+            "maxLength": 128,
             "minLength": 1,
+            "pattern": "^[A-Za-z0-9._-]+$",
             "type": "string"
           },
           "volumes": {
@@ -32237,6 +32489,11 @@
           "clusterLabel": {
             "type": "string"
           },
+          "clusterLabelValue": {
+            "description": "Configured metric cluster label value. Omitted or empty uses the Soha cluster ID for legacy compatibility.",
+            "maxLength": 1024,
+            "type": "string"
+          },
           "grafanaBaseUrl": {
             "type": "string"
           },
@@ -33495,18 +33752,39 @@
       "KubernetesResourceGraphEdge": {
         "additionalProperties": false,
         "properties": {
+          "fieldPath": {
+            "type": "string"
+          },
           "id": {
             "minLength": 1,
             "type": "string"
           },
+          "note": {
+            "type": "string"
+          },
+          "port": {
+            "type": "string"
+          },
+          "protocol": {
+            "type": "string"
+          },
           "relation": {
             "minLength": 1,
             "type": "string"
           },
+          "resolutionState": {
+            "type": "string"
+          },
+          "sectionName": {
+            "type": "string"
+          },
           "sourceId": {
             "minLength": 1,
             "type": "string"
           },
+          "sourceRef": {
+            "$ref": "#/components/schemas/KubernetesResourceRef"
+          },
           "targetId": {
             "minLength": 1,
             "type": "string"
@@ -34112,6 +34390,10 @@
           },
           "namespace": {
             "type": "string"
+          },
+          "requireObservedIdentity": {
+            "description": "Require the YAML to identify the observed Kubernetes object by metadata.uid and metadata.resourceVersion.",
+            "type": "boolean"
           }
         },
         "required": [
@@ -34441,6 +34723,57 @@
         ],
         "type": "object"
       },
+      "KubernetesSecretCertificate": {
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "namespace": {
+            "type": "string"
+          },
+          "notAfter": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "notBefore": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "selfSigned": {
+            "description": "The first certificate is signed by its own key; this is not a trust validation result.",
+            "type": "boolean",
+            "x-go-pointer": true
+          },
+          "status": {
+            "enum": [
+              "available",
+              "missing",
+              "invalid",
+              "unsupported_type"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "namespace",
+          "status"
+        ],
+        "type": "object"
+      },
+      "KubernetesSecretCertificateEnvelope": {
+        "additionalProperties": false,
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/KubernetesSecretCertificate"
+          }
+        },
+        "required": [
+          "data"
+        ],
+        "type": "object"
+      },
       "KubernetesSecretDataInput": {
         "additionalProperties": false,
         "description": "Data values are plain text. The response detail returns Kubernetes Base64-encoded values.",
@@ -35576,6 +35909,10 @@
             "format": "date-time",
             "type": "string"
           },
+          "name": {
+            "maxLength": 253,
+            "type": "string"
+          },
           "namespace": {
             "maxLength": 63,
             "type": "string"
@@ -35636,6 +35973,10 @@
       "KubernetesTopologyGraphEdge": {
         "additionalProperties": false,
         "properties": {
+          "fieldPath": {
+            "maxLength": 1024,
+            "type": "string"
+          },
           "id": {
             "maxLength": 2048,
             "minLength": 1,
@@ -35666,7 +36007,14 @@
               "weights",
               "mirrors",
               "resolves",
-              "selects"
+              "selects",
+              "uses-class",
+              "uses-secret",
+              "uses-config",
+              "parameters",
+              "targets",
+              "authorizes-reference",
+              "policy-peer"
             ],
             "type": "string",
             "x-enum-varnames": [
@@ -35676,7 +36024,14 @@
               "KubernetesTopologyGraphEdgeRelationWeights",
               "KubernetesTopologyGraphEdgeRelationMirrors",
               "KubernetesTopologyGraphEdgeRelationResolves",
-              "KubernetesTopologyGraphEdgeRelationSelects"
+              "KubernetesTopologyGraphEdgeRelationSelects",
+              "KubernetesTopologyGraphEdgeRelationUsesClass",
+              "KubernetesTopologyGraphEdgeRelationUsesSecret",
+              "KubernetesTopologyGraphEdgeRelationUsesConfig",
+              "KubernetesTopologyGraphEdgeRelationParameters",
+              "KubernetesTopologyGraphEdgeRelationTargets",
+              "KubernetesTopologyGraphEdgeRelationAuthorizesReference",
+              "KubernetesTopologyGraphEdgeRelationPolicyPeer"
             ]
           },
           "resolutionState": {
@@ -35686,6 +36041,10 @@
             "maxLength": 2048,
             "type": "string"
           },
+          "sectionName": {
+            "maxLength": 253,
+            "type": "string"
+          },
           "source": {
             "maxLength": 2048,
             "minLength": 1,
@@ -35931,7 +36290,7 @@
             "type": "array"
           },
           "version": {
-            "pattern": "^v1$",
+            "pattern": "^v1$|^network\\.topology\\.(snapshot|named-root)\\.v1$",
             "type": "string"
           }
         },
@@ -35990,7 +36349,8 @@
                 "sourceId": {
                   "enum": [
                     "kubernetes.ingressclasses",
-                    "gateway.gatewayclasses"
+                    "gateway.gatewayclasses",
+                    "kubernetes.namespaces"
                   ]
                 }
               },
@@ -36009,6 +36369,10 @@
           }
         ],
         "properties": {
+          "name": {
+            "maxLength": 253,
+            "type": "string"
+          },
           "namespace": {
             "maxLength": 63,
             "pattern": "^$|^[a-z0-9]([a-z0-9-]*[a-z0-9])?$",
@@ -36016,6 +36380,10 @@
           },
           "sourceId": {
             "enum": [
+              "kubernetes.networkpolicies",
+              "kubernetes.namespaces",
+              "kubernetes.configmaps",
+              "gateway.backendtlspolicies",
               "kubernetes.services",
               "kubernetes.pods",
               "kubernetes.endpointslices",
@@ -36041,6 +36409,10 @@
             ],
             "type": "string",
             "x-enum-varnames": [
+              "KubernetesTopologySourceKubernetesNetworkpolicies",
+              "KubernetesTopologySourceKubernetesNamespaces",
+              "KubernetesTopologySourceKubernetesConfigmaps",
+              "KubernetesTopologySourceGatewayBackendtlspolicies",
               "KubernetesTopologySourceKubernetesServices",
               "KubernetesTopologySourceKubernetesPods",
               "KubernetesTopologySourceKubernetesEndpointslices",
@@ -71455,7 +71827,7 @@
   "info": {
     "description": "Public OpenSoha core API contract. This first contract focuses on stable cross-repository boundaries: auth, health, runner-facing control-plane callbacks, AI Gateway, and MCP capability discovery. Pod session WebSocket targets and their UID-aware ticket requirements are described separately in x-soha-websocket-paths to preserve HTTP client generation.\n",
     "title": "Soha API",
-    "version": "0.1.27"
+    "version": "0.1.29"
   },
   "openapi": "3.1.0",
   "paths": {
@@ -83726,6 +84098,63 @@
         }
       }
     },
+    "/clusters/{clusterID}/configuration/secrets/{name}/certificate": {
+      "get": {
+        "description": "Public metadata for the first tls.crt certificate of a TLS Secret. Requires resource-scoped Secret view; never returns certificate PEM, Secret data or private keys. Dates do not establish certificate trust, host matching or controller deployment.",
+        "operationId": "getKubernetesSecretCertificate",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
+          {
+            "in": "query",
+            "name": "namespace",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesSecretCertificateEnvelope"
+                }
+              }
+            },
+            "description": "Public certificate metadata, including explicit missing or invalid certificate state."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.configuration.secrets.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/configuration/secrets/{name}/data": {
       "put": {
         "operationId": "updateKubernetesSecretData",
@@ -83891,6 +84320,79 @@
         }
       }
     },
+    "/clusters/{clusterID}/configuration/secrets/{name}/yaml": {
+      "put": {
+        "operationId": "applyKubernetesSecretYaml",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
+          {
+            "in": "query",
+            "name": "namespace",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesObservedResourceYamlInput"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesResourceYamlEnvelope"
+                }
+              }
+            },
+            "description": "Updated Kubernetes resource YAML."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
+          "501": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.configuration.secret-data.view",
+            "platform.configuration.secrets.update"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/configuration/validatingwebhookconfigurations": {
       "get": {
         "operationId": "listKubernetesValidatingWebhookConfigurations",
@@ -84741,6 +85243,81 @@
         }
       }
     },
+    "/clusters/{clusterID}/helm/releases/{releaseName}/values": {
+      "put": {
+        "operationId": "updateKubernetesHelmReleaseValues",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesReleaseName"
+          },
+          {
+            "in": "query",
+            "name": "namespace",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesHelmReleaseValuesUpdateInput"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesHelmReleaseValuesEnvelope"
+                }
+              }
+            },
+            "description": "Helm release values after upgrade."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
+          "501": {
+            "$ref": "#/components/responses/Error"
+          },
+          "502": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.helm.releases.update"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/infrastructure/nodes": {
       "get": {
         "operationId": "listKubernetesNodes",
@@ -86634,9 +87211,56 @@
         }
       }
     },
-    "/clusters/{clusterID}/network/ingresses/{name}/detail": {
-      "get": {
-        "operationId": "getKubernetesIngressDetail",
+    "/clusters/{clusterID}/network/ingresses/{name}/detail": {
+      "get": {
+        "operationId": "getKubernetesIngressDetail",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesIngressDetailEnvelope"
+                }
+              }
+            },
+            "description": "Ingress routes and authorized backend relations."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.network.ingresses.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/network/ingresses/{name}/yaml": {
+      "put": {
+        "operationId": "applyKubernetesIngressYaml",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
@@ -86645,19 +87269,38 @@
             "$ref": "#/components/parameters/KubernetesResourceName"
           },
           {
-            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+            "in": "query",
+            "name": "namespace",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesObservedResourceYamlInput"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesIngressDetailEnvelope"
+                  "$ref": "#/components/schemas/KubernetesResourceYamlEnvelope"
                 }
               }
             },
-            "description": "Ingress routes and authorized backend relations."
+            "description": "Updated Kubernetes resource YAML."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -86665,6 +87308,12 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
+          "501": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -86675,7 +87324,7 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.ingresses.view"
+            "platform.network.ingresses.update"
           ],
           "mode": "all"
         }
@@ -87181,6 +87830,78 @@
         }
       }
     },
+    "/clusters/{clusterID}/network/services/{serviceName}/yaml": {
+      "put": {
+        "operationId": "applyKubernetesServiceYaml",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesServiceName"
+          },
+          {
+            "in": "query",
+            "name": "namespace",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesObservedResourceYamlInput"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesResourceYamlEnvelope"
+                }
+              }
+            },
+            "description": "Updated Kubernetes resource YAML."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
+          "501": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.network.services.update"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/network/topology": {
       "get": {
         "operationId": "getKubernetesNetworkTopology",
@@ -87774,6 +88495,24 @@
               "minLength": 1,
               "type": "string"
             }
+          },
+          {
+            "description": "Exact served group/version for a CRD instance, or apiextensions.k8s.io/v1 for a CRD definition. Required together with resource for explicit CRD graphs.",
+            "in": "query",
+            "name": "apiVersion",
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Exact CRD plural resource name. For a CRD definition use customresourcedefinitions.",
+            "in": "query",
+            "name": "resource",
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -88661,6 +89400,111 @@
         }
       }
     },
+    "/clusters/{clusterID}/workloads/daemonsets/{daemonSetName}/rollouts": {
+      "get": {
+        "description": "Retained ControllerRevisions controlled by the selected DaemonSet UID. Replica counts include only Pods controlled by that DaemonSet and referencing the ControllerRevision hash label, not replicas inferred from template names. podRevisionHash is the observed history label; matchesCurrentTemplate compares the native stored patch with the selected DaemonSet template and does not imply every Pod is updated.",
+        "operationId": "listKubernetesDaemonSetRollouts",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesDaemonSetName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceDefaultQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesDeploymentRolloutListEnvelope"
+                }
+              }
+            },
+            "description": "Retained DaemonSet ControllerRevisions. Revision is the native ControllerRevision sequence, name is the ControllerRevision name, and zero replicas means no currently observed owned Pod references this revision. This is not a permanent change archive."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.workloads.daemon-sets.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/workloads/daemonsets/{daemonSetName}/rollouts/{revisionName}/yaml": {
+      "get": {
+        "description": "Read a retained ControllerRevision only when its controlling owner UID matches the selected DaemonSet in the same namespace. Does not resolve Secret references. Inline template values may be sensitive, as in workload YAML.",
+        "operationId": "getKubernetesDaemonSetRevisionYaml",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesDaemonSetName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceDefaultQuery"
+          },
+          {
+            "in": "path",
+            "name": "revisionName",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesResourceYamlEnvelope"
+                }
+              }
+            },
+            "description": "Authorized ControllerRevision YAML; it is a stored template patch, not a live DaemonSet object."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.workloads.daemon-sets.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/workloads/daemonsets/{daemonSetName}/yaml": {
       "get": {
         "operationId": "getKubernetesDaemonSetYaml",
@@ -88762,6 +89606,59 @@
         }
       }
     },
+    "/clusters/{clusterID}/workloads/deployments/{deploymentName}": {
+      "delete": {
+        "description": "Request deletion of a Deployment. With expectedUid, a same-name replacement is rejected and an Agent that cannot enforce the precondition returns 501.",
+        "operationId": "deleteKubernetesDeployment",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesDeploymentName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesExpectedWorkloadUID"
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Deletion requested."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
+          "501": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.deployment.delete"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/workloads/deployments/{deploymentName}/detail": {
       "get": {
         "operationId": "getKubernetesDeploymentDetail",
@@ -89107,6 +90004,62 @@
         }
       }
     },
+    "/clusters/{clusterID}/workloads/jobs/{jobName}/metrics": {
+      "get": {
+        "operationId": "getKubernetesJobMetrics",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesJobName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceDefaultQuery"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesMetricsRangeMinutesQuery"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesMetricsStepSecondsQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesResourceMetricsEnvelope"
+                }
+              }
+            },
+            "description": "Prometheus metrics aggregated from Pods owned by the current Job UID in the selected namespace; retained Pods only, with explicit missing or unconfigured results."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.workloads.jobs.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/workloads/jobs/{jobName}/yaml": {
       "get": {
         "operationId": "getKubernetesJobYaml",
@@ -89254,6 +90207,7 @@
     },
     "/clusters/{clusterID}/workloads/pods/{podName}": {
       "delete": {
+        "description": "Request deletion of a Pod. With expectedUid, a same-name replacement is rejected and an Agent that cannot enforce the precondition returns 501.",
         "operationId": "deleteKubernetesPod",
         "parameters": [
           {
@@ -89264,6 +90218,9 @@
           },
           {
             "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesExpectedWorkloadUID"
           }
         ],
         "responses": {
@@ -89282,6 +90239,9 @@
           "409": {
             "$ref": "#/components/responses/Error"
           },
+          "501": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -89686,6 +90646,62 @@
         }
       }
     },
+    "/clusters/{clusterID}/workloads/replicasets/{replicaSetName}/metrics": {
+      "get": {
+        "operationId": "getKubernetesReplicaSetMetrics",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesReplicaSetName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceDefaultQuery"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesMetricsRangeMinutesQuery"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesMetricsStepSecondsQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesResourceMetricsEnvelope"
+                }
+              }
+            },
+            "description": "Prometheus metrics aggregated from Pods owned by the current ReplicaSet UID in the selected namespace; retained Pods only, with explicit missing or unconfigured results."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.workloads.replica-sets.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/workloads/replicasets/{replicaSetName}/yaml": {
       "get": {
         "operationId": "getKubernetesReplicaSetYaml",
@@ -89870,6 +90886,62 @@
         }
       }
     },
+    "/clusters/{clusterID}/workloads/replicationcontrollers/{name}/metrics": {
+      "get": {
+        "operationId": "getKubernetesReplicationControllerMetrics",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceDefaultQuery"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesMetricsRangeMinutesQuery"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesMetricsStepSecondsQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesResourceMetricsEnvelope"
+                }
+              }
+            },
+            "description": "Prometheus metrics aggregated from Pods owned by the current ReplicationController UID in the selected namespace; retained Pods only, with explicit missing or unconfigured results."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.workloads.replication-controllers.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/workloads/replicationcontrollers/{name}/yaml": {
       "get": {
         "operationId": "getKubernetesReplicationControllerYaml",
@@ -90064,6 +91136,111 @@
         }
       }
     },
+    "/clusters/{clusterID}/workloads/statefulsets/{statefulSetName}/rollouts": {
+      "get": {
+        "description": "Retained ControllerRevisions controlled by the selected StatefulSet UID. Replica counts include only Pods controlled by that StatefulSet and referencing the revision, not replicas inferred from the template.",
+        "operationId": "listKubernetesStatefulSetRollouts",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesStatefulSetName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceDefaultQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesDeploymentRolloutListEnvelope"
+                }
+              }
+            },
+            "description": "Retained StatefulSet ControllerRevisions. Revision is the native ControllerRevision sequence, name is the ControllerRevision name, and zero replicas means no currently observed owned Pod references this revision. This is not a permanent change archive."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.workloads.stateful-sets.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/workloads/statefulsets/{statefulSetName}/rollouts/{revisionName}/yaml": {
+      "get": {
+        "description": "Read a retained ControllerRevision only when its controlling owner UID matches the selected StatefulSet in the same namespace. Does not resolve Secret references. Inline template values may be sensitive, as in workload YAML.",
+        "operationId": "getKubernetesStatefulSetRevisionYaml",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesStatefulSetName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceDefaultQuery"
+          },
+          {
+            "in": "path",
+            "name": "revisionName",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesResourceYamlEnvelope"
+                }
+              }
+            },
+            "description": "Authorized ControllerRevision YAML; it is a stored template patch, not a live StatefulSet object."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.workloads.stateful-sets.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/workloads/statefulsets/{statefulSetName}/yaml": {
       "get": {
         "operationId": "getKubernetesStatefulSetYaml",