apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: helm.sh/resource-policy: keep labels: helm.sh/chart: netbox-enterprise-crds-2.3.0 app.kubernetes.io/managed-by: Helm netboxlabs.com/managed-by: netbox-operator name: netboxenterprises.netboxlabs.com spec: group: netboxlabs.com names: categories: [] kind: NetBoxEnterprise plural: netboxenterprises shortNames: - nbe singular: netboxenterprise scope: Namespaced versions: - additionalPrinterColumns: - description: Whether the cluster is ready jsonPath: .status.ready name: Ready type: boolean - description: License tier jsonPath: .status.license.tier name: Tier type: string - description: License type when healthy, or the reason when not (LicenseMismatch/LicenseExpired/LicenseUnavailable) jsonPath: .status.licenseStatus name: License type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha2 schema: openAPIV3Schema: description: Custom resource representing a NetBox Labs Cluster (v1alpha2) properties: spec: description: "v1alpha2 NetBoxEnterprise spec \u2014 sparse, with defaults resolved by accessors.\n\nField-population rules enforced by [`super::schema_regression`]:\n\n- Every field is `Option`, `Vec`, or `BTreeMap`\n- Every field has `#[serde(default, skip_serializing_if = \"...\")]`\n- **No `#[serde(default = \"fn\")]`** \u2014 defaults live in [`super::defaults`]\n and are exposed through per-field accessors on this type" properties: annotations: additionalProperties: type: string description: Annotations applied to all cluster resources. nullable: true type: object backups: description: 'Enable Velero backups for this cluster. Requires Velero to be installed in the cluster. Defaults to `false`.' nullable: true type: boolean changes: description: 'Change Management plugin (`netbox_changes`). Enabled by default; only takes effect on an enterprise license. See [`Self::changes`].' nullable: true properties: enabled: description: 'Enable or disable Change Management (the `netbox_changes` plugin). Defaults to [`DEFAULT_CHANGES_ENABLED`] (on). Requires an enterprise license to take effect. Disabling also turns off Change Management''s branch governance: protecting `main` from direct edits and requiring approval before a branch is merged. Existing change requests and history are retained (the plugin''s tables are not dropped), and re-enabling restores access to them.' nullable: true type: boolean type: object clusterDnsSuffix: description: 'Kubernetes cluster DNS suffix. Most clusters use the default `cluster.local`, but some environments configure a different suffix. All operator-generated FQDNs use this value when set.' nullable: true type: string copilot: description: "Copilot AI backend configuration. Off by default \u2014 the operator\nonly deploys Copilot when the user opts in via\n`copilot.enabled = true` and supplies an LLM API key Secret." nullable: true properties: awsCredentialsSecret: description: 'Optional Kubernetes Secret with explicit AWS credentials (keys: `aws_access_key_id`, `aws_secret_access_key`). When omitted, the Copilot backend uses ambient credential resolution (IRSA, instance profile, etc.).' nullable: true type: string awsRegion: description: 'AWS region for Bedrock provider. Defaults to [`DEFAULT_COPILOT_AWS_REGION`]. Only meaningful when `llm_provider == Bedrock`.' nullable: true type: string databaseUser: description: 'PostgreSQL user for Copilot. Defaults to [`DEFAULT_COPILOT_DB_USER`].' maxLength: 63 minLength: 1 nullable: true type: string enabled: description: 'Enable the Copilot backend. Defaults to [`DEFAULT_COPILOT_ENABLED`] (off).' nullable: true type: boolean image: description: Container image. Defaults via [`CopilotImage`] accessors. nullable: true properties: digest: description: 'Optional image digest for immutable references. Takes precedence over `tag` in the operator''s image-string assembly when set.' nullable: true type: string imagePullSecrets: description: 'Pull secrets for private registries. Merged with cluster-level `spec.imagePullSecrets` at reconcile time.' items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: description: "Container image pull policy.\n\nVariant names are PascalCase to match Kubernetes API conventions exactly.\nDo not add `#[serde(rename_all)]` \u2014 the Rust names must serialize verbatim.\n\nSee: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy" enum: - IfNotPresent - Always - Never nullable: true type: string registry: description: Container registry host. Defaults to [`DEFAULT_COPILOT_REGISTRY`]. nullable: true type: string repository: description: Repository path. Defaults to [`DEFAULT_COPILOT_REPOSITORY`]. nullable: true type: string tag: description: Image tag. Defaults to [`DEFAULT_COPILOT_TAG`]. nullable: true type: string type: object limits: description: Resource limits. Defaults to [`default_copilot_limits`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object llmApiKeySecret: description: 'Name of the Kubernetes Secret holding the LLM API key. Defaults to [`DEFAULT_COPILOT_LLM_API_KEY_SECRET`].' nullable: true type: string llmApiKeySecretKey: description: 'Key within the LLM API key Secret. Defaults to [`DEFAULT_COPILOT_LLM_API_KEY_SECRET_KEY`].' nullable: true type: string llmMaxSteps: description: 'Maximum LLM reasoning steps per turn. Defaults to [`DEFAULT_COPILOT_LLM_MAX_STEPS`].' format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer llmModel: description: LLM model identifier. Defaults to [`DEFAULT_COPILOT_LLM_MODEL`]. nullable: true type: string llmProvider: description: LLM provider for the Copilot backend. enum: - anthropic - bedrock nullable: true type: string netboxAuthApiTimeout: description: 'Timeout (seconds) for NetBox auth API calls. Defaults to [`DEFAULT_COPILOT_NETBOX_AUTH_API_TIMEOUT`].' format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer netboxAuthCacheTtl: description: 'Session-validation cache TTL (seconds). Defaults to [`DEFAULT_COPILOT_NETBOX_AUTH_CACHE_TTL`].' format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer netboxAuthCookieName: description: 'NetBox session cookie name read by Copilot. Defaults to [`DEFAULT_COPILOT_NETBOX_AUTH_COOKIE_NAME`].' nullable: true type: string postgres: description: 'External PostgreSQL connection. When omitted, Copilot uses the PGO-generated secret `{cluster-name}-postgres-pguser-copilot`.' nullable: true properties: databaseUrl: description: 'Secret reference holding the full `DATABASE_URL` URI (e.g. `postgresql://user:pass@host:5432/db?sslmode=require`).' properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object keychainCaCertificates: description: 'CA certificates from `spec.tlsKeychain` to install for verifying the Copilot PostgreSQL server certificate. Required when `ssl_mode` is `verify-ca` or `verify-full`.' items: type: string type: array keychainClientCertificate: description: 'Client certificate from `spec.tlsKeychain` to present for mutual TLS, when the server''s `pg_hba.conf` demands `clientcert=verify-ca` or `verify-full`. The key must be PKCS#8 PEM.' nullable: true type: string sslMode: description: 'PostgreSQL SSL connection mode. Controls how SSL/TLS is used when connecting to PostgreSQL. These modes match the libpq `sslmode` parameter values. # Modes | Mode | Description | |------|-------------| | `disable` | No SSL - unencrypted connection | | `allow` | Try non-SSL first, use SSL if server requires it | | `prefer` | Try SSL first, fall back to non-SSL (default for external) | | `require` | Require SSL, but don''t verify the server certificate | | `verify-ca` | Require SSL and verify the server certificate is signed by a trusted CA | | `verify-full` | Require SSL, verify CA, and verify the server hostname matches the certificate | # Security Recommendations - For production external databases, use `verify-full` with proper CA certificates - Operator-managed PostgreSQL (PGO) always uses `require` internally - `disable` and `allow` should only be used in development environments' enum: - disable - allow - prefer - require - verify-ca - verify-full nullable: true type: string required: - databaseUrl type: object redisDb: description: 'Redis database number for Copilot. Defaults to [`DEFAULT_COPILOT_REDIS_DB`].' format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer replicas: description: Replica count. Defaults to [`DEFAULT_COPILOT_REPLICAS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: Resource requests. Defaults to [`default_copilot_resources`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object timeouts: description: 'Per-service timeout overrides for the Copilot Ingress. Field-level merges over the cluster-wide `spec.ingress.timeouts` default. When unset, Copilot falls back to long-lived-connection defaults suitable for streaming chat responses.' nullable: true properties: gateway: description: Gateway API HTTPRoute rule timeout overrides. nullable: true properties: backendRequest: description: 'BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended' nullable: true type: string request: description: 'Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended' nullable: true type: string type: object ingress: description: Ingress-level timeout overrides (nginx annotation translation). nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object topologySpreadConstraints: description: 'Topology spread constraints for Copilot pods. Useful for HA deployments with multiple replicas.' items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object diode: description: "Diode ingestion suite configuration (ingester + reconciler + auth +\nHydra OIDC server). Enabled by default \u2014 see [`Self::diode`]." nullable: true properties: auth: description: Diode auth deployment. nullable: true properties: annotations: additionalProperties: type: string description: Annotations to apply to auth pods. nullable: true type: object enabled: description: 'Enable the auth service deployment. Defaults to [`DEFAULT_DIODE_ENABLED`].' nullable: true type: boolean extraEnvs: description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: Container image. nullable: true properties: digest: description: "Optional image digest for immutable references. Component-specific\ndefault applies when unset.\n\nv1alpha2 is the served *and* storage version, so this is the schema\nevery install's CR is actually validated against \u2014 the same guard on\n[`crate::crd::v1alpha1::diode::DiodeImage::digest`] never fires on the\nlive path (NBE-2217).\n\nThe empty-string alternation is load-bearing, not slack: `pattern`\napplies to any string that is *present*, and both the accessors below\nand `resolve_diode_image` deliberately treat `digest: \"\"` as unset\n(falls back to the per-component pinned default) \u2014 a bare digest\npattern would reject that value at admission before it ever reaches\nthe resolver.\n\nThe pattern is restricted to the two algorithms containerd actually\naccepts, each at its fixed hex length, lowercase only \u2014 go-digest\nrequires lowercase hex for `sha256`/`sha512`, so a syntactically\ndigest-shaped value like `sha256:ABCD\u2026` or `sha256:a` would otherwise\npass admission and still hit the kubelet as InvalidImageName." nullable: true pattern: ^$|^sha256:[a-f0-9]{64}$|^sha512:[a-f0-9]{128}$ type: string imagePullSecrets: description: Pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: description: "Container image pull policy.\n\nVariant names are PascalCase to match Kubernetes API conventions exactly.\nDo not add `#[serde(rename_all)]` \u2014 the Rust names must serialize verbatim.\n\nSee: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy" enum: - IfNotPresent - Always - Never nullable: true type: string registry: description: Container registry host. Defaults to [`DEFAULT_DIODE_REGISTRY`]. nullable: true type: string repository: description: "Repository path. Component-specific default applies when unset \u2014\nsee the per-component accessors." nullable: true type: string tag: description: Image tag. Component-specific default applies when unset. nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to auth pods. nullable: true type: object limits: description: Resource limits. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object port: description: Service port. Defaults to [`DEFAULT_DIODE_AUTH_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer replicas: description: Replica count. Defaults to [`DEFAULT_DIODE_REPLICAS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: Resource requests. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object serviceAccount: description: 'Kubernetes service account name. Auto-generated as `{cluster-name}-diode-auth` when unset.' nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for auth pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object config: description: Diode runtime configuration (ingester / reconciler / auth / hydra). nullable: true properties: auth: description: Diode auth runtime configuration. nullable: true properties: logLevel: description: 'Log level for Diode services. Uses Go''s slog package levels. See [slog Level documentation](https://pkg.go.dev/log/slog#Level).' enum: - INFO - DEBUG - WARN - ERROR nullable: true type: string sentryDsn: description: Sentry DSN for error tracking. nullable: true type: string telemetryConfig: description: Telemetry configuration. nullable: true properties: environment: description: 'Deployment environment name. When `None`, the Diode binary uses its compiled-in default.' nullable: true type: string metricsEnabled: description: 'Enable Prometheus metrics endpoint. Defaults to [`DEFAULT_DIODE_METRICS_ENABLED`].' nullable: true type: boolean metricsExporter: description: 'Metrics exporter backend for Diode telemetry. See [Diode telemetry config]. [Diode telemetry config]: https://github.com/netboxlabs/diode/blob/62f1c2ea05452f3bf32cab7932ed61d1877c7da0/diode-server/telemetry/config.go' enum: - prometheus - otlp - console - none nullable: true type: string metricsPort: description: 'Port for the metrics endpoint. Component-specific default applies when unset.' format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer traceExporter: description: 'Trace exporter backend for Diode telemetry. See [Diode telemetry config]. [Diode telemetry config]: https://github.com/netboxlabs/diode/blob/62f1c2ea05452f3bf32cab7932ed61d1877c7da0/diode-server/telemetry/config.go' enum: - otlp - console - none nullable: true type: string type: object type: object hydra: description: Hydra OIDC server runtime configuration. nullable: true properties: oidc: description: OIDC configuration. nullable: true properties: subjectIdentifiers: description: Subject identifier configuration. properties: supportedTypes: description: Supported subject identifier types. items: description: 'OIDC subject identifier algorithm type. See [Hydra subject identifiers](https://www.ory.com/docs/hydra/guides/openid).' enum: - public - pairwise type: string type: array required: - supportedTypes type: object required: - subjectIdentifiers type: object serve: description: Server listening configuration. nullable: true properties: admin: description: Admin API server configuration. nullable: true properties: host: description: Bind address. Defaults to [`DEFAULT_HYDRA_BIND_HOST`]. nullable: true type: string port: description: Admin API port. Defaults to [`DEFAULT_HYDRA_ADMIN_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer type: object public: description: Public API server configuration. nullable: true properties: host: description: Bind address. Defaults to [`DEFAULT_HYDRA_BIND_HOST`]. nullable: true type: string port: description: Public API port. Defaults to [`DEFAULT_HYDRA_PUBLIC_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer type: object tls: description: TLS termination configuration. nullable: true properties: allowTerminationFrom: description: 'Networks allowed to terminate TLS (e.g., load balancers). Defaults to [`default_hydra_tls_allow_termination_from`] when unset.' items: pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\/(3[0-2]|[0-2]?[0-9])$ type: string nullable: true type: array type: object type: object strategies: description: Token strategies. nullable: true properties: accessToken: description: Access token strategy. enum: - jwt - opaque type: string jwt: description: JWT-specific configuration. properties: scopeClaim: description: Format for scope claim in JWT. enum: - list - string - both type: string required: - scopeClaim type: object required: - accessToken - jwt type: object ttl: description: Token TTL configuration. nullable: true properties: accessToken: description: 'Access token lifetime (e.g., "1h", "30m"). Defaults to [`DEFAULT_HYDRA_ACCESS_TOKEN_TTL`].' nullable: true type: string type: object urls: description: 'URL configuration. When omitted (and `urls.self.issuer` unset within), the operator auto-generates the issuer URL from cluster name and namespace at reconcile time.' nullable: true properties: self: description: Self-referential URLs. nullable: true properties: issuer: description: 'OIDC issuer URL. If not specified, will be auto-generated based on cluster name and namespace.' nullable: true type: string type: object type: object type: object ingester: description: Diode ingester runtime configuration. nullable: true properties: logLevel: description: 'Log level for Diode services. Uses Go''s slog package levels. See [slog Level documentation](https://pkg.go.dev/log/slog#Level).' enum: - INFO - DEBUG - WARN - ERROR nullable: true type: string redisMemoryHighWatermarkPct: description: 'Redis `used_memory`/`maxmemory` percentage at which the ingester rejects ingest with `ResourceExhausted` (`REDIS_MEMORY_HIGH_WATERMARK_PCT`). Defaults to [`DEFAULT_DIODE_REDIS_MEMORY_HIGH_WATERMARK_PCT`] (90); 0 disables the check. Only meaningful when Redis has a `maxmemory` cap.' format: uint8 maximum: 100.0 minimum: 0.0 nullable: true type: integer redisStreamDb: description: 'Redis database number for stream storage. Defaults to [`DEFAULT_DIODE_REDIS_STREAM_DB`].' format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer sentryDsn: description: Sentry DSN for error tracking. nullable: true type: string telemetryConfig: description: Telemetry configuration. nullable: true properties: environment: description: 'Deployment environment name. When `None`, the Diode binary uses its compiled-in default.' nullable: true type: string metricsEnabled: description: 'Enable Prometheus metrics endpoint. Defaults to [`DEFAULT_DIODE_METRICS_ENABLED`].' nullable: true type: boolean metricsExporter: description: 'Metrics exporter backend for Diode telemetry. See [Diode telemetry config]. [Diode telemetry config]: https://github.com/netboxlabs/diode/blob/62f1c2ea05452f3bf32cab7932ed61d1877c7da0/diode-server/telemetry/config.go' enum: - prometheus - otlp - console - none nullable: true type: string metricsPort: description: 'Port for the metrics endpoint. Component-specific default applies when unset.' format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer traceExporter: description: 'Trace exporter backend for Diode telemetry. See [Diode telemetry config]. [Diode telemetry config]: https://github.com/netboxlabs/diode/blob/62f1c2ea05452f3bf32cab7932ed61d1877c7da0/diode-server/telemetry/config.go' enum: - otlp - console - none nullable: true type: string type: object type: object reconciler: description: Diode reconciler runtime configuration. nullable: true properties: autoApplyChangesets: description: 'Automatically apply changesets to NetBox. Defaults to [`DEFAULT_DIODE_AUTO_APPLY_CHANGESETS`].' nullable: true type: boolean autoApplyProcessorConcurrency: description: 'Number of concurrent auto-apply processors (`AUTO_APPLY_PROCESSOR_CONCURRENCY`). Defaults to [`DEFAULT_DIODE_AUTO_APPLY_PROCESSOR_CONCURRENCY`].' format: uint8 maximum: 255.0 minimum: 1.0 nullable: true type: integer databaseName: description: PostgreSQL database name. maxLength: 63 minLength: 1 nullable: true type: string databaseUser: description: PostgreSQL database user. maxLength: 63 minLength: 1 nullable: true type: string ingestionLogProcessorConcurrency: description: 'Number of concurrent ingestion-log processors (`INGESTION_LOG_PROCESSOR_CONCURRENCY`). Defaults to [`DEFAULT_DIODE_INGESTION_LOG_PROCESSOR_CONCURRENCY`].' format: uint8 maximum: 255.0 minimum: 1.0 nullable: true type: integer logLevel: description: 'Log level for Diode services. Uses Go''s slog package levels. See [slog Level documentation](https://pkg.go.dev/log/slog#Level).' enum: - INFO - DEBUG - WARN - ERROR nullable: true type: string migrationEnabled: description: 'Enable database migrations on startup. Defaults to [`DEFAULT_DIODE_MIGRATION_ENABLED`].' nullable: true type: boolean netboxClientId: description: OAuth2 client ID for NetBox authentication. nullable: true type: string pluginApiBaseUrl: description: 'NetBox Diode plugin API base URL. When `None`, the operator auto-generates one from cluster metadata at reconcile time.' nullable: true type: string postgres: description: 'External PostgreSQL connection. When `None`, the operator uses the PGO-generated secret `{cluster-name}-postgres-pguser-diode`.' nullable: true properties: password: description: Password reference (external Secret). properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object postgresqlProfile: description: Name of a PostgreSQL profile from `postgresqlProfiles`. nullable: true type: string required: - password type: object rateLimitBurst: description: Rate limit burst size. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer rateLimitNetboxBurst: description: NetBox API rate limit burst size. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer rateLimitNetboxRps: description: NetBox API rate limit requests per second. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer rateLimitRps: description: Rate limit requests per second. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer redisDb: description: Redis database number. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer redisStreamDb: description: Redis database number for stream storage. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer sentryDsn: description: Sentry DSN for error tracking. nullable: true type: string telemetryConfig: description: Telemetry configuration. nullable: true properties: environment: description: 'Deployment environment name. When `None`, the Diode binary uses its compiled-in default.' nullable: true type: string metricsEnabled: description: 'Enable Prometheus metrics endpoint. Defaults to [`DEFAULT_DIODE_METRICS_ENABLED`].' nullable: true type: boolean metricsExporter: description: 'Metrics exporter backend for Diode telemetry. See [Diode telemetry config]. [Diode telemetry config]: https://github.com/netboxlabs/diode/blob/62f1c2ea05452f3bf32cab7932ed61d1877c7da0/diode-server/telemetry/config.go' enum: - prometheus - otlp - console - none nullable: true type: string metricsPort: description: 'Port for the metrics endpoint. Component-specific default applies when unset.' format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer traceExporter: description: 'Trace exporter backend for Diode telemetry. See [Diode telemetry config]. [Diode telemetry config]: https://github.com/netboxlabs/diode/blob/62f1c2ea05452f3bf32cab7932ed61d1877c7da0/diode-server/telemetry/config.go' enum: - otlp - console - none nullable: true type: string type: object type: object type: object enabled: description: 'Enable the entire Diode suite. Defaults to [`DEFAULT_DIODE_ENABLED`].' nullable: true type: boolean hydra: description: Hydra OIDC server deployment. nullable: true properties: annotations: additionalProperties: type: string description: Annotations to apply to Hydra pods. nullable: true type: object autoMigrate: description: 'Enable automatic database migrations on startup. Defaults to [`DEFAULT_HYDRA_AUTO_MIGRATE`].' nullable: true type: boolean databaseName: description: 'PostgreSQL database name for Hydra. Defaults to [`DEFAULT_HYDRA_DATABASE_NAME`].' maxLength: 63 minLength: 1 nullable: true type: string databaseUser: description: 'PostgreSQL database user for Hydra. Defaults to [`DEFAULT_HYDRA_DATABASE_USER`].' maxLength: 63 minLength: 1 nullable: true type: string enabled: description: 'Enable the Hydra deployment. Defaults to [`DEFAULT_HYDRA_ENABLED`].' nullable: true type: boolean extraEnvs: description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: Container image. Defaults via [`HydraImage`] accessors. nullable: true properties: digest: description: 'Optional image digest for immutable references. Takes precedence over `tag` when the operator assembles the image string.' nullable: true type: string imagePullSecrets: description: Pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: description: "Container image pull policy.\n\nVariant names are PascalCase to match Kubernetes API conventions exactly.\nDo not add `#[serde(rename_all)]` \u2014 the Rust names must serialize verbatim.\n\nSee: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy" enum: - IfNotPresent - Always - Never nullable: true type: string registry: description: Container registry host. Defaults to [`DEFAULT_HYDRA_REGISTRY`]. nullable: true type: string repository: description: Repository path. Defaults to [`DEFAULT_HYDRA_REPOSITORY`]. nullable: true type: string tag: description: Image tag. Defaults to [`DEFAULT_HYDRA_TAG`]. nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to Hydra pods. nullable: true type: object limits: description: Resource limits. Defaults to [`default_hydra_limits`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object postgresqlProfile: description: 'Name of a PostgreSQL profile from `postgresqlProfiles` from which Hydra inherits PostgreSQL connection settings.' nullable: true type: string replicas: description: Replica count. Defaults to [`DEFAULT_HYDRA_REPLICAS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: Resource requests. Defaults to [`default_hydra_resources`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object secrets: description: 'Kubernetes Secret references for Hydra. When unset, the operator auto-generates references based on PostgreSQL configuration.' nullable: true properties: cookie: description: Cookie secret for session management. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object dsn: description: Database connection DSN. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object system: description: System secret for encryption. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object serviceAccount: description: 'Kubernetes service account name. When `None`, the operator auto-generates `{cluster-name}-diode-hydra`.' nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for Hydra pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object ingester: description: Diode ingester deployment. nullable: true properties: annotations: additionalProperties: type: string description: Annotations to apply to ingester pods. nullable: true type: object enabled: description: 'Enable the ingester deployment. Defaults to [`DEFAULT_DIODE_ENABLED`].' nullable: true type: boolean extraEnvs: description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: 'Container image. Defaults via [`DiodeImage`] accessors and the per-component fallbacks on [`Self::repository`] / [`Self::tag`] / [`Self::digest`].' nullable: true properties: digest: description: "Optional image digest for immutable references. Component-specific\ndefault applies when unset.\n\nv1alpha2 is the served *and* storage version, so this is the schema\nevery install's CR is actually validated against \u2014 the same guard on\n[`crate::crd::v1alpha1::diode::DiodeImage::digest`] never fires on the\nlive path (NBE-2217).\n\nThe empty-string alternation is load-bearing, not slack: `pattern`\napplies to any string that is *present*, and both the accessors below\nand `resolve_diode_image` deliberately treat `digest: \"\"` as unset\n(falls back to the per-component pinned default) \u2014 a bare digest\npattern would reject that value at admission before it ever reaches\nthe resolver.\n\nThe pattern is restricted to the two algorithms containerd actually\naccepts, each at its fixed hex length, lowercase only \u2014 go-digest\nrequires lowercase hex for `sha256`/`sha512`, so a syntactically\ndigest-shaped value like `sha256:ABCD\u2026` or `sha256:a` would otherwise\npass admission and still hit the kubelet as InvalidImageName." nullable: true pattern: ^$|^sha256:[a-f0-9]{64}$|^sha512:[a-f0-9]{128}$ type: string imagePullSecrets: description: Pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: description: "Container image pull policy.\n\nVariant names are PascalCase to match Kubernetes API conventions exactly.\nDo not add `#[serde(rename_all)]` \u2014 the Rust names must serialize verbatim.\n\nSee: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy" enum: - IfNotPresent - Always - Never nullable: true type: string registry: description: Container registry host. Defaults to [`DEFAULT_DIODE_REGISTRY`]. nullable: true type: string repository: description: "Repository path. Component-specific default applies when unset \u2014\nsee the per-component accessors." nullable: true type: string tag: description: Image tag. Component-specific default applies when unset. nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to ingester pods. nullable: true type: object limits: description: Resource limits. Defaults to [`default_diode_limits`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object port: description: Service port. Defaults to [`DEFAULT_DIODE_INGESTER_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer replicas: description: Replica count. Defaults to [`DEFAULT_DIODE_REPLICAS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: Resource requests. Defaults to [`default_diode_resources`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object serviceAccount: description: 'Kubernetes service account name. Auto-generated as `{cluster-name}-diode-ingester` when unset.' nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for ingester pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object reconciler: description: Diode reconciler deployment. nullable: true properties: annotations: additionalProperties: type: string description: Annotations to apply to reconciler pods. nullable: true type: object enabled: description: 'Enable the reconciler deployment. Defaults to [`DEFAULT_DIODE_ENABLED`].' nullable: true type: boolean extraEnvs: description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: Container image. nullable: true properties: digest: description: "Optional image digest for immutable references. Component-specific\ndefault applies when unset.\n\nv1alpha2 is the served *and* storage version, so this is the schema\nevery install's CR is actually validated against \u2014 the same guard on\n[`crate::crd::v1alpha1::diode::DiodeImage::digest`] never fires on the\nlive path (NBE-2217).\n\nThe empty-string alternation is load-bearing, not slack: `pattern`\napplies to any string that is *present*, and both the accessors below\nand `resolve_diode_image` deliberately treat `digest: \"\"` as unset\n(falls back to the per-component pinned default) \u2014 a bare digest\npattern would reject that value at admission before it ever reaches\nthe resolver.\n\nThe pattern is restricted to the two algorithms containerd actually\naccepts, each at its fixed hex length, lowercase only \u2014 go-digest\nrequires lowercase hex for `sha256`/`sha512`, so a syntactically\ndigest-shaped value like `sha256:ABCD\u2026` or `sha256:a` would otherwise\npass admission and still hit the kubelet as InvalidImageName." nullable: true pattern: ^$|^sha256:[a-f0-9]{64}$|^sha512:[a-f0-9]{128}$ type: string imagePullSecrets: description: Pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: description: "Container image pull policy.\n\nVariant names are PascalCase to match Kubernetes API conventions exactly.\nDo not add `#[serde(rename_all)]` \u2014 the Rust names must serialize verbatim.\n\nSee: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy" enum: - IfNotPresent - Always - Never nullable: true type: string registry: description: Container registry host. Defaults to [`DEFAULT_DIODE_REGISTRY`]. nullable: true type: string repository: description: "Repository path. Component-specific default applies when unset \u2014\nsee the per-component accessors." nullable: true type: string tag: description: Image tag. Component-specific default applies when unset. nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to reconciler pods. nullable: true type: object limits: description: Resource limits. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object port: description: Service port. Defaults to [`DEFAULT_DIODE_RECONCILER_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer replicas: description: Replica count. Defaults to [`DEFAULT_DIODE_REPLICAS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: Resource requests. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object serviceAccount: description: 'Kubernetes service account name. Auto-generated as `{cluster-name}-diode-reconciler` when unset.' nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for reconciler pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object timeouts: description: Per-route timeout overrides for the Diode HTTP and gRPC surfaces. nullable: true properties: grpc: description: Timeout overrides for the Diode gRPC Ingress. nullable: true properties: ingress: description: Ingress-level timeout overrides for the gRPC Ingress. nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object http: description: Timeout overrides for the Diode HTTP Ingress + HTTPRoute. nullable: true properties: gateway: description: Gateway API HTTPRoute rule timeout overrides. nullable: true properties: backendRequest: description: 'BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended' nullable: true type: string request: description: 'Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended' nullable: true type: string type: object ingress: description: Ingress-level timeout overrides (nginx annotation translation). nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object type: object topologySpreadConstraints: description: 'Topology spread constraints applied to every Diode pod (ingester, reconciler, auth, proxy). A per-component setting overrides it; when unset the operator falls back to `spec.replication.topologySpreadConstraints` then a hostname default.' items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object extraCaCertificates: description: 'Additional CA certificates to trust system-wide. These certificates are added to the system trust store of all NetBox components (netbox, worker) and merged into every service-specific CA bundle (PostgreSQL, Redis). Users must create Kubernetes Secrets containing PEM-encoded certificates, then reference them here.' items: description: SecretKeySelector selects a key of a Secret. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: array extraManifests: description: 'Additional Kubernetes manifests to deploy alongside the managed workloads. Each entry is a YAML string and may contain multiple documents separated by `---`. Documents are parsed into typed resources, run through the same base and enterprise mutation pipelines as operator-built resources, and applied with the managed workloads. Unsupported kinds are rejected at reconcile time.' items: type: string type: array gateway: description: "Gateway API configuration for operator-managed Gateway and Route\nobjects.\n\nDefaults to an empty [`GatewayConfig`] (disabled by default) when\nomitted \u2014 see [`Self::gateway`]." nullable: true properties: annotations: additionalProperties: type: string description: Extra annotations merged onto all Gateway API resources. type: object className: description: "GatewayClass name for the Gateway resource. Defaults to\n[`DEFAULT_GATEWAY_CLASS_NAME`] (`traefik`) \u2014 resolve via\n[`Self::class_name`].\n\nCommon values: `\"traefik\"`, `\"envoy\"`, `\"cilium\"`, `\"istio\"`." nullable: true type: string enabled: description: "Whether the operator creates Gateway API resources. Defaults to\n[`DEFAULT_GATEWAY_ENABLED`] \u2014 resolve via [`Self::enabled`].\n\nWhen `true`, the operator creates a Gateway and the associated\nHTTPRoute/GRPCRoute objects." nullable: true type: boolean listeners: description: 'Gateway listener definitions. Each entry maps to a `spec.listeners[]` entry on the Gateway. Uses the upstream Gateway API `GatewayListeners` type directly.' items: description: 'Listener embodies the concept of a logical endpoint where a Gateway accepts network connections.' properties: allowedRoutes: description: "AllowedRoutes defines the types of routes that MAY be attached to a\nListener and the trusted namespaces where those Route resources MAY be\npresent.\n\nAlthough a client request may match multiple route rules, only one rule\nmay ultimately receive the request. Matching precedence MUST be\ndetermined in order of the following criteria:\n\n* The most specific match as defined by the Route type.\n* The oldest Route based on creation timestamp. For example, a Route with\n a creation timestamp of \"2020-09-08 01:02:03\" is given precedence over\n a Route with a creation timestamp of \"2020-09-08 01:02:04\".\n* If everything else is equivalent, the Route appearing first in\n alphabetical order (namespace/name) should be given precedence. For\n example, foo/bar is given precedence over foo/baz.\n\nAll valid rules within a Route attached to this Listener should be\nimplemented. Invalid Route rules can be ignored (sometimes that will mean\nthe full Route). If a Route rule transitions from valid to invalid,\nsupport for that Route rule should be dropped to ensure consistency. For\nexample, even if a filter specified by a Route rule is invalid, the rest\nof the rules within that Route should still be supported.\n\nSupport: Core" nullable: true properties: kinds: description: 'Kinds specifies the groups and kinds of Routes that are allowed to bind to this Gateway Listener. When unspecified or empty, the kinds of Routes selected are determined using the Listener protocol. A RouteGroupKind MUST correspond to kinds of Routes that are compatible with the application protocol specified in the Listener''s Protocol field. If an implementation does not support or recognize this resource type, it MUST set the "ResolvedRefs" condition to False for this Listener with the "InvalidRouteKinds" reason. Support: Core' items: description: RouteGroupKind indicates the group and kind of a Route resource. properties: group: description: Group is the group of the Route. nullable: true type: string kind: description: Kind is the kind of the Route. type: string required: - kind type: object nullable: true type: array namespaces: description: 'Namespaces indicates namespaces from which Routes may be attached to this Listener. This is restricted to the namespace of this Gateway by default. Support: Core' nullable: true properties: from: description: "From indicates where Routes will be selected for this Gateway. Possible\nvalues are:\n\n* All: Routes in all namespaces may be used by this Gateway.\n* Selector: Routes in namespaces selected by the selector may be used by\n this Gateway.\n* Same: Only Routes in the same namespace may be used by this Gateway.\n\nSupport: Core" enum: - All - Selector - Same - null nullable: true type: string selector: description: 'Selector must be specified when From is set to "Selector". In that case, only Routes in Namespaces matching this Selector will be selected by this Gateway. This field is ignored for other values of "From". Support: Core' nullable: true properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: 'A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.' properties: key: description: key is the label key that the selector applies to. type: string operator: description: 'operator represents a key''s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.' type: string values: description: 'values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.' items: type: string nullable: true type: array required: - key - operator type: object nullable: true type: array matchLabels: additionalProperties: type: string description: 'matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.' nullable: true type: object type: object type: object type: object hostname: description: "Hostname specifies the virtual hostname to match for protocol types that\ndefine this concept. When unspecified, all hostnames are matched. This\nfield is ignored for protocols that don't require hostname based\nmatching.\n\nImplementations MUST apply Hostname matching appropriately for each of\nthe following protocols:\n\n* TLS: The Listener Hostname MUST match the SNI.\n* HTTP: The Listener Hostname MUST match the Host header of the request.\n* HTTPS: The Listener Hostname SHOULD match both the SNI and Host header.\n Note that this does not require the SNI and Host header to be the same.\n The semantics of this are described in more detail below.\n\nTo ensure security, Section 11.1 of RFC-6066 emphasizes that server\nimplementations that rely on SNI hostname matching MUST also verify\nhostnames within the application protocol.\n\nSection 9.1.2 of RFC-7540 provides a mechanism for servers to reject the\nreuse of a connection by responding with the HTTP 421 Misdirected Request\nstatus code. This indicates that the origin server has rejected the\nrequest because it appears to have been misdirected.\n\nTo detect misdirected requests, Gateways SHOULD match the authority of\nthe requests with all the SNI hostname(s) configured across all the\nGateway Listeners on the same port and protocol:\n\n* If another Listener has an exact match or more specific wildcard entry,\n the Gateway SHOULD return a 421.\n* If the current Listener (selected by SNI matching during ClientHello)\n does not match the Host:\n * If another Listener does match the Host, the Gateway SHOULD return a\n 421.\n * If no other Listener matches the Host, the Gateway MUST return a\n 404.\n\nFor HTTPRoute and TLSRoute resources, there is an interaction with the\n`spec.hostnames` array. When both listener and route specify hostnames,\nthere MUST be an intersection between the values for a Route to be\naccepted. For more information, refer to the Route specific Hostnames\ndocumentation.\n\nHostnames that are prefixed with a wildcard label (`*.`) are interpreted\nas a suffix match. That means that a match for `*.example.com` would match\nboth `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\nSupport: Core" nullable: true type: string name: description: 'Name is the name of the Listener. This name MUST be unique within a Gateway. Support: Core' type: string port: description: 'Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules. Support: Core' format: int32 type: integer protocol: description: 'Protocol specifies the network protocol this listener expects to receive. Support: Core' type: string tls: description: 'TLS is the TLS configuration for the Listener. This field is required if the Protocol field is "HTTPS" or "TLS". It is invalid to set this field if the Protocol field is "HTTP", "TCP", or "UDP". The association of SNIs to Certificate defined in ListenerTLSConfig is defined based on the Hostname field for this listener. The GatewayClass MUST use the longest matching SNI out of all available certificates for any TLS handshake. Support: Core' nullable: true properties: certificateRefs: description: 'CertificateRefs contains a series of references to Kubernetes objects that contains TLS certificates and private keys. These certificates are used to establish a TLS handshake for requests that match the hostname of the associated listener. A single CertificateRef to a Kubernetes Secret has "Core" support. Implementations MAY choose to support attaching multiple certificates to a Listener, but this behavior is implementation-specific. References to a resource in different namespace are invalid UNLESS there is a ReferenceGrant in the target namespace that allows the certificate to be attached. If a ReferenceGrant does not allow this reference, the "ResolvedRefs" condition MUST be set to False for this listener with the "RefNotPermitted" reason. This field is required to have at least one element when the mode is set to "Terminate" (default) and is optional otherwise. CertificateRefs can reference to standard Kubernetes resources, i.e. Secret, or implementation-specific custom resources. Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls Support: Implementation-specific (More than one reference or other resource types)' items: description: 'SecretObjectReference identifies an API object including its namespace, defaulting to Secret. The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid. References to objects with invalid Group and Kind are not valid, and must be rejected by the implementation, with appropriate Conditions set on the containing object.' properties: group: description: 'Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred.' nullable: true type: string kind: description: Kind is kind of the referent. For example "Secret". nullable: true type: string name: description: Name is the name of the referent. type: string namespace: description: 'Namespace is the namespace of the referenced object. When unspecified, the local namespace is inferred. Note that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace''s owner to accept the reference. See the ReferenceGrant documentation for details. Support: Core' nullable: true type: string required: - name type: object nullable: true type: array mode: description: "Mode defines the TLS behavior for the TLS session initiated by the client.\nThere are two possible modes:\n\n- Terminate: The TLS session between the downstream client and the\n Gateway is terminated at the Gateway. This mode requires certificates\n to be specified in some way, such as populating the certificateRefs\n field.\n- Passthrough: The TLS session is NOT terminated by the Gateway. This\n implies that the Gateway can't decipher the TLS stream except for\n the ClientHello message of the TLS protocol. The certificateRefs field\n is ignored in this mode.\n\nSupport: Core" enum: - Terminate - Passthrough - null nullable: true type: string options: additionalProperties: type: string description: 'Options are a list of key/value pairs to enable extended TLS configuration for each implementation. For example, configuring the minimum TLS version or supported cipher suites. A set of common keys MAY be defined by the API in the future. To avoid any ambiguity, implementation-specific definitions MUST use domain-prefixed names, such as `example.com/my-custom-option`. Un-prefixed names are reserved for key names defined by Gateway API. Support: Implementation-specific' nullable: true type: object type: object required: - name - port - protocol type: object type: array maxRequestBodyBytes: description: 'Maximum request body size, in bytes, enforced at the bundled Traefik gateway. `0` disables the cap. Unset resolves to the v1alpha1 `DEFAULT_MAX_REQUEST_BODY_BYTES` via [`Self::max_request_body_bytes`]. Only applies when the gateway class is the bundled Traefik.' format: int64 nullable: true type: integer timeouts: description: 'Timeouts applied to all generated HTTPRoute rules. Maps to `spec.rules[].timeouts` on HTTPRoute resources. Values are Gateway API duration strings (e.g., `"30s"`, `"1m"`).' nullable: true properties: backendRequest: description: 'BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended' nullable: true type: string request: description: 'Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended' nullable: true type: string type: object type: object imagePullPolicy: description: "Container image pull policy.\n\nVariant names are PascalCase to match Kubernetes API conventions exactly.\nDo not add `#[serde(rename_all)]` \u2014 the Rust names must serialize verbatim.\n\nSee: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy" enum: - IfNotPresent - Always - Never nullable: true type: string imagePullSecrets: description: Image pull secrets for private registries. items: type: string type: array ingress: description: "Ingress configuration for operator-managed Ingress objects.\n\nDefaults to an empty [`IngressConfig`] (enabled with class\n`\"nginx\"`) when omitted \u2014 see [`Self::ingress`]." nullable: true properties: annotations: additionalProperties: type: string description: 'Extra annotations merged onto every Ingress object. Values here override the hardcoded nginx-specific defaults when keys collide.' type: object className: description: "Kubernetes Ingress class name. Defaults to `\"nginx\"`\n([`DEFAULT_INGRESS_CLASS_NAME`]) \u2014 resolve via [`Self::class_name`].\n\nMaps to `spec.ingressClassName` on all generated Ingress objects." nullable: true type: string enabled: description: "Whether the operator creates Ingress objects. Defaults to `true`\n([`DEFAULT_INGRESS_ENABLED`]) \u2014 resolve via [`Self::enabled`].\n\nWhen `false`, the operator skips Ingress creation entirely and\nexisting Ingress objects are pruned by orphan cleanup." nullable: true type: boolean timeouts: description: "Proxy timeouts translated to controller-specific annotations.\n\nCurrently only the `nginx` class is supported \u2014 other classes log\na warning and leave timeouts at the controller defaults." nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object tls: description: 'TLS termination entries for Ingress resources. Each entry maps directly to a Kubernetes `IngressTLS` object. All unique hosts across entries are used to create `IngressRule` entries.' items: description: IngressTLS describes the transport layer security associated with an ingress. properties: hosts: description: hosts is a list of hosts included in the TLS certificate. The values in this list must match the name/s used in the tlsSecret. Defaults to the wildcard host setting for the loadbalancer controller fulfilling this Ingress, if left unspecified. items: type: string type: array secretName: description: secretName is the name of the secret used to terminate TLS traffic on port 443. Field is left optional to allow TLS routing based on SNI hostname alone. If the SNI host in a listener conflicts with the "Host" header field used by an IngressRule, the SNI host is used for termination and value of the "Host" header is used for routing. type: string type: object type: array type: object labels: additionalProperties: type: string description: Labels applied to all cluster resources. nullable: true type: object maintenanceMode: description: "Enable maintenance mode \u2014 scales down all deployments and creates a\nmaintenance pod for manual operations. Defaults to `false`." nullable: true type: boolean netbox: description: "NetBox application deployment configuration.\n\nDefaults to an empty `NetBoxApp` whose own accessors fill in\nimage/registry/replicas/etc. \u2014 see [`Self::netbox`]." nullable: true properties: appReadyTimeout: description: 'Maximum time the operator waits for the NetBox app deployment to become ready after each reconcile. Covers database migrations run at pod startup. Accepts durations (`5m`, `300s`) or bare seconds. When omitted, defaults to 5m (300s).' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string config: description: 'NetBox application configuration (secrets, allowed hosts, storage, plugins, metrics). Accessors on the returned [`NetBoxConfig`] supply per-field defaults.' nullable: true properties: allowedHosts: description: 'Allowed hostnames for NetBox. Defaults to [`default_netbox_allowed_hosts`] (a single wildcard).' items: type: string nullable: true type: array customPythonConfig: description: 'Custom Python configuration appended after `configuration.py`. Rendered into `user_extra.py` and mounted as `zzz_80_user_extra.py`.' nullable: true type: string customPythonConfigRef: description: 'Reference to a ConfigMap key containing custom Python configuration. `customPythonConfig` takes precedence when both are set.' nullable: true properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object emailPassword: description: Email password reference. Operator auto-generates when omitted. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object metricsEnabled: description: 'Enable the Prometheus `/metrics` endpoint. Defaults to [`DEFAULT_NETBOX_METRICS_ENABLED`].' nullable: true type: boolean plugins: description: 'Custom plugins configuration for installing Python packages from a wheelhouse.' nullable: true properties: mediaWheelhousePollInterval: description: 'How often the wheelhouse-watcher sidecar polls the media-dir wheelhouse file for mtime/size changes. Accepts human-friendly strings (`5m`, `1h`) or bare seconds (`300`). Only relevant when no explicit wheelhouse source is configured and custom Python config is present.' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string wheelhouse: description: 'Wheelhouse source configuration. Specify either `s3` or `pvc` as the source for the wheelhouse tarball. Validation runs automatically via the [`TryFrom`] path.' nullable: true properties: pvc: description: PVC source configuration for the wheelhouse file. nullable: true properties: claimName: description: 'Name of the PVC containing the wheelhouse. When `create` is `true` the operator creates this PVC; otherwise it must already exist.' type: string create: description: 'Whether the operator should create + manage the PVC lifecycle. Defaults to `false` (the PVC must already exist).' nullable: true type: boolean path: description: 'Path to the wheelhouse file within the PVC. Defaults to [`DEFAULT_PVC_WHEELHOUSE_PATH`].' nullable: true type: string size: description: 'Size of the operator-created PVC. Only consulted when `create` is `true`. Defaults to [`DEFAULT_WHEELHOUSE_PVC_SIZE`].' nullable: true type: string storageClassName: description: 'Storage class for the operator-created PVC. Only consulted when `create` is `true`.' nullable: true type: string required: - claimName type: object s3: description: S3 bucket configuration for wheelhouse download. nullable: true properties: bucket: description: S3 bucket name. type: string credentialsSecret: description: Reference to Secret containing S3 credentials. properties: accessKeyId: description: 'Key within the secret for the access key id. Defaults to [`DEFAULT_PLUGIN_ACCESS_KEY_ID_KEY`].' nullable: true type: string name: description: Name of the Kubernetes Secret containing S3 credentials. type: string secretAccessKey: description: 'Key within the secret for the secret access key. Defaults to [`DEFAULT_PLUGIN_SECRET_ACCESS_KEY_KEY`].' nullable: true type: string required: - name type: object endpoint: description: S3-compatible endpoint URL. Falls back to the AWS default when unset. nullable: true type: string key: description: Object key within the bucket. Defaults to [`DEFAULT_WHEELHOUSE_KEY`]. nullable: true type: string region: description: AWS region. Defaults to [`DEFAULT_S3_REGION`]. nullable: true type: string verifySSL: description: 'Whether to verify SSL certificates. Defaults to [`DEFAULT_PLUGIN_VERIFY_SSL`].' nullable: true type: boolean required: - bucket - credentialsSecret type: object type: object type: object postgres: description: 'PostgreSQL connection configuration. Derived from `spec.postgresql` when omitted.' nullable: true properties: database: description: Database name for NetBox. Defaults to [`DEFAULT_NETBOX_DB_NAME`]. maxLength: 63 minLength: 1 nullable: true type: string password: description: Password reference. Auto-generated when omitted. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object user: description: Database username for NetBox. Defaults to [`DEFAULT_NETBOX_DB_USER`]. maxLength: 63 minLength: 1 nullable: true type: string users: description: 'Users to create in PostgreSQL (for PGO). Defaults to [`default_postgres_users`].' items: description: PostgreSQL user specification for PGO. properties: databases: description: Databases the user can access. items: maxLength: 63 minLength: 1 type: string type: array name: description: Username. maxLength: 63 minLength: 1 type: string options: description: PostgreSQL user options (e.g., "SUPERUSER"). type: string required: - databases - name - options type: object nullable: true type: array type: object redis: description: 'Redis connection configuration. Derived from `spec.redis` when omitted.' nullable: true properties: cachingDatabase: description: 'Redis DB index for the caching connection. Defaults to 1. Set to 0 for Redis Enterprise, which only supports DB index 0. No upper bound is enforced; see `tasksDatabase`.' format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer host: description: Redis hostname. type: string password: description: 'Password reference for Redis authentication. Used for both the tasks queue and cache connections.' nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object port: description: Redis port number. Defaults to [`DEFAULT_REDIS_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer tasksDatabase: description: "Redis DB index for the tasks (RQ) connection. Defaults to 0 in the\nconsuming config. Redis Enterprise only supports DB index 0. No upper\nbound is enforced \u2014 an out-of-range index fails at `SELECT` time." format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer username: description: 'Redis username for ACL authentication (Redis 6.0+). Empty string falls back to legacy auth.' nullable: true type: string required: - host type: object secretKey: description: Django secret-key reference. Auto-generated when omitted. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object storage: description: Storage configuration (S3 etc.) for NetBox media files. nullable: true properties: s3: description: S3 storage configuration. nullable: true properties: accessKeyId: description: AWS access key id reference (from a Kubernetes Secret). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object bucketName: description: S3 bucket name. nullable: true type: string enabled: description: Enable S3 storage for media files. Defaults to `false`. nullable: true type: boolean endpointUrl: description: Custom S3 endpoint URL (MinIO, Garage, or any S3-compatible service). nullable: true type: string regionName: description: AWS region name. Defaults to [`DEFAULT_S3_REGION`]. nullable: true type: string secretAccessKey: description: AWS secret access key reference (from a Kubernetes Secret). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object tlsConfig: description: 'TLS configuration referencing certificates from the cluster''s `tlsKeychain`.' nullable: true properties: insecureSkipVerify: description: "Skip TLS certificate verification. Defaults to `false`.\n\n**PostgreSQL caveat**: has no effect when CA certificates are\nconfigured via `keychainCaCertificates` \u2014 libpq still verifies the\nserver certificate whenever `PGSSLROOTCERT` is set. Drop the CA\nlist instead." nullable: true type: boolean keychainCaCertificates: description: 'Names of CA certificates from the cluster''s `tlsKeychain` to use for verifying server certificates. Each name must match an entry in `tlsKeychain.caCertificateSecrets[].name`.' items: type: string type: array keychainClientCertificate: description: 'Name of a client certificate from the cluster''s `tlsKeychain` for mutual TLS authentication.' nullable: true type: string type: object type: object type: object superuser: description: "Superuser secret references. When set, `username`, `email` and\n`password` are required and `apiToken` is optional; when `None`, the\noperator generates all credentials. Nothing reads `apiToken`'s value,\nbut naming a key its Secret does not carry stops the NetBox pod from\nstarting \u2014 see that field's own description." nullable: true properties: apiToken: description: "Secret reference for superuser API token. Optional, and nothing reads\nits value: NetBox 4.5+ tokens are peppered v2 tokens that cannot be\nplanted from a plaintext secret, so the NetBox bootstrap seeds no token\nat all (see `superuser_upsert_section` in `netbox-workload`'s\n`config::entrypoint`). It stays accepted so specs that already set it\nkeep applying, but requiring it forced operators to invent a value that\ndoes nothing and 403s if used (NBE-2219).\n\nUnread is not the same as harmless to set. Naming a key here adds it to\nthe NetBox pod's projected `secrets` volume, from a source that is not\nmarked optional. Name a key the Secret does not carry and kubelet fails\nthe whole volume \u2014\n`MountVolume.SetUp failed for volume \"secrets\" : references non-existent\nsecret key` \u2014 so the NetBox pod never starts. The operator reports that\non the resource as `SuperuserSecret=False`, with a Warning event when the\nstate is entered, but still projects what the resource declares. Point\nthis at a key that really exists, or leave it unset.\n\nThis field's own `name` is not consulted. The projected volume carries\n`password` and `apiToken` together and sources both from the Secret named\nby `password.name`, so point this key at a Secret that one holds." nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object email: description: Secret reference for superuser email. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object password: description: Secret reference for superuser password. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object username: description: Secret reference for superuser username. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object required: - email - password - username type: object type: object diodePlugin: description: 'NetBox-side deadlines for outbound calls to Diode. When `None`, the operator uses the pre-existing hardcoded plugin defaults (500ms auth, 5000ms gRPC). Re-uses [`crate::crd::v1alpha1::netbox::NetBoxDiodePluginConfig`] for the same reason as `timeouts`.' nullable: true properties: authTimeout: description: 'Timeout for Hydra token introspection calls from the NetBox plugins. Default: `500ms`.' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string grpcTimeout: description: 'Timeout for Diode gRPC calls from the NetBox plugins. Default: `5s`.' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object env: description: 'Environment variables for NetBox containers. When omitted, the accessor supplies [`default_envs`] (currently empty). Merged with `yamlEnv` by the operator.' items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object nullable: true type: array httpPort: description: 'HTTP port the NetBox container listens on. Defaults to [`DEFAULT_NETBOX_HTTP_PORT`].' format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer image: description: 'Container image specification. Defaults to a freshly-resolved [`NetBoxImage`] when the user omits the field; per-field accessors on the returned image fill in registry/repository/tag.' nullable: true properties: digest: description: 'Optional image digest for pinning to a specific build, independent of `tag`. When set, the operator emits `repository@digest` instead of `repository:tag`.' nullable: true type: string imagePullSecrets: description: 'Pull secrets for private registries. When set, merged with the cluster-level `spec.imagePullSecrets`.' items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: description: "Container image pull policy.\n\nVariant names are PascalCase to match Kubernetes API conventions exactly.\nDo not add `#[serde(rename_all)]` \u2014 the Rust names must serialize verbatim.\n\nSee: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy" enum: - IfNotPresent - Always - Never nullable: true type: string registry: description: 'Container registry hostname. Defaults to [`DEFAULT_NETBOX_REGISTRY`].' nullable: true type: string repository: description: 'Repository path within the registry. Defaults to [`DEFAULT_NETBOX_REPOSITORY`].' nullable: true type: string tag: description: Image tag (e.g. `v4.4.10`). Defaults to [`DEFAULT_NETBOX_TAG`]. nullable: true type: string type: object limits: description: 'Resource **limits** for NetBox pods. Defaults to [`default_netbox_limits`].' nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object mediaStorageSize: description: 'Media storage PVC size. Defaults to [`DEFAULT_NETBOX_MEDIA_STORAGE_SIZE`].' nullable: true type: string migrationStatementTimeout: description: 'Per-statement timeout for index reconciliation. Defaults to [`default_netbox_migration_statement_timeout`] (15m).' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string migrationTimeout: description: 'Maximum time for the migration Job to run before Kubernetes terminates it. Defaults to [`default_netbox_migration_timeout`] (1h).' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string replicas: description: 'Number of NetBox web application replicas. Defaults to [`DEFAULT_NETBOX_REPLICAS`].' format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: 'Resource **requests** for NetBox pods. Defaults to [`default_netbox_resources`].' nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object scriptsStorageSize: description: 'Scripts storage PVC size. Defaults to [`DEFAULT_NETBOX_SCRIPTS_STORAGE_SIZE`]. Holds custom user scripts.' nullable: true type: string statusPort: description: 'Deprecated: no longer used. Retained for CRD parity with v1alpha1. Previously configured the nginx unit status port; ignored since the switch to granian in nbe-core 4.5.x.' format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer storageAccessMode: description: "Access mode for the media and scripts PVCs. Defaults to\n`ReadWriteOnce` (single-node). Use `ReadWriteMany` with an\nRWX-capable `storageClassName` to spread `replicas > 1` across\nnodes \u2014 or move media to S3 entirely via `config.storage`." enum: - ReadWriteOnce - ReadOnlyMany - ReadWriteMany - ReadWriteOncePod - null nullable: true type: string storageClassName: description: 'Storage class for the media and scripts PVCs. When omitted, the cluster''s default StorageClass is used.' nullable: true type: string timeouts: description: 'Per-service timeout overrides for the NetBox Ingress and HTTPRoute. Field-level merges over the cluster-wide `spec.ingress.timeouts` / `spec.gateway.timeouts`. When `None`, the cluster-wide defaults apply unchanged. Re-uses [`crate::crd::v1alpha1::timeouts::AppTimeouts`] since the v1alpha1 type is already sparse-shaped (all `Option`, no `#[serde(default = "fn")]`).' nullable: true properties: gateway: description: Gateway API HTTPRoute rule timeout overrides. nullable: true properties: backendRequest: description: 'BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended' nullable: true type: string request: description: 'Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended' nullable: true type: string type: object ingress: description: Ingress-level timeout overrides (nginx annotation translation). nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object topologySpreadConstraints: description: 'Topology spread constraints for NetBox web pods. When configured, controls how pods are distributed across topology domains (nodes, zones). Useful for HA deployments with multiple replicas.' items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array urls: description: "External URLs at which the NetBox service is reachable.\n\nEach entry's host portion drives an `IngressRule.host` on the\nNetBox Ingress, producing one rule per URL. The scheme, port, and\npath are ignored \u2014 only the hostname is used. Unparseable entries\nare skipped with a warning; when no entries parse, the Ingress\nfalls back to a single wildcard rule.\n\nTLS termination is configured independently via `spec.ingress.tls`." items: type: string nullable: true type: array worker: description: Background worker configuration. nullable: true properties: affinity: description: "Pod affinity for worker pods.\n\nWhen omitted, the operator emits a required `kubernetes.io/hostname`\npod affinity binding each worker to a NetBox pod (so the worker can\nmount the same single-node media and scripts PVCs) only when both:\n\n- `spec.netbox.storageAccessMode` is unset, `ReadWriteOnce`, or\n `ReadWriteOncePod`; and\n- `spec.netbox.replicas == 1`.\n\nProvide an explicit `Affinity` to override; the operator injects\nNetBox's selector labels into any `podAffinity` / `podAntiAffinity`\nterm whose `labelSelector` is empty. To disable all affinity supply\nan explicit empty object `affinity: {}`." nullable: true properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. properties: preferredDuringSchedulingIgnoredDuringExecution: description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. items: description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). properties: preference: description: A node selector term, associated with the corresponding weight. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchFields: description: A list of node selector requirements by node's fields. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array type: object weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. format: int32 type: integer required: - preference - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. items: description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchFields: description: A list of node selector requirements by node's fields. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array type: object type: array required: - nodeSelectorTerms type: object type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer required: - podAffinityTerm - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. items: description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object type: array type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer required: - podAffinityTerm - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. items: description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object type: array type: object type: object env: description: 'Environment variables for worker containers. When omitted, the accessor supplies [`default_envs`] (currently empty). Merged with `yamlEnv` by the operator.' items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object nullable: true type: array limits: description: 'Resource **limits** for worker pods. Defaults to [`default_netbox_worker_limits`].' nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object replicas: description: 'Number of worker replicas. Defaults to [`DEFAULT_NETBOX_WORKER_REPLICAS`].' format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: 'Resource **requests** for worker pods. Defaults to [`default_netbox_worker_resources`].' nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object topologySpreadConstraints: description: 'Topology spread constraints for worker pods. When configured, controls how pods are distributed across topology domains.' items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array yamlEnv: description: 'YAML string containing environment variables as key-value pairs. Example: `"FOO: bar\nBAZ: qux"`.' nullable: true type: string type: object yamlEnv: description: 'YAML string containing environment variables as key-value pairs. Converted to `EnvVar` array format by the operator. Example: `"FOO: bar\nBAZ: qux"`.' nullable: true type: string type: object plugins: description: "Cross-service plugin enablement (`spec.plugins`). Holds NDX (NetBox Data\nExchange) and Asset Lifecycle \u2014 see [`Self::plugins`]." nullable: true properties: assetLifecycle: description: 'Asset Lifecycle plugin (`netbox_asset_lifecycle`, Premium tier, off by default). See [`Self::asset_lifecycle`].' nullable: true properties: enabled: description: 'Enable or disable Asset Lifecycle (the `netbox_asset_lifecycle` plugin). Defaults to [`DEFAULT_ASSET_LIFECYCLE_ENABLED`] (off). Requires a Premium-tier license to take effect. Disabling drops the plugin from the rendered plugin config. Existing Asset Lifecycle tables are retained (not dropped).' nullable: true type: boolean type: object ndx: description: NDX (NetBox Data Exchange) plugin (paid-only). See [`Self::ndx`]. nullable: true properties: enabled: description: "Enable or disable the NDX plugin (the user lever). Defaults to\n[`DEFAULT_NDX_ENABLED`] (on). Effective only when the license carries a\npaid NDX token entitlement \u2014 the operator gates on the token." nullable: true type: boolean type: object type: object postgresql: description: "PostgreSQL deployment configuration (operator-managed PGO or\nexternal). Defaults to an empty `PostgreSQL` whose accessors\nresolve to operator-managed defaults \u2014 see [`Self::postgresql`]." nullable: true properties: backups: description: "pgBackRest backup configuration. Ignored when `external` is true \u2014\nan external DB's backups are the customer's to run." nullable: true properties: enabled: description: "Whether pgBackRest is enabled. Defaults to\n[`DEFAULT_POSTGRES_BACKUPS_ENABLED`].\n\nSetting this to `false` leaves the database backed up by **nothing**. It removes\nthe pgBackRest repository, and `PGDATA` stays excluded from Velero's filesystem\nbackup \u2014 deliberately, because a file-by-file copy of a live data directory is a\ntorn copy, and one that looks restorable is worse than none. So this is opting\nout of Postgres disaster recovery, not selecting a different mechanism.\n\nNote also that disabling it on a running cluster does not remove the repository\nhost: PGO leaves the StatefulSet (and its PVC) in place, so this is not a clean\nrevert." nullable: true type: boolean fullSchedule: description: 'Cron schedule for full backups. Defaults to [`DEFAULT_POSTGRES_BACKUPS_FULL_SCHEDULE`]. An empty string disables scheduled full backups.' nullable: true type: string incrementalSchedule: description: 'Cron schedule for incremental backups. Defaults to [`DEFAULT_POSTGRES_BACKUPS_INCREMENTAL_SCHEDULE`]. An empty string disables scheduled incremental backups.' nullable: true type: string repoStorageClassName: description: 'Storage class for the pgBackRest repo PVC. Falls back to the PostgreSQL data storage class, then the cluster default.' nullable: true type: string repoStorageSize: description: 'Storage size for the pgBackRest repo PVC. Defaults to [`DEFAULT_POSTGRES_BACKUPS_REPO_STORAGE_SIZE`].' nullable: true type: string retentionFull: description: "Number of full backups to retain. Defaults to\n[`DEFAULT_POSTGRES_BACKUPS_RETENTION_FULL`].\n\nMinimum 1. pgBackRest's `repo1-retention-full` accepts 1..=9999999, so `0`\nrenders a config the repo host rejects at parse time \u2014 which surfaces as a\nrepo host that cannot configure itself and therefore no backups at all, with\nnothing in the CR status naming the field at fault. The schema bound makes the\nAPI server reject it at admission instead." format: uint8 maximum: 255.0 minimum: 1.0 nullable: true type: integer type: object external: description: 'Whether PostgreSQL is externally managed. Defaults to [`DEFAULT_POSTGRES_EXTERNAL`].' nullable: true type: boolean instances: description: 'Number of PostgreSQL instances. `0` triggers auto-scaling to `min(node_count, 3)`. Defaults to [`DEFAULT_POSTGRES_INSTANCES`].' format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer limits: description: Resource limits for PostgreSQL pods. `None` leaves them unset. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object postgresqlProfile: description: 'Name of a profile from `spec.postgresql_profiles`. When set, the connection inherits TLS configuration, host, and port from the named profile.' nullable: true type: string registry: description: 'Container registry override for PostgreSQL images. Defaults to [`DEFAULT_POSTGRES_REGISTRY`].' nullable: true type: string resources: description: Resource requests for PostgreSQL pods. `None` leaves them unset. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object storageClassName: description: 'Storage class name for PostgreSQL PVCs. Inherits the cluster default when unset.' nullable: true type: string storageSize: description: 'Storage size for PostgreSQL PVCs. Defaults to [`DEFAULT_POSTGRES_STORAGE_SIZE`].' nullable: true type: string version: description: PostgreSQL major version. Defaults to [`DEFAULT_POSTGRES_VERSION`]. nullable: true type: string type: object postgresqlProfiles: additionalProperties: description: "v1alpha2 sparse replacement for\n[`crate::crd::v1alpha1::postgresql_config::PostgreSQLProfile`].\n\nAll fields are optional \u2014 a profile may specify only TLS settings,\nonly connection details, or both. Components resolve each field\nindependently: inline config takes priority, then the profile, then\ndefaults." properties: host: description: PostgreSQL hostname. nullable: true type: string port: description: PostgreSQL port number. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer tlsConfig: description: TLS configuration for the PostgreSQL connection. nullable: true properties: insecureSkipVerify: description: "Skip TLS certificate verification. Defaults to `false`.\n\n**PostgreSQL caveat**: has no effect when CA certificates are\nconfigured via `keychainCaCertificates` \u2014 libpq still verifies the\nserver certificate whenever `PGSSLROOTCERT` is set. Drop the CA\nlist instead." nullable: true type: boolean keychainCaCertificates: description: 'Names of CA certificates from the cluster''s `tlsKeychain` to use for verifying server certificates. Each name must match an entry in `tlsKeychain.caCertificateSecrets[].name`.' items: type: string type: array keychainClientCertificate: description: 'Name of a client certificate from the cluster''s `tlsKeychain` for mutual TLS authentication.' nullable: true type: string sslmode: description: 'PostgreSQL SSL connection mode. Controls how SSL/TLS is used when connecting to PostgreSQL. These modes match the libpq `sslmode` parameter values. # Modes | Mode | Description | |------|-------------| | `disable` | No SSL - unencrypted connection | | `allow` | Try non-SSL first, use SSL if server requires it | | `prefer` | Try SSL first, fall back to non-SSL (default for external) | | `require` | Require SSL, but don''t verify the server certificate | | `verify-ca` | Require SSL and verify the server certificate is signed by a trusted CA | | `verify-full` | Require SSL, verify CA, and verify the server hostname matches the certificate | # Security Recommendations - For production external databases, use `verify-full` with proper CA certificates - Operator-managed PostgreSQL (PGO) always uses `require` internally - `disable` and `allow` should only be used in development environments' enum: - disable - allow - prefer - require - verify-ca - verify-full nullable: true type: string type: object username: description: PostgreSQL username. nullable: true type: string type: object description: 'Named PostgreSQL connection profiles. Each profile bundles host/port/username and TLS settings under a single name so multiple components can reference it instead of duplicating inline config.' type: object proxy: description: "Egress proxy settings (NBE-1501). When set, the operator injects\nHTTP_PROXY/HTTPS_PROXY/NO_PROXY into every workload it creates. Absence\nmeans no proxy \u2014 see [`Self::proxy`]." nullable: true properties: httpProxy: description: HTTP proxy URL (e.g. `http://proxy.corp:3128`). nullable: true type: string httpsProxy: description: "HTTPS proxy URL \u2014 used for license/S3/external HTTPS egress." nullable: true type: string noProxy: description: 'Comma-separated extra `NO_PROXY` entries, appended to the cluster-internal defaults the operator always includes.' nullable: true type: string type: object reconcileInterval: description: 'How often the operator re-checks external state even when no Kubernetes events are received. Covers changes that don''t produce watch events: PGO secret rotations, wheelhouse uploads, etc. Accepts Kubernetes-style duration strings (`5m`, `1h`) or bare seconds (`300`). When omitted, falls back to the `--reconcile-interval-secs` CLI flag. Useful for debugging: lower values surface external-state convergence issues faster without redeploying the operator.' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string redis: description: "Redis deployment configuration (operator-managed via OT-CONTAINER-KIT\nor external). Defaults to an empty `Redis` whose accessors resolve\nto operator-managed defaults \u2014 see [`Self::redis`]." nullable: true properties: additionalConfig: description: 'Raw Redis directives appended to the server config. Only applies to operator-managed Redis.' nullable: true type: string aofEnabled: description: 'Whether to enable AOF (Append-Only File) persistence. `None` leaves the Redis server default unchanged. Only applies to operator-managed Redis.' nullable: true type: boolean clusterSize: description: 'Number of Redis replicas. `0` triggers auto-scaling to `min(node_count, 3)`. Sentinel is deployed when the effective size exceeds 1. Defaults to [`DEFAULT_REDIS_CLUSTER_SIZE`].' format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer dynamicConfig: description: 'Runtime Redis `CONFIG SET` directives applied without a restart. Only applies to operator-managed Redis.' items: type: string nullable: true type: array external: description: 'Whether Redis is externally managed. Defaults to [`DEFAULT_REDIS_EXTERNAL`].' nullable: true type: boolean limits: description: Resource limits for Redis pods. `None` leaves them unset. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object maxMemoryPercent: description: "Cap Redis memory at N% of the container memory limit (0\u2013100).\nOnly applies to operator-managed Redis (`external: false`)." format: uint8 maximum: 100.0 minimum: 0.0 nullable: true type: integer maxMemoryPolicy: description: 'Redis key eviction policy applied when `maxmemory` is reached. Maps directly to Redis''s `maxmemory-policy` configuration directive. Combined with `maxMemoryPercent` to control OOM behavior: set `maxMemoryPercent` to cap memory usage, then choose an eviction policy that matches your workload (LRU for general caches, `noeviction` to reject writes instead of evicting data). See for details.' enum: - noeviction - allkeys-lru - volatile-lru - allkeys-random - volatile-random - volatile-ttl - allkeys-lfu - volatile-lfu nullable: true type: string name: description: Redis instance name. Defaults to [`DEFAULT_REDIS_NAME`]. nullable: true type: string persistence: description: 'Whether to enable persistence for Redis data. Defaults to [`DEFAULT_REDIS_PERSISTENCE`].' nullable: true type: boolean requireAuth: description: 'Whether authentication is required for Redis connections. Defaults to [`DEFAULT_REDIS_REQUIRE_AUTH`].' nullable: true type: boolean resources: description: Resource requests for Redis pods. `None` leaves them unset. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object sentinelMasterName: description: 'Sentinel master group name. Required when `sentinels` is set. Ignored for operator-managed Redis.' nullable: true type: string sentinels: description: 'Sentinel endpoints for external Redis HA. Ignored for operator-managed Redis (the operator auto-configures Sentinel based on `cluster_size`).' items: description: 'v1alpha2 sparse replacement for [`crate::crd::v1alpha1::redis_config::SentinelEndpoint`]. `host` stays required (no sensible default); `port` defaults to [`DEFAULT_REDIS_SENTINEL_PORT`].' properties: host: description: Sentinel hostname. type: string port: description: Sentinel port number. Defaults to [`DEFAULT_REDIS_SENTINEL_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer required: - host type: object nullable: true type: array storageClassName: description: 'Storage class name for Redis PVCs. Inherits the cluster default when unset. Only used when `persistence: true`.' nullable: true type: string storageSize: description: 'Storage size for the Redis PVC. Only used when `persistence: true`. Defaults to [`DEFAULT_REDIS_STORAGE_SIZE`].' nullable: true type: string tlsConfig: description: 'TLS configuration for external Redis connections. The presence of this section enables TLS. Only used when `external: true`.' nullable: true properties: insecureSkipVerify: description: "Skip TLS certificate verification. Defaults to `false`.\n\n**PostgreSQL caveat**: has no effect when CA certificates are\nconfigured via `keychainCaCertificates` \u2014 libpq still verifies the\nserver certificate whenever `PGSSLROOTCERT` is set. Drop the CA\nlist instead." nullable: true type: boolean keychainCaCertificates: description: 'Names of CA certificates from the cluster''s `tlsKeychain` to use for verifying server certificates. Each name must match an entry in `tlsKeychain.caCertificateSecrets[].name`.' items: type: string type: array keychainClientCertificate: description: 'Name of a client certificate from the cluster''s `tlsKeychain` for mutual TLS authentication.' nullable: true type: string type: object type: object registry: description: 'Container registry host override for all images. When set, replaces the registry portion of every container image. Use with `registryNamespace` for flat-namespace registries (e.g., Replicated local registry in airgap installs).' nullable: true type: string registryNamespace: description: 'Registry namespace for flat-namespace registries. When set alongside `registry`, all repository paths are flattened to `{namespace}/{basename}`. For example, `docker.io/oryd/hydra:v2.3.0` becomes `{registry}/{namespace}/hydra:v2.3.0`. When only `registry` is set (no namespace), the full original repository path is preserved.' nullable: true type: string replicatedApp: description: 'Replicated-specific tuning knobs (SDK, license fallback, etc.). Only applies when NBE is installed via the Replicated channel. Defaults are appropriate for typical installs; the fields here exist for debugging and airgap-specific tuning.' nullable: true properties: licenseFallback: description: 'License-fallback retry tuning. When the Replicated SDK is unreachable at operator startup, the license fetcher returns a default-Community license. Rather than immediately proceeding as Community (which skips enterprise image-rewrite mutations and causes private GHCR pulls to 401), the operator issues fresh SDK fetches on subsequent reconciles for a bounded budget. These knobs tune that budget.' nullable: true properties: retryInterval: description: 'Delay between retry attempts. Accepts Kubernetes-style durations (`5s`) or bare seconds (`5`). Defaults via [`default_license_fallback_retry_interval`].' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string totalTimeout: description: 'Total time budget for the retry loop. Once exhausted, reconcile proceeds with the default-Community license. Accepts Kubernetes-style durations (`30s`, `1m`) or bare seconds (`30`). Defaults via [`default_license_fallback_total_timeout`].' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object replication: description: 'Cluster-wide replication and HA configuration. Top-level `topologySpreadConstraints` here apply to every operator-managed deployment unless overridden at the component level.' nullable: true properties: topologySpreadConstraints: description: "Default `topologySpreadConstraints` applied to every operator-managed\ndeployment's pod spec. Per-component\n`topologySpreadConstraints` fields override this default for their\ncomponent.\n\nThe operator injects each deployment's own selector labels into every\nconstraint's `labelSelector` so spread is scoped to that deployment's\npods \u2014 leave `labelSelector` empty (`{}`) unless you need extra\nfiltering." items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object routing: description: "North/south routing selector (`auto`/`gateway`/`ingress`). Defaults to\n`auto` \u2014 see [`Self::routing`]." nullable: true properties: mode: description: "User-facing selector for the operator's north/south routing path.\n\n`Auto` resolves to Gateway only when `spec.gateway` is enabled *and* the\noperator can list Gateway API resources (the CRDs are installed and the\noperator's ServiceAccount has RBAC for them), falling back to Ingress\notherwise; `Gateway`/`Ingress` pin a path explicitly. This is the master\nswitch \u2014 the per-config `enabled` flags (`spec.gateway.enabled`,\n`spec.ingress.enabled`) still apply, so a pinned mode with its path\ndisabled emits nothing (the operator logs a warning + event in that case)." enum: - auto - gateway - ingress nullable: true type: string type: object secretChecksumDebounce: description: 'How long the external secret checksum must be stable before being embedded in pod template annotations (which triggers a rolling restart). PGO rewrites secrets during initial cluster setup, so `resourceVersion` increments on every housekeeping write. The debounce window prevents those transient changes from causing unnecessary rolling restarts. Accepts Kubernetes-style duration strings (`30s`, `1m`) or bare seconds. Defaults via [`default_secret_checksum_debounce`].' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string storageBackend: description: 'Where NetBox media/scripts storage lives (NBE-1691). Shared by both CRD versions; values serialize to the kebab-case strings `pvc`, `external`, and `in-cluster`, shared by the CRD field `storageBackend` and the KOTS `storage_backend` config select.' enum: - pvc - external - in-cluster nullable: true type: string suspend: description: 'Suspend reconciliation/annealing of resources while debugging. When `true`, the operator skips applying downstream resources and waits for the field to be cleared. Defaults to `false`.' nullable: true type: boolean tlsKeychain: description: "Cluster-wide TLS keychain \u2014 CA and client certificate references\nthat per-service `tlsConfig` blocks can name." nullable: true properties: caCertificateSecrets: description: 'CA certificate secrets to trust for TLS connections. These certificates will be added to the trust store for validating server certificates when connecting to external services.' items: description: "v1alpha2 sparse replacement for\n[`crate::crd::v1alpha1::tls::CaCertificateSecret`].\n\nReference to a Kubernetes secret containing a CA certificate, used for\nconfiguring trusted CA certificates for TLS verification. The secret\nshould contain the CA certificate in PEM format. `key` defaults to\n`\"ca.crt\"` ([`DEFAULT_CA_CERT_KEY`]) \u2014 resolve via [`Self::key`]." properties: key: description: "Key within the secret that contains the CA certificate data.\nDefaults to [`DEFAULT_CA_CERT_KEY`] \u2014 resolve via [`Self::key`]." nullable: true type: string name: description: 'Logical name for this CA certificate entry. If `secret` is not specified, this name is also used as the Kubernetes secret name.' type: string secret: description: 'Name of the Kubernetes secret containing the CA certificate. If not specified, [`Self::secret_name`] falls back to `name`.' nullable: true type: string required: - name type: object type: array clientCertificateSecrets: description: 'Client certificate secrets for mutual TLS (mTLS) authentication. These certificates can be used to authenticate the client when connecting to services that require client certificate authentication.' items: description: "v1alpha2 sparse replacement for\n[`crate::crd::v1alpha1::tls::ClientCertificateSecret`].\n\nReference to a Kubernetes secret containing a client certificate and\nprivate key. The secret should be of type `kubernetes.io/tls` or\ncontain equivalent keys. `cert_key` defaults to `\"tls.crt\"` and\n`private_key` to `\"tls.key\"` \u2014 both resolve via per-field accessors." properties: certKey: description: "Key within the secret that contains the client certificate data.\nDefaults to [`DEFAULT_CLIENT_CERT_KEY`] \u2014 resolve via\n[`Self::cert_key`]." nullable: true type: string name: description: 'Logical name for this client certificate entry. If `secret` is not specified, this name is also used as the Kubernetes secret name.' type: string privateKey: description: "Key within the secret that contains the private key data.\nDefaults to [`DEFAULT_PRIVATE_KEY`] \u2014 resolve via\n[`Self::private_key`]." nullable: true type: string secret: description: 'Name of the Kubernetes secret containing the client certificate. If not specified, [`Self::secret_name`] falls back to `name`.' nullable: true type: string required: - name type: object type: array type: object turbobulk: description: "TurboBulk bulk data API plugin (Premium tier). The lever defaults on\nbut only activates on a Premium-tier license \u2014 see [`Self::turbobulk`]." nullable: true properties: enableWrites: description: 'Enable TurboBulk write APIs (bulk load / delete). Defaults to [`DEFAULT_TURBOBULK_ENABLE_WRITES`] (off).' nullable: true type: boolean enabled: description: "Enable or disable the TurboBulk plugin (the user lever). Defaults to\n[`DEFAULT_TURBOBULK_ENABLED`] (on). Effective only on Premium-tier\nlicenses \u2014 the operator gates on tier." nullable: true type: boolean type: object type: object status: description: Status of the NetBoxEnterprise custom resource. nullable: true properties: components: default: copilot: ready: false diode: ready: false netbox: ready: false postgresql: ready: false redis: ready: false worker: ready: false description: Detailed status for each component. properties: copilot: default: ready: false description: Copilot backend component status (if enabled). properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object diode: default: ready: false description: Diode application component status (if enabled). properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object netbox: default: ready: false description: NetBox web application component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object postgresql: default: ready: false description: PostgreSQL database component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object redis: default: ready: false description: Redis cache/queue component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object worker: default: ready: false description: NetBox worker component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object type: object conditions: description: Kubernetes standard conditions array. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array convergedGeneration: description: 'Highest CR generation that has reached all-components-ready. When this equals `metadata.generation`, the current config rollout has converged and the progress sentinel reports Ready. (NBE-1255)' format: int64 nullable: true type: integer dependencyWaitStartedAt: description: 'RFC3339 timestamp of when the operator first observed a dependency-wait timeout for the current generation. Used to measure how long a wait has persisted so a brief wait (`WaitingForDependencies`) can be distinguished from a hanging one (`DependencyWaitStalled`) without ever asserting failure. Cleared on the first successful reconcile. (NBE-1401)' nullable: true type: string lastReconcileTime: description: Timestamp of the last successful reconciliation (RFC3339 format). nullable: true type: string license: default: edition: Community isAssuranceEntitled: false isCopilotEntitled: false tier: Community description: License associated with the deployment properties: channelName: description: Channel name (e.g., stable, beta, dev) nullable: true type: string customerEmail: description: Customer email from license nullable: true type: string customerName: description: Customer name from license nullable: true type: string edition: default: Community description: NetBox edition (Community or Enterprise) enum: - Community - Enterprise type: string entitlements: additionalProperties: properties: title: description: Entitlement title type: string value: description: Entitlement value (can be any JSON type) x-kubernetes-preserve-unknown-fields: true type: object description: Raw entitlements for additional checks type: object expiresAt: description: Expiration date (ISO 8601 format) nullable: true type: string isAssuranceEntitled: default: false description: Whether NetBox Assurance is entitled type: boolean isCopilotEntitled: default: false description: Whether Copilot is entitled type: boolean isNdxEntitled: default: false description: Whether the NDX plugin is entitled (paid NDX token present) type: boolean isVisualExplorerEntitled: default: false description: Whether Visual Explorer (the first UI Platform app) is entitled type: boolean licenseId: description: Unique license identifier nullable: true type: string licenseType: description: License type (dev, trial, prod, paid) nullable: true type: string platformOrgId: description: Platform organization ID nullable: true type: string tier: default: Community description: NetBox tier from license entitlement enum: - Community - Starter - Professional - Premium type: string type: object licenseStatus: description: 'Computed license display string for the `kubectl get` LICENSE printer column. Shows the license type ("Dev", "Trial", "Paid") when the license is healthy, or the condition reason ("LicenseMismatch", "LicenseExpired", "LicenseUnavailable") when it is not. `None` until the first reconcile completes.' nullable: true type: string message: description: Human-readable message about the current state. nullable: true type: string migrationHash: description: 'SHA-256 hash of migration-relevant inputs (image tag, wheelhouse, plugin config). When this changes, the operator runs a migration Job before updating NetBox Deployments.' nullable: true type: string migrationPhase1Hash: description: 'SHA-256 hash of Phase 1 migration inputs (image + core config, no plugins). When this hash matches, Phase 1 (core migrations) is considered complete and the operator proceeds directly to Phase 2. (NBE-902)' nullable: true type: string observedGeneration: description: Generation observed by the controller during last reconciliation. format: int64 nullable: true type: integer phase: description: "Coarse startup phase the operator reports on `status.phase` so install\nprogress is visible from `kubectl`, the e2e serving gate, and the KOTS UI\ninstead of an opaque multi-minute 503 (NBE-1529).\n\nVariants are ordered along the install timeline. The operator observes\n`WaitingForDependencies`, `Migrating`, `Serving`, and `Degraded` directly\n(dependency-wait timer, migration Job status, component readiness, existing\nconditions). The in-pod phases \u2014 `InstallingPlugins`, `CollectingStatic`,\n`Booting` \u2014 happen inside the NetBox entrypoint and are reported back via\nthe `nbe_startup` table the operator reads.\n\nSerializes to its PascalCase variant name (k8s phase convention), which is\nserde's default for fieldless variants \u2014 so the serde wire form and the\n`strum::Display` form match without explicit renames." enum: - WaitingForDependencies - Migrating - InstallingPlugins - CollectingStatic - Booting - Serving - Degraded nullable: true type: string ready: default: false description: Overall cluster readiness indicator. type: boolean secretChecksum: description: 'Aggregate hash of all external secret `resourceVersion` values. Used by the debounce logic to detect when PGO secrets have stabilized.' nullable: true type: string secretChecksumObservedAt: description: 'RFC 3339 timestamp recording when `secret_checksum` was first observed to change. The operator only embeds external-secret checksums in pod template annotations once this timestamp is older than the debounce window, preventing deployment thrashing during PGO''s initial secret setup phase.' nullable: true type: string version: default: '' description: Netbox Labs Operator Version type: string wheelhouseFingerprint: description: "Last-seen wheelhouse content fingerprint from the wheelhouse-watcher\nsidecar (`_` or `absent`). Persisted in status so the\nmigration hash is a pure function of stored state (never cleared on a\nfailed live read \u2014 fail-safe). (NBE-1320)" nullable: true type: string type: object required: - spec title: NetBoxEnterprise type: object served: true storage: true subresources: status: {} - additionalPrinterColumns: - description: Whether the cluster is ready jsonPath: .status.ready name: Ready type: boolean - description: License tier jsonPath: .status.license.tier name: Tier type: string - description: License type when healthy, or the reason when not (LicenseMismatch/LicenseExpired/LicenseUnavailable) jsonPath: .status.licenseStatus name: License type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: Custom resource representing a NetBox Labs Cluster properties: spec: description: NetBoxEnterprise custom resource for declarative NetBox deployments. properties: annotations: additionalProperties: type: string description: Annotations applied to all cluster resources. nullable: true type: object backups: default: false description: 'Enable Velero backups for this cluster. Requires Velero to be installed in the cluster.' type: boolean changes: default: enabled: true description: 'Change Management plugin (`netbox_changes`). Enabled by default; unchecking `enabled` drops `netbox_changes` from the rendered plugin config. Only takes effect on an enterprise license.' properties: enabled: default: true description: "Enable or disable Change Management (the `netbox_changes` plugin), which\nrecords and manages staged changes to NetBox objects. Defaults to `true`.\nRequires an enterprise license to take effect \u2014 Change Management is not\ndeployed on an unlicensed install regardless of this setting.\n\nDisabling also turns off Change Management's branch governance:\nprotecting `main` from direct edits and requiring approval before a branch\nis merged. Existing change requests and history are retained (the plugin's\ntables are not dropped), and re-enabling restores access to them." type: boolean type: object clusterDnsSuffix: description: 'Kubernetes cluster DNS suffix. Most clusters use the default `cluster.local`, but some environments configure a different suffix. All operator-generated FQDNs will use this value.' nullable: true type: string copilot: default: awsRegion: us-east-2 databaseUser: copilot enabled: false limits: cpu: 1000 memory: 1024 llmApiKeySecret: copilot-llm-api-key llmApiKeySecretKey: apiKey llmMaxSteps: 20 llmModel: anthropic/claude-sonnet-4-6 llmProvider: anthropic netboxAuthApiTimeout: 5 netboxAuthCacheTtl: 60 netboxAuthCookieName: sessionid redisDb: 2 replicas: 1 resources: cpu: 100 memory: 256 description: "Copilot AI assistant backend service.\n\nWhen enabled, deploys the Copilot backend and activates the `netbox_copilot`\nplugin in NetBox. Disabled by default \u2014 requires a Kubernetes secret\ncontaining a valid LLM API key to be created before enabling." properties: awsCredentialsSecret: description: 'Optional name of a Kubernetes Secret containing explicit AWS credentials for Bedrock. Only used when `llmProvider` is `bedrock`. The secret must contain two keys: `aws_access_key_id` and `aws_secret_access_key`. When omitted, the Copilot backend uses ambient credential resolution (IRSA, instance profile, etc.). When using the KOTS admin console, this secret is provisioned automatically from the AWS Access Key ID and Secret Access Key fields.' nullable: true type: string awsRegion: default: us-east-2 description: 'AWS region for Amazon Bedrock (e.g. `us-east-2`). Only used when `llmProvider` is `bedrock`. Sets the `AWS_DEFAULT_REGION` environment variable in the Copilot backend container.' type: string databaseUser: default: copilot description: PostgreSQL user for Copilot's database. maxLength: 63 minLength: 1 type: string enabled: default: false description: 'Enable or disable the Copilot backend service. When enabled, the Copilot backend is deployed and the `netbox_copilot` NetBox plugin is activated. Requires a valid LLM API key secret.' type: boolean image: description: 'Container image configuration. When not specified, uses the operator''s built-in defaults.' nullable: true properties: digest: description: Optional image digest for immutable image references. nullable: true type: string pullPolicy: default: IfNotPresent description: Image pull policy (Always, IfNotPresent, Never). enum: - IfNotPresent - Always - Never type: string registry: default: nbe-ecr description: Container registry host or Replicated registry alias. type: string repository: default: nbl_copilot description: Image repository path. type: string tag: default: v1.31.2 description: Image tag. type: string type: object limits: default: cpu: 1000 memory: 1024 description: Resource limits for the Copilot backend container. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object llmApiKeySecret: default: copilot-llm-api-key description: 'Name of the Kubernetes Secret containing the LLM API key. The secret must exist in the same namespace as the NetBoxEnterprise resource. For Anthropic, the secret should contain the API key under `llmApiKeySecretKey`.' type: string llmApiKeySecretKey: default: apiKey description: Key within `llmApiKeySecret` that holds the LLM API key value. type: string llmMaxSteps: default: 20 description: Maximum number of LLM reasoning steps per conversation turn. format: uint8 maximum: 255.0 minimum: 0.0 type: integer llmModel: default: anthropic/claude-sonnet-4-6 description: LLM model identifier (provider-prefixed format, e.g. `anthropic/claude-sonnet-4-6`). type: string llmProvider: default: anthropic description: LLM provider to use. enum: - anthropic - bedrock type: string netboxAuthApiTimeout: default: 5 description: Timeout in seconds for NetBox auth API calls. format: uint8 maximum: 255.0 minimum: 0.0 type: integer netboxAuthCacheTtl: default: 60 description: TTL in seconds for caching NetBox auth session validation results. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer netboxAuthCookieName: default: sessionid description: NetBox session cookie name used for authentication. type: string postgres: description: 'External PostgreSQL connection configuration. When specified, Copilot connects to this external database instead of the PGO-managed PostgreSQL cluster. The secret must contain the password. If not specified, uses the PGO-generated secret `{cluster-name}-postgres-pguser-copilot`.' nullable: true properties: databaseUrl: description: 'Secret key containing the full `DATABASE_URL` URI (e.g. `postgresql://user:pass@host:5432/db?sslmode=require`). When using the KOTS admin console, this secret is provisioned automatically from the Copilot database fields.' properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object keychainCaCertificates: description: 'Names of CA certificate secrets in the TLS keychain for verifying the Copilot PostgreSQL server certificate. Required when `sslMode` is `verify-ca` or `verify-full`. The named secrets must be registered in `spec.tlsKeychain.caCertificateSecrets`. Certificates are projected into the Copilot pod and pointed at with `PGSSLROOTCERT`, so libpq verifies against exactly these CAs rather than the whole system trust store.' items: type: string type: array keychainClientCertificate: description: 'Name of a client certificate secret in the TLS keychain, for a PostgreSQL server whose `pg_hba.conf` demands mutual TLS (`clientcert=verify-ca`/`verify-full`). The name must match an entry in `spec.tlsKeychain.clientCertificateSecrets`. The certificate and its key are projected into the Copilot pod and pointed at with `PGSSLCERT`/`PGSSLKEY`. The key must be PKCS#8 PEM (`-----BEGIN PRIVATE KEY-----`).' nullable: true type: string sslMode: description: 'PostgreSQL SSL connection mode. Controls how SSL/TLS is used when connecting to PostgreSQL. These modes match the libpq `sslmode` parameter values. # Modes | Mode | Description | |------|-------------| | `disable` | No SSL - unencrypted connection | | `allow` | Try non-SSL first, use SSL if server requires it | | `prefer` | Try SSL first, fall back to non-SSL (default for external) | | `require` | Require SSL, but don''t verify the server certificate | | `verify-ca` | Require SSL and verify the server certificate is signed by a trusted CA | | `verify-full` | Require SSL, verify CA, and verify the server hostname matches the certificate | # Security Recommendations - For production external databases, use `verify-full` with proper CA certificates - Operator-managed PostgreSQL (PGO) always uses `require` internally - `disable` and `allow` should only be used in development environments' enum: - disable - allow - prefer - require - verify-ca - verify-full nullable: true type: string required: - databaseUrl type: object redisDb: default: 2 description: 'Redis database number used by Copilot. Uses DB 2 by default to avoid conflicts with NetBox (DB 0) and Diode (DB 1).' format: uint8 maximum: 255.0 minimum: 0.0 type: integer replicas: default: 1 description: Number of Copilot backend replicas. format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 100 memory: 256 description: Resource requests for the Copilot backend container. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object timeouts: description: 'Per-service timeout overrides for the Copilot Ingress. Field-level merges over the cluster-wide `spec.ingress.timeouts` default. When unset, Copilot falls back to long-lived-connection defaults suitable for streaming chat responses (see [`CopilotApp::intrinsic_timeouts`]).' nullable: true properties: gateway: description: Gateway API HTTPRoute rule timeout overrides. nullable: true properties: backendRequest: description: 'BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended' nullable: true type: string request: description: 'Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended' nullable: true type: string type: object ingress: description: Ingress-level timeout overrides (nginx annotation translation). nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object topologySpreadConstraints: description: 'Topology spread constraints for Copilot pods. When configured, controls how pods are distributed across topology domains (nodes, zones). Useful for HA deployments with multiple replicas.' items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object diode: default: auth: annotations: null enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 port: 8080 replicas: 0 resources: cpu: 100 memory: 128 config: null enabled: true hydra: annotations: null autoMigrate: true databaseName: hydra databaseUser: hydra enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 replicas: 0 resources: cpu: 100 memory: 128 ingester: annotations: null enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 port: 8081 replicas: 0 resources: cpu: 100 memory: 128 reconciler: annotations: null enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 port: 8081 replicas: 0 resources: cpu: 100 memory: 128 description: Diode application (includes Hydra OIDC server) properties: auth: default: annotations: null enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 port: 8080 replicas: 0 resources: cpu: 100 memory: 128 description: Diode auth service component. properties: annotations: additionalProperties: type: string description: Annotations to apply to auth service pods. nullable: true type: object enabled: default: true description: Enable or disable the auth service deployment. type: boolean extraEnvs: default: [] description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: 'Container image configuration. When not specified, uses operator defaults allowing automatic version updates.' nullable: true properties: digest: description: "Optional image digest for immutable image references.\n\nThe empty-string alternation is load-bearing (NBE-2217), not slack:\n`pattern` applies to any string that is *present*, and\n`resolve_diode_image` deliberately treats `digest: \"\"` as unset\n(falls back to the per-component pinned default) \u2014 a bare digest\npattern would reject that value at admission before it ever reaches\nthe resolver.\n\nThe pattern is restricted to the two algorithms containerd actually\naccepts, each at its fixed hex length, lowercase only \u2014 go-digest\nrequires lowercase hex for `sha256`/`sha512`, so a syntactically\ndigest-shaped value like `sha256:ABCD\u2026` or `sha256:a` would otherwise\npass admission and still hit the kubelet as InvalidImageName." nullable: true pattern: ^$|^sha256:[a-f0-9]{64}$|^sha512:[a-f0-9]{128}$ type: string imagePullSecrets: description: Image pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: default: IfNotPresent description: Image pull policy (Always, IfNotPresent, Never). enum: - IfNotPresent - Always - Never type: string registry: default: docker.io description: Container registry URL. type: string repository: description: 'Image repository path. When unset, the operator fills in the component-specific default (auth/ingester/reconciler).' nullable: true type: string tag: description: 'Image tag. When unset, the operator fills in the component-specific default tag.' nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to auth service pods. nullable: true type: object limits: default: cpu: 500 memory: 512 description: Resource limits. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object port: default: 8080 description: Service port for auth API. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer replicas: default: 0 description: 'Number of auth service replicas. Set to 0 for auto-scaling based on node count (min(nodes, 3)); the operator resolves the sentinel at reconcile time (NBE-881). For a fixed count, set 1 or more.' format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 100 memory: 128 description: Resource requests. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object serviceAccount: description: 'Kubernetes service account name. If not specified, auto-generated as `{cluster-name}-diode-auth`.' nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for auth service pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object config: description: Diode application level configuration nullable: true properties: auth: default: logLevel: INFO telemetryConfig: metricsEnabled: false metricsExporter: prometheus metricsPort: null traceExporter: none description: Diode auth configuration properties: logLevel: default: INFO description: Log level. enum: - INFO - DEBUG - WARN - ERROR type: string sentryDsn: description: Sentry DSN for error tracking. nullable: true type: string telemetryConfig: default: metricsEnabled: false metricsExporter: prometheus metricsPort: null traceExporter: none description: Telemetry configuration. properties: environment: description: 'Deployment environment name. When None, Diode uses its own built-in default.' nullable: true type: string metricsEnabled: default: false description: Enable Prometheus metrics endpoint. type: boolean metricsExporter: default: prometheus description: Metrics exporter backend. enum: - prometheus - otlp - console - none type: string metricsPort: description: Port for metrics endpoint (component-specific default). format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer traceExporter: default: none description: Trace exporter backend. enum: - otlp - console - none type: string type: object type: object hydra: default: oidc: subjectIdentifiers: supportedTypes: - public serve: admin: host: 0.0.0.0 port: 4445 public: host: 0.0.0.0 port: 4444 tls: allowTerminationFrom: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 strategies: accessToken: jwt jwt: scopeClaim: both ttl: accessToken: 1h description: Hydra OIDC server configuration properties: oidc: default: subjectIdentifiers: supportedTypes: - public description: OIDC configuration. properties: subjectIdentifiers: description: Subject identifier configuration. properties: supportedTypes: description: Supported subject identifier types. items: description: 'OIDC subject identifier algorithm type. See [Hydra subject identifiers](https://www.ory.com/docs/hydra/guides/openid).' enum: - public - pairwise type: string type: array required: - supportedTypes type: object required: - subjectIdentifiers type: object serve: default: admin: host: 0.0.0.0 port: 4445 public: host: 0.0.0.0 port: 4444 tls: allowTerminationFrom: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 description: Server listening configuration. properties: admin: default: host: 0.0.0.0 port: 4445 description: Admin API server configuration. properties: host: default: 0.0.0.0 description: Bind address. type: string port: default: 4445 description: Admin API port. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer type: object public: default: host: 0.0.0.0 port: 4444 description: Public API server configuration. properties: host: default: 0.0.0.0 description: Bind address. type: string port: default: 4444 description: Public API port. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer type: object tls: default: allowTerminationFrom: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 description: TLS termination configuration. properties: allowTerminationFrom: default: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 description: Networks allowed to terminate TLS (e.g., load balancers). items: pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\/(3[0-2]|[0-2]?[0-9])$ type: string type: array type: object type: object strategies: default: accessToken: jwt jwt: scopeClaim: both description: Token strategies. properties: accessToken: description: Access token strategy. enum: - jwt - opaque type: string jwt: description: JWT-specific configuration. properties: scopeClaim: description: Format for scope claim in JWT. enum: - list - string - both type: string required: - scopeClaim type: object required: - accessToken - jwt type: object ttl: default: accessToken: 1h description: Token TTL configuration. properties: accessToken: default: 1h description: Access token lifetime (e.g., "1h", "30m"). type: string type: object urls: description: URL configuration. nullable: true properties: self: description: Self-referential URLs. nullable: true properties: issuer: description: 'OIDC issuer URL. If not specified, will be auto-generated based on cluster name and namespace.' nullable: true type: string type: object type: object type: object ingester: default: logLevel: INFO redisMemoryHighWatermarkPct: 90 redisStreamDb: 1 telemetryConfig: metricsEnabled: false metricsExporter: prometheus metricsPort: null traceExporter: none description: Diode ingester configuration properties: logLevel: default: INFO description: Log level. enum: - INFO - DEBUG - WARN - ERROR type: string redisMemoryHighWatermarkPct: default: 90 description: "Redis `used_memory` / `maxmemory` percentage at which the ingester\nrejects Ingest with `ResourceExhausted` (`REDIS_MEMORY_HIGH_WATERMARK_PCT`).\nDefaults to 90, matching NetBox Cloud. 0 disables the check.\n\nOnly meaningful when Redis has a `maxmemory` cap \u2014 set the cluster's\n`redis.maxMemoryPercent`. Without a cap the ratio is undefined and the\ncheck is a no-op." format: uint8 maximum: 100.0 minimum: 0.0 type: integer redisStreamDb: default: 1 description: Redis database number for stream storage. format: uint8 maximum: 255.0 minimum: 0.0 type: integer sentryDsn: description: Sentry DSN for error tracking. nullable: true type: string telemetryConfig: default: metricsEnabled: false metricsExporter: prometheus metricsPort: null traceExporter: none description: Telemetry configuration. properties: environment: description: 'Deployment environment name. When None, Diode uses its own built-in default.' nullable: true type: string metricsEnabled: default: false description: Enable Prometheus metrics endpoint. type: boolean metricsExporter: default: prometheus description: Metrics exporter backend. enum: - prometheus - otlp - console - none type: string metricsPort: description: Port for metrics endpoint (component-specific default). format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer traceExporter: default: none description: Trace exporter backend. enum: - otlp - console - none type: string type: object type: object reconciler: default: autoApplyChangesets: true autoApplyProcessorConcurrency: 1 databaseName: diode databaseUser: diode ingestionLogProcessorConcurrency: 4 logLevel: INFO migrationEnabled: true netboxClientId: diode-to-netbox rateLimitBurst: 1 rateLimitNetboxBurst: 1 rateLimitNetboxRps: 20 rateLimitRps: 20 redisDb: 0 redisStreamDb: 1 telemetryConfig: metricsEnabled: false metricsExporter: prometheus metricsPort: null traceExporter: none description: Diode reconciler configuration properties: autoApplyChangesets: default: true description: Automatically apply changesets to NetBox. type: boolean autoApplyProcessorConcurrency: default: 1 description: 'Number of concurrent auto-apply processors (`AUTO_APPLY_PROCESSOR_CONCURRENCY`).' format: uint8 maximum: 255.0 minimum: 1.0 type: integer databaseName: default: diode description: PostgreSQL database name. maxLength: 63 minLength: 1 type: string databaseUser: default: diode description: PostgreSQL database user. maxLength: 63 minLength: 1 type: string ingestionLogProcessorConcurrency: default: 4 description: 'Number of concurrent ingestion-log processors (`INGESTION_LOG_PROCESSOR_CONCURRENCY`).' format: uint8 maximum: 255.0 minimum: 1.0 type: integer logLevel: default: INFO description: Log level. enum: - INFO - DEBUG - WARN - ERROR type: string migrationEnabled: default: true description: Enable database migrations on startup. type: boolean netboxClientId: default: diode-to-netbox description: OAuth2 client ID for NetBox authentication. type: string pluginApiBaseUrl: description: 'NetBox Diode plugin API base URL. If not specified, auto-generated based on cluster name and namespace.' nullable: true type: string postgres: description: 'PostgreSQL connection configuration (optional, for external databases). If not provided, defaults to using PGO-generated secrets with the pattern: `{cluster-name}-postgres-pguser-diode` For external databases, specify the secret containing connection details.' nullable: true properties: password: description: Password reference (references external secret). properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object postgresqlProfile: description: 'Name of a PostgreSQL profile from `postgresqlProfiles`. When set, the component inherits PostgreSQL configuration (host, port, TLS) from the named profile. This is used by KOTS to avoid duplicating cluster-level PostgreSQL settings for each component.' nullable: true type: string required: - password type: object rateLimitBurst: default: 1 description: Rate limit burst size. format: uint8 maximum: 255.0 minimum: 0.0 type: integer rateLimitNetboxBurst: default: 1 description: NetBox API rate limit burst size. format: uint8 maximum: 255.0 minimum: 0.0 type: integer rateLimitNetboxRps: default: 20 description: NetBox API rate limit requests per second. format: uint8 maximum: 255.0 minimum: 0.0 type: integer rateLimitRps: default: 20 description: Rate limit requests per second. format: uint8 maximum: 255.0 minimum: 0.0 type: integer redisDb: default: 0 description: Redis database number. format: uint8 maximum: 255.0 minimum: 0.0 type: integer redisStreamDb: default: 1 description: Redis database number for stream storage. format: uint8 maximum: 255.0 minimum: 0.0 type: integer sentryDsn: description: Sentry DSN for error tracking. nullable: true type: string telemetryConfig: default: metricsEnabled: false metricsExporter: prometheus metricsPort: null traceExporter: none description: Telemetry configuration. properties: environment: description: 'Deployment environment name. When None, Diode uses its own built-in default.' nullable: true type: string metricsEnabled: default: false description: Enable Prometheus metrics endpoint. type: boolean metricsExporter: default: prometheus description: Metrics exporter backend. enum: - prometheus - otlp - console - none type: string metricsPort: description: Port for metrics endpoint (component-specific default). format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer traceExporter: default: none description: Trace exporter backend. enum: - otlp - console - none type: string type: object type: object type: object enabled: default: true description: Enable or disable the entire Diode application suite. type: boolean hydra: default: annotations: null autoMigrate: true databaseName: hydra databaseUser: hydra enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 replicas: 0 resources: cpu: 100 memory: 128 description: Hydra OIDC server for Diode authentication. properties: annotations: additionalProperties: type: string description: Annotations to apply to Hydra pods. nullable: true type: object autoMigrate: default: true description: Enable automatic database migrations on startup. type: boolean databaseName: default: hydra description: 'PostgreSQL database name for Hydra. NOTE: the consumer side only stores this; it has no effect today. For operator-managed PostgreSQL the database name is baked into the PGO-generated DSN; for an external database the provided DSN is authoritative. It takes effect once PGO provisioning derives databases from configured names.' maxLength: 63 minLength: 1 type: string databaseUser: default: hydra description: 'PostgreSQL database user for Hydra. Selects the PGO-generated secret referenced for the DSN (`{cluster-name}-postgres-pguser-{user}`). A non-default user must have a matching entry in `spec.postgresql.users`; the default user list only provisions `hydra`, so PGO never creates the secret for an unlisted user.' maxLength: 63 minLength: 1 type: string enabled: default: true description: Enable or disable Hydra deployment. type: boolean extraEnvs: default: [] description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: 'Container image configuration. When not specified, uses operator defaults allowing automatic version updates.' nullable: true properties: digest: description: Optional image digest for immutable image references. nullable: true type: string imagePullSecrets: description: Image pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: default: IfNotPresent description: Image pull policy (Always, IfNotPresent, Never). enum: - IfNotPresent - Always - Never type: string registry: default: docker.io description: Container registry URL. type: string repository: default: oryd/hydra description: Image repository path. type: string tag: default: v25.4.0 description: Image tag. type: string type: object labels: additionalProperties: type: string description: Labels to apply to Hydra pods. nullable: true type: object limits: default: cpu: 500 memory: 512 description: Resource limits. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object postgresqlProfile: description: 'Name of a PostgreSQL profile from `postgresqlProfiles`. When set, Hydra inherits PostgreSQL configuration (host, port, TLS) from the named profile. Used by KOTS to avoid duplicating cluster-level PostgreSQL settings.' nullable: true type: string replicas: default: 0 description: 'Number of Hydra replicas. Set to 0 for auto-scaling based on node count (min(nodes, 3)); the operator resolves the sentinel at reconcile time (NBE-881). For a fixed count, set 1 or more.' format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 100 memory: 128 description: Resource requests. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object secrets: description: 'Secret references for Hydra. If not provided, will be auto-generated based on PostgreSQL configuration.' nullable: true properties: cookie: description: Cookie secret for session management. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object dsn: description: Database connection DSN. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object system: description: System secret for encryption. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object serviceAccount: description: 'Kubernetes service account name. If not specified, auto-generated as `{cluster-name}-diode-hydra`.' nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for Hydra pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object ingester: default: annotations: null enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 port: 8081 replicas: 0 resources: cpu: 100 memory: 128 description: Diode ingester component. properties: annotations: additionalProperties: type: string description: Annotations to apply to ingester pods. nullable: true type: object enabled: default: true description: Enable or disable the ingester deployment. type: boolean extraEnvs: default: [] description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: 'Container image configuration. When not specified, uses operator defaults allowing automatic version updates.' nullable: true properties: digest: description: "Optional image digest for immutable image references.\n\nThe empty-string alternation is load-bearing (NBE-2217), not slack:\n`pattern` applies to any string that is *present*, and\n`resolve_diode_image` deliberately treats `digest: \"\"` as unset\n(falls back to the per-component pinned default) \u2014 a bare digest\npattern would reject that value at admission before it ever reaches\nthe resolver.\n\nThe pattern is restricted to the two algorithms containerd actually\naccepts, each at its fixed hex length, lowercase only \u2014 go-digest\nrequires lowercase hex for `sha256`/`sha512`, so a syntactically\ndigest-shaped value like `sha256:ABCD\u2026` or `sha256:a` would otherwise\npass admission and still hit the kubelet as InvalidImageName." nullable: true pattern: ^$|^sha256:[a-f0-9]{64}$|^sha512:[a-f0-9]{128}$ type: string imagePullSecrets: description: Image pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: default: IfNotPresent description: Image pull policy (Always, IfNotPresent, Never). enum: - IfNotPresent - Always - Never type: string registry: default: docker.io description: Container registry URL. type: string repository: description: 'Image repository path. When unset, the operator fills in the component-specific default (auth/ingester/reconciler).' nullable: true type: string tag: description: 'Image tag. When unset, the operator fills in the component-specific default tag.' nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to ingester pods. nullable: true type: object limits: default: cpu: 500 memory: 512 description: Resource limits. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object port: default: 8081 description: Service port for ingester API. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer replicas: default: 0 description: 'Number of ingester replicas. Set to 0 for auto-scaling based on node count (min(nodes, 3)); the operator resolves the sentinel at reconcile time (NBE-881). For a fixed count, set 1 or more.' format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 100 memory: 128 description: Resource requests. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object serviceAccount: description: 'Kubernetes service account name. If not specified, auto-generated as `{cluster-name}-diode-ingester`.' nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for ingester pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object reconciler: default: annotations: null enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 port: 8081 replicas: 0 resources: cpu: 100 memory: 128 description: Diode reconciler component. properties: annotations: additionalProperties: type: string description: Annotations to apply to reconciler pods. nullable: true type: object enabled: default: true description: Enable or disable the reconciler deployment. type: boolean extraEnvs: default: [] description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: 'Container image configuration. When not specified, uses operator defaults allowing automatic version updates.' nullable: true properties: digest: description: "Optional image digest for immutable image references.\n\nThe empty-string alternation is load-bearing (NBE-2217), not slack:\n`pattern` applies to any string that is *present*, and\n`resolve_diode_image` deliberately treats `digest: \"\"` as unset\n(falls back to the per-component pinned default) \u2014 a bare digest\npattern would reject that value at admission before it ever reaches\nthe resolver.\n\nThe pattern is restricted to the two algorithms containerd actually\naccepts, each at its fixed hex length, lowercase only \u2014 go-digest\nrequires lowercase hex for `sha256`/`sha512`, so a syntactically\ndigest-shaped value like `sha256:ABCD\u2026` or `sha256:a` would otherwise\npass admission and still hit the kubelet as InvalidImageName." nullable: true pattern: ^$|^sha256:[a-f0-9]{64}$|^sha512:[a-f0-9]{128}$ type: string imagePullSecrets: description: Image pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: default: IfNotPresent description: Image pull policy (Always, IfNotPresent, Never). enum: - IfNotPresent - Always - Never type: string registry: default: docker.io description: Container registry URL. type: string repository: description: 'Image repository path. When unset, the operator fills in the component-specific default (auth/ingester/reconciler).' nullable: true type: string tag: description: 'Image tag. When unset, the operator fills in the component-specific default tag.' nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to reconciler pods. nullable: true type: object limits: default: cpu: 500 memory: 512 description: Resource limits. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object port: default: 8081 description: Service port for reconciler API. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer replicas: default: 0 description: 'Number of reconciler replicas. Set to 0 for auto-scaling based on node count (min(nodes, 3)); the operator resolves the sentinel at reconcile time (NBE-881). For a fixed count, set 1 or more.' format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 100 memory: 128 description: Resource requests. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object serviceAccount: description: 'Kubernetes service account name. If not specified, auto-generated as `{cluster-name}-diode-reconciler`.' nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for reconciler pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object timeouts: description: 'Per-route timeout overrides for the Diode HTTP and gRPC surfaces. Field-level merges over the cluster-wide `spec.ingress.timeouts` and `spec.gateway.timeouts` defaults. `http` applies to the Diode HTTP Ingress and HTTPRoute (Hydra oauth2 + Diode auth); `grpc` applies to the Diode gRPC Ingress (Ingester + Reconciler).' nullable: true properties: grpc: description: Timeout overrides for the Diode gRPC Ingress. nullable: true properties: ingress: description: Ingress-level timeout overrides for the gRPC Ingress. nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object http: description: Timeout overrides for the Diode HTTP Ingress + HTTPRoute. nullable: true properties: gateway: description: Gateway API HTTPRoute rule timeout overrides. nullable: true properties: backendRequest: description: 'BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended' nullable: true type: string request: description: 'Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended' nullable: true type: string type: object ingress: description: Ingress-level timeout overrides (nginx annotation translation). nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object type: object topologySpreadConstraints: description: 'Topology spread constraints applied to every Diode pod (ingester, reconciler, auth, proxy). Acts as a Diode-suite-wide default: a per-component `topologySpreadConstraints` overrides it, and when unset the operator falls back to `spec.replication.topologySpreadConstraints` and then a hostname default.' items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object extraCaCertificates: description: "Additional CA certificates to trust system-wide.\n\nThese certificates will be added to the system trust store of all NetBox\ncomponents (netbox, worker) and merged into every service-\nspecific CA bundle (PostgreSQL, Redis). Useful for:\n- Custom or self-signed CA certificates\n- Internal enterprise CA certificates\n- Third-party service certificates (LDAP, webhooks, etc.)\n\nUsers must create Kubernetes secrets containing PEM-encoded certificates,\nthen reference them here. Multiple certificates can be concatenated in a\nsingle secret key, or split across multiple references.\n\n# Example\n```yaml\nextraCaCertificates:\n - name: company-root-ca\n key: ca.crt\n - name: partner-ca-bundle\n key: ca-bundle.pem\n```" items: description: SecretKeySelector selects a key of a Secret. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: array extraManifests: description: "Additional Kubernetes manifests to deploy alongside the managed\nworkloads.\n\nEach entry is a YAML string and may contain multiple documents\nseparated by `---`. Documents are parsed into typed resources, run\nthrough the same base and enterprise mutation pipelines as\noperator-built resources (canonical labels, registry rewrites, pull\nsecrets), and applied with the managed workloads.\n\nSupported kinds: Deployment, Job, Secret, ConfigMap, Service,\nServiceAccount, Ingress, Role, RoleBinding, PersistentVolumeClaim.\nAny other kind is rejected at reconcile time. Resources are always\ndeployed into the cluster's namespace; an explicit mismatching\n`metadata.namespace` is rejected.\n\n# Example\n```yaml\nextraManifests:\n - |\n apiVersion: v1\n kind: ConfigMap\n metadata:\n name: my-extra-config\n data:\n key: value\n```" items: type: string type: array gateway: description: "Gateway API configuration for operator-managed Gateway and Route\nresources.\n\nWhen omitted or disabled, no Gateway API resources are created.\nCan coexist with Ingress \u2014 both can be enabled simultaneously." nullable: true properties: annotations: additionalProperties: type: string description: Extra annotations merged onto all Gateway API resources. type: object className: default: traefik description: 'GatewayClass name for the Gateway resource. Maps to `spec.gatewayClassName` on the generated Gateway. Common values: `"traefik"`, `"envoy"`, `"cilium"`, `"istio"`.' type: string enabled: default: false description: 'Whether the operator creates Gateway API resources. Defaults to `false` (opt-in). When `true`, the operator creates a Gateway and the associated HTTPRoute/GRPCRoute objects.' type: boolean listeners: description: 'Gateway listener definitions. Each entry maps to a `spec.listeners[]` entry on the Gateway. Uses the upstream Gateway API `GatewayListeners` type directly.' items: description: 'Listener embodies the concept of a logical endpoint where a Gateway accepts network connections.' properties: allowedRoutes: description: "AllowedRoutes defines the types of routes that MAY be attached to a\nListener and the trusted namespaces where those Route resources MAY be\npresent.\n\nAlthough a client request may match multiple route rules, only one rule\nmay ultimately receive the request. Matching precedence MUST be\ndetermined in order of the following criteria:\n\n* The most specific match as defined by the Route type.\n* The oldest Route based on creation timestamp. For example, a Route with\n a creation timestamp of \"2020-09-08 01:02:03\" is given precedence over\n a Route with a creation timestamp of \"2020-09-08 01:02:04\".\n* If everything else is equivalent, the Route appearing first in\n alphabetical order (namespace/name) should be given precedence. For\n example, foo/bar is given precedence over foo/baz.\n\nAll valid rules within a Route attached to this Listener should be\nimplemented. Invalid Route rules can be ignored (sometimes that will mean\nthe full Route). If a Route rule transitions from valid to invalid,\nsupport for that Route rule should be dropped to ensure consistency. For\nexample, even if a filter specified by a Route rule is invalid, the rest\nof the rules within that Route should still be supported.\n\nSupport: Core" nullable: true properties: kinds: description: 'Kinds specifies the groups and kinds of Routes that are allowed to bind to this Gateway Listener. When unspecified or empty, the kinds of Routes selected are determined using the Listener protocol. A RouteGroupKind MUST correspond to kinds of Routes that are compatible with the application protocol specified in the Listener''s Protocol field. If an implementation does not support or recognize this resource type, it MUST set the "ResolvedRefs" condition to False for this Listener with the "InvalidRouteKinds" reason. Support: Core' items: description: RouteGroupKind indicates the group and kind of a Route resource. properties: group: description: Group is the group of the Route. nullable: true type: string kind: description: Kind is the kind of the Route. type: string required: - kind type: object nullable: true type: array namespaces: description: 'Namespaces indicates namespaces from which Routes may be attached to this Listener. This is restricted to the namespace of this Gateway by default. Support: Core' nullable: true properties: from: description: "From indicates where Routes will be selected for this Gateway. Possible\nvalues are:\n\n* All: Routes in all namespaces may be used by this Gateway.\n* Selector: Routes in namespaces selected by the selector may be used by\n this Gateway.\n* Same: Only Routes in the same namespace may be used by this Gateway.\n\nSupport: Core" enum: - All - Selector - Same - null nullable: true type: string selector: description: 'Selector must be specified when From is set to "Selector". In that case, only Routes in Namespaces matching this Selector will be selected by this Gateway. This field is ignored for other values of "From". Support: Core' nullable: true properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: 'A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.' properties: key: description: key is the label key that the selector applies to. type: string operator: description: 'operator represents a key''s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.' type: string values: description: 'values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.' items: type: string nullable: true type: array required: - key - operator type: object nullable: true type: array matchLabels: additionalProperties: type: string description: 'matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.' nullable: true type: object type: object type: object type: object hostname: description: "Hostname specifies the virtual hostname to match for protocol types that\ndefine this concept. When unspecified, all hostnames are matched. This\nfield is ignored for protocols that don't require hostname based\nmatching.\n\nImplementations MUST apply Hostname matching appropriately for each of\nthe following protocols:\n\n* TLS: The Listener Hostname MUST match the SNI.\n* HTTP: The Listener Hostname MUST match the Host header of the request.\n* HTTPS: The Listener Hostname SHOULD match both the SNI and Host header.\n Note that this does not require the SNI and Host header to be the same.\n The semantics of this are described in more detail below.\n\nTo ensure security, Section 11.1 of RFC-6066 emphasizes that server\nimplementations that rely on SNI hostname matching MUST also verify\nhostnames within the application protocol.\n\nSection 9.1.2 of RFC-7540 provides a mechanism for servers to reject the\nreuse of a connection by responding with the HTTP 421 Misdirected Request\nstatus code. This indicates that the origin server has rejected the\nrequest because it appears to have been misdirected.\n\nTo detect misdirected requests, Gateways SHOULD match the authority of\nthe requests with all the SNI hostname(s) configured across all the\nGateway Listeners on the same port and protocol:\n\n* If another Listener has an exact match or more specific wildcard entry,\n the Gateway SHOULD return a 421.\n* If the current Listener (selected by SNI matching during ClientHello)\n does not match the Host:\n * If another Listener does match the Host, the Gateway SHOULD return a\n 421.\n * If no other Listener matches the Host, the Gateway MUST return a\n 404.\n\nFor HTTPRoute and TLSRoute resources, there is an interaction with the\n`spec.hostnames` array. When both listener and route specify hostnames,\nthere MUST be an intersection between the values for a Route to be\naccepted. For more information, refer to the Route specific Hostnames\ndocumentation.\n\nHostnames that are prefixed with a wildcard label (`*.`) are interpreted\nas a suffix match. That means that a match for `*.example.com` would match\nboth `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\nSupport: Core" nullable: true type: string name: description: 'Name is the name of the Listener. This name MUST be unique within a Gateway. Support: Core' type: string port: description: 'Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules. Support: Core' format: int32 type: integer protocol: description: 'Protocol specifies the network protocol this listener expects to receive. Support: Core' type: string tls: description: 'TLS is the TLS configuration for the Listener. This field is required if the Protocol field is "HTTPS" or "TLS". It is invalid to set this field if the Protocol field is "HTTP", "TCP", or "UDP". The association of SNIs to Certificate defined in ListenerTLSConfig is defined based on the Hostname field for this listener. The GatewayClass MUST use the longest matching SNI out of all available certificates for any TLS handshake. Support: Core' nullable: true properties: certificateRefs: description: 'CertificateRefs contains a series of references to Kubernetes objects that contains TLS certificates and private keys. These certificates are used to establish a TLS handshake for requests that match the hostname of the associated listener. A single CertificateRef to a Kubernetes Secret has "Core" support. Implementations MAY choose to support attaching multiple certificates to a Listener, but this behavior is implementation-specific. References to a resource in different namespace are invalid UNLESS there is a ReferenceGrant in the target namespace that allows the certificate to be attached. If a ReferenceGrant does not allow this reference, the "ResolvedRefs" condition MUST be set to False for this listener with the "RefNotPermitted" reason. This field is required to have at least one element when the mode is set to "Terminate" (default) and is optional otherwise. CertificateRefs can reference to standard Kubernetes resources, i.e. Secret, or implementation-specific custom resources. Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls Support: Implementation-specific (More than one reference or other resource types)' items: description: 'SecretObjectReference identifies an API object including its namespace, defaulting to Secret. The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid. References to objects with invalid Group and Kind are not valid, and must be rejected by the implementation, with appropriate Conditions set on the containing object.' properties: group: description: 'Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred.' nullable: true type: string kind: description: Kind is kind of the referent. For example "Secret". nullable: true type: string name: description: Name is the name of the referent. type: string namespace: description: 'Namespace is the namespace of the referenced object. When unspecified, the local namespace is inferred. Note that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace''s owner to accept the reference. See the ReferenceGrant documentation for details. Support: Core' nullable: true type: string required: - name type: object nullable: true type: array mode: description: "Mode defines the TLS behavior for the TLS session initiated by the client.\nThere are two possible modes:\n\n- Terminate: The TLS session between the downstream client and the\n Gateway is terminated at the Gateway. This mode requires certificates\n to be specified in some way, such as populating the certificateRefs\n field.\n- Passthrough: The TLS session is NOT terminated by the Gateway. This\n implies that the Gateway can't decipher the TLS stream except for\n the ClientHello message of the TLS protocol. The certificateRefs field\n is ignored in this mode.\n\nSupport: Core" enum: - Terminate - Passthrough - null nullable: true type: string options: additionalProperties: type: string description: 'Options are a list of key/value pairs to enable extended TLS configuration for each implementation. For example, configuring the minimum TLS version or supported cipher suites. A set of common keys MAY be defined by the API in the future. To avoid any ambiguity, implementation-specific definitions MUST use domain-prefixed names, such as `example.com/my-custom-option`. Un-prefixed names are reserved for key names defined by Gateway API. Support: Implementation-specific' nullable: true type: object type: object required: - name - port - protocol type: object type: array maxRequestBodyBytes: description: 'Maximum request body size, in bytes, enforced at the bundled Traefik gateway. `0` disables the cap (unlimited). Unset resolves to [`DEFAULT_MAX_REQUEST_BODY_BYTES`] via [`Self::max_request_body_bytes`]. Only takes effect when the gateway class is the bundled Traefik (`traefik`); BYO-gateway installs configure body limits on their own controller. Maps to a `traefik.io` `Middleware` (`spec.buffering.maxRequestBodyBytes`) attached to the NetBox HTTPRoute. The signed `i64` type matches the Traefik `Middleware` CRD (`spec.buffering.maxRequestBodyBytes: int64`); `0` or any negative value is treated as unlimited (no cap emitted).' format: int64 nullable: true type: integer timeouts: description: 'Timeouts applied to all generated HTTPRoute rules. Maps to `spec.rules[].timeouts` on HTTPRoute resources. Values are Gateway API duration strings (e.g., `"30s"`, `"1m"`).' nullable: true properties: backendRequest: description: 'BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended' nullable: true type: string request: description: 'Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended' nullable: true type: string type: object type: object imagePullPolicy: default: IfNotPresent description: Image pull policy for NetBox containers. enum: - IfNotPresent - Always - Never type: string imagePullSecrets: description: Image pull secrets for private registries. items: type: string type: array ingress: description: 'Ingress configuration for all operator-managed Ingress resources. When omitted, the operator uses default settings (nginx class, no TLS, no extra annotations).' nullable: true properties: annotations: additionalProperties: type: string description: 'Extra annotations merged onto every Ingress object. Values here override the hardcoded nginx-specific defaults when keys collide.' type: object className: default: nginx description: 'Kubernetes Ingress class name. Maps to `spec.ingressClassName` on all generated Ingress objects. Defaults to `"nginx"` for backward compatibility.' type: string enabled: default: true description: 'Whether the operator creates Ingress objects. When `false`, the operator skips Ingress creation entirely. Existing Ingress objects are pruned by orphan cleanup.' type: boolean timeouts: description: "Proxy timeouts translated to controller-specific annotations.\n\nCurrently only the `nginx` class is supported \u2014 other classes\nlog a warning and leave timeouts at the controller defaults." nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object tls: description: 'TLS termination entries for Ingress resources. Each entry maps directly to a Kubernetes `IngressTLS` object. All unique hosts across entries are used to create `IngressRule` entries.' items: description: IngressTLS describes the transport layer security associated with an ingress. properties: hosts: description: hosts is a list of hosts included in the TLS certificate. The values in this list must match the name/s used in the tlsSecret. Defaults to the wildcard host setting for the loadbalancer controller fulfilling this Ingress, if left unspecified. items: type: string type: array secretName: description: secretName is the name of the secret used to terminate TLS traffic on port 443. Field is left optional to allow TLS routing based on SNI hostname alone. If the SNI host in a listener conflicts with the "Host" header field used by an IngressRule, the SNI host is used for termination and value of the "Host" header is used for routing. type: string type: object type: array type: object labels: additionalProperties: type: string description: Labels applied to all cluster resources. nullable: true type: object maintenanceMode: default: false description: Enable maintenance mode - scales down all deployments and creates a maintenance pod for manual operations. type: boolean netbox: description: NetBox application deployment configuration. properties: appReadyTimeout: default: 5m description: 'Maximum time the operator waits for the NetBox app deployment to become ready after each reconcile. Covers database migrations run at pod startup. Accepts durations (`5m`, `300s`) or bare seconds. Default: 5m (300s).' pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string config: description: NetBox application specific configuration nullable: true properties: allowedHosts: default: - '*' description: Allowed hostnames for NetBox. items: type: string type: array customPythonConfig: description: 'Custom Python configuration to be loaded after NetBox configuration.py. This content is rendered into user_extra.py and mounted as zzz_80_user_extra.py, allowing customization of PLUGINS, PLUGINS_CONFIG, and other NetBox settings.' nullable: true type: string customPythonConfigRef: description: 'Reference to a ConfigMap key containing custom Python configuration. If both customPythonConfig and customPythonConfigRef are specified, customPythonConfig takes precedence.' nullable: true properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object emailPassword: description: Email password reference (auto-generated if needed). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object metricsEnabled: default: false description: Enable Prometheus metrics endpoint at /metrics. type: boolean plugins: default: mediaWheelhousePollInterval: 5m description: Custom plugins configuration for installing Python packages from wheelhouse. properties: mediaWheelhousePollInterval: default: 5m description: 'How often the wheelhouse-watcher sidecar polls the wheelhouse file for mtime/size changes. Accepts human-friendly strings (`5m`, `1h`) or bare seconds (`300`). Relevant whenever a watcher runs: the media-dir wheelhouse (no configured source, custom Python config present) or a configured PVC source, where polling the file is the only way to see a wheelhouse dropped onto an existing claim. Ignored for S3 sources, which the operator probes itself. (The `media` in the name predates PVC support; it is kept because renaming a CRD field would break existing CRs.)' pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string wheelhouse: description: 'Wheelhouse source configuration. Specify either `s3` or `pvc` as the source for the wheelhouse tarball. Validation is performed automatically during deserialization.' nullable: true properties: pvc: description: PVC source configuration for wheelhouse file. nullable: true properties: claimName: description: 'Name of the PVC containing the wheelhouse. If `create` is true, the operator will create this PVC. If `create` is false (default), the PVC must already exist.' type: string create: default: false description: 'Create the PVC if it doesn''t exist (default: false). When true, the operator will create and manage the PVC lifecycle. Use maintenanceMode to access the PVC and upload the wheelhouse file.' type: boolean path: default: wheelhouse.tar.gz description: 'Path to the wheelhouse file within the PVC (default: wheelhouse.tar.gz).' type: string size: default: 1Gi description: 'Size of the PVC to create (default: 1Gi). Only used when `create` is true.' type: string storageClassName: description: 'Storage class name for the PVC. Only used when `create` is true.' nullable: true type: string required: - claimName type: object s3: description: S3 bucket configuration for wheelhouse download. nullable: true properties: bucket: description: S3 bucket name. type: string credentialsSecret: description: Reference to Secret containing S3 credentials. properties: accessKeyId: default: AWS_ACCESS_KEY_ID description: 'Key within the secret for the access key ID (default: AWS_ACCESS_KEY_ID).' type: string name: description: Name of the Kubernetes Secret containing S3 credentials. type: string secretAccessKey: default: AWS_SECRET_ACCESS_KEY description: 'Key within the secret for the secret access key (default: AWS_SECRET_ACCESS_KEY).' type: string required: - name type: object endpoint: description: S3-compatible endpoint URL (optional, uses AWS default if not specified). nullable: true type: string key: default: media/wheelhouse.tar.gz description: 'Object key within the bucket (default: media/wheelhouse.tar.gz).' type: string region: default: us-east-1 description: 'AWS region (default: us-east-1).' type: string verifySSL: default: true description: 'Whether to verify SSL certificates (default: true).' type: boolean required: - bucket - credentialsSecret type: object type: object type: object postgres: description: PostgreSQL connection configuration (derived from spec.postgresql if not provided). nullable: true properties: database: default: netbox description: Database name for NetBox. maxLength: 63 minLength: 1 type: string password: description: Password reference (auto-generated if not provided). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object user: default: netbox description: Database username for NetBox. maxLength: 63 minLength: 1 type: string users: default: - databases: - netbox name: netbox options: SUPERUSER - databases: - copilot name: copilot options: SUPERUSER - databases: - diode name: diode options: SUPERUSER - databases: - hydra name: hydra options: SUPERUSER description: Users to create in PostgreSQL (for PGO). items: description: PostgreSQL user specification for PGO. properties: databases: description: Databases the user can access. items: maxLength: 63 minLength: 1 type: string type: array name: description: Username. maxLength: 63 minLength: 1 type: string options: description: PostgreSQL user options (e.g., "SUPERUSER"). type: string required: - databases - name - options type: object type: array type: object redis: description: Redis connection configuration (derived from spec.redis if not provided). nullable: true properties: cachingDatabase: description: 'Redis DB index for the caching connection. Defaults to 1. Set to 0 for Redis Enterprise, which only supports DB index 0. No upper bound is enforced; see `tasksDatabase`.' format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer host: description: Redis hostname. type: string password: description: 'Password reference for Redis authentication. This password is used for both the tasks queue and cache connections. If not provided and `requireAuth` is true, authentication will fail.' nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object port: default: 6379 description: Redis port number. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer tasksDatabase: description: "Redis DB index for the tasks (RQ) connection. Defaults to 0.\n\nRedis Enterprise only supports DB index 0; this is already the tasks\ndefault, but the field is exposed for symmetry with `cachingDatabase`.\n\nNo upper bound is enforced: the real ceiling is the target Redis's\n`databases` setting (stock OSS is 16, Enterprise is 1), which the\noperator can't know \u2014 an out-of-range index fails at `SELECT` time." format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer username: description: 'Redis username for ACL authentication (Redis 6.0+). If not specified, defaults to empty string (legacy auth mode).' nullable: true type: string required: - host type: object secretKey: description: Django secret key reference (auto-generated if not provided). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object storage: default: s3: accessKeyId: null bucketName: null enabled: false endpointUrl: null regionName: '' secretAccessKey: null tlsConfig: null description: Storage configuration (S3, etc.) for NetBox media files. properties: s3: default: accessKeyId: null bucketName: null enabled: false endpointUrl: null regionName: '' secretAccessKey: null tlsConfig: null description: S3 storage configuration. properties: accessKeyId: description: AWS access key ID reference (from a Kubernetes Secret). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object bucketName: description: S3 bucket name. nullable: true type: string enabled: default: false description: Enable S3 storage for media files. type: boolean endpointUrl: description: Custom S3 endpoint URL (for MinIO, Garage, or other S3-compatible services). nullable: true type: string regionName: default: us-east-1 description: 'AWS region name (default: us-east-1).' type: string secretAccessKey: description: AWS secret access key reference (from a Kubernetes Secret). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object tlsConfig: description: 'TLS configuration referencing certificates from the cluster''s `tlsKeychain`. When present, enables: - Custom CA certificates for server verification (via keychain) - Client certificates for mutual TLS (mTLS) authentication - Insecure skip verification (disabling SSL certificate verification)' nullable: true properties: insecureSkipVerify: default: false description: 'Skip TLS certificate verification. **Warning**: Setting this to `true` disables certificate verification and should only be used for testing or development environments. **PostgreSQL caveat**: This field has no effect on PostgreSQL certificate verification when CA certificates are configured via `keychainCaCertificates`. For backward compatibility, libpq verifies the server certificate whenever `PGSSLROOTCERT` is set and `sslmode=require`, effectively upgrading it to `verify-ca` behavior. Since the operator sets `PGSSLROOTCERT` when any CA certificates are provided, `insecureSkipVerify: true` will not prevent certificate validation for PostgreSQL connections. To skip verification, remove the CA certificates instead.' type: boolean keychainCaCertificates: description: 'Names of CA certificates from the cluster''s `tlsKeychain` to use for verifying server certificates. These names must match entries in `tlsKeychain.caCertificateSecrets[].name`.' items: type: string type: array keychainClientCertificate: description: 'Name of a client certificate from the cluster''s `tlsKeychain` to use for mutual TLS (mTLS) authentication. This name must match an entry in `tlsKeychain.clientCertificateSecrets[].name`.' nullable: true type: string type: object type: object type: object superuser: description: "Superuser secret references. If provided, username, email and password\nare required and `apiToken` is optional. If None, operator generates all\ncredentials. Nothing reads `apiToken`'s value, but naming a key its\nSecret does not carry stops the NetBox pod from starting \u2014 see that\nfield's own description." nullable: true properties: apiToken: description: "Secret reference for superuser API token. Optional, and nothing reads\nits value: NetBox 4.5+ tokens are peppered v2 tokens that cannot be\nplanted from a plaintext secret, so the NetBox bootstrap seeds no token\nat all (see `superuser_upsert_section` in `netbox-workload`'s\n`config::entrypoint`). It stays accepted so specs that already set it\nkeep applying, but requiring it forced operators to invent a value that\ndoes nothing and 403s if used (NBE-2219).\n\nUnread is not the same as harmless to set. Naming a key here adds it to\nthe NetBox pod's projected `secrets` volume, from a source that is not\nmarked optional. Name a key the Secret does not carry and kubelet fails\nthe whole volume \u2014\n`MountVolume.SetUp failed for volume \"secrets\" : references non-existent\nsecret key` \u2014 so the NetBox pod never starts. The operator reports that\non the resource as `SuperuserSecret=False`, with a Warning event when the\nstate is entered, but still projects what the resource declares. Point\nthis at a key that really exists, or leave it unset.\n\nThis field's own `name` is not consulted. The projected volume carries\n`password` and `apiToken` together and sources both from the Secret named\nby `password.name`, so point this key at a Secret that one holds." nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object email: description: Secret reference for superuser email. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object password: description: Secret reference for superuser password. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object username: description: Secret reference for superuser username. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object required: - email - password - username type: object type: object diodePlugin: description: 'NetBox-side deadlines for outbound calls to Diode. These bound how long the NetBox Diode/Assurance plugins wait on Hydra token introspection (`authTimeout`) and Diode gRPC calls (`grpcTimeout`). Tune these when raising the cluster-wide ingress/gateway timeouts so the app layer doesn''t cap the higher ingress bound.' nullable: true properties: authTimeout: description: 'Timeout for Hydra token introspection calls from the NetBox plugins. Default: `500ms`.' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string grpcTimeout: description: 'Timeout for Diode gRPC calls from the NetBox plugins. Default: `5s`.' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object env: default: [] description: Environment variables for NetBox containers. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array httpPort: default: 8080 description: HTTP port for NetBox web interface. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer image: description: 'Container image specification. When not specified, uses operator defaults allowing automatic version updates.' nullable: true properties: digest: description: Image digest for pinning specific versions. nullable: true type: string imagePullSecrets: description: Pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: default: IfNotPresent description: Image pull policy. enum: - IfNotPresent - Always - Never type: string registry: default: docker.io description: Container registry hostname. type: string repository: default: netboxcommunity/netbox description: Repository path within the registry. type: string tag: default: v4.6.8 description: Image tag. type: string type: object limits: default: cpu: 1000 memory: 1500 description: Resource limits for NetBox pods. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object mediaStorageSize: default: 10Gi description: Media storage PVC size (e.g., "10Gi"). type: string migrationStatementTimeout: default: 15m description: 'Per-statement timeout for index reconciliation. Prevents a single slow index creation from consuming the entire job deadline. Accepts durations (`15m`, `900s`) or bare seconds (`900`). Default: 15m.' pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string migrationTimeout: default: 1h description: 'Maximum time for the migration Job to run before Kubernetes terminates it. Accepts durations (`1h`, `30m`) or bare seconds (`3600`). Default: 1h.' pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string replicas: default: 1 description: Number of NetBox web application replicas. format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 200 memory: 750 description: Resource requests for NetBox pods. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object scriptsStorageSize: default: 1Gi description: 'Scripts storage PVC size (e.g., "1Gi"). This volume stores custom scripts uploaded by users.' type: string statusPort: description: 'Deprecated: no longer used. Retained for CRD backwards compatibility. Previously configured the nginx unit status port; ignored since the switch to granian in nbe-core 4.5.x.' format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer storageAccessMode: description: 'Access mode for the media and scripts PVCs. Defaults to `ReadWriteOnce`, which pins all NetBox replicas to a single node. Set `ReadWriteMany` (and pair with an RWX-capable `storageClassName`) to allow `replicas > 1` to schedule across nodes for HA. S3-backed media (configured via `spec.netbox.config.storage`) bypasses these PVCs entirely and is the recommended HA path when available.' enum: - ReadWriteOnce - ReadOnlyMany - ReadWriteMany - ReadWriteOncePod - null nullable: true type: string storageClassName: description: Storage class for the media and scripts PVCs. nullable: true type: string timeouts: description: 'Per-service timeout overrides for the NetBox Ingress and HTTPRoute. Field-level merges over the cluster-wide `spec.ingress.timeouts` and `spec.gateway.timeouts` defaults.' nullable: true properties: gateway: description: Gateway API HTTPRoute rule timeout overrides. nullable: true properties: backendRequest: description: 'BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended' nullable: true type: string request: description: 'Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended' nullable: true type: string type: object ingress: description: Ingress-level timeout overrides (nginx annotation translation). nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object topologySpreadConstraints: description: 'Topology spread constraints for NetBox web pods. When configured, controls how pods are distributed across topology domains (nodes, zones). Useful for HA deployments with multiple replicas.' items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array urls: description: "External URLs at which the NetBox service is reachable.\n\nEach entry's host portion drives an `IngressRule.host` on the\nNetBox Ingress, producing one rule per URL. The scheme, port,\nand path are ignored \u2014 only the hostname is used. Unparseable\nentries are skipped with a warning; when no entries parse,\nthe Ingress falls back to a single wildcard rule.\n\nTLS termination is configured independently via\n`spec.ingress.tls`. When both are set, `urls` drives the rule\nhosts and `spec.ingress.tls` is preserved verbatim in the\nIngress `tls` block." items: type: string nullable: true type: array worker: default: env: [] limits: cpu: 1000 memory: 1500 replicas: 1 resources: cpu: 100 memory: 128 description: Background worker configuration. properties: affinity: description: "Pod affinity for worker pods.\n\nWhen omitted, the operator emits a required `kubernetes.io/hostname`\npod affinity binding each worker to a NetBox pod (so the worker can\nmount the same single-node media and scripts PVCs) only when both:\n\n- `spec.netbox.storageAccessMode` is unset, `ReadWriteOnce`, or\n `ReadWriteOncePod` \u2014 i.e., the PVCs are single-node attach; and\n- `spec.netbox.replicas == 1` \u2014 i.e., NetBox runs as a single replica.\n\nThe default is skipped when either condition fails:\n\n- `ReadWriteMany` / `ReadOnlyMany` \u2014 the PVCs can mount on multiple\n nodes, so colocation is unnecessary and would block HA scheduling.\n- `spec.netbox.replicas > 1` \u2014 required hostname colocation would\n force every worker onto whichever subset of nodes runs a NetBox\n pod, leaving extra workers Pending when worker replicas exceed\n that subset.\n\nProvide an explicit `Affinity` to override; the operator will inject\nNetBox's selector labels (`app.kubernetes.io/component=netbox`,\n`app.kubernetes.io/instance=`, ...) into any `podAffinity`\nor `podAntiAffinity` term whose `labelSelector` is empty, using the\nsame pattern as `topologySpreadConstraints`. To disable all affinity\nregardless of access mode or replica count, supply an explicit empty\nobject `affinity: {}`." nullable: true properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. properties: preferredDuringSchedulingIgnoredDuringExecution: description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. items: description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). properties: preference: description: A node selector term, associated with the corresponding weight. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchFields: description: A list of node selector requirements by node's fields. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array type: object weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. format: int32 type: integer required: - preference - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. items: description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchFields: description: A list of node selector requirements by node's fields. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array type: object type: array required: - nodeSelectorTerms type: object type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer required: - podAffinityTerm - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. items: description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object type: array type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer required: - podAffinityTerm - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. items: description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object type: array type: object type: object env: default: [] description: Environment variables for worker containers. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array limits: default: cpu: 1000 memory: 1500 description: Resource limits for worker pods. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object replicas: default: 1 description: Number of worker replicas. format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 100 memory: 128 description: Resource requests for worker pods. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object topologySpreadConstraints: description: 'Topology spread constraints for NetBox worker pods. When configured, controls how pods are distributed across topology domains (nodes, zones). Useful for HA deployments with multiple replicas.' items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array yamlEnv: description: 'YAML string containing environment variables as key-value pairs. This will be converted to EnvVar array format by the operator. Example: "FOO: bar\nBAZ: qux"' nullable: true type: string type: object yamlEnv: description: 'YAML string containing environment variables as key-value pairs. This will be converted to EnvVar array format by the operator. Example: "FOO: bar\nBAZ: qux"' nullable: true type: string type: object plugins: default: assetLifecycle: enabled: false ndx: enabled: true description: 'Cross-service plugin enablement (`spec.plugins`). Groups plugins whose setup spans more than one service. Holds NDX (NetBox Data Exchange) and Asset Lifecycle; see [`Plugins`].' properties: assetLifecycle: default: enabled: false description: 'Asset Lifecycle plugin (`netbox_asset_lifecycle`, Premium tier, off by default). See [`AssetLifecycleApp`].' properties: enabled: default: false description: "Enable or disable Asset Lifecycle (the `netbox_asset_lifecycle` plugin).\nDefaults to `false`. Requires a Premium-tier license to take effect \u2014\nthe plugin is not deployed on lower tiers regardless of this setting.\n\nDisabling drops the plugin from the rendered plugin config. Existing\nAsset Lifecycle tables are retained (not dropped), and re-enabling\nrestores access to them." type: boolean type: object ndx: default: enabled: true description: NDX (NetBox Data Exchange) plugin (paid-only). See [`NdxApp`]. properties: enabled: default: true description: "Enable or disable the NDX plugin (the user lever). Default `true`.\nEffective only when the license carries a paid NDX token entitlement \u2014\nthe operator gates on the token and renders no NDX config without one,\nrather than shipping a config that fails NetBox boot." type: boolean type: object type: object postgresql: description: PostgreSQL database configuration (operator-managed or external). properties: backups: description: "pgBackRest backup configuration (NBE-1695). Ignored when `external` is\ntrue \u2014 an external DB's backups are the customer's to run.\n\nDeliberately a bare `#[serde(default)]` `Option` rather than a populated\ndefault: the v1alpha2 \u2192 v1alpha1 conversion bridge asserts the exact set\nof default-bearing `postgresql` fields (see `v1alpha2::convert`), and the\nresolved values live on [`PostgresBackups`]' accessors instead." nullable: true properties: enabled: description: "Whether pgBackRest is enabled. Defaults to\n[`DEFAULT_POSTGRES_BACKUPS_ENABLED`].\n\nSetting this to `false` leaves the database backed up by **nothing**. It removes\nthe pgBackRest repository, and `PGDATA` stays excluded from Velero's filesystem\nbackup \u2014 deliberately, because a file-by-file copy of a live data directory is a\ntorn copy, and one that looks restorable is worse than none. So this is opting\nout of Postgres disaster recovery, not selecting a different mechanism.\n\nNote also that disabling it on a running cluster does not remove the repository\nhost: PGO leaves the StatefulSet (and its PVC) in place, so this is not a clean\nrevert." nullable: true type: boolean fullSchedule: description: 'Cron schedule for full backups. Defaults to [`DEFAULT_POSTGRES_BACKUPS_FULL_SCHEDULE`]. An empty string disables scheduled full backups.' nullable: true type: string incrementalSchedule: description: 'Cron schedule for incremental backups. Defaults to [`DEFAULT_POSTGRES_BACKUPS_INCREMENTAL_SCHEDULE`]. An empty string disables scheduled incremental backups.' nullable: true type: string repoStorageClassName: description: 'Storage class for the pgBackRest repo PVC. Falls back to the PostgreSQL data storage class, then the cluster default.' nullable: true type: string repoStorageSize: description: 'Storage size for the pgBackRest repo PVC. Defaults to [`DEFAULT_POSTGRES_BACKUPS_REPO_STORAGE_SIZE`].' nullable: true type: string retentionFull: description: "Number of full backups to retain. Defaults to\n[`DEFAULT_POSTGRES_BACKUPS_RETENTION_FULL`].\n\nMinimum 1. pgBackRest's `repo1-retention-full` accepts 1..=9999999, so `0`\nrenders a config the repo host rejects at parse time \u2014 which surfaces as a\nrepo host that cannot configure itself and therefore no backups at all, with\nnothing in the CR status naming the field at fault. The schema bound makes the\nAPI server reject it at admission instead." format: uint8 maximum: 255.0 minimum: 1.0 nullable: true type: integer type: object external: default: false description: Whether PostgreSQL is externally managed (not deployed by operator). type: boolean instances: default: 0 description: 'Number of PostgreSQL instances (replicas). Set to 0 for auto-scaling based on node count (min(nodes, 3)). Auto-scaling requires cluster-scoped RBAC (rbac.scope: cluster). For manual HA, set to 3 or more.' format: uint8 maximum: 255.0 minimum: 0.0 type: integer limits: description: 'Resource limits for PostgreSQL pods (CPU in millicores, memory in MiB). When `None`, no resource limits are set on PostgreSQL pods. **Warning**: Without limits, pods may consume more resources than available on the node, potentially causing node instability.' nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object postgresqlProfile: description: 'Name of a PostgreSQL profile from [`NetBoxEnterpriseSpec::postgresql_profiles`]. When set, the PostgreSQL connection inherits TLS configuration, host, and port from the named profile. Used to centralize external PostgreSQL settings so they are specified once rather than per-component. See also: [`PostgreSQLProfile`] for the profile schema.' nullable: true type: string registry: description: Container registry override for PostgreSQL images. nullable: true type: string resources: description: 'Resource requests for PostgreSQL pods (CPU in millicores, memory in MiB). When `None`, no resource requests are set on PostgreSQL pods, allowing PGO to use Kubernetes defaults (effectively unlimited). This is the default behavior for backward compatibility.' nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object storageClassName: description: 'Storage class name for PostgreSQL PVCs. If not specified, the cluster''s default storage class will be used. Required if the cluster has no default storage class configured.' nullable: true type: string storageSize: default: 4Gi description: Storage size for PostgreSQL PVC (e.g., "10Gi"). type: string version: default: '18' description: PostgreSQL major version. type: string type: object postgresqlProfiles: additionalProperties: description: "A named PostgreSQL connection profile.\n\nBundles connection details (host, port, username) and TLS configuration\nunder a single name so that multiple components can reference it instead\nof duplicating inline settings.\n\nAll fields are optional \u2014 a profile may specify only TLS settings, only\nconnection details, or both. Components resolve each field independently:\ninline config takes priority, then the profile, then defaults.\n\n# Example\n\n```yaml\npostgresqlProfiles:\n netbox:\n host: db.example.com\n port: 5432\n username: netbox\n tlsConfig:\n sslmode: verify-full\n keychainCaCertificates: ['pgo']\n```" properties: host: description: PostgreSQL hostname. nullable: true type: string port: description: PostgreSQL port number. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer tlsConfig: description: TLS configuration for the PostgreSQL connection. nullable: true properties: insecureSkipVerify: default: false description: 'Skip TLS certificate verification. **Warning**: Setting this to `true` disables certificate verification and should only be used for testing or development environments. **PostgreSQL caveat**: This field has no effect on PostgreSQL certificate verification when CA certificates are configured via `keychainCaCertificates`. For backward compatibility, libpq verifies the server certificate whenever `PGSSLROOTCERT` is set and `sslmode=require`, effectively upgrading it to `verify-ca` behavior. Since the operator sets `PGSSLROOTCERT` when any CA certificates are provided, `insecureSkipVerify: true` will not prevent certificate validation for PostgreSQL connections. To skip verification, remove the CA certificates instead.' type: boolean keychainCaCertificates: description: 'Names of CA certificates from the cluster''s `tlsKeychain` to use for verifying server certificates. These names must match entries in `tlsKeychain.caCertificateSecrets[].name`.' items: type: string type: array keychainClientCertificate: description: 'Name of a client certificate from the cluster''s `tlsKeychain` to use for mutual TLS (mTLS) authentication. This name must match an entry in `tlsKeychain.clientCertificateSecrets[].name`.' nullable: true type: string sslmode: default: prefer description: 'SSL mode for PostgreSQL connection. Effective defaults depend on deployment mode: - **External PostgreSQL**: `prefer` (safe fallback that opportunistically uses TLS) - **Operator-managed PostgreSQL**: `require` (PGO always enables TLS) For production external databases, consider using `verify-full` with proper CA certificates configured via `keychainCaCertificates`. **Important**: For backward compatibility, libpq verifies server certificates whenever `PGSSLROOTCERT` is set and `sslmode=require`. Since the operator sets `PGSSLROOTCERT` when `keychainCaCertificates` is non-empty, providing a CA certificate effectively upgrades `require` to behave like `verify-ca`. Ensure the CA certificate matches the server, or omit it to use `require` without verification.' enum: - disable - allow - prefer - require - verify-ca - verify-full type: string type: object username: description: PostgreSQL username. nullable: true type: string type: object description: 'Named PostgreSQL connection profiles for component reuse. Each profile bundles connection details (host, port, username) and TLS configuration under a name. Components like Diode and Hydra can reference a profile via `postgresqlProfile` instead of duplicating inline settings. For example, KOTS populates a `"netbox"` profile with the cluster-level PostgreSQL settings, then Diode/Hydra reference it when "reuse NetBox config" is selected.' type: object proxy: description: 'Egress proxy settings (NBE-1501). When set, the operator injects HTTP_PROXY/HTTPS_PROXY/NO_PROXY into every workload it creates. Absence means no proxy (direct-connection install).' nullable: true properties: httpProxy: description: HTTP proxy URL (e.g. `http://proxy.corp:3128`). nullable: true type: string httpsProxy: description: "HTTPS proxy URL \u2014 used for license/S3/external HTTPS egress." nullable: true type: string noProxy: description: 'Comma-separated extra `NO_PROXY` entries, appended to the cluster-internal defaults the operator always includes.' nullable: true type: string type: object reconcileInterval: description: 'How often the operator re-checks external state even when no Kubernetes events are received. Covers changes that don''t produce watch events: PGO secret rotations, wheelhouse uploads, etc. Accepts Kubernetes-style duration strings (`5m`, `1h`) or bare seconds (`300`). When omitted, falls back to the `--reconcile-interval-secs` CLI flag (default `5m`). Useful for debugging: lower values surface external-state convergence issues faster without redeploying the operator.' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string redis: description: Redis cache/queue configuration (operator-managed or external). properties: additionalConfig: description: "Raw Redis configuration directives appended to the server config.\n\nWritten verbatim into an operator-managed ConfigMap that OpsTree\nmounts via `redisConfig.additionalRedisConfig`, after any directives\ngenerated by `aofEnabled`, `maxMemoryPercent`, `maxMemoryPolicy`, and\n`dynamicConfig`. Raw directives take precedence over typed fields\n(Redis uses the last occurrence).\n\nOnly applies to operator-managed Redis (`external: false`).\n\nExample \u2014 set absolute memory cap and RDB snapshot interval:\n```yaml\nredis:\n additionalConfig: |\n maxmemory 512mb\n save 3600 1\n```" nullable: true type: string aofEnabled: description: 'Whether to enable AOF (Append-Only File) persistence. `false` disables AOF, preventing the OOM death spiral: without AOF, a Redis restart does not replay the log and re-fill memory. Streams and in-flight Diode events are lost on crash, but the NetBox cache (the durable state) is preserved via RDB snapshots. `true` enables AOF for maximum durability. Redis default is `false`. `null` (omit) leaves the Redis server default unchanged. Only applies to operator-managed Redis (`external: false`).' nullable: true type: boolean clusterSize: default: 0 description: 'Number of Redis replicas. Set to 0 for auto-scaling based on node count (min(nodes, 3)). Auto-scaling requires cluster-scoped RBAC (rbac.scope: cluster). Sentinel is deployed when effective size > 1.' format: uint8 maximum: 255.0 minimum: 0.0 type: integer dynamicConfig: description: "Extra Redis configuration directives, applied on the next pod roll.\n\nEach entry is appended to the operator-managed Redis config ConfigMap\n(alongside the directives generated by `aofEnabled`,\n`maxMemoryPercent`, and `maxMemoryPolicy`). When the ConfigMap content\nchanges, the operator rolls the Redis pod automatically so the new\ndirectives take effect \u2014 values land on that restart, not live\n(NBE-1214). The OpsTree Redis Operator's `redisConfig.dynamicConfig`\nruntime `CONFIG SET` path is not used; it never reaches the running\ninstance.\n\nPrefer the typed `maxMemoryPercent`, `maxMemoryPolicy`, and `aofEnabled`\nfields when they cover what you need; reach for `dynamicConfig` only for\ntuning that has no typed equivalent.\n\nExample:\n```yaml\nredis:\n dynamicConfig:\n - \"hz 15\"\n - \"latency-monitor-threshold 100\"\n```\n\nOnly applies to operator-managed Redis (`external: false`)." items: type: string nullable: true type: array external: default: false description: Whether Redis is externally managed (not deployed by operator). type: boolean limits: description: 'Resource limits for Redis pods (CPU in millicores, memory in MiB). When `None`, no resource limits are set on Redis pods. **Warning**: Without limits, pods may consume more resources than available on the node, potentially causing node instability.' nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object maxMemoryPercent: description: "Cap Redis memory at N% of the container memory limit (0\u2013100).\n\nResolves to a `maxmemory ` directive emitted into the Redis\nserver config. Requires `limits.memory` to be set; silently no-ops\notherwise.\n\nThe operator bypasses OpsTree's `redisConfig.maxMemoryPercentOfLimit`\nfield because the upstream entrypoint never plumbs the\n`REDIS_MAX_MEMORY` env var it produces into Redis's config or argv.\n\nCombine with `maxMemoryPolicy` to control what happens when the cap is\nreached. Without a policy, Redis defaults to `noeviction` (reject writes).\n\nOnly applies to operator-managed Redis (`external: false`)." format: uint8 maximum: 100.0 minimum: 0.0 nullable: true type: integer maxMemoryPolicy: description: 'Redis key eviction policy applied when `maxmemory` is reached. Maps directly to Redis''s `maxmemory-policy` configuration directive. Combined with `maxMemoryPercent` to control OOM behavior: set `maxMemoryPercent` to cap memory usage, then choose an eviction policy that matches your workload (LRU for general caches, `noeviction` to reject writes instead of evicting data). See for details.' enum: - noeviction - allkeys-lru - volatile-lru - allkeys-random - volatile-random - volatile-ttl - allkeys-lfu - volatile-lfu nullable: true type: string name: default: redis description: Redis instance name. type: string persistence: default: true description: Whether to enable persistence for Redis data. type: boolean requireAuth: default: false description: 'Whether authentication is required for Redis connections. Default behavior: - Operator-managed: false (Redis operator doesn''t enable auth by default) - External: false (assume no auth unless explicitly configured) Set to true when connecting to Redis instances that require authentication.' type: boolean resources: description: 'Resource requests for Redis pods (CPU in millicores, memory in MiB). When `None`, no resource requests are set on Redis pods (unlimited).' nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object sentinelMasterName: description: 'Sentinel master group name. Required when `sentinels` is configured. Identifies which master group the Sentinels are monitoring (e.g., "netbox-redis"). Ignored for operator-managed Redis.' nullable: true type: string sentinels: description: 'Sentinel endpoints for external Redis HA. When configured, NetBox uses Redis Sentinel for master discovery instead of connecting directly. Each endpoint is a Sentinel instance. Ignored for operator-managed Redis (operator auto-configures Sentinel).' items: description: A Redis Sentinel endpoint address. properties: host: description: Sentinel hostname. type: string port: default: 26379 description: Sentinel port number. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer required: - host type: object nullable: true type: array storageClassName: description: 'Storage class name for Redis PVCs. If not specified, the cluster''s default storage class will be used. Required if the cluster has no default storage class configured. Only used when `persistence: true`.' nullable: true type: string storageSize: default: 1Gi description: 'Storage size for the Redis PVC (e.g., "1Gi"). Only used when `persistence: true`.' type: string tlsConfig: description: 'TLS configuration for external Redis connections. Uses the cluster''s `tlsKeychain` to reference CA and client certificates for secure connections. The presence of this section enables TLS. Only used when `external: true`.' nullable: true properties: insecureSkipVerify: default: false description: 'Skip TLS certificate verification. **Warning**: Setting this to `true` disables certificate verification and should only be used for testing or development environments. **PostgreSQL caveat**: This field has no effect on PostgreSQL certificate verification when CA certificates are configured via `keychainCaCertificates`. For backward compatibility, libpq verifies the server certificate whenever `PGSSLROOTCERT` is set and `sslmode=require`, effectively upgrading it to `verify-ca` behavior. Since the operator sets `PGSSLROOTCERT` when any CA certificates are provided, `insecureSkipVerify: true` will not prevent certificate validation for PostgreSQL connections. To skip verification, remove the CA certificates instead.' type: boolean keychainCaCertificates: description: 'Names of CA certificates from the cluster''s `tlsKeychain` to use for verifying server certificates. These names must match entries in `tlsKeychain.caCertificateSecrets[].name`.' items: type: string type: array keychainClientCertificate: description: 'Name of a client certificate from the cluster''s `tlsKeychain` to use for mutual TLS (mTLS) authentication. This name must match an entry in `tlsKeychain.clientCertificateSecrets[].name`.' nullable: true type: string type: object type: object registry: description: 'Container registry host override for all images. When set, replaces the registry portion of every container image. Use with `registry_namespace` for flat-namespace registries (e.g., Replicated local registry in airgap installs).' nullable: true type: string registryNamespace: description: 'Registry namespace for flat-namespace registries. When set alongside `registry`, all repository paths are flattened to `{namespace}/{basename}`. For example, `docker.io/oryd/hydra:v2.3.0` becomes `{registry}/{namespace}/hydra:v2.3.0`. When only `registry` is set (no namespace), the full original repository path is preserved.' nullable: true type: string replicatedApp: description: 'Replicated-specific tuning knobs (SDK, license fallback, etc.). Groups configuration that only applies when NBE is installed via the Replicated channel. Defaults are appropriate for typical installs; the fields here exist for debugging and airgap-specific tuning.' nullable: true properties: licenseFallback: description: "License-retry tuning.\n\nWhen the Replicated SDK is unreachable and no license is cached, the\noperator blocks reconciliation and issues fresh SDK fetches on\nsubsequent reconciles \u2014 there is no longer a \"proceed as Community\"\nfallback (NBE-1341). These knobs tune how long it retries before\nescalating: once the budget is exhausted the operator emits a `warn!`\nand surfaces the license-unavailable UI banner, but keeps blocking until\na license becomes available. See NBE-863, NBE-1341.\n\n(The `licenseFallback` field name is retained for CRD compatibility.)" nullable: true properties: retryInterval: description: 'Delay between retry attempts. Accepts Kubernetes-style durations (`5s`) or bare seconds (`5`). Defaults to 5 seconds.' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string totalTimeout: description: "Total time budget for the retry loop before escalating. Once exhausted,\nthe operator emits a `warn!` and shows the license-unavailable banner but\nkeeps blocking \u2014 it does not proceed without a license. Accepts\nKubernetes-style durations (`2m`, `1m30s`) or bare seconds (`120`).\nDefaults to 120 seconds." nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object replication: default: {} description: 'Cluster-wide replication and HA configuration. Top-level `topologySpreadConstraints` here apply to every operator-managed deployment unless overridden at the component level.' properties: topologySpreadConstraints: description: "Default `topologySpreadConstraints` applied to every operator-managed\ndeployment's pod spec. Per-component `topologySpreadConstraints` fields\noverride this default for that component.\n\nThe operator injects each deployment's own selector labels into every\nconstraint's `labelSelector` so spread is scoped to that deployment's\npods \u2014 leave `labelSelector` empty (`{}`) unless you need extra filtering." items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: 'MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn''t set. Keys that don''t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).' items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: 'MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won''t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.' format: int32 type: integer nodeAffinityPolicy: description: 'NodeAffinityPolicy indicates how we will treat Pod''s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string nodeTaintsPolicy: description: 'NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.' type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field." type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object routing: description: 'North/south routing selector. Chooses whether the operator emits Gateway API objects or Ingress objects. `auto` (default) detects the Gateway API and falls back to Ingress.' nullable: true properties: mode: default: auto description: 'Which north/south routing path the operator emits. `auto` (the default) emits Gateway API objects when `spec.gateway` is enabled and the operator can list Gateway API resources (CRDs installed and RBAC granted), and Ingress objects otherwise; `gateway`/`ingress` pin a path explicitly.' enum: - auto - gateway - ingress type: string type: object secretChecksumDebounce: description: 'How long the external secret checksum must be stable before being embedded in pod template annotations (which triggers a rolling restart). PGO rewrites secrets during initial cluster setup, so `resourceVersion` increments on every housekeeping write. The debounce window prevents those transient changes from causing unnecessary rolling restarts. Accepts Kubernetes-style duration strings (`30s`, `1m`) or bare seconds. When omitted, defaults to `30s`. Lower values speed up convergence in test environments; raise it for slow-bootstrapping clusters.' nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string storageBackend: default: pvc description: 'Where NetBox media/scripts storage lives (NBE-1691): `pvc` (default), `external` (user-provided S3), or `in-cluster` (operator-provisioned Garage). Resolved from v1alpha2 through the conversion bridge.' enum: - pvc - external - in-cluster type: string suspend: default: false description: 'Suspend reconciliation/annealing of resources while debugging. When set to `true`, the operator will skip applying downstream resources and wait for the field to be cleared before resuming reconciliation.' type: boolean tlsKeychain: description: 'TLS keychain configuration for CA and client certificates. Allows specifying trusted CA certificates and client certificates for secure connections to external services.' nullable: true properties: caCertificateSecrets: description: 'CA certificate secrets to trust for TLS connections. These certificates will be added to the trust store for validating server certificates when connecting to external services.' items: description: "Reference to a Kubernetes secret containing a CA certificate.\n\nUsed for configuring trusted CA certificates for TLS verification.\nThe secret should contain the CA certificate in PEM format.\n\n# Example\n\n```yaml\n- name: my-ca-secret\n key: ca.crt\n- name: aliased-ca\n secret: actual-secret-name\n```" properties: key: default: ca.crt description: 'Key within the secret that contains the CA certificate data. Defaults to `ca.crt` if not specified.' type: string name: description: 'Logical name for this CA certificate entry. If `secret` is not specified, this name is also used as the Kubernetes secret name.' type: string secret: description: 'Name of the Kubernetes secret containing the CA certificate. If not specified, the `name` field is used as the secret name.' nullable: true type: string required: - name type: object type: array clientCertificateSecrets: description: 'Client certificate secrets for mutual TLS (mTLS) authentication. These certificates can be used to authenticate the client when connecting to services that require client certificate authentication.' items: description: "Reference to a Kubernetes secret containing a client certificate and private key.\n\nUsed for configuring client certificates for mutual TLS (mTLS) authentication.\nThe secret should be of type `kubernetes.io/tls` or contain equivalent keys.\n\n# Example\n\n```yaml\n- name: my-client-cert\n certKey: tls.crt\n privateKey: tls.key\n- name: aliased-client\n secret: actual-secret-name\n```" properties: certKey: default: tls.crt description: 'Key within the secret that contains the client certificate data. Defaults to `tls.crt` (standard key for `kubernetes.io/tls` secrets).' type: string name: description: 'Logical name for this client certificate entry. If `secret` is not specified, this name is also used as the Kubernetes secret name.' type: string privateKey: default: tls.key description: 'Key within the secret that contains the private key data. Defaults to `tls.key` (standard key for `kubernetes.io/tls` secrets).' type: string secret: description: 'Name of the Kubernetes secret containing the client certificate. If not specified, the `name` field is used as the secret name.' nullable: true type: string required: - name type: object type: array type: object turbobulk: default: enableWrites: false enabled: true description: 'TurboBulk bulk data API plugin (Premium tier). `enabled` is the user lever (default on); the operator additionally requires a Premium-tier license before activating the plugin.' properties: enableWrites: default: false description: 'Enable TurboBulk write APIs (bulk load / delete). Default `false`. Bulk writes can modify or delete large numbers of objects in one transaction; keep disabled until write workflows are validated.' type: boolean enabled: default: true description: "Enable or disable the TurboBulk plugin (the user lever). Default `true`.\nEffective only on Premium-tier licenses \u2014 the operator gates on tier." type: boolean type: object required: - netbox - postgresql - redis type: object status: description: Status of the NetBoxEnterprise custom resource. nullable: true properties: components: default: copilot: ready: false diode: ready: false netbox: ready: false postgresql: ready: false redis: ready: false worker: ready: false description: Detailed status for each component. properties: copilot: default: ready: false description: Copilot backend component status (if enabled). properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object diode: default: ready: false description: Diode application component status (if enabled). properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object netbox: default: ready: false description: NetBox web application component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object postgresql: default: ready: false description: PostgreSQL database component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object redis: default: ready: false description: Redis cache/queue component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object worker: default: ready: false description: NetBox worker component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object type: object conditions: description: Kubernetes standard conditions array. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array convergedGeneration: description: 'Highest CR generation that has reached all-components-ready. When this equals `metadata.generation`, the current config rollout has converged and the progress sentinel reports Ready. (NBE-1255)' format: int64 nullable: true type: integer dependencyWaitStartedAt: description: 'RFC3339 timestamp of when the operator first observed a dependency-wait timeout for the current generation. Used to measure how long a wait has persisted so a brief wait (`WaitingForDependencies`) can be distinguished from a hanging one (`DependencyWaitStalled`) without ever asserting failure. Cleared on the first successful reconcile. (NBE-1401)' nullable: true type: string lastReconcileTime: description: Timestamp of the last successful reconciliation (RFC3339 format). nullable: true type: string license: default: edition: Community isAssuranceEntitled: false isCopilotEntitled: false tier: Community description: License associated with the deployment properties: channelName: description: Channel name (e.g., stable, beta, dev) nullable: true type: string customerEmail: description: Customer email from license nullable: true type: string customerName: description: Customer name from license nullable: true type: string edition: default: Community description: NetBox edition (Community or Enterprise) enum: - Community - Enterprise type: string entitlements: additionalProperties: properties: title: description: Entitlement title type: string value: description: Entitlement value (can be any JSON type) x-kubernetes-preserve-unknown-fields: true type: object description: Raw entitlements for additional checks type: object expiresAt: description: Expiration date (ISO 8601 format) nullable: true type: string isAssuranceEntitled: default: false description: Whether NetBox Assurance is entitled type: boolean isCopilotEntitled: default: false description: Whether Copilot is entitled type: boolean isNdxEntitled: default: false description: Whether the NDX plugin is entitled (paid NDX token present) type: boolean isVisualExplorerEntitled: default: false description: Whether Visual Explorer (the first UI Platform app) is entitled type: boolean licenseId: description: Unique license identifier nullable: true type: string licenseType: description: License type (dev, trial, prod, paid) nullable: true type: string platformOrgId: description: Platform organization ID nullable: true type: string tier: default: Community description: NetBox tier from license entitlement enum: - Community - Starter - Professional - Premium type: string type: object licenseStatus: description: 'Computed license display string for the `kubectl get` LICENSE printer column. Shows the license type ("Dev", "Trial", "Paid") when the license is healthy, or the condition reason ("LicenseMismatch", "LicenseExpired", "LicenseUnavailable") when it is not. `None` until the first reconcile completes.' nullable: true type: string message: description: Human-readable message about the current state. nullable: true type: string migrationHash: description: 'SHA-256 hash of migration-relevant inputs (image tag, wheelhouse, plugin config). When this changes, the operator runs a migration Job before updating NetBox Deployments.' nullable: true type: string migrationPhase1Hash: description: 'SHA-256 hash of Phase 1 migration inputs (image + core config, no plugins). When this hash matches, Phase 1 (core migrations) is considered complete and the operator proceeds directly to Phase 2. (NBE-902)' nullable: true type: string observedGeneration: description: Generation observed by the controller during last reconciliation. format: int64 nullable: true type: integer phase: description: "Coarse startup phase the operator reports on `status.phase` so install\nprogress is visible from `kubectl`, the e2e serving gate, and the KOTS UI\ninstead of an opaque multi-minute 503 (NBE-1529).\n\nVariants are ordered along the install timeline. The operator observes\n`WaitingForDependencies`, `Migrating`, `Serving`, and `Degraded` directly\n(dependency-wait timer, migration Job status, component readiness, existing\nconditions). The in-pod phases \u2014 `InstallingPlugins`, `CollectingStatic`,\n`Booting` \u2014 happen inside the NetBox entrypoint and are reported back via\nthe `nbe_startup` table the operator reads.\n\nSerializes to its PascalCase variant name (k8s phase convention), which is\nserde's default for fieldless variants \u2014 so the serde wire form and the\n`strum::Display` form match without explicit renames." enum: - WaitingForDependencies - Migrating - InstallingPlugins - CollectingStatic - Booting - Serving - Degraded nullable: true type: string ready: default: false description: Overall cluster readiness indicator. type: boolean secretChecksum: description: 'Aggregate hash of all external secret `resourceVersion` values. Used by the debounce logic to detect when PGO secrets have stabilized.' nullable: true type: string secretChecksumObservedAt: description: 'RFC 3339 timestamp recording when `secret_checksum` was first observed to change. The operator only embeds external-secret checksums in pod template annotations once this timestamp is older than the debounce window, preventing deployment thrashing during PGO''s initial secret setup phase.' nullable: true type: string version: default: '' description: Netbox Labs Operator Version type: string wheelhouseFingerprint: description: "Last-seen wheelhouse content fingerprint from the wheelhouse-watcher\nsidecar (`_` or `absent`). Persisted in status so the\nmigration hash is a pure function of stored state (never cleared on a\nfailed live read \u2014 fail-safe). (NBE-1320)" nullable: true type: string type: object required: - spec title: NetBoxEnterprise type: object served: true storage: false subresources: status: {}