# NetBoxEnterprise CRD from netbox-enterprise origin/release/2.4.0 (ab6af1da51b7), # charts/netbox-enterprise-crds/templates/netboxenterprises.netboxlabs.com.yaml. Generated by scripts/release/publish-crd.ts; do not edit. apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: helm.sh/resource-policy: keep labels: name: netboxenterprises.netboxlabs.com spec: group: netboxlabs.com names: categories: [] kind: NetBoxEnterprise plural: netboxenterprises shortNames: - nbe singular: netboxenterprise scope: Namespaced versions: - additionalPrinterColumns: - description: Whether the cluster is ready jsonPath: .status.ready name: Ready type: boolean - description: License tier jsonPath: .status.license.tier name: Tier type: string - description: License type when healthy, or the reason when not (LicenseMismatch/LicenseExpired/LicenseUnavailable) jsonPath: .status.licenseStatus name: License type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha2 schema: openAPIV3Schema: description: Custom resource representing a NetBox Labs Cluster (v1alpha2) properties: spec: description: |- v1alpha2 NetBoxEnterprise spec — sparse, with defaults resolved by accessors. Field-population rules enforced by [`super::schema_regression`]: - Every field is `Option`, `Vec`, or `BTreeMap` - Every field has `#[serde(default, skip_serializing_if = "...")]` - **No `#[serde(default = "fn")]`** — defaults live in [`super::defaults`] and are exposed through per-field accessors on this type properties: annotations: additionalProperties: type: string description: Annotations applied to all cluster resources. nullable: true type: object backups: description: |- Enable Velero backups for this cluster. Requires Velero to be installed in the cluster. Defaults to `false`. nullable: true type: boolean changes: description: |- Change Management plugin (`netbox_changes`). Enabled by default; only takes effect on an enterprise license. See [`Self::changes`]. nullable: true properties: enabled: description: |- Enable or disable Change Management (the `netbox_changes` plugin). Defaults to [`DEFAULT_CHANGES_ENABLED`] (on). Requires an enterprise license to take effect. Disabling also turns off Change Management's branch governance: protecting `main` from direct edits and requiring approval before a branch is merged. Existing change requests and history are retained (the plugin's tables are not dropped), and re-enabling restores access to them. nullable: true type: boolean type: object clusterDnsSuffix: description: |- Kubernetes cluster DNS suffix. Most clusters use the default `cluster.local`, but some environments configure a different suffix. All operator-generated FQDNs use this value when set. nullable: true type: string copilot: description: |- Copilot AI backend configuration. Off by default — the operator only deploys Copilot when the user opts in via `copilot.enabled = true` and supplies an LLM API key Secret. nullable: true properties: awsCredentialsSecret: description: |- Optional Kubernetes Secret with explicit AWS credentials (keys: `aws_access_key_id`, `aws_secret_access_key`). When omitted, the Copilot backend uses ambient credential resolution (IRSA, instance profile, etc.). nullable: true type: string awsRegion: description: |- AWS region for Bedrock provider. Defaults to [`DEFAULT_COPILOT_AWS_REGION`]. Only meaningful when `llm_provider == Bedrock`. nullable: true type: string databaseUser: description: |- PostgreSQL user for Copilot. Defaults to [`DEFAULT_COPILOT_DB_USER`]. maxLength: 63 minLength: 1 nullable: true type: string enabled: description: |- Enable the Copilot backend. Defaults to [`DEFAULT_COPILOT_ENABLED`] (off). nullable: true type: boolean image: description: Container image. Defaults via [`CopilotImage`] accessors. nullable: true properties: digest: description: |- Optional image digest for immutable references. Takes precedence over `tag` in the operator's image-string assembly when set. nullable: true type: string imagePullSecrets: description: |- Pull secrets for private registries. Merged with cluster-level `spec.imagePullSecrets` at reconcile time. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: description: |- Container image pull policy. Variant names are PascalCase to match Kubernetes API conventions exactly. Do not add `#[serde(rename_all)]` — the Rust names must serialize verbatim. See: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy enum: - IfNotPresent - Always - Never nullable: true type: string registry: description: Container registry host. Defaults to [`DEFAULT_COPILOT_REGISTRY`]. nullable: true type: string repository: description: Repository path. Defaults to [`DEFAULT_COPILOT_REPOSITORY`]. nullable: true type: string tag: description: Image tag. Defaults to [`DEFAULT_COPILOT_TAG`]. nullable: true type: string type: object limits: description: Resource limits. Defaults to [`default_copilot_limits`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object llmApiKeySecret: description: |- Name of the Kubernetes Secret holding the LLM API key. Defaults to [`DEFAULT_COPILOT_LLM_API_KEY_SECRET`]. nullable: true type: string llmApiKeySecretKey: description: |- Key within the LLM API key Secret. Defaults to [`DEFAULT_COPILOT_LLM_API_KEY_SECRET_KEY`]. nullable: true type: string llmMaxSteps: description: |- Maximum LLM reasoning steps per turn. Defaults to [`DEFAULT_COPILOT_LLM_MAX_STEPS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer llmModel: description: LLM model identifier. Defaults to [`DEFAULT_COPILOT_LLM_MODEL`]. nullable: true type: string llmProvider: description: LLM provider for the Copilot backend. enum: - anthropic - bedrock nullable: true type: string netboxAuthApiTimeout: description: |- Timeout (seconds) for NetBox auth API calls. Defaults to [`DEFAULT_COPILOT_NETBOX_AUTH_API_TIMEOUT`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer netboxAuthCacheTtl: description: |- Session-validation cache TTL (seconds). Defaults to [`DEFAULT_COPILOT_NETBOX_AUTH_CACHE_TTL`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer netboxAuthCookieName: description: |- NetBox session cookie name read by Copilot. Defaults to [`DEFAULT_COPILOT_NETBOX_AUTH_COOKIE_NAME`]. nullable: true type: string postgres: description: |- External PostgreSQL connection. When omitted, Copilot uses the PGO-generated secret `{cluster-name}-postgres-pguser-copilot`. nullable: true properties: databaseUrl: description: |- Secret reference holding the full `DATABASE_URL` URI (e.g. `postgresql://user:pass@host:5432/db?sslmode=require`). properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object keychainCaCertificates: description: |- CA certificates from `spec.tlsKeychain` to install for verifying the Copilot PostgreSQL server certificate. Required when `ssl_mode` is `verify-ca` or `verify-full`. items: type: string type: array keychainClientCertificate: description: |- Client certificate from `spec.tlsKeychain` to present for mutual TLS, when the server's `pg_hba.conf` demands `clientcert=verify-ca` or `verify-full`. The key must be PKCS#8 PEM. nullable: true type: string sslMode: description: |- PostgreSQL SSL connection mode. Controls how SSL/TLS is used when connecting to PostgreSQL. These modes match the libpq `sslmode` parameter values. # Modes | Mode | Description | |------|-------------| | `disable` | No SSL - unencrypted connection | | `allow` | Try non-SSL first, use SSL if server requires it | | `prefer` | Try SSL first, fall back to non-SSL (default for external) | | `require` | Require SSL, but don't verify the server certificate | | `verify-ca` | Require SSL and verify the server certificate is signed by a trusted CA | | `verify-full` | Require SSL, verify CA, and verify the server hostname matches the certificate | # Security Recommendations - For production external databases, use `verify-full` with proper CA certificates - Operator-managed PostgreSQL (PGO) always uses `require` internally - `disable` and `allow` should only be used in development environments enum: - disable - allow - prefer - require - verify-ca - verify-full nullable: true type: string required: - databaseUrl type: object redisDb: description: |- Redis database number for Copilot. Defaults to [`DEFAULT_COPILOT_REDIS_DB`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer replicas: description: Replica count. Defaults to [`DEFAULT_COPILOT_REPLICAS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: Resource requests. Defaults to [`default_copilot_resources`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object timeouts: description: |- Per-service timeout overrides for the Copilot Ingress. Field-level merges over the cluster-wide `spec.ingress.timeouts` default. When unset, Copilot falls back to long-lived-connection defaults suitable for streaming chat responses. nullable: true properties: gateway: description: Gateway API HTTPRoute rule timeout overrides. nullable: true properties: backendRequest: description: |- BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended nullable: true type: string request: description: |- Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended nullable: true type: string type: object ingress: description: Ingress-level timeout overrides (nginx annotation translation). nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object topologySpreadConstraints: description: |- Topology spread constraints for Copilot pods. Useful for HA deployments with multiple replicas. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object diode: description: |- Diode ingestion suite configuration (ingester + reconciler + auth + Hydra OIDC server). Enabled by default — see [`Self::diode`]. nullable: true properties: auth: description: Diode auth deployment. nullable: true properties: annotations: additionalProperties: type: string description: Annotations to apply to auth pods. nullable: true type: object enabled: description: |- Enable the auth service deployment. Defaults to [`DEFAULT_DIODE_ENABLED`]. nullable: true type: boolean extraEnvs: description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: Container image. nullable: true properties: digest: description: |- Optional image digest for immutable references. Component-specific default applies when unset. v1alpha2 is the served *and* storage version, so this is the schema every install's CR is actually validated against — the same guard on [`crate::crd::v1alpha1::diode::DiodeImage::digest`] never fires on the live path (NBE-2217). The empty-string alternation is load-bearing, not slack: `pattern` applies to any string that is *present*, and both the accessors below and `resolve_diode_image` deliberately treat `digest: ""` as unset (falls back to the per-component pinned default) — a bare digest pattern would reject that value at admission before it ever reaches the resolver. The pattern is restricted to the two algorithms containerd actually accepts, each at its fixed hex length, lowercase only — go-digest requires lowercase hex for `sha256`/`sha512`, so a syntactically digest-shaped value like `sha256:ABCD…` or `sha256:a` would otherwise pass admission and still hit the kubelet as InvalidImageName. nullable: true pattern: ^$|^sha256:[a-f0-9]{64}$|^sha512:[a-f0-9]{128}$ type: string imagePullSecrets: description: Pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: description: |- Container image pull policy. Variant names are PascalCase to match Kubernetes API conventions exactly. Do not add `#[serde(rename_all)]` — the Rust names must serialize verbatim. See: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy enum: - IfNotPresent - Always - Never nullable: true type: string registry: description: Container registry host. Defaults to [`DEFAULT_DIODE_REGISTRY`]. nullable: true type: string repository: description: |- Repository path. Component-specific default applies when unset — see the per-component accessors. nullable: true type: string tag: description: Image tag. Component-specific default applies when unset. nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to auth pods. nullable: true type: object limits: description: Resource limits. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object port: description: Service port. Defaults to [`DEFAULT_DIODE_AUTH_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer replicas: description: Replica count. Defaults to [`DEFAULT_DIODE_REPLICAS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: Resource requests. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object serviceAccount: description: |- Kubernetes service account name. Auto-generated as `{cluster-name}-diode-auth` when unset. nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for auth pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object config: description: Diode runtime configuration (ingester / reconciler / auth / hydra). nullable: true properties: auth: description: Diode auth runtime configuration. nullable: true properties: logLevel: description: |- Log level for Diode services. Uses Go's slog package levels. See [slog Level documentation](https://pkg.go.dev/log/slog#Level). enum: - INFO - DEBUG - WARN - ERROR nullable: true type: string sentryDsn: description: Sentry DSN for error tracking. nullable: true type: string telemetryConfig: description: Telemetry configuration. nullable: true properties: environment: description: |- Deployment environment name. When `None`, the Diode binary uses its compiled-in default. nullable: true type: string metricsEnabled: description: |- Enable Prometheus metrics endpoint. Defaults to [`DEFAULT_DIODE_METRICS_ENABLED`]. nullable: true type: boolean metricsExporter: description: |- Metrics exporter backend for Diode telemetry. See [Diode telemetry config]. [Diode telemetry config]: https://github.com/netboxlabs/diode/blob/62f1c2ea05452f3bf32cab7932ed61d1877c7da0/diode-server/telemetry/config.go enum: - prometheus - otlp - console - none nullable: true type: string metricsPort: description: |- Port for the metrics endpoint. Component-specific default applies when unset. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer traceExporter: description: |- Trace exporter backend for Diode telemetry. See [Diode telemetry config]. [Diode telemetry config]: https://github.com/netboxlabs/diode/blob/62f1c2ea05452f3bf32cab7932ed61d1877c7da0/diode-server/telemetry/config.go enum: - otlp - console - none nullable: true type: string type: object type: object hydra: description: Hydra OIDC server runtime configuration. nullable: true properties: oidc: description: OIDC configuration. nullable: true properties: subjectIdentifiers: description: Subject identifier configuration. properties: supportedTypes: description: Supported subject identifier types. items: description: |- OIDC subject identifier algorithm type. See [Hydra subject identifiers](https://www.ory.com/docs/hydra/guides/openid). enum: - public - pairwise type: string type: array required: - supportedTypes type: object required: - subjectIdentifiers type: object serve: description: Server listening configuration. nullable: true properties: admin: description: Admin API server configuration. nullable: true properties: host: description: Bind address. Defaults to [`DEFAULT_HYDRA_BIND_HOST`]. nullable: true type: string port: description: Admin API port. Defaults to [`DEFAULT_HYDRA_ADMIN_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer type: object public: description: Public API server configuration. nullable: true properties: host: description: Bind address. Defaults to [`DEFAULT_HYDRA_BIND_HOST`]. nullable: true type: string port: description: Public API port. Defaults to [`DEFAULT_HYDRA_PUBLIC_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer type: object tls: description: TLS termination configuration. nullable: true properties: allowTerminationFrom: description: |- Networks allowed to terminate TLS (e.g., load balancers). Defaults to [`default_hydra_tls_allow_termination_from`] when unset. items: pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\/(3[0-2]|[0-2]?[0-9])$ type: string nullable: true type: array type: object type: object strategies: description: Token strategies. nullable: true properties: accessToken: description: Access token strategy. enum: - jwt - opaque type: string jwt: description: JWT-specific configuration. properties: scopeClaim: description: Format for scope claim in JWT. enum: - list - string - both type: string required: - scopeClaim type: object required: - accessToken - jwt type: object ttl: description: Token TTL configuration. nullable: true properties: accessToken: description: |- Access token lifetime (e.g., "1h", "30m"). Defaults to [`DEFAULT_HYDRA_ACCESS_TOKEN_TTL`]. nullable: true type: string type: object urls: description: |- URL configuration. When omitted (and `urls.self.issuer` unset within), the operator auto-generates the issuer URL from cluster name and namespace at reconcile time. nullable: true properties: self: description: Self-referential URLs. nullable: true properties: issuer: description: |- OIDC issuer URL. If not specified, will be auto-generated based on cluster name and namespace. nullable: true type: string type: object type: object type: object ingester: description: Diode ingester runtime configuration. nullable: true properties: logLevel: description: |- Log level for Diode services. Uses Go's slog package levels. See [slog Level documentation](https://pkg.go.dev/log/slog#Level). enum: - INFO - DEBUG - WARN - ERROR nullable: true type: string redisMemoryHighWatermarkPct: description: |- Redis `used_memory`/`maxmemory` percentage at which the ingester rejects ingest with `ResourceExhausted` (`REDIS_MEMORY_HIGH_WATERMARK_PCT`). Defaults to [`DEFAULT_DIODE_REDIS_MEMORY_HIGH_WATERMARK_PCT`] (90); 0 disables the check. Only meaningful when Redis has a `maxmemory` cap. format: uint8 maximum: 100.0 minimum: 0.0 nullable: true type: integer redisStreamDb: description: |- Redis database number for stream storage. Defaults to [`DEFAULT_DIODE_REDIS_STREAM_DB`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer sentryDsn: description: Sentry DSN for error tracking. nullable: true type: string telemetryConfig: description: Telemetry configuration. nullable: true properties: environment: description: |- Deployment environment name. When `None`, the Diode binary uses its compiled-in default. nullable: true type: string metricsEnabled: description: |- Enable Prometheus metrics endpoint. Defaults to [`DEFAULT_DIODE_METRICS_ENABLED`]. nullable: true type: boolean metricsExporter: description: |- Metrics exporter backend for Diode telemetry. See [Diode telemetry config]. [Diode telemetry config]: https://github.com/netboxlabs/diode/blob/62f1c2ea05452f3bf32cab7932ed61d1877c7da0/diode-server/telemetry/config.go enum: - prometheus - otlp - console - none nullable: true type: string metricsPort: description: |- Port for the metrics endpoint. Component-specific default applies when unset. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer traceExporter: description: |- Trace exporter backend for Diode telemetry. See [Diode telemetry config]. [Diode telemetry config]: https://github.com/netboxlabs/diode/blob/62f1c2ea05452f3bf32cab7932ed61d1877c7da0/diode-server/telemetry/config.go enum: - otlp - console - none nullable: true type: string type: object type: object reconciler: description: Diode reconciler runtime configuration. nullable: true properties: autoApplyChangesets: description: |- Automatically apply changesets to NetBox. Defaults to [`DEFAULT_DIODE_AUTO_APPLY_CHANGESETS`]. nullable: true type: boolean autoApplyProcessorConcurrency: description: |- Number of concurrent auto-apply processors (`AUTO_APPLY_PROCESSOR_CONCURRENCY`). Defaults to [`DEFAULT_DIODE_AUTO_APPLY_PROCESSOR_CONCURRENCY`]. format: uint8 maximum: 255.0 minimum: 1.0 nullable: true type: integer databaseName: description: PostgreSQL database name. maxLength: 63 minLength: 1 nullable: true type: string databaseUser: description: PostgreSQL database user. maxLength: 63 minLength: 1 nullable: true type: string ingestionLogProcessorConcurrency: description: |- Number of concurrent ingestion-log processors (`INGESTION_LOG_PROCESSOR_CONCURRENCY`). Defaults to [`DEFAULT_DIODE_INGESTION_LOG_PROCESSOR_CONCURRENCY`]. format: uint8 maximum: 255.0 minimum: 1.0 nullable: true type: integer logLevel: description: |- Log level for Diode services. Uses Go's slog package levels. See [slog Level documentation](https://pkg.go.dev/log/slog#Level). enum: - INFO - DEBUG - WARN - ERROR nullable: true type: string migrationEnabled: description: |- Enable database migrations on startup. Defaults to [`DEFAULT_DIODE_MIGRATION_ENABLED`]. nullable: true type: boolean netboxClientId: description: OAuth2 client ID for NetBox authentication. nullable: true type: string pluginApiBaseUrl: description: |- NetBox Diode plugin API base URL. When `None`, the operator auto-generates one from cluster metadata at reconcile time. nullable: true type: string postgres: description: |- External PostgreSQL connection. When `None`, the operator uses the PGO-generated secret `{cluster-name}-postgres-pguser-diode`. nullable: true properties: password: description: Password reference (external Secret). properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object postgresqlProfile: description: Name of a PostgreSQL profile from `postgresqlProfiles`. nullable: true type: string required: - password type: object rateLimitBurst: description: Rate limit burst size. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer rateLimitNetboxBurst: description: NetBox API rate limit burst size. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer rateLimitNetboxRps: description: NetBox API rate limit requests per second. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer rateLimitRps: description: Rate limit requests per second. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer redisDb: description: Redis database number. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer redisStreamDb: description: Redis database number for stream storage. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer sentryDsn: description: Sentry DSN for error tracking. nullable: true type: string telemetryConfig: description: Telemetry configuration. nullable: true properties: environment: description: |- Deployment environment name. When `None`, the Diode binary uses its compiled-in default. nullable: true type: string metricsEnabled: description: |- Enable Prometheus metrics endpoint. Defaults to [`DEFAULT_DIODE_METRICS_ENABLED`]. nullable: true type: boolean metricsExporter: description: |- Metrics exporter backend for Diode telemetry. See [Diode telemetry config]. [Diode telemetry config]: https://github.com/netboxlabs/diode/blob/62f1c2ea05452f3bf32cab7932ed61d1877c7da0/diode-server/telemetry/config.go enum: - prometheus - otlp - console - none nullable: true type: string metricsPort: description: |- Port for the metrics endpoint. Component-specific default applies when unset. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer traceExporter: description: |- Trace exporter backend for Diode telemetry. See [Diode telemetry config]. [Diode telemetry config]: https://github.com/netboxlabs/diode/blob/62f1c2ea05452f3bf32cab7932ed61d1877c7da0/diode-server/telemetry/config.go enum: - otlp - console - none nullable: true type: string type: object type: object type: object enabled: description: |- Enable the entire Diode suite. Defaults to [`DEFAULT_DIODE_ENABLED`]. nullable: true type: boolean hydra: description: Hydra OIDC server deployment. nullable: true properties: annotations: additionalProperties: type: string description: Annotations to apply to Hydra pods. nullable: true type: object autoMigrate: description: |- Enable automatic database migrations on startup. Defaults to [`DEFAULT_HYDRA_AUTO_MIGRATE`]. nullable: true type: boolean databaseName: description: |- PostgreSQL database name for Hydra. Defaults to [`DEFAULT_HYDRA_DATABASE_NAME`]. maxLength: 63 minLength: 1 nullable: true type: string databaseUser: description: |- PostgreSQL database user for Hydra. Defaults to [`DEFAULT_HYDRA_DATABASE_USER`]. maxLength: 63 minLength: 1 nullable: true type: string enabled: description: |- Enable the Hydra deployment. Defaults to [`DEFAULT_HYDRA_ENABLED`]. nullable: true type: boolean extraEnvs: description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: Container image. Defaults via [`HydraImage`] accessors. nullable: true properties: digest: description: |- Optional image digest for immutable references. Takes precedence over `tag` when the operator assembles the image string. nullable: true type: string imagePullSecrets: description: Pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: description: |- Container image pull policy. Variant names are PascalCase to match Kubernetes API conventions exactly. Do not add `#[serde(rename_all)]` — the Rust names must serialize verbatim. See: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy enum: - IfNotPresent - Always - Never nullable: true type: string registry: description: Container registry host. Defaults to [`DEFAULT_HYDRA_REGISTRY`]. nullable: true type: string repository: description: Repository path. Defaults to [`DEFAULT_HYDRA_REPOSITORY`]. nullable: true type: string tag: description: Image tag. Defaults to [`DEFAULT_HYDRA_TAG`]. nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to Hydra pods. nullable: true type: object limits: description: Resource limits. Defaults to [`default_hydra_limits`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object postgresqlProfile: description: |- Name of a PostgreSQL profile from `postgresqlProfiles` from which Hydra inherits PostgreSQL connection settings. nullable: true type: string replicas: description: Replica count. Defaults to [`DEFAULT_HYDRA_REPLICAS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: Resource requests. Defaults to [`default_hydra_resources`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object secrets: description: |- Kubernetes Secret references for Hydra. When unset, the operator auto-generates references based on PostgreSQL configuration. nullable: true properties: cookie: description: Cookie secret for session management. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object dsn: description: Database connection DSN. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object system: description: System secret for encryption. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object serviceAccount: description: |- Kubernetes service account name. When `None`, the operator auto-generates `{cluster-name}-diode-hydra`. nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for Hydra pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object ingester: description: Diode ingester deployment. nullable: true properties: annotations: additionalProperties: type: string description: Annotations to apply to ingester pods. nullable: true type: object enabled: description: |- Enable the ingester deployment. Defaults to [`DEFAULT_DIODE_ENABLED`]. nullable: true type: boolean extraEnvs: description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: |- Container image. Defaults via [`DiodeImage`] accessors and the per-component fallbacks on [`Self::repository`] / [`Self::tag`] / [`Self::digest`]. nullable: true properties: digest: description: |- Optional image digest for immutable references. Component-specific default applies when unset. v1alpha2 is the served *and* storage version, so this is the schema every install's CR is actually validated against — the same guard on [`crate::crd::v1alpha1::diode::DiodeImage::digest`] never fires on the live path (NBE-2217). The empty-string alternation is load-bearing, not slack: `pattern` applies to any string that is *present*, and both the accessors below and `resolve_diode_image` deliberately treat `digest: ""` as unset (falls back to the per-component pinned default) — a bare digest pattern would reject that value at admission before it ever reaches the resolver. The pattern is restricted to the two algorithms containerd actually accepts, each at its fixed hex length, lowercase only — go-digest requires lowercase hex for `sha256`/`sha512`, so a syntactically digest-shaped value like `sha256:ABCD…` or `sha256:a` would otherwise pass admission and still hit the kubelet as InvalidImageName. nullable: true pattern: ^$|^sha256:[a-f0-9]{64}$|^sha512:[a-f0-9]{128}$ type: string imagePullSecrets: description: Pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: description: |- Container image pull policy. Variant names are PascalCase to match Kubernetes API conventions exactly. Do not add `#[serde(rename_all)]` — the Rust names must serialize verbatim. See: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy enum: - IfNotPresent - Always - Never nullable: true type: string registry: description: Container registry host. Defaults to [`DEFAULT_DIODE_REGISTRY`]. nullable: true type: string repository: description: |- Repository path. Component-specific default applies when unset — see the per-component accessors. nullable: true type: string tag: description: Image tag. Component-specific default applies when unset. nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to ingester pods. nullable: true type: object limits: description: Resource limits. Defaults to [`default_diode_limits`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object port: description: Service port. Defaults to [`DEFAULT_DIODE_INGESTER_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer replicas: description: Replica count. Defaults to [`DEFAULT_DIODE_REPLICAS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: Resource requests. Defaults to [`default_diode_resources`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object serviceAccount: description: |- Kubernetes service account name. Auto-generated as `{cluster-name}-diode-ingester` when unset. nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for ingester pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object reconciler: description: Diode reconciler deployment. nullable: true properties: annotations: additionalProperties: type: string description: Annotations to apply to reconciler pods. nullable: true type: object enabled: description: |- Enable the reconciler deployment. Defaults to [`DEFAULT_DIODE_ENABLED`]. nullable: true type: boolean extraEnvs: description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: Container image. nullable: true properties: digest: description: |- Optional image digest for immutable references. Component-specific default applies when unset. v1alpha2 is the served *and* storage version, so this is the schema every install's CR is actually validated against — the same guard on [`crate::crd::v1alpha1::diode::DiodeImage::digest`] never fires on the live path (NBE-2217). The empty-string alternation is load-bearing, not slack: `pattern` applies to any string that is *present*, and both the accessors below and `resolve_diode_image` deliberately treat `digest: ""` as unset (falls back to the per-component pinned default) — a bare digest pattern would reject that value at admission before it ever reaches the resolver. The pattern is restricted to the two algorithms containerd actually accepts, each at its fixed hex length, lowercase only — go-digest requires lowercase hex for `sha256`/`sha512`, so a syntactically digest-shaped value like `sha256:ABCD…` or `sha256:a` would otherwise pass admission and still hit the kubelet as InvalidImageName. nullable: true pattern: ^$|^sha256:[a-f0-9]{64}$|^sha512:[a-f0-9]{128}$ type: string imagePullSecrets: description: Pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: description: |- Container image pull policy. Variant names are PascalCase to match Kubernetes API conventions exactly. Do not add `#[serde(rename_all)]` — the Rust names must serialize verbatim. See: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy enum: - IfNotPresent - Always - Never nullable: true type: string registry: description: Container registry host. Defaults to [`DEFAULT_DIODE_REGISTRY`]. nullable: true type: string repository: description: |- Repository path. Component-specific default applies when unset — see the per-component accessors. nullable: true type: string tag: description: Image tag. Component-specific default applies when unset. nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to reconciler pods. nullable: true type: object limits: description: Resource limits. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object port: description: Service port. Defaults to [`DEFAULT_DIODE_RECONCILER_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer replicas: description: Replica count. Defaults to [`DEFAULT_DIODE_REPLICAS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: Resource requests. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object serviceAccount: description: |- Kubernetes service account name. Auto-generated as `{cluster-name}-diode-reconciler` when unset. nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for reconciler pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object timeouts: description: Per-route timeout overrides for the Diode HTTP and gRPC surfaces. nullable: true properties: grpc: description: Timeout overrides for the Diode gRPC Ingress. nullable: true properties: ingress: description: Ingress-level timeout overrides for the gRPC Ingress. nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object http: description: Timeout overrides for the Diode HTTP Ingress + HTTPRoute. nullable: true properties: gateway: description: Gateway API HTTPRoute rule timeout overrides. nullable: true properties: backendRequest: description: |- BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended nullable: true type: string request: description: |- Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended nullable: true type: string type: object ingress: description: Ingress-level timeout overrides (nginx annotation translation). nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object type: object topologySpreadConstraints: description: |- Topology spread constraints applied to every Diode pod (ingester, reconciler, auth, proxy). A per-component setting overrides it; when unset the operator falls back to `spec.replication.topologySpreadConstraints` then a hostname default. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object extraCaCertificates: description: |- Additional CA certificates to trust system-wide. These certificates are added to the system trust store of all NetBox components (netbox, worker) and merged into every service-specific CA bundle (PostgreSQL, Redis). Users must create Kubernetes Secrets containing PEM-encoded certificates, then reference them here. items: description: SecretKeySelector selects a key of a Secret. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: array extraManifests: description: |- Additional Kubernetes manifests to deploy alongside the managed workloads. Each entry is a YAML string and may contain multiple documents separated by `---`. Documents are parsed into typed resources, run through the same base and enterprise mutation pipelines as operator-built resources, and applied with the managed workloads. Unsupported kinds are rejected at reconcile time. items: type: string type: array gateway: description: |- Gateway API configuration for operator-managed Gateway and Route objects. Defaults to an empty [`GatewayConfig`] (disabled by default) when omitted — see [`Self::gateway`]. nullable: true properties: annotations: additionalProperties: type: string description: Extra annotations merged onto all Gateway API resources. type: object className: description: |- GatewayClass name for the Gateway resource. Defaults to [`DEFAULT_GATEWAY_CLASS_NAME`] (`traefik`) — resolve via [`Self::class_name`]. Common values: `"traefik"`, `"envoy"`, `"cilium"`, `"istio"`. nullable: true type: string enabled: description: |- Whether the operator creates Gateway API resources. Defaults to [`DEFAULT_GATEWAY_ENABLED`] — resolve via [`Self::enabled`]. When `true`, the operator creates a Gateway and the associated HTTPRoute/GRPCRoute objects. nullable: true type: boolean listeners: description: |- Gateway listener definitions. Each entry maps to a `spec.listeners[]` entry on the Gateway. Uses the upstream Gateway API `GatewayListeners` type directly. items: description: |- Listener embodies the concept of a logical endpoint where a Gateway accepts network connections. properties: allowedRoutes: description: |- AllowedRoutes defines the types of routes that MAY be attached to a Listener and the trusted namespaces where those Route resources MAY be present. Although a client request may match multiple route rules, only one rule may ultimately receive the request. Matching precedence MUST be determined in order of the following criteria: * The most specific match as defined by the Route type. * The oldest Route based on creation timestamp. For example, a Route with a creation timestamp of "2020-09-08 01:02:03" is given precedence over a Route with a creation timestamp of "2020-09-08 01:02:04". * If everything else is equivalent, the Route appearing first in alphabetical order (namespace/name) should be given precedence. For example, foo/bar is given precedence over foo/baz. All valid rules within a Route attached to this Listener should be implemented. Invalid Route rules can be ignored (sometimes that will mean the full Route). If a Route rule transitions from valid to invalid, support for that Route rule should be dropped to ensure consistency. For example, even if a filter specified by a Route rule is invalid, the rest of the rules within that Route should still be supported. Support: Core nullable: true properties: kinds: description: |- Kinds specifies the groups and kinds of Routes that are allowed to bind to this Gateway Listener. When unspecified or empty, the kinds of Routes selected are determined using the Listener protocol. A RouteGroupKind MUST correspond to kinds of Routes that are compatible with the application protocol specified in the Listener's Protocol field. If an implementation does not support or recognize this resource type, it MUST set the "ResolvedRefs" condition to False for this Listener with the "InvalidRouteKinds" reason. Support: Core items: description: RouteGroupKind indicates the group and kind of a Route resource. properties: group: description: Group is the group of the Route. nullable: true type: string kind: description: Kind is the kind of the Route. type: string required: - kind type: object nullable: true type: array namespaces: description: |- Namespaces indicates namespaces from which Routes may be attached to this Listener. This is restricted to the namespace of this Gateway by default. Support: Core nullable: true properties: from: description: |- From indicates where Routes will be selected for this Gateway. Possible values are: * All: Routes in all namespaces may be used by this Gateway. * Selector: Routes in namespaces selected by the selector may be used by this Gateway. * Same: Only Routes in the same namespace may be used by this Gateway. Support: Core enum: - All - Selector - Same - null nullable: true type: string selector: description: |- Selector must be specified when From is set to "Selector". In that case, only Routes in Namespaces matching this Selector will be selected by this Gateway. This field is ignored for other values of "From". Support: Core nullable: true properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string nullable: true type: array required: - key - operator type: object nullable: true type: array matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. nullable: true type: object type: object type: object type: object hostname: description: |- Hostname specifies the virtual hostname to match for protocol types that define this concept. When unspecified, all hostnames are matched. This field is ignored for protocols that don't require hostname based matching. Implementations MUST apply Hostname matching appropriately for each of the following protocols: * TLS: The Listener Hostname MUST match the SNI. * HTTP: The Listener Hostname MUST match the Host header of the request. * HTTPS: The Listener Hostname SHOULD match both the SNI and Host header. Note that this does not require the SNI and Host header to be the same. The semantics of this are described in more detail below. To ensure security, Section 11.1 of RFC-6066 emphasizes that server implementations that rely on SNI hostname matching MUST also verify hostnames within the application protocol. Section 9.1.2 of RFC-7540 provides a mechanism for servers to reject the reuse of a connection by responding with the HTTP 421 Misdirected Request status code. This indicates that the origin server has rejected the request because it appears to have been misdirected. To detect misdirected requests, Gateways SHOULD match the authority of the requests with all the SNI hostname(s) configured across all the Gateway Listeners on the same port and protocol: * If another Listener has an exact match or more specific wildcard entry, the Gateway SHOULD return a 421. * If the current Listener (selected by SNI matching during ClientHello) does not match the Host: * If another Listener does match the Host, the Gateway SHOULD return a 421. * If no other Listener matches the Host, the Gateway MUST return a 404. For HTTPRoute and TLSRoute resources, there is an interaction with the `spec.hostnames` array. When both listener and route specify hostnames, there MUST be an intersection between the values for a Route to be accepted. For more information, refer to the Route specific Hostnames documentation. Hostnames that are prefixed with a wildcard label (`*.`) are interpreted as a suffix match. That means that a match for `*.example.com` would match both `test.example.com`, and `foo.test.example.com`, but not `example.com`. Support: Core nullable: true type: string name: description: |- Name is the name of the Listener. This name MUST be unique within a Gateway. Support: Core type: string port: description: |- Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules. Support: Core format: int32 type: integer protocol: description: |- Protocol specifies the network protocol this listener expects to receive. Support: Core type: string tls: description: |- TLS is the TLS configuration for the Listener. This field is required if the Protocol field is "HTTPS" or "TLS". It is invalid to set this field if the Protocol field is "HTTP", "TCP", or "UDP". The association of SNIs to Certificate defined in ListenerTLSConfig is defined based on the Hostname field for this listener. The GatewayClass MUST use the longest matching SNI out of all available certificates for any TLS handshake. Support: Core nullable: true properties: certificateRefs: description: |- CertificateRefs contains a series of references to Kubernetes objects that contains TLS certificates and private keys. These certificates are used to establish a TLS handshake for requests that match the hostname of the associated listener. A single CertificateRef to a Kubernetes Secret has "Core" support. Implementations MAY choose to support attaching multiple certificates to a Listener, but this behavior is implementation-specific. References to a resource in different namespace are invalid UNLESS there is a ReferenceGrant in the target namespace that allows the certificate to be attached. If a ReferenceGrant does not allow this reference, the "ResolvedRefs" condition MUST be set to False for this listener with the "RefNotPermitted" reason. This field is required to have at least one element when the mode is set to "Terminate" (default) and is optional otherwise. CertificateRefs can reference to standard Kubernetes resources, i.e. Secret, or implementation-specific custom resources. Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls Support: Implementation-specific (More than one reference or other resource types) items: description: |- SecretObjectReference identifies an API object including its namespace, defaulting to Secret. The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid. References to objects with invalid Group and Kind are not valid, and must be rejected by the implementation, with appropriate Conditions set on the containing object. properties: group: description: |- Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. nullable: true type: string kind: description: Kind is kind of the referent. For example "Secret". nullable: true type: string name: description: Name is the name of the referent. type: string namespace: description: |- Namespace is the namespace of the referenced object. When unspecified, the local namespace is inferred. Note that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. Support: Core nullable: true type: string required: - name type: object nullable: true type: array mode: description: |- Mode defines the TLS behavior for the TLS session initiated by the client. There are two possible modes: - Terminate: The TLS session between the downstream client and the Gateway is terminated at the Gateway. This mode requires certificates to be specified in some way, such as populating the certificateRefs field. - Passthrough: The TLS session is NOT terminated by the Gateway. This implies that the Gateway can't decipher the TLS stream except for the ClientHello message of the TLS protocol. The certificateRefs field is ignored in this mode. Support: Core enum: - Terminate - Passthrough - null nullable: true type: string options: additionalProperties: type: string description: |- Options are a list of key/value pairs to enable extended TLS configuration for each implementation. For example, configuring the minimum TLS version or supported cipher suites. A set of common keys MAY be defined by the API in the future. To avoid any ambiguity, implementation-specific definitions MUST use domain-prefixed names, such as `example.com/my-custom-option`. Un-prefixed names are reserved for key names defined by Gateway API. Support: Implementation-specific nullable: true type: object type: object required: - name - port - protocol type: object type: array maxRequestBodyBytes: description: |- Maximum request body size, in bytes, enforced at the bundled Traefik gateway. `0` disables the cap. Unset resolves to the v1alpha1 `DEFAULT_MAX_REQUEST_BODY_BYTES` via [`Self::max_request_body_bytes`]. Only applies when the gateway class is the bundled Traefik. format: int64 nullable: true type: integer timeouts: description: |- Timeouts applied to all generated HTTPRoute rules. Maps to `spec.rules[].timeouts` on HTTPRoute resources. Values are Gateway API duration strings (e.g., `"30s"`, `"1m"`). nullable: true properties: backendRequest: description: |- BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended nullable: true type: string request: description: |- Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended nullable: true type: string type: object type: object imagePullPolicy: description: |- Container image pull policy. Variant names are PascalCase to match Kubernetes API conventions exactly. Do not add `#[serde(rename_all)]` — the Rust names must serialize verbatim. See: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy enum: - IfNotPresent - Always - Never nullable: true type: string imagePullSecrets: description: Image pull secrets for private registries. items: type: string type: array ingress: description: |- Ingress configuration for operator-managed Ingress objects. Defaults to an empty [`IngressConfig`] (enabled with class `"nginx"`) when omitted — see [`Self::ingress`]. nullable: true properties: annotations: additionalProperties: type: string description: |- Extra annotations merged onto every Ingress object. Values here override the hardcoded nginx-specific defaults when keys collide. type: object className: description: |- Kubernetes Ingress class name. Defaults to `"nginx"` ([`DEFAULT_INGRESS_CLASS_NAME`]) — resolve via [`Self::class_name`]. Maps to `spec.ingressClassName` on all generated Ingress objects. Only the `nginx` class is supported for the Diode and Copilot Ingresses. Their paths are regex captures that route only when paired with `nginx.ingress.kubernetes.io/rewrite-target`, and the operator emits that annotation for the `nginx` class alone. On any other class those two Ingresses are not created and a warning is logged; the NetBox Ingress needs no rewrite and is still created. Supplying `rewrite-target` yourself through `annotations` below does not lift the restriction, and breaks NetBox if you try: that map is merged onto every Ingress, and NetBox's path has no capture group, so `/$1` there rewrites every NetBox request to `/`. To route Diode and Copilot through a non-nginx controller, use the Gateway API instead: set both `routing.mode: gateway` and `gateway.enabled: true` (with a `gateway.className` and listeners). Setting `routing.mode` alone emits no Gateway resources either. nullable: true type: string enabled: description: |- Whether the operator creates Ingress objects. Defaults to `true` ([`DEFAULT_INGRESS_ENABLED`]) — resolve via [`Self::enabled`]. When `false`, the operator skips Ingress creation entirely and existing Ingress objects are pruned by orphan cleanup. nullable: true type: boolean timeouts: description: |- Proxy timeouts translated to controller-specific annotations. Currently only the `nginx` class is supported — other classes log a warning and leave timeouts at the controller defaults. nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object tls: description: |- TLS termination entries for Ingress resources. Each entry maps directly to a Kubernetes `IngressTLS` object. All unique hosts across entries are used to create `IngressRule` entries. items: description: IngressTLS describes the transport layer security associated with an ingress. properties: hosts: description: hosts is a list of hosts included in the TLS certificate. The values in this list must match the name/s used in the tlsSecret. Defaults to the wildcard host setting for the loadbalancer controller fulfilling this Ingress, if left unspecified. items: type: string type: array secretName: description: secretName is the name of the secret used to terminate TLS traffic on port 443. Field is left optional to allow TLS routing based on SNI hostname alone. If the SNI host in a listener conflicts with the "Host" header field used by an IngressRule, the SNI host is used for termination and value of the "Host" header is used for routing. type: string type: object type: array type: object labels: additionalProperties: type: string description: Labels applied to all cluster resources. nullable: true type: object maintenanceMode: description: |- Enable maintenance mode — scales down all deployments and creates a maintenance pod for manual operations. Defaults to `false`. nullable: true type: boolean netbox: description: |- NetBox application deployment configuration. Defaults to an empty `NetBoxApp` whose own accessors fill in image/registry/replicas/etc. — see [`Self::netbox`]. nullable: true properties: appReadyTimeout: description: |- Maximum time the operator waits for the NetBox app deployment to become ready after each reconcile. Covers database migrations run at pod startup. Accepts durations (`5m`, `300s`) or bare seconds. When omitted, defaults to 5m (300s). nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string config: description: |- NetBox application configuration (secrets, allowed hosts, storage, plugins, metrics). Accessors on the returned [`NetBoxConfig`] supply per-field defaults. nullable: true properties: allowedHosts: description: |- Allowed hostnames for NetBox. Defaults to [`default_netbox_allowed_hosts`] (a single wildcard). items: type: string nullable: true type: array customPythonConfig: description: |- Custom Python configuration appended after `configuration.py`. Rendered into `user_extra.py` and mounted as `zzz_80_user_extra.py`. nullable: true type: string customPythonConfigRef: description: |- Reference to a ConfigMap key containing custom Python configuration. `customPythonConfig` takes precedence when both are set. nullable: true properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object emailPassword: description: Email password reference. Operator auto-generates when omitted. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object metricsEnabled: description: |- Enable the Prometheus `/metrics` endpoint. Defaults to [`DEFAULT_NETBOX_METRICS_ENABLED`]. nullable: true type: boolean plugins: description: |- Custom plugins configuration for installing Python packages from a wheelhouse. nullable: true properties: mediaWheelhousePollInterval: description: |- How often the wheelhouse-watcher sidecar polls the media-dir wheelhouse file for mtime/size changes. Accepts human-friendly strings (`5m`, `1h`) or bare seconds (`300`). Only relevant when no explicit wheelhouse source is configured and custom Python config is present. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string wheelhouse: description: |- Wheelhouse source configuration. Specify either `s3` or `pvc` as the source for the wheelhouse tarball. Validation runs automatically via the [`TryFrom`] path. nullable: true properties: pvc: description: PVC source configuration for the wheelhouse file. nullable: true properties: claimName: description: |- Name of the PVC containing the wheelhouse. When `create` is `true` the operator creates this PVC; otherwise it must already exist. type: string create: description: |- Whether the operator should create + manage the PVC lifecycle. Defaults to `false` (the PVC must already exist). nullable: true type: boolean path: description: |- Path to the wheelhouse file within the PVC. Defaults to [`DEFAULT_PVC_WHEELHOUSE_PATH`]. nullable: true type: string size: description: |- Size of the operator-created PVC. Only consulted when `create` is `true`. Defaults to [`DEFAULT_WHEELHOUSE_PVC_SIZE`]. nullable: true pattern: ^(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[kMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ type: string storageClassName: description: |- Storage class for the operator-created PVC. Only consulted when `create` is `true`. nullable: true type: string required: - claimName type: object s3: description: S3 bucket configuration for wheelhouse download. nullable: true properties: bucket: description: S3 bucket name. type: string credentialsSecret: description: Reference to Secret containing S3 credentials. properties: accessKeyId: description: |- Key within the secret for the access key id. Defaults to [`DEFAULT_PLUGIN_ACCESS_KEY_ID_KEY`]. nullable: true type: string name: description: Name of the Kubernetes Secret containing S3 credentials. type: string secretAccessKey: description: |- Key within the secret for the secret access key. Defaults to [`DEFAULT_PLUGIN_SECRET_ACCESS_KEY_KEY`]. nullable: true type: string required: - name type: object endpoint: description: S3-compatible endpoint URL. Falls back to the AWS default when unset. nullable: true type: string key: description: Object key within the bucket. Defaults to [`DEFAULT_WHEELHOUSE_KEY`]. nullable: true type: string region: description: AWS region. Defaults to [`DEFAULT_S3_REGION`]. nullable: true type: string verifySSL: description: |- Whether to verify SSL certificates. Defaults to [`DEFAULT_PLUGIN_VERIFY_SSL`]. nullable: true type: boolean required: - bucket - credentialsSecret type: object type: object type: object postgres: description: |- PostgreSQL connection configuration. Derived from `spec.postgresql` when omitted. nullable: true properties: database: description: Database name for NetBox. Defaults to [`DEFAULT_NETBOX_DB_NAME`]. maxLength: 63 minLength: 1 nullable: true type: string password: description: Password reference. Auto-generated when omitted. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object user: description: Database username for NetBox. Defaults to [`DEFAULT_NETBOX_DB_USER`]. maxLength: 63 minLength: 1 nullable: true type: string users: description: |- Users to create in PostgreSQL (for PGO). Defaults to [`default_postgres_users`]. items: description: PostgreSQL user specification for PGO. properties: databases: description: Databases the user can access. items: maxLength: 63 minLength: 1 type: string type: array name: description: Username. maxLength: 63 minLength: 1 type: string options: description: PostgreSQL user options (e.g., "SUPERUSER"). type: string required: - databases - name - options type: object nullable: true type: array type: object redis: description: |- Redis connection configuration. Derived from `spec.redis` when omitted. nullable: true properties: cachingDatabase: description: |- Redis DB index for the caching connection. Defaults to 1. Set to 0 for Redis Enterprise, which only supports DB index 0. No upper bound is enforced; see `tasksDatabase`. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer host: description: Redis hostname. type: string password: description: |- Password reference for Redis authentication. Used for both the tasks queue and cache connections. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object port: description: Redis port number. Defaults to [`DEFAULT_REDIS_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer tasksDatabase: description: |- Redis DB index for the tasks (RQ) connection. Defaults to 0 in the consuming config. Redis Enterprise only supports DB index 0. No upper bound is enforced — an out-of-range index fails at `SELECT` time. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer username: description: |- Redis username for ACL authentication (Redis 6.0+). Empty string falls back to legacy auth. nullable: true type: string required: - host type: object secretKey: description: Django secret-key reference. Auto-generated when omitted. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object storage: description: Storage configuration (S3 etc.) for NetBox media files. nullable: true properties: s3: description: S3 storage configuration. nullable: true properties: accessKeyId: description: AWS access key id reference (from a Kubernetes Secret). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object bucketName: description: S3 bucket name. nullable: true type: string enabled: description: Enable S3 storage for media files. Defaults to `false`. nullable: true type: boolean endpointUrl: description: Custom S3 endpoint URL (MinIO, Garage, or any S3-compatible service). nullable: true type: string regionName: description: AWS region name. Defaults to [`DEFAULT_S3_REGION`]. nullable: true type: string secretAccessKey: description: AWS secret access key reference (from a Kubernetes Secret). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object tlsConfig: description: |- TLS configuration referencing certificates from the cluster's `tlsKeychain`. nullable: true properties: insecureSkipVerify: description: |- Skip TLS certificate verification. Defaults to `false`. **PostgreSQL caveat**: has no effect when CA certificates are configured via `keychainCaCertificates` — libpq still verifies the server certificate whenever `PGSSLROOTCERT` is set. Drop the CA list instead. nullable: true type: boolean keychainCaCertificates: description: |- Names of CA certificates from the cluster's `tlsKeychain` to use for verifying server certificates. Each name must match an entry in `tlsKeychain.caCertificateSecrets[].name`. items: type: string type: array keychainClientCertificate: description: |- Name of a client certificate from the cluster's `tlsKeychain` for mutual TLS authentication. nullable: true type: string type: object type: object type: object superuser: description: |- Superuser secret references. When set, `username`, `email` and `password` are required and `apiToken` is optional; when `None`, the operator generates all credentials. Nothing reads `apiToken`'s value, but naming a key its Secret does not carry stops the NetBox pod from starting — see that field's own description. nullable: true properties: apiToken: description: |- Secret reference for superuser API token. Optional, and nothing reads its value: NetBox 4.5+ tokens are peppered v2 tokens that cannot be planted from a plaintext secret, so the NetBox bootstrap seeds no token at all (see `superuser_upsert_section` in `netbox-workload`'s `config::entrypoint`). It stays accepted so specs that already set it keep applying, but requiring it forced operators to invent a value that does nothing and 403s if used (NBE-2219). Unread is not the same as harmless to set. Naming a key here adds it to the NetBox pod's projected `secrets` volume, from a source that is not marked optional. Name a key the Secret does not carry and kubelet fails the whole volume — `MountVolume.SetUp failed for volume "secrets" : references non-existent secret key` — so the NetBox pod never starts. The operator reports that on the resource as `SuperuserSecret=False`, with a Warning event when the state is entered, but still projects what the resource declares. Point this at a key that really exists, or leave it unset. This field's own `name` is not consulted. The projected volume carries `password` and `apiToken` together and sources both from the Secret named by `password.name`, so point this key at a Secret that one holds. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object email: description: Secret reference for superuser email. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object password: description: Secret reference for superuser password. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object username: description: Secret reference for superuser username. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object required: - email - password - username type: object type: object diodePlugin: description: |- NetBox-side deadlines for outbound calls to Diode. When `None`, the operator uses the pre-existing hardcoded plugin defaults (500ms auth, 5000ms gRPC). Re-uses [`crate::crd::v1alpha1::netbox::NetBoxDiodePluginConfig`] for the same reason as `timeouts`. nullable: true properties: authTimeout: description: |- Timeout for Hydra token introspection calls from the NetBox plugins. Default: `500ms`. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string grpcTimeout: description: |- Timeout for Diode gRPC calls from the NetBox plugins. Default: `5s`. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object env: description: |- Environment variables for NetBox containers. When omitted, the accessor supplies [`default_envs`] (currently empty). Merged with `yamlEnv` by the operator. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object nullable: true type: array httpPort: description: |- HTTP port the NetBox container listens on. Defaults to [`DEFAULT_NETBOX_HTTP_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer image: description: |- Container image specification. Defaults to a freshly-resolved [`NetBoxImage`] when the user omits the field; per-field accessors on the returned image fill in registry/repository/tag. nullable: true properties: digest: description: |- Optional image digest for pinning to a specific build, independent of `tag`. When set, the operator emits `repository@digest` instead of `repository:tag`. nullable: true type: string imagePullSecrets: description: |- Pull secrets for private registries. When set, merged with the cluster-level `spec.imagePullSecrets`. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: description: |- Container image pull policy. Variant names are PascalCase to match Kubernetes API conventions exactly. Do not add `#[serde(rename_all)]` — the Rust names must serialize verbatim. See: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy enum: - IfNotPresent - Always - Never nullable: true type: string registry: description: |- Container registry hostname. Defaults to [`DEFAULT_NETBOX_REGISTRY`]. nullable: true type: string repository: description: |- Repository path within the registry. Defaults to [`DEFAULT_NETBOX_REPOSITORY`]. nullable: true type: string tag: description: Image tag (e.g. `v4.4.10`). Defaults to [`DEFAULT_NETBOX_TAG`]. nullable: true type: string type: object limits: description: |- Resource **limits** for NetBox pods. Defaults to [`default_netbox_limits`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object mediaStorageSize: description: |- Media storage PVC size. Defaults to [`DEFAULT_NETBOX_MEDIA_STORAGE_SIZE`]. nullable: true pattern: ^(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[kMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ type: string migrationStatementTimeout: description: |- Per-statement timeout for index reconciliation. Defaults to [`default_netbox_migration_statement_timeout`] (15m). nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string migrationTimeout: description: |- Maximum time for the migration Job to run before Kubernetes terminates it. Defaults to [`default_netbox_migration_timeout`] (1h). nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string replicas: description: |- Number of NetBox web application replicas. Defaults to [`DEFAULT_NETBOX_REPLICAS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: |- Resource **requests** for NetBox pods. Defaults to [`default_netbox_resources`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object scriptsStorageSize: description: |- Scripts storage PVC size. Defaults to [`DEFAULT_NETBOX_SCRIPTS_STORAGE_SIZE`]. Holds custom user scripts. nullable: true pattern: ^(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[kMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ type: string statusPort: description: |- Deprecated: no longer used. Retained for CRD parity with v1alpha1. Previously configured the nginx unit status port; ignored since the switch to granian in nbe-core 4.5.x. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer storageAccessMode: description: |- Access mode for the media and scripts PVCs. Defaults to `ReadWriteOnce` (single-node). Use `ReadWriteMany` with an RWX-capable `storageClassName` to spread `replicas > 1` across nodes — or move media to S3 entirely via `config.storage`. enum: - ReadWriteOnce - ReadOnlyMany - ReadWriteMany - ReadWriteOncePod - null nullable: true type: string storageClassName: description: |- Storage class for the media and scripts PVCs. When omitted, the cluster's default StorageClass is used. nullable: true type: string timeouts: description: |- Per-service timeout overrides for the NetBox Ingress and HTTPRoute. Field-level merges over the cluster-wide `spec.ingress.timeouts` / `spec.gateway.timeouts`. When `None`, the cluster-wide defaults apply unchanged. Re-uses [`crate::crd::v1alpha1::timeouts::AppTimeouts`] since the v1alpha1 type is already sparse-shaped (all `Option`, no `#[serde(default = "fn")]`). nullable: true properties: gateway: description: Gateway API HTTPRoute rule timeout overrides. nullable: true properties: backendRequest: description: |- BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended nullable: true type: string request: description: |- Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended nullable: true type: string type: object ingress: description: Ingress-level timeout overrides (nginx annotation translation). nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object topologySpreadConstraints: description: |- Topology spread constraints for NetBox web pods. When configured, controls how pods are distributed across topology domains (nodes, zones). Useful for HA deployments with multiple replicas. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array urls: description: |- External URLs at which the NetBox service is reachable. Each entry's host portion drives an `IngressRule.host` on the NetBox Ingress, producing one rule per URL. The scheme, port, and path are ignored — only the hostname is used. Unparseable entries are skipped with a warning; when no entries parse, the Ingress falls back to a single wildcard rule. TLS termination is configured independently via `spec.ingress.tls`. items: type: string nullable: true type: array worker: description: Background worker configuration. nullable: true properties: affinity: description: |- Pod affinity for worker pods. When omitted, the operator emits a required `kubernetes.io/hostname` pod affinity binding each worker to a NetBox pod (so the worker can mount the same single-node media and scripts PVCs) only when both: - `spec.netbox.storageAccessMode` is unset, `ReadWriteOnce`, or `ReadWriteOncePod`; and - `spec.netbox.replicas == 1`. Provide an explicit `Affinity` to override; the operator injects NetBox's selector labels into any `podAffinity` / `podAntiAffinity` term whose `labelSelector` is empty. To disable all affinity supply an explicit empty object `affinity: {}`. nullable: true properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. properties: preferredDuringSchedulingIgnoredDuringExecution: description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. items: description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). properties: preference: description: A node selector term, associated with the corresponding weight. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchFields: description: A list of node selector requirements by node's fields. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array type: object weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. format: int32 type: integer required: - preference - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. items: description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchFields: description: A list of node selector requirements by node's fields. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array type: object type: array required: - nodeSelectorTerms type: object type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer required: - podAffinityTerm - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. items: description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object type: array type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer required: - podAffinityTerm - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. items: description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object type: array type: object type: object env: description: |- Environment variables for worker containers. When omitted, the accessor supplies [`default_envs`] (currently empty). Merged with `yamlEnv` by the operator. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object nullable: true type: array limits: description: |- Resource **limits** for worker pods. Defaults to [`default_netbox_worker_limits`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object replicas: description: |- Number of worker replicas. Defaults to [`DEFAULT_NETBOX_WORKER_REPLICAS`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer resources: description: |- Resource **requests** for worker pods. Defaults to [`default_netbox_worker_resources`]. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object topologySpreadConstraints: description: |- Topology spread constraints for worker pods. When configured, controls how pods are distributed across topology domains. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array yamlEnv: description: |- YAML string containing environment variables as key-value pairs. Example: `"FOO: bar\nBAZ: qux"`. nullable: true type: string type: object yamlEnv: description: |- YAML string containing environment variables as key-value pairs. Converted to `EnvVar` array format by the operator. Example: `"FOO: bar\nBAZ: qux"`. nullable: true type: string type: object plugins: description: |- Cross-service plugin enablement (`spec.plugins`). Holds NDX (NetBox Data Exchange) and Asset Lifecycle — see [`Self::plugins`]. nullable: true properties: assetLifecycle: description: |- Asset Lifecycle plugin (`netbox_asset_lifecycle`, Premium tier, off by default). See [`Self::asset_lifecycle`]. nullable: true properties: enabled: description: |- Enable or disable Asset Lifecycle (the `netbox_asset_lifecycle` plugin). Defaults to [`DEFAULT_ASSET_LIFECYCLE_ENABLED`] (off). Requires a Premium-tier license to take effect. Disabling drops the plugin from the rendered plugin config. Existing Asset Lifecycle tables are retained (not dropped). nullable: true type: boolean type: object ndx: description: NDX (NetBox Data Exchange) plugin (paid-only). See [`Self::ndx`]. nullable: true properties: enabled: description: |- Enable or disable the NDX plugin (the user lever). Defaults to [`DEFAULT_NDX_ENABLED`] (on). Effective only when the license carries a paid NDX token entitlement — the operator gates on the token. nullable: true type: boolean type: object type: object postgresql: description: |- PostgreSQL deployment configuration (operator-managed PGO or external). Defaults to an empty `PostgreSQL` whose accessors resolve to operator-managed defaults — see [`Self::postgresql`]. nullable: true properties: backups: description: |- pgBackRest backup configuration. Ignored when `external` is true — an external DB's backups are the customer's to run. nullable: true properties: enabled: description: |- Whether pgBackRest is enabled. Defaults to [`DEFAULT_POSTGRES_BACKUPS_ENABLED`]. Setting this to `false` leaves the database backed up by **nothing**. It removes the pgBackRest repository, and `PGDATA` stays excluded from Velero's filesystem backup — deliberately, because a file-by-file copy of a live data directory is a torn copy, and one that looks restorable is worse than none. So this is opting out of Postgres disaster recovery, not selecting a different mechanism. Note also that disabling it on a running cluster does not remove the repository host: PGO leaves the StatefulSet (and its PVC) in place, so this is not a clean revert. nullable: true type: boolean fullSchedule: description: |- Cron schedule for full backups. Defaults to [`DEFAULT_POSTGRES_BACKUPS_FULL_SCHEDULE`]. An empty string disables scheduled full backups. nullable: true type: string incrementalSchedule: description: |- Cron schedule for incremental backups. Defaults to [`DEFAULT_POSTGRES_BACKUPS_INCREMENTAL_SCHEDULE`]. An empty string disables scheduled incremental backups. nullable: true type: string repoStorageClassName: description: |- Storage class for the pgBackRest repo PVC. Falls back to the PostgreSQL data storage class, then the cluster default. nullable: true type: string repoStorageSize: description: |- Storage size for the pgBackRest repo PVC. Defaults to [`DEFAULT_POSTGRES_BACKUPS_REPO_STORAGE_SIZE`]. nullable: true pattern: ^(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[kMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ type: string retentionFull: description: |- Number of full backups to retain. Defaults to [`DEFAULT_POSTGRES_BACKUPS_RETENTION_FULL`]. Minimum 1. pgBackRest's `repo1-retention-full` accepts 1..=9999999, so `0` renders a config the repo host rejects at parse time — which surfaces as a repo host that cannot configure itself and therefore no backups at all, with nothing in the CR status naming the field at fault. The schema bound makes the API server reject it at admission instead. format: uint8 maximum: 255.0 minimum: 1.0 nullable: true type: integer type: object external: description: |- Whether PostgreSQL is externally managed. Defaults to [`DEFAULT_POSTGRES_EXTERNAL`]. nullable: true type: boolean instances: description: |- Number of PostgreSQL instances. `0` triggers auto-scaling to `min(node_count, 3)`. Defaults to [`DEFAULT_POSTGRES_INSTANCES`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer limits: description: Resource limits for PostgreSQL pods. `None` leaves them unset. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object postgresqlProfile: description: |- Name of a profile from `spec.postgresql_profiles`. When set, the connection inherits TLS configuration, host, and port from the named profile. nullable: true type: string registry: description: |- Container registry override for PostgreSQL images. Defaults to [`DEFAULT_POSTGRES_REGISTRY`]. nullable: true type: string resources: description: Resource requests for PostgreSQL pods. `None` leaves them unset. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object storageClassName: description: |- Storage class name for PostgreSQL PVCs. Inherits the cluster default when unset. nullable: true type: string storageSize: description: |- Storage size for PostgreSQL PVCs. Defaults to [`DEFAULT_POSTGRES_STORAGE_SIZE`]. nullable: true pattern: ^(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[kMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ type: string version: description: PostgreSQL major version. Defaults to [`DEFAULT_POSTGRES_VERSION`]. nullable: true type: string type: object postgresqlProfiles: additionalProperties: description: |- v1alpha2 sparse replacement for [`crate::crd::v1alpha1::postgresql_config::PostgreSQLProfile`]. All fields are optional — a profile may specify only TLS settings, only connection details, or both. Components resolve each field independently: inline config takes priority, then the profile, then defaults. properties: host: description: PostgreSQL hostname. nullable: true type: string port: description: PostgreSQL port number. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer tlsConfig: description: TLS configuration for the PostgreSQL connection. nullable: true properties: insecureSkipVerify: description: |- Skip TLS certificate verification. Defaults to `false`. **PostgreSQL caveat**: has no effect when CA certificates are configured via `keychainCaCertificates` — libpq still verifies the server certificate whenever `PGSSLROOTCERT` is set. Drop the CA list instead. nullable: true type: boolean keychainCaCertificates: description: |- Names of CA certificates from the cluster's `tlsKeychain` to use for verifying server certificates. Each name must match an entry in `tlsKeychain.caCertificateSecrets[].name`. items: type: string type: array keychainClientCertificate: description: |- Name of a client certificate from the cluster's `tlsKeychain` for mutual TLS authentication. nullable: true type: string sslmode: description: |- PostgreSQL SSL connection mode. Controls how SSL/TLS is used when connecting to PostgreSQL. These modes match the libpq `sslmode` parameter values. # Modes | Mode | Description | |------|-------------| | `disable` | No SSL - unencrypted connection | | `allow` | Try non-SSL first, use SSL if server requires it | | `prefer` | Try SSL first, fall back to non-SSL (default for external) | | `require` | Require SSL, but don't verify the server certificate | | `verify-ca` | Require SSL and verify the server certificate is signed by a trusted CA | | `verify-full` | Require SSL, verify CA, and verify the server hostname matches the certificate | # Security Recommendations - For production external databases, use `verify-full` with proper CA certificates - Operator-managed PostgreSQL (PGO) always uses `require` internally - `disable` and `allow` should only be used in development environments enum: - disable - allow - prefer - require - verify-ca - verify-full nullable: true type: string type: object username: description: PostgreSQL username. nullable: true type: string type: object description: |- Named PostgreSQL connection profiles. Each profile bundles host/port/username and TLS settings under a single name so multiple components can reference it instead of duplicating inline config. type: object proxy: description: |- Egress proxy settings (NBE-1501). When set, the operator injects HTTP_PROXY/HTTPS_PROXY/NO_PROXY into every workload it creates. Absence means no proxy — see [`Self::proxy`]. nullable: true properties: httpProxy: description: HTTP proxy URL (e.g. `http://proxy.corp:3128`). nullable: true type: string httpsProxy: description: HTTPS proxy URL — used for license/S3/external HTTPS egress. nullable: true type: string noProxy: description: |- Comma-separated extra `NO_PROXY` entries, appended to the cluster-internal defaults the operator always includes. nullable: true type: string type: object reconcileInterval: description: |- How often the operator re-checks external state even when no Kubernetes events are received. Covers changes that don't produce watch events: PGO secret rotations, wheelhouse uploads, etc. Accepts Kubernetes-style duration strings (`5m`, `1h`) or bare seconds (`300`). When omitted, falls back to the `--reconcile-interval-secs` CLI flag. Useful for debugging: lower values surface external-state convergence issues faster without redeploying the operator. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string redis: description: |- Redis deployment configuration (operator-managed via OT-CONTAINER-KIT or external). Defaults to an empty `Redis` whose accessors resolve to operator-managed defaults — see [`Self::redis`]. nullable: true properties: additionalConfig: description: |- Raw Redis directives appended to the server config. Only applies to operator-managed Redis. nullable: true type: string aofEnabled: description: |- Whether to enable AOF (Append-Only File) persistence. `None` leaves the Redis server default unchanged. Only applies to operator-managed Redis. nullable: true type: boolean clusterSize: description: |- Number of Redis replicas. `0` triggers auto-scaling to `min(node_count, 3)`. Sentinel is deployed when the effective size exceeds 1. Defaults to [`DEFAULT_REDIS_CLUSTER_SIZE`]. format: uint8 maximum: 255.0 minimum: 0.0 nullable: true type: integer dynamicConfig: description: |- Runtime Redis `CONFIG SET` directives applied without a restart. Only applies to operator-managed Redis. items: type: string nullable: true type: array external: description: |- Whether Redis is externally managed. Defaults to [`DEFAULT_REDIS_EXTERNAL`]. nullable: true type: boolean limits: description: Resource limits for Redis pods. `None` leaves them unset. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object maxMemoryPercent: description: |- Cap Redis memory at N% of the container memory limit (0–100). Only applies to operator-managed Redis (`external: false`). format: uint8 maximum: 100.0 minimum: 0.0 nullable: true type: integer maxMemoryPolicy: description: |- Redis key eviction policy applied when `maxmemory` is reached. Maps directly to Redis's `maxmemory-policy` configuration directive. Combined with `maxMemoryPercent` to control OOM behavior: set `maxMemoryPercent` to cap memory usage, then choose an eviction policy that matches your workload (LRU for general caches, `noeviction` to reject writes instead of evicting data). See for details. enum: - noeviction - allkeys-lru - volatile-lru - allkeys-random - volatile-random - volatile-ttl - allkeys-lfu - volatile-lfu nullable: true type: string name: description: Redis instance name. Defaults to [`DEFAULT_REDIS_NAME`]. nullable: true type: string persistence: description: |- Whether to enable persistence for Redis data. Defaults to [`DEFAULT_REDIS_PERSISTENCE`]. nullable: true type: boolean requireAuth: description: |- Whether authentication is required for Redis connections. Defaults to [`DEFAULT_REDIS_REQUIRE_AUTH`]. nullable: true type: boolean resources: description: Resource requests for Redis pods. `None` leaves them unset. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object sentinelMasterName: description: |- Sentinel master group name. Required when `sentinels` is set. Ignored for operator-managed Redis. nullable: true type: string sentinels: description: |- Sentinel endpoints for external Redis HA. Ignored for operator-managed Redis (the operator auto-configures Sentinel based on `cluster_size`). items: description: |- v1alpha2 sparse replacement for [`crate::crd::v1alpha1::redis_config::SentinelEndpoint`]. `host` stays required (no sensible default); `port` defaults to [`DEFAULT_REDIS_SENTINEL_PORT`]. properties: host: description: Sentinel hostname. type: string port: description: Sentinel port number. Defaults to [`DEFAULT_REDIS_SENTINEL_PORT`]. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer required: - host type: object nullable: true type: array storageClassName: description: |- Storage class name for Redis PVCs. Inherits the cluster default when unset. Only used when `persistence: true`. nullable: true type: string storageSize: description: |- Storage size for the Redis PVC. Only used when `persistence: true`. Defaults to [`DEFAULT_REDIS_STORAGE_SIZE`]. nullable: true pattern: ^(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[kMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ type: string tlsConfig: description: |- TLS configuration for external Redis connections. The presence of this section enables TLS. Only used when `external: true`. nullable: true properties: insecureSkipVerify: description: |- Skip TLS certificate verification. Defaults to `false`. **PostgreSQL caveat**: has no effect when CA certificates are configured via `keychainCaCertificates` — libpq still verifies the server certificate whenever `PGSSLROOTCERT` is set. Drop the CA list instead. nullable: true type: boolean keychainCaCertificates: description: |- Names of CA certificates from the cluster's `tlsKeychain` to use for verifying server certificates. Each name must match an entry in `tlsKeychain.caCertificateSecrets[].name`. items: type: string type: array keychainClientCertificate: description: |- Name of a client certificate from the cluster's `tlsKeychain` for mutual TLS authentication. nullable: true type: string type: object type: object registry: description: |- Container registry host override for all images. When set, replaces the registry portion of every container image. Use with `registryNamespace` for flat-namespace registries (e.g., Replicated local registry in airgap installs). nullable: true type: string registryNamespace: description: |- Registry namespace for flat-namespace registries. When set alongside `registry`, all repository paths are flattened to `{namespace}/{basename}`. For example, `docker.io/oryd/hydra:v2.3.0` becomes `{registry}/{namespace}/hydra:v2.3.0`. When only `registry` is set (no namespace), the full original repository path is preserved. nullable: true type: string replicatedApp: description: |- Replicated-specific tuning knobs (SDK, license fallback, etc.). Only applies when NBE is installed via the Replicated channel. Defaults are appropriate for typical installs; the fields here exist for debugging and airgap-specific tuning. nullable: true properties: licenseFallback: description: |- License-fallback retry tuning. When the Replicated SDK is unreachable at operator startup, the license fetcher returns a default-Community license. Rather than immediately proceeding as Community (which skips enterprise image-rewrite mutations and causes private GHCR pulls to 401), the operator issues fresh SDK fetches on subsequent reconciles for a bounded budget. These knobs tune that budget. nullable: true properties: retryInterval: description: |- Delay between retry attempts. Accepts Kubernetes-style durations (`5s`) or bare seconds (`5`). Defaults via [`default_license_fallback_retry_interval`]. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string totalTimeout: description: |- Total time budget for the retry loop. Once exhausted, reconcile proceeds with the default-Community license. Accepts Kubernetes-style durations (`30s`, `1m`) or bare seconds (`30`). Defaults via [`default_license_fallback_total_timeout`]. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object replication: description: |- Cluster-wide replication and HA configuration. Top-level `topologySpreadConstraints` here apply to every operator-managed deployment unless overridden at the component level. nullable: true properties: topologySpreadConstraints: description: |- Default `topologySpreadConstraints` applied to every operator-managed deployment's pod spec. Per-component `topologySpreadConstraints` fields override this default for their component. The operator injects each deployment's own selector labels into every constraint's `labelSelector` so spread is scoped to that deployment's pods — leave `labelSelector` empty (`{}`) unless you need extra filtering. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object routing: description: |- North/south routing selector (`auto`/`gateway`/`ingress`). Defaults to `auto` — see [`Self::routing`]. nullable: true properties: mode: description: |- User-facing selector for the operator's north/south routing path. `Auto` resolves to Gateway only when `spec.gateway` is enabled *and* the operator can list Gateway API resources (the CRDs are installed and the operator's ServiceAccount has RBAC for them), falling back to Ingress otherwise; `Gateway`/`Ingress` pin a path explicitly. This is the master switch — the per-config `enabled` flags (`spec.gateway.enabled`, `spec.ingress.enabled`) still apply, so a pinned mode with its path disabled emits nothing (the operator logs a warning + event in that case). enum: - auto - gateway - ingress nullable: true type: string type: object secretChecksumDebounce: description: |- How long the external secret checksum must be stable before being embedded in pod template annotations (which triggers a rolling restart). PGO rewrites secrets during initial cluster setup, so `resourceVersion` increments on every housekeeping write. The debounce window prevents those transient changes from causing unnecessary rolling restarts. Accepts Kubernetes-style duration strings (`30s`, `1m`) or bare seconds. Defaults via [`default_secret_checksum_debounce`]. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string storageBackend: description: |- Where NetBox media/scripts storage lives (NBE-1691). Shared by both CRD versions; values serialize to the kebab-case strings `pvc`, `external`, and `in-cluster`, shared by the CRD field `storageBackend` and the KOTS `storage_backend` config select. enum: - pvc - external - in-cluster nullable: true type: string suspend: description: |- Suspend reconciliation/annealing of resources while debugging. When `true`, the operator skips applying downstream resources and waits for the field to be cleared. Defaults to `false`. nullable: true type: boolean tlsKeychain: description: |- Cluster-wide TLS keychain — CA and client certificate references that per-service `tlsConfig` blocks can name. nullable: true properties: caCertificateSecrets: description: |- CA certificate secrets to trust for TLS connections. These certificates will be added to the trust store for validating server certificates when connecting to external services. items: description: |- v1alpha2 sparse replacement for [`crate::crd::v1alpha1::tls::CaCertificateSecret`]. Reference to a Kubernetes secret containing a CA certificate, used for configuring trusted CA certificates for TLS verification. The secret should contain the CA certificate in PEM format. `key` defaults to `"ca.crt"` ([`DEFAULT_CA_CERT_KEY`]) — resolve via [`Self::key`]. properties: key: description: |- Key within the secret that contains the CA certificate data. Defaults to [`DEFAULT_CA_CERT_KEY`] — resolve via [`Self::key`]. nullable: true type: string name: description: |- Logical name for this CA certificate entry. If `secret` is not specified, this name is also used as the Kubernetes secret name. type: string secret: description: |- Name of the Kubernetes secret containing the CA certificate. If not specified, [`Self::secret_name`] falls back to `name`. nullable: true type: string required: - name type: object type: array clientCertificateSecrets: description: |- Client certificate secrets for mutual TLS (mTLS) authentication. These certificates can be used to authenticate the client when connecting to services that require client certificate authentication. items: description: |- v1alpha2 sparse replacement for [`crate::crd::v1alpha1::tls::ClientCertificateSecret`]. Reference to a Kubernetes secret containing a client certificate and private key. The secret should be of type `kubernetes.io/tls` or contain equivalent keys. `cert_key` defaults to `"tls.crt"` and `private_key` to `"tls.key"` — both resolve via per-field accessors. properties: certKey: description: |- Key within the secret that contains the client certificate data. Defaults to [`DEFAULT_CLIENT_CERT_KEY`] — resolve via [`Self::cert_key`]. nullable: true type: string name: description: |- Logical name for this client certificate entry. If `secret` is not specified, this name is also used as the Kubernetes secret name. type: string privateKey: description: |- Key within the secret that contains the private key data. Defaults to [`DEFAULT_PRIVATE_KEY`] — resolve via [`Self::private_key`]. nullable: true type: string secret: description: |- Name of the Kubernetes secret containing the client certificate. If not specified, [`Self::secret_name`] falls back to `name`. nullable: true type: string required: - name type: object type: array type: object turbobulk: description: |- TurboBulk bulk data API plugin (Premium tier). The lever defaults on but only activates on a Premium-tier license — see [`Self::turbobulk`]. nullable: true properties: enableWrites: description: |- Enable TurboBulk write APIs (bulk load / delete). Defaults to [`DEFAULT_TURBOBULK_ENABLE_WRITES`] (off). nullable: true type: boolean enabled: description: |- Enable or disable the TurboBulk plugin (the user lever). Defaults to [`DEFAULT_TURBOBULK_ENABLED`] (on). Effective only on Premium-tier licenses — the operator gates on tier. nullable: true type: boolean type: object type: object status: description: Status of the NetBoxEnterprise custom resource. nullable: true properties: components: default: copilot: ready: false diode: ready: false netbox: ready: false postgresql: ready: false redis: ready: false worker: ready: false description: Detailed status for each component. properties: copilot: default: ready: false description: Copilot backend component status (if enabled). properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object diode: default: ready: false description: Diode application component status (if enabled). properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object netbox: default: ready: false description: NetBox web application component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object postgresql: default: ready: false description: PostgreSQL database component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object redis: default: ready: false description: Redis cache/queue component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object worker: default: ready: false description: NetBox worker component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object type: object conditions: description: Kubernetes standard conditions array. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array convergedGeneration: description: |- Highest CR generation that has reached all-components-ready. When this equals `metadata.generation`, the current config rollout has converged and the progress sentinel reports Ready. (NBE-1255) format: int64 nullable: true type: integer customPythonConfigRefDigest: description: |- Last resolved content digest of the ConfigMap key named by `spec.netbox.config.customPythonConfigRef`. Persisted for the same fail-safe reason as `wheelhouse_fingerprint`: a ConfigMap that is momentarily absent (deleted and re-applied by a GitOps prune, say) must not move the migration hash, because moving it deletes an in-flight `manage.py migrate`. Held across an absence so the input can only advance, never regress. (NBE-1883/NBE-1564) nullable: true type: string dependencyWaitStartedAt: description: |- RFC3339 timestamp of when the operator first observed a dependency-wait timeout for the current generation. Used to measure how long a wait has persisted so a brief wait (`WaitingForDependencies`) can be distinguished from a hanging one (`DependencyWaitStalled`) without ever asserting failure. Cleared on the first successful reconcile. (NBE-1401) nullable: true type: string lastReconcileTime: description: Timestamp of the last successful reconciliation (RFC3339 format). nullable: true type: string license: default: edition: Community isAssuranceEntitled: false isCopilotEntitled: false tier: Community description: License associated with the deployment properties: channelName: description: Channel name (e.g., stable, beta, dev) nullable: true type: string customerEmail: description: Customer email from license nullable: true type: string customerName: description: Customer name from license nullable: true type: string edition: default: Community description: NetBox edition (Community or Enterprise) enum: - Community - Enterprise type: string entitlements: additionalProperties: properties: title: description: Entitlement title type: string value: description: Entitlement value (can be any JSON type) x-kubernetes-preserve-unknown-fields: true type: object description: Raw entitlements for additional checks type: object expiresAt: description: Expiration date (ISO 8601 format) nullable: true type: string isAssuranceEntitled: default: false description: Whether NetBox Assurance is entitled type: boolean isCopilotEntitled: default: false description: Whether Copilot is entitled type: boolean isNdxEntitled: default: false description: Whether the NDX plugin is entitled (paid NDX token present) type: boolean isVisualExplorerEntitled: default: false description: Whether Visual Explorer (the first UI Platform app) is entitled type: boolean licenseId: description: Unique license identifier nullable: true type: string licenseType: description: License type (dev, trial, prod, paid) nullable: true type: string platformOrgId: description: Platform organization ID nullable: true type: string tier: default: Community description: NetBox tier from license entitlement enum: - Community - Starter - Professional - Premium type: string type: object licenseStatus: description: |- Computed license display string for the `kubectl get` LICENSE printer column. Shows the license type ("Dev", "Trial", "Paid") when the license is healthy, or the condition reason ("LicenseMismatch", "LicenseExpired", "LicenseUnavailable") when it is not. `None` until the first reconcile completes. nullable: true type: string message: description: Human-readable message about the current state. nullable: true type: string migrationHash: description: |- SHA-256 hash of migration-relevant inputs (image tag, wheelhouse, plugin config). When this changes, the operator runs a migration Job before updating NetBox Deployments. nullable: true type: string migrationPhase1Hash: description: |- SHA-256 hash of Phase 1 migration inputs (image + core config, no plugins). When this hash matches, Phase 1 (core migrations) is considered complete and the operator proceeds directly to Phase 2. (NBE-902) nullable: true type: string observedGeneration: description: Generation observed by the controller during last reconciliation. format: int64 nullable: true type: integer phase: description: |- Coarse startup phase the operator reports on `status.phase` so install progress is visible from `kubectl`, the e2e serving gate, and the KOTS UI instead of an opaque multi-minute 503 (NBE-1529). Variants are ordered along the install timeline. The operator observes `WaitingForDependencies`, `Migrating`, `Serving`, and `Degraded` directly (dependency-wait timer, migration Job status, component readiness, existing conditions). The in-pod phases — `InstallingPlugins`, `CollectingStatic`, `Booting` — happen inside the NetBox entrypoint and are reported back via the `nbe_startup` table the operator reads. Serializes to its PascalCase variant name (k8s phase convention), which is serde's default for fieldless variants — so the serde wire form and the `strum::Display` form match without explicit renames. enum: - WaitingForDependencies - Migrating - InstallingPlugins - CollectingStatic - Booting - Serving - Degraded nullable: true type: string ready: default: false description: Overall cluster readiness indicator. type: boolean secretChecksum: description: |- Aggregate hash of all external secret `resourceVersion` values. Used by the debounce logic to detect when PGO secrets have stabilized. nullable: true type: string secretChecksumObservedAt: description: |- RFC 3339 timestamp recording when `secret_checksum` was first observed to change. The operator only embeds external-secret checksums in pod template annotations once this timestamp is older than the debounce window, preventing deployment thrashing during PGO's initial secret setup phase. nullable: true type: string version: default: '' description: Netbox Labs Operator Version type: string wheelhouseFingerprint: description: |- Last-seen wheelhouse content fingerprint from the wheelhouse-watcher sidecar (`_` or `absent`). Persisted in status so the migration hash is a pure function of stored state (never cleared on a failed live read — fail-safe). (NBE-1320) nullable: true type: string type: object required: - spec title: NetBoxEnterprise type: object served: true storage: true subresources: status: {} - additionalPrinterColumns: - description: Whether the cluster is ready jsonPath: .status.ready name: Ready type: boolean - description: License tier jsonPath: .status.license.tier name: Tier type: string - description: License type when healthy, or the reason when not (LicenseMismatch/LicenseExpired/LicenseUnavailable) jsonPath: .status.licenseStatus name: License type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: Custom resource representing a NetBox Labs Cluster properties: spec: description: NetBoxEnterprise custom resource for declarative NetBox deployments. properties: annotations: additionalProperties: type: string description: Annotations applied to all cluster resources. nullable: true type: object backups: default: false description: |- Enable Velero backups for this cluster. Requires Velero to be installed in the cluster. type: boolean changes: default: enabled: true description: |- Change Management plugin (`netbox_changes`). Enabled by default; unchecking `enabled` drops `netbox_changes` from the rendered plugin config. Only takes effect on an enterprise license. properties: enabled: default: true description: |- Enable or disable Change Management (the `netbox_changes` plugin), which records and manages staged changes to NetBox objects. Defaults to `true`. Requires an enterprise license to take effect — Change Management is not deployed on an unlicensed install regardless of this setting. Disabling also turns off Change Management's branch governance: protecting `main` from direct edits and requiring approval before a branch is merged. Existing change requests and history are retained (the plugin's tables are not dropped), and re-enabling restores access to them. type: boolean type: object clusterDnsSuffix: description: |- Kubernetes cluster DNS suffix. Most clusters use the default `cluster.local`, but some environments configure a different suffix. All operator-generated FQDNs will use this value. nullable: true type: string copilot: default: awsRegion: us-east-2 databaseUser: copilot enabled: false limits: cpu: 1000 memory: 1024 llmApiKeySecret: copilot-llm-api-key llmApiKeySecretKey: apiKey llmMaxSteps: 20 llmModel: anthropic/claude-sonnet-4-6 llmProvider: anthropic netboxAuthApiTimeout: 5 netboxAuthCacheTtl: 60 netboxAuthCookieName: sessionid redisDb: 2 replicas: 1 resources: cpu: 100 memory: 256 description: |- Copilot AI assistant backend service. When enabled, deploys the Copilot backend and activates the `netbox_copilot` plugin in NetBox. Disabled by default — requires a Kubernetes secret containing a valid LLM API key to be created before enabling. properties: awsCredentialsSecret: description: |- Optional name of a Kubernetes Secret containing explicit AWS credentials for Bedrock. Only used when `llmProvider` is `bedrock`. The secret must contain two keys: `aws_access_key_id` and `aws_secret_access_key`. When omitted, the Copilot backend uses ambient credential resolution (IRSA, instance profile, etc.). When using the KOTS admin console, this secret is provisioned automatically from the AWS Access Key ID and Secret Access Key fields. nullable: true type: string awsRegion: default: us-east-2 description: |- AWS region for Amazon Bedrock (e.g. `us-east-2`). Only used when `llmProvider` is `bedrock`. Sets the `AWS_DEFAULT_REGION` environment variable in the Copilot backend container. type: string databaseUser: default: copilot description: PostgreSQL user for Copilot's database. maxLength: 63 minLength: 1 type: string enabled: default: false description: |- Enable or disable the Copilot backend service. When enabled, the Copilot backend is deployed and the `netbox_copilot` NetBox plugin is activated. Requires a valid LLM API key secret. type: boolean image: description: |- Container image configuration. When not specified, uses the operator's built-in defaults. nullable: true properties: digest: description: Optional image digest for immutable image references. nullable: true type: string pullPolicy: default: IfNotPresent description: Image pull policy (Always, IfNotPresent, Never). enum: - IfNotPresent - Always - Never type: string registry: default: nbe-ecr description: Container registry host or Replicated registry alias. type: string repository: default: nbl_copilot description: Image repository path. type: string tag: default: v1.31.2 description: Image tag. type: string type: object limits: default: cpu: 1000 memory: 1024 description: Resource limits for the Copilot backend container. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object llmApiKeySecret: default: copilot-llm-api-key description: |- Name of the Kubernetes Secret containing the LLM API key. The secret must exist in the same namespace as the NetBoxEnterprise resource. For Anthropic, the secret should contain the API key under `llmApiKeySecretKey`. type: string llmApiKeySecretKey: default: apiKey description: Key within `llmApiKeySecret` that holds the LLM API key value. type: string llmMaxSteps: default: 20 description: Maximum number of LLM reasoning steps per conversation turn. format: uint8 maximum: 255.0 minimum: 0.0 type: integer llmModel: default: anthropic/claude-sonnet-4-6 description: LLM model identifier (provider-prefixed format, e.g. `anthropic/claude-sonnet-4-6`). type: string llmProvider: default: anthropic description: LLM provider to use. enum: - anthropic - bedrock type: string netboxAuthApiTimeout: default: 5 description: Timeout in seconds for NetBox auth API calls. format: uint8 maximum: 255.0 minimum: 0.0 type: integer netboxAuthCacheTtl: default: 60 description: TTL in seconds for caching NetBox auth session validation results. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer netboxAuthCookieName: default: sessionid description: NetBox session cookie name used for authentication. type: string postgres: description: |- External PostgreSQL connection configuration. When specified, Copilot connects to this external database instead of the PGO-managed PostgreSQL cluster. The secret must contain the password. If not specified, uses the PGO-generated secret `{cluster-name}-postgres-pguser-copilot`. nullable: true properties: databaseUrl: description: |- Secret key containing the full `DATABASE_URL` URI (e.g. `postgresql://user:pass@host:5432/db?sslmode=require`). When using the KOTS admin console, this secret is provisioned automatically from the Copilot database fields. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object keychainCaCertificates: description: |- Names of CA certificate secrets in the TLS keychain for verifying the Copilot PostgreSQL server certificate. Required when `sslMode` is `verify-ca` or `verify-full`. The named secrets must be registered in `spec.tlsKeychain.caCertificateSecrets`. Certificates are projected into the Copilot pod and pointed at with `PGSSLROOTCERT`, so libpq verifies against exactly these CAs rather than the whole system trust store. items: type: string type: array keychainClientCertificate: description: |- Name of a client certificate secret in the TLS keychain, for a PostgreSQL server whose `pg_hba.conf` demands mutual TLS (`clientcert=verify-ca`/`verify-full`). The name must match an entry in `spec.tlsKeychain.clientCertificateSecrets`. The certificate and its key are projected into the Copilot pod and pointed at with `PGSSLCERT`/`PGSSLKEY`. The key must be PKCS#8 PEM (`-----BEGIN PRIVATE KEY-----`). nullable: true type: string sslMode: description: |- PostgreSQL SSL connection mode. Controls how SSL/TLS is used when connecting to PostgreSQL. These modes match the libpq `sslmode` parameter values. # Modes | Mode | Description | |------|-------------| | `disable` | No SSL - unencrypted connection | | `allow` | Try non-SSL first, use SSL if server requires it | | `prefer` | Try SSL first, fall back to non-SSL (default for external) | | `require` | Require SSL, but don't verify the server certificate | | `verify-ca` | Require SSL and verify the server certificate is signed by a trusted CA | | `verify-full` | Require SSL, verify CA, and verify the server hostname matches the certificate | # Security Recommendations - For production external databases, use `verify-full` with proper CA certificates - Operator-managed PostgreSQL (PGO) always uses `require` internally - `disable` and `allow` should only be used in development environments enum: - disable - allow - prefer - require - verify-ca - verify-full nullable: true type: string required: - databaseUrl type: object redisDb: default: 2 description: |- Redis database number used by Copilot. Uses DB 2 by default to avoid conflicts with NetBox (DB 0) and Diode (DB 1). format: uint8 maximum: 255.0 minimum: 0.0 type: integer replicas: default: 1 description: Number of Copilot backend replicas. format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 100 memory: 256 description: Resource requests for the Copilot backend container. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object timeouts: description: |- Per-service timeout overrides for the Copilot Ingress. Field-level merges over the cluster-wide `spec.ingress.timeouts` default. When unset, Copilot falls back to long-lived-connection defaults suitable for streaming chat responses (see [`CopilotApp::intrinsic_timeouts`]). nullable: true properties: gateway: description: Gateway API HTTPRoute rule timeout overrides. nullable: true properties: backendRequest: description: |- BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended nullable: true type: string request: description: |- Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended nullable: true type: string type: object ingress: description: Ingress-level timeout overrides (nginx annotation translation). nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object topologySpreadConstraints: description: |- Topology spread constraints for Copilot pods. When configured, controls how pods are distributed across topology domains (nodes, zones). Useful for HA deployments with multiple replicas. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object diode: default: auth: annotations: null enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 port: 8080 replicas: 0 resources: cpu: 100 memory: 128 config: null enabled: true hydra: annotations: null autoMigrate: true databaseName: hydra databaseUser: hydra enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 replicas: 0 resources: cpu: 100 memory: 128 ingester: annotations: null enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 port: 8081 replicas: 0 resources: cpu: 100 memory: 128 reconciler: annotations: null enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 port: 8081 replicas: 0 resources: cpu: 100 memory: 128 description: Diode application (includes Hydra OIDC server) properties: auth: default: annotations: null enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 port: 8080 replicas: 0 resources: cpu: 100 memory: 128 description: Diode auth service component. properties: annotations: additionalProperties: type: string description: Annotations to apply to auth service pods. nullable: true type: object enabled: default: true description: Enable or disable the auth service deployment. type: boolean extraEnvs: default: [] description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: |- Container image configuration. When not specified, uses operator defaults allowing automatic version updates. nullable: true properties: digest: description: |- Optional image digest for immutable image references. The empty-string alternation is load-bearing (NBE-2217), not slack: `pattern` applies to any string that is *present*, and `resolve_diode_image` deliberately treats `digest: ""` as unset (falls back to the per-component pinned default) — a bare digest pattern would reject that value at admission before it ever reaches the resolver. The pattern is restricted to the two algorithms containerd actually accepts, each at its fixed hex length, lowercase only — go-digest requires lowercase hex for `sha256`/`sha512`, so a syntactically digest-shaped value like `sha256:ABCD…` or `sha256:a` would otherwise pass admission and still hit the kubelet as InvalidImageName. nullable: true pattern: ^$|^sha256:[a-f0-9]{64}$|^sha512:[a-f0-9]{128}$ type: string imagePullSecrets: description: Image pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: default: IfNotPresent description: Image pull policy (Always, IfNotPresent, Never). enum: - IfNotPresent - Always - Never type: string registry: default: docker.io description: Container registry URL. type: string repository: description: |- Image repository path. When unset, the operator fills in the component-specific default (auth/ingester/reconciler). nullable: true type: string tag: description: |- Image tag. When unset, the operator fills in the component-specific default tag. nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to auth service pods. nullable: true type: object limits: default: cpu: 500 memory: 512 description: Resource limits. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object port: default: 8080 description: Service port for auth API. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer replicas: default: 0 description: |- Number of auth service replicas. Set to 0 for auto-scaling based on node count (min(nodes, 3)); the operator resolves the sentinel at reconcile time (NBE-881). For a fixed count, set 1 or more. format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 100 memory: 128 description: Resource requests. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object serviceAccount: description: |- Kubernetes service account name. If not specified, auto-generated as `{cluster-name}-diode-auth`. nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for auth service pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object config: description: Diode application level configuration nullable: true properties: auth: default: logLevel: INFO telemetryConfig: metricsEnabled: false metricsExporter: prometheus metricsPort: null traceExporter: none description: Diode auth configuration properties: logLevel: default: INFO description: Log level. enum: - INFO - DEBUG - WARN - ERROR type: string sentryDsn: description: Sentry DSN for error tracking. nullable: true type: string telemetryConfig: default: metricsEnabled: false metricsExporter: prometheus metricsPort: null traceExporter: none description: Telemetry configuration. properties: environment: description: |- Deployment environment name. When None, Diode uses its own built-in default. nullable: true type: string metricsEnabled: default: false description: Enable Prometheus metrics endpoint. type: boolean metricsExporter: default: prometheus description: Metrics exporter backend. enum: - prometheus - otlp - console - none type: string metricsPort: description: Port for metrics endpoint (component-specific default). format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer traceExporter: default: none description: Trace exporter backend. enum: - otlp - console - none type: string type: object type: object hydra: default: oidc: subjectIdentifiers: supportedTypes: - public serve: admin: host: 0.0.0.0 port: 4445 public: host: 0.0.0.0 port: 4444 tls: allowTerminationFrom: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 strategies: accessToken: jwt jwt: scopeClaim: both ttl: accessToken: 1h description: Hydra OIDC server configuration properties: oidc: default: subjectIdentifiers: supportedTypes: - public description: OIDC configuration. properties: subjectIdentifiers: description: Subject identifier configuration. properties: supportedTypes: description: Supported subject identifier types. items: description: |- OIDC subject identifier algorithm type. See [Hydra subject identifiers](https://www.ory.com/docs/hydra/guides/openid). enum: - public - pairwise type: string type: array required: - supportedTypes type: object required: - subjectIdentifiers type: object serve: default: admin: host: 0.0.0.0 port: 4445 public: host: 0.0.0.0 port: 4444 tls: allowTerminationFrom: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 description: Server listening configuration. properties: admin: default: host: 0.0.0.0 port: 4445 description: Admin API server configuration. properties: host: default: 0.0.0.0 description: Bind address. type: string port: default: 4445 description: Admin API port. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer type: object public: default: host: 0.0.0.0 port: 4444 description: Public API server configuration. properties: host: default: 0.0.0.0 description: Bind address. type: string port: default: 4444 description: Public API port. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer type: object tls: default: allowTerminationFrom: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 description: TLS termination configuration. properties: allowTerminationFrom: default: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 description: Networks allowed to terminate TLS (e.g., load balancers). items: pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\/(3[0-2]|[0-2]?[0-9])$ type: string type: array type: object type: object strategies: default: accessToken: jwt jwt: scopeClaim: both description: Token strategies. properties: accessToken: description: Access token strategy. enum: - jwt - opaque type: string jwt: description: JWT-specific configuration. properties: scopeClaim: description: Format for scope claim in JWT. enum: - list - string - both type: string required: - scopeClaim type: object required: - accessToken - jwt type: object ttl: default: accessToken: 1h description: Token TTL configuration. properties: accessToken: default: 1h description: Access token lifetime (e.g., "1h", "30m"). type: string type: object urls: description: URL configuration. nullable: true properties: self: description: Self-referential URLs. nullable: true properties: issuer: description: |- OIDC issuer URL. If not specified, will be auto-generated based on cluster name and namespace. nullable: true type: string type: object type: object type: object ingester: default: logLevel: INFO redisMemoryHighWatermarkPct: 90 redisStreamDb: 1 telemetryConfig: metricsEnabled: false metricsExporter: prometheus metricsPort: null traceExporter: none description: Diode ingester configuration properties: logLevel: default: INFO description: Log level. enum: - INFO - DEBUG - WARN - ERROR type: string redisMemoryHighWatermarkPct: default: 90 description: |- Redis `used_memory` / `maxmemory` percentage at which the ingester rejects Ingest with `ResourceExhausted` (`REDIS_MEMORY_HIGH_WATERMARK_PCT`). Defaults to 90, matching NetBox Cloud. 0 disables the check. Only meaningful when Redis has a `maxmemory` cap — set the cluster's `redis.maxMemoryPercent`. Without a cap the ratio is undefined and the check is a no-op. format: uint8 maximum: 100.0 minimum: 0.0 type: integer redisStreamDb: default: 1 description: Redis database number for stream storage. format: uint8 maximum: 255.0 minimum: 0.0 type: integer sentryDsn: description: Sentry DSN for error tracking. nullable: true type: string telemetryConfig: default: metricsEnabled: false metricsExporter: prometheus metricsPort: null traceExporter: none description: Telemetry configuration. properties: environment: description: |- Deployment environment name. When None, Diode uses its own built-in default. nullable: true type: string metricsEnabled: default: false description: Enable Prometheus metrics endpoint. type: boolean metricsExporter: default: prometheus description: Metrics exporter backend. enum: - prometheus - otlp - console - none type: string metricsPort: description: Port for metrics endpoint (component-specific default). format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer traceExporter: default: none description: Trace exporter backend. enum: - otlp - console - none type: string type: object type: object reconciler: default: autoApplyChangesets: true autoApplyProcessorConcurrency: 1 databaseName: diode databaseUser: diode ingestionLogProcessorConcurrency: 4 logLevel: INFO migrationEnabled: true netboxClientId: diode-to-netbox rateLimitBurst: 1 rateLimitNetboxBurst: 1 rateLimitNetboxRps: 20 rateLimitRps: 20 redisDb: 0 redisStreamDb: 1 telemetryConfig: metricsEnabled: false metricsExporter: prometheus metricsPort: null traceExporter: none description: Diode reconciler configuration properties: autoApplyChangesets: default: true description: Automatically apply changesets to NetBox. type: boolean autoApplyProcessorConcurrency: default: 1 description: |- Number of concurrent auto-apply processors (`AUTO_APPLY_PROCESSOR_CONCURRENCY`). format: uint8 maximum: 255.0 minimum: 1.0 type: integer databaseName: default: diode description: PostgreSQL database name. maxLength: 63 minLength: 1 type: string databaseUser: default: diode description: PostgreSQL database user. maxLength: 63 minLength: 1 type: string ingestionLogProcessorConcurrency: default: 4 description: |- Number of concurrent ingestion-log processors (`INGESTION_LOG_PROCESSOR_CONCURRENCY`). format: uint8 maximum: 255.0 minimum: 1.0 type: integer logLevel: default: INFO description: Log level. enum: - INFO - DEBUG - WARN - ERROR type: string migrationEnabled: default: true description: Enable database migrations on startup. type: boolean netboxClientId: default: diode-to-netbox description: OAuth2 client ID for NetBox authentication. type: string pluginApiBaseUrl: description: |- NetBox Diode plugin API base URL. If not specified, auto-generated based on cluster name and namespace. nullable: true type: string postgres: description: |- PostgreSQL connection configuration (optional, for external databases). If not provided, defaults to using PGO-generated secrets with the pattern: `{cluster-name}-postgres-pguser-diode` For external databases, specify the secret containing connection details. nullable: true properties: password: description: Password reference (references external secret). properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object postgresqlProfile: description: |- Name of a PostgreSQL profile from `postgresqlProfiles`. When set, the component inherits PostgreSQL configuration (host, port, TLS) from the named profile. This is used by KOTS to avoid duplicating cluster-level PostgreSQL settings for each component. nullable: true type: string required: - password type: object rateLimitBurst: default: 1 description: Rate limit burst size. format: uint8 maximum: 255.0 minimum: 0.0 type: integer rateLimitNetboxBurst: default: 1 description: NetBox API rate limit burst size. format: uint8 maximum: 255.0 minimum: 0.0 type: integer rateLimitNetboxRps: default: 20 description: NetBox API rate limit requests per second. format: uint8 maximum: 255.0 minimum: 0.0 type: integer rateLimitRps: default: 20 description: Rate limit requests per second. format: uint8 maximum: 255.0 minimum: 0.0 type: integer redisDb: default: 0 description: Redis database number. format: uint8 maximum: 255.0 minimum: 0.0 type: integer redisStreamDb: default: 1 description: Redis database number for stream storage. format: uint8 maximum: 255.0 minimum: 0.0 type: integer sentryDsn: description: Sentry DSN for error tracking. nullable: true type: string telemetryConfig: default: metricsEnabled: false metricsExporter: prometheus metricsPort: null traceExporter: none description: Telemetry configuration. properties: environment: description: |- Deployment environment name. When None, Diode uses its own built-in default. nullable: true type: string metricsEnabled: default: false description: Enable Prometheus metrics endpoint. type: boolean metricsExporter: default: prometheus description: Metrics exporter backend. enum: - prometheus - otlp - console - none type: string metricsPort: description: Port for metrics endpoint (component-specific default). format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer traceExporter: default: none description: Trace exporter backend. enum: - otlp - console - none type: string type: object type: object type: object enabled: default: true description: Enable or disable the entire Diode application suite. type: boolean hydra: default: annotations: null autoMigrate: true databaseName: hydra databaseUser: hydra enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 replicas: 0 resources: cpu: 100 memory: 128 description: Hydra OIDC server for Diode authentication. properties: annotations: additionalProperties: type: string description: Annotations to apply to Hydra pods. nullable: true type: object autoMigrate: default: true description: Enable automatic database migrations on startup. type: boolean databaseName: default: hydra description: |- PostgreSQL database name for Hydra. NOTE: the consumer side only stores this; it has no effect today. For operator-managed PostgreSQL the database name is baked into the PGO-generated DSN; for an external database the provided DSN is authoritative. It takes effect once PGO provisioning derives databases from configured names. maxLength: 63 minLength: 1 type: string databaseUser: default: hydra description: |- PostgreSQL database user for Hydra. Selects the PGO-generated secret referenced for the DSN (`{cluster-name}-postgres-pguser-{user}`). A non-default user must have a matching entry in `spec.postgresql.users`; the default user list only provisions `hydra`, so PGO never creates the secret for an unlisted user. maxLength: 63 minLength: 1 type: string enabled: default: true description: Enable or disable Hydra deployment. type: boolean extraEnvs: default: [] description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: |- Container image configuration. When not specified, uses operator defaults allowing automatic version updates. nullable: true properties: digest: description: Optional image digest for immutable image references. nullable: true type: string imagePullSecrets: description: Image pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: default: IfNotPresent description: Image pull policy (Always, IfNotPresent, Never). enum: - IfNotPresent - Always - Never type: string registry: default: docker.io description: Container registry URL. type: string repository: default: oryd/hydra description: Image repository path. type: string tag: default: v25.4.0 description: Image tag. type: string type: object labels: additionalProperties: type: string description: Labels to apply to Hydra pods. nullable: true type: object limits: default: cpu: 500 memory: 512 description: Resource limits. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object postgresqlProfile: description: |- Name of a PostgreSQL profile from `postgresqlProfiles`. When set, Hydra inherits PostgreSQL configuration (host, port, TLS) from the named profile. Used by KOTS to avoid duplicating cluster-level PostgreSQL settings. nullable: true type: string replicas: default: 0 description: |- Number of Hydra replicas. Set to 0 for auto-scaling based on node count (min(nodes, 3)); the operator resolves the sentinel at reconcile time (NBE-881). For a fixed count, set 1 or more. format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 100 memory: 128 description: Resource requests. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object secrets: description: |- Secret references for Hydra. If not provided, will be auto-generated based on PostgreSQL configuration. nullable: true properties: cookie: description: Cookie secret for session management. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object dsn: description: Database connection DSN. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object system: description: System secret for encryption. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object serviceAccount: description: |- Kubernetes service account name. If not specified, auto-generated as `{cluster-name}-diode-hydra`. nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for Hydra pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object ingester: default: annotations: null enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 port: 8081 replicas: 0 resources: cpu: 100 memory: 128 description: Diode ingester component. properties: annotations: additionalProperties: type: string description: Annotations to apply to ingester pods. nullable: true type: object enabled: default: true description: Enable or disable the ingester deployment. type: boolean extraEnvs: default: [] description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: |- Container image configuration. When not specified, uses operator defaults allowing automatic version updates. nullable: true properties: digest: description: |- Optional image digest for immutable image references. The empty-string alternation is load-bearing (NBE-2217), not slack: `pattern` applies to any string that is *present*, and `resolve_diode_image` deliberately treats `digest: ""` as unset (falls back to the per-component pinned default) — a bare digest pattern would reject that value at admission before it ever reaches the resolver. The pattern is restricted to the two algorithms containerd actually accepts, each at its fixed hex length, lowercase only — go-digest requires lowercase hex for `sha256`/`sha512`, so a syntactically digest-shaped value like `sha256:ABCD…` or `sha256:a` would otherwise pass admission and still hit the kubelet as InvalidImageName. nullable: true pattern: ^$|^sha256:[a-f0-9]{64}$|^sha512:[a-f0-9]{128}$ type: string imagePullSecrets: description: Image pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: default: IfNotPresent description: Image pull policy (Always, IfNotPresent, Never). enum: - IfNotPresent - Always - Never type: string registry: default: docker.io description: Container registry URL. type: string repository: description: |- Image repository path. When unset, the operator fills in the component-specific default (auth/ingester/reconciler). nullable: true type: string tag: description: |- Image tag. When unset, the operator fills in the component-specific default tag. nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to ingester pods. nullable: true type: object limits: default: cpu: 500 memory: 512 description: Resource limits. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object port: default: 8081 description: Service port for ingester API. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer replicas: default: 0 description: |- Number of ingester replicas. Set to 0 for auto-scaling based on node count (min(nodes, 3)); the operator resolves the sentinel at reconcile time (NBE-881). For a fixed count, set 1 or more. format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 100 memory: 128 description: Resource requests. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object serviceAccount: description: |- Kubernetes service account name. If not specified, auto-generated as `{cluster-name}-diode-ingester`. nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for ingester pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object reconciler: default: annotations: null enabled: true extraEnvs: [] labels: null limits: cpu: 500 memory: 512 port: 8081 replicas: 0 resources: cpu: 100 memory: 128 description: Diode reconciler component. properties: annotations: additionalProperties: type: string description: Annotations to apply to reconciler pods. nullable: true type: object enabled: default: true description: Enable or disable the reconciler deployment. type: boolean extraEnvs: default: [] description: Additional environment variables. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array image: description: |- Container image configuration. When not specified, uses operator defaults allowing automatic version updates. nullable: true properties: digest: description: |- Optional image digest for immutable image references. The empty-string alternation is load-bearing (NBE-2217), not slack: `pattern` applies to any string that is *present*, and `resolve_diode_image` deliberately treats `digest: ""` as unset (falls back to the per-component pinned default) — a bare digest pattern would reject that value at admission before it ever reaches the resolver. The pattern is restricted to the two algorithms containerd actually accepts, each at its fixed hex length, lowercase only — go-digest requires lowercase hex for `sha256`/`sha512`, so a syntactically digest-shaped value like `sha256:ABCD…` or `sha256:a` would otherwise pass admission and still hit the kubelet as InvalidImageName. nullable: true pattern: ^$|^sha256:[a-f0-9]{64}$|^sha512:[a-f0-9]{128}$ type: string imagePullSecrets: description: Image pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: default: IfNotPresent description: Image pull policy (Always, IfNotPresent, Never). enum: - IfNotPresent - Always - Never type: string registry: default: docker.io description: Container registry URL. type: string repository: description: |- Image repository path. When unset, the operator fills in the component-specific default (auth/ingester/reconciler). nullable: true type: string tag: description: |- Image tag. When unset, the operator fills in the component-specific default tag. nullable: true type: string type: object labels: additionalProperties: type: string description: Labels to apply to reconciler pods. nullable: true type: object limits: default: cpu: 500 memory: 512 description: Resource limits. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object port: default: 8081 description: Service port for reconciler API. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer replicas: default: 0 description: |- Number of reconciler replicas. Set to 0 for auto-scaling based on node count (min(nodes, 3)); the operator resolves the sentinel at reconcile time (NBE-881). For a fixed count, set 1 or more. format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 100 memory: 128 description: Resource requests. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object serviceAccount: description: |- Kubernetes service account name. If not specified, auto-generated as `{cluster-name}-diode-reconciler`. nullable: true type: string topologySpreadConstraints: description: Topology spread constraints for reconciler pods. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object timeouts: description: |- Per-route timeout overrides for the Diode HTTP and gRPC surfaces. Field-level merges over the cluster-wide `spec.ingress.timeouts` and `spec.gateway.timeouts` defaults. `http` applies to the Diode HTTP Ingress and HTTPRoute (Hydra oauth2 + Diode auth); `grpc` applies to the Diode gRPC Ingress (Ingester + Reconciler). nullable: true properties: grpc: description: Timeout overrides for the Diode gRPC Ingress. nullable: true properties: ingress: description: Ingress-level timeout overrides for the gRPC Ingress. nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object http: description: Timeout overrides for the Diode HTTP Ingress + HTTPRoute. nullable: true properties: gateway: description: Gateway API HTTPRoute rule timeout overrides. nullable: true properties: backendRequest: description: |- BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended nullable: true type: string request: description: |- Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended nullable: true type: string type: object ingress: description: Ingress-level timeout overrides (nginx annotation translation). nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object type: object topologySpreadConstraints: description: |- Topology spread constraints applied to every Diode pod (ingester, reconciler, auth, proxy). Acts as a Diode-suite-wide default: a per-component `topologySpreadConstraints` overrides it, and when unset the operator falls back to `spec.replication.topologySpreadConstraints` and then a hostname default. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object extraCaCertificates: description: |- Additional CA certificates to trust system-wide. These certificates will be added to the system trust store of all NetBox components (netbox, worker) and merged into every service- specific CA bundle (PostgreSQL, Redis). Useful for: - Custom or self-signed CA certificates - Internal enterprise CA certificates - Third-party service certificates (LDAP, webhooks, etc.) Users must create Kubernetes secrets containing PEM-encoded certificates, then reference them here. Multiple certificates can be concatenated in a single secret key, or split across multiple references. # Example ```yaml extraCaCertificates: - name: company-root-ca key: ca.crt - name: partner-ca-bundle key: ca-bundle.pem ``` items: description: SecretKeySelector selects a key of a Secret. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: array extraManifests: description: |- Additional Kubernetes manifests to deploy alongside the managed workloads. Each entry is a YAML string and may contain multiple documents separated by `---`. Documents are parsed into typed resources, run through the same base and enterprise mutation pipelines as operator-built resources (canonical labels, registry rewrites, pull secrets), and applied with the managed workloads. Supported kinds: Deployment, Job, Secret, ConfigMap, Service, ServiceAccount, Ingress, Role, RoleBinding, PersistentVolumeClaim. Any other kind is rejected at reconcile time. Resources are always deployed into the cluster's namespace; an explicit mismatching `metadata.namespace` is rejected. # Example ```yaml extraManifests: - | apiVersion: v1 kind: ConfigMap metadata: name: my-extra-config data: key: value ``` items: type: string type: array gateway: description: |- Gateway API configuration for operator-managed Gateway and Route resources. When omitted or disabled, no Gateway API resources are created. Can coexist with Ingress — both can be enabled simultaneously. nullable: true properties: annotations: additionalProperties: type: string description: Extra annotations merged onto all Gateway API resources. type: object className: default: traefik description: |- GatewayClass name for the Gateway resource. Maps to `spec.gatewayClassName` on the generated Gateway. Common values: `"traefik"`, `"envoy"`, `"cilium"`, `"istio"`. type: string enabled: default: false description: |- Whether the operator creates Gateway API resources. Defaults to `false` (opt-in). When `true`, the operator creates a Gateway and the associated HTTPRoute/GRPCRoute objects. type: boolean listeners: description: |- Gateway listener definitions. Each entry maps to a `spec.listeners[]` entry on the Gateway. Uses the upstream Gateway API `GatewayListeners` type directly. items: description: |- Listener embodies the concept of a logical endpoint where a Gateway accepts network connections. properties: allowedRoutes: description: |- AllowedRoutes defines the types of routes that MAY be attached to a Listener and the trusted namespaces where those Route resources MAY be present. Although a client request may match multiple route rules, only one rule may ultimately receive the request. Matching precedence MUST be determined in order of the following criteria: * The most specific match as defined by the Route type. * The oldest Route based on creation timestamp. For example, a Route with a creation timestamp of "2020-09-08 01:02:03" is given precedence over a Route with a creation timestamp of "2020-09-08 01:02:04". * If everything else is equivalent, the Route appearing first in alphabetical order (namespace/name) should be given precedence. For example, foo/bar is given precedence over foo/baz. All valid rules within a Route attached to this Listener should be implemented. Invalid Route rules can be ignored (sometimes that will mean the full Route). If a Route rule transitions from valid to invalid, support for that Route rule should be dropped to ensure consistency. For example, even if a filter specified by a Route rule is invalid, the rest of the rules within that Route should still be supported. Support: Core nullable: true properties: kinds: description: |- Kinds specifies the groups and kinds of Routes that are allowed to bind to this Gateway Listener. When unspecified or empty, the kinds of Routes selected are determined using the Listener protocol. A RouteGroupKind MUST correspond to kinds of Routes that are compatible with the application protocol specified in the Listener's Protocol field. If an implementation does not support or recognize this resource type, it MUST set the "ResolvedRefs" condition to False for this Listener with the "InvalidRouteKinds" reason. Support: Core items: description: RouteGroupKind indicates the group and kind of a Route resource. properties: group: description: Group is the group of the Route. nullable: true type: string kind: description: Kind is the kind of the Route. type: string required: - kind type: object nullable: true type: array namespaces: description: |- Namespaces indicates namespaces from which Routes may be attached to this Listener. This is restricted to the namespace of this Gateway by default. Support: Core nullable: true properties: from: description: |- From indicates where Routes will be selected for this Gateway. Possible values are: * All: Routes in all namespaces may be used by this Gateway. * Selector: Routes in namespaces selected by the selector may be used by this Gateway. * Same: Only Routes in the same namespace may be used by this Gateway. Support: Core enum: - All - Selector - Same - null nullable: true type: string selector: description: |- Selector must be specified when From is set to "Selector". In that case, only Routes in Namespaces matching this Selector will be selected by this Gateway. This field is ignored for other values of "From". Support: Core nullable: true properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string nullable: true type: array required: - key - operator type: object nullable: true type: array matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. nullable: true type: object type: object type: object type: object hostname: description: |- Hostname specifies the virtual hostname to match for protocol types that define this concept. When unspecified, all hostnames are matched. This field is ignored for protocols that don't require hostname based matching. Implementations MUST apply Hostname matching appropriately for each of the following protocols: * TLS: The Listener Hostname MUST match the SNI. * HTTP: The Listener Hostname MUST match the Host header of the request. * HTTPS: The Listener Hostname SHOULD match both the SNI and Host header. Note that this does not require the SNI and Host header to be the same. The semantics of this are described in more detail below. To ensure security, Section 11.1 of RFC-6066 emphasizes that server implementations that rely on SNI hostname matching MUST also verify hostnames within the application protocol. Section 9.1.2 of RFC-7540 provides a mechanism for servers to reject the reuse of a connection by responding with the HTTP 421 Misdirected Request status code. This indicates that the origin server has rejected the request because it appears to have been misdirected. To detect misdirected requests, Gateways SHOULD match the authority of the requests with all the SNI hostname(s) configured across all the Gateway Listeners on the same port and protocol: * If another Listener has an exact match or more specific wildcard entry, the Gateway SHOULD return a 421. * If the current Listener (selected by SNI matching during ClientHello) does not match the Host: * If another Listener does match the Host, the Gateway SHOULD return a 421. * If no other Listener matches the Host, the Gateway MUST return a 404. For HTTPRoute and TLSRoute resources, there is an interaction with the `spec.hostnames` array. When both listener and route specify hostnames, there MUST be an intersection between the values for a Route to be accepted. For more information, refer to the Route specific Hostnames documentation. Hostnames that are prefixed with a wildcard label (`*.`) are interpreted as a suffix match. That means that a match for `*.example.com` would match both `test.example.com`, and `foo.test.example.com`, but not `example.com`. Support: Core nullable: true type: string name: description: |- Name is the name of the Listener. This name MUST be unique within a Gateway. Support: Core type: string port: description: |- Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules. Support: Core format: int32 type: integer protocol: description: |- Protocol specifies the network protocol this listener expects to receive. Support: Core type: string tls: description: |- TLS is the TLS configuration for the Listener. This field is required if the Protocol field is "HTTPS" or "TLS". It is invalid to set this field if the Protocol field is "HTTP", "TCP", or "UDP". The association of SNIs to Certificate defined in ListenerTLSConfig is defined based on the Hostname field for this listener. The GatewayClass MUST use the longest matching SNI out of all available certificates for any TLS handshake. Support: Core nullable: true properties: certificateRefs: description: |- CertificateRefs contains a series of references to Kubernetes objects that contains TLS certificates and private keys. These certificates are used to establish a TLS handshake for requests that match the hostname of the associated listener. A single CertificateRef to a Kubernetes Secret has "Core" support. Implementations MAY choose to support attaching multiple certificates to a Listener, but this behavior is implementation-specific. References to a resource in different namespace are invalid UNLESS there is a ReferenceGrant in the target namespace that allows the certificate to be attached. If a ReferenceGrant does not allow this reference, the "ResolvedRefs" condition MUST be set to False for this listener with the "RefNotPermitted" reason. This field is required to have at least one element when the mode is set to "Terminate" (default) and is optional otherwise. CertificateRefs can reference to standard Kubernetes resources, i.e. Secret, or implementation-specific custom resources. Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls Support: Implementation-specific (More than one reference or other resource types) items: description: |- SecretObjectReference identifies an API object including its namespace, defaulting to Secret. The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid. References to objects with invalid Group and Kind are not valid, and must be rejected by the implementation, with appropriate Conditions set on the containing object. properties: group: description: |- Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. nullable: true type: string kind: description: Kind is kind of the referent. For example "Secret". nullable: true type: string name: description: Name is the name of the referent. type: string namespace: description: |- Namespace is the namespace of the referenced object. When unspecified, the local namespace is inferred. Note that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. Support: Core nullable: true type: string required: - name type: object nullable: true type: array mode: description: |- Mode defines the TLS behavior for the TLS session initiated by the client. There are two possible modes: - Terminate: The TLS session between the downstream client and the Gateway is terminated at the Gateway. This mode requires certificates to be specified in some way, such as populating the certificateRefs field. - Passthrough: The TLS session is NOT terminated by the Gateway. This implies that the Gateway can't decipher the TLS stream except for the ClientHello message of the TLS protocol. The certificateRefs field is ignored in this mode. Support: Core enum: - Terminate - Passthrough - null nullable: true type: string options: additionalProperties: type: string description: |- Options are a list of key/value pairs to enable extended TLS configuration for each implementation. For example, configuring the minimum TLS version or supported cipher suites. A set of common keys MAY be defined by the API in the future. To avoid any ambiguity, implementation-specific definitions MUST use domain-prefixed names, such as `example.com/my-custom-option`. Un-prefixed names are reserved for key names defined by Gateway API. Support: Implementation-specific nullable: true type: object type: object required: - name - port - protocol type: object type: array maxRequestBodyBytes: description: |- Maximum request body size, in bytes, enforced at the bundled Traefik gateway. `0` disables the cap (unlimited). Unset resolves to [`DEFAULT_MAX_REQUEST_BODY_BYTES`] via [`Self::max_request_body_bytes`]. Only takes effect when the gateway class is the bundled Traefik (`traefik`); BYO-gateway installs configure body limits on their own controller. Maps to a `traefik.io` `Middleware` (`spec.buffering.maxRequestBodyBytes`) attached to the NetBox and Copilot HTTPRoutes and to every rule of the Diode HTTPRoute. The signed `i64` type matches the Traefik `Middleware` CRD (`spec.buffering.maxRequestBodyBytes: int64`); `0` or any negative value is treated as unlimited (no cap emitted). format: int64 nullable: true type: integer timeouts: description: |- Timeouts applied to all generated HTTPRoute rules. Maps to `spec.rules[].timeouts` on HTTPRoute resources. Values are Gateway API duration strings (e.g., `"30s"`, `"1m"`). nullable: true properties: backendRequest: description: |- BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended nullable: true type: string request: description: |- Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended nullable: true type: string type: object type: object imagePullPolicy: default: IfNotPresent description: Image pull policy for NetBox containers. enum: - IfNotPresent - Always - Never type: string imagePullSecrets: description: Image pull secrets for private registries. items: type: string type: array ingress: description: |- Ingress configuration for all operator-managed Ingress resources. When omitted, the operator uses default settings (nginx class, no TLS, no extra annotations). nullable: true properties: annotations: additionalProperties: type: string description: |- Extra annotations merged onto every Ingress object. Values here override the hardcoded nginx-specific defaults when keys collide. type: object className: default: nginx description: |- Kubernetes Ingress class name. Maps to `spec.ingressClassName` on all generated Ingress objects. Defaults to `"nginx"` for backward compatibility. Only the `nginx` class is supported for the Diode and Copilot Ingresses. Their paths are regex captures that route only when paired with `nginx.ingress.kubernetes.io/rewrite-target`, and the operator emits that annotation for the `nginx` class alone. On any other class those two Ingresses are not created and a warning is logged; the NetBox Ingress needs no rewrite and is still created. Supplying `rewrite-target` yourself through `annotations` below does not lift the restriction, and breaks NetBox if you try: that map is merged onto every Ingress, and NetBox's path has no capture group, so `/$1` there rewrites every NetBox request to `/`. To route Diode and Copilot through a non-nginx controller, use the Gateway API instead: set both `routing.mode: gateway` and `gateway.enabled: true` (with a `gateway.className` and listeners). Setting `routing.mode` alone emits no Gateway resources either. type: string enabled: default: true description: |- Whether the operator creates Ingress objects. When `false`, the operator skips Ingress creation entirely. Existing Ingress objects are pruned by orphan cleanup. type: boolean timeouts: description: |- Proxy timeouts translated to controller-specific annotations. Currently only the `nginx` class is supported — other classes log a warning and leave timeouts at the controller defaults. nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object tls: description: |- TLS termination entries for Ingress resources. Each entry maps directly to a Kubernetes `IngressTLS` object. All unique hosts across entries are used to create `IngressRule` entries. items: description: IngressTLS describes the transport layer security associated with an ingress. properties: hosts: description: hosts is a list of hosts included in the TLS certificate. The values in this list must match the name/s used in the tlsSecret. Defaults to the wildcard host setting for the loadbalancer controller fulfilling this Ingress, if left unspecified. items: type: string type: array secretName: description: secretName is the name of the secret used to terminate TLS traffic on port 443. Field is left optional to allow TLS routing based on SNI hostname alone. If the SNI host in a listener conflicts with the "Host" header field used by an IngressRule, the SNI host is used for termination and value of the "Host" header is used for routing. type: string type: object type: array type: object labels: additionalProperties: type: string description: Labels applied to all cluster resources. nullable: true type: object maintenanceMode: default: false description: Enable maintenance mode - scales down all deployments and creates a maintenance pod for manual operations. type: boolean netbox: description: NetBox application deployment configuration. properties: appReadyTimeout: default: 5m description: |- Maximum time the operator waits for the NetBox app deployment to become ready after each reconcile. Covers database migrations run at pod startup. Accepts durations (`5m`, `300s`) or bare seconds. Default: 5m (300s). pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string config: description: NetBox application specific configuration nullable: true properties: allowedHosts: default: - '*' description: Allowed hostnames for NetBox. items: type: string type: array customPythonConfig: description: |- Custom Python configuration to be loaded after NetBox configuration.py. This content is rendered into user_extra.py and mounted as zzz_80_user_extra.py, allowing customization of PLUGINS, PLUGINS_CONFIG, and other NetBox settings. nullable: true type: string customPythonConfigRef: description: |- Reference to a ConfigMap key containing custom Python configuration. If both customPythonConfig and customPythonConfigRef are specified, customPythonConfig takes precedence. nullable: true properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object emailPassword: description: Email password reference (auto-generated if needed). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object metricsEnabled: default: false description: Enable Prometheus metrics endpoint at /metrics. type: boolean plugins: default: mediaWheelhousePollInterval: 5m description: Custom plugins configuration for installing Python packages from wheelhouse. properties: mediaWheelhousePollInterval: default: 5m description: |- How often the wheelhouse-watcher sidecar polls the wheelhouse file for mtime/size changes. Accepts human-friendly strings (`5m`, `1h`) or bare seconds (`300`). Relevant whenever a watcher runs: the media-dir wheelhouse (no configured source, custom Python config present) or a configured PVC source, where polling the file is the only way to see a wheelhouse dropped onto an existing claim. Ignored for S3 sources, which the operator probes itself. (The `media` in the name predates PVC support; it is kept because renaming a CRD field would break existing CRs.) pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string wheelhouse: description: |- Wheelhouse source configuration. Specify either `s3` or `pvc` as the source for the wheelhouse tarball. Validation is performed automatically during deserialization. nullable: true properties: pvc: description: PVC source configuration for wheelhouse file. nullable: true properties: claimName: description: |- Name of the PVC containing the wheelhouse. If `create` is true, the operator will create this PVC. If `create` is false (default), the PVC must already exist. type: string create: default: false description: |- Create the PVC if it doesn't exist (default: false). When true, the operator will create and manage the PVC lifecycle. Use maintenanceMode to access the PVC and upload the wheelhouse file. type: boolean path: default: wheelhouse.tar.gz description: 'Path to the wheelhouse file within the PVC (default: wheelhouse.tar.gz).' type: string size: default: 1Gi description: |- Size of the PVC to create (default: 1Gi). Only used when `create` is true. pattern: ^$|^(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[kMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ type: string storageClassName: description: |- Storage class name for the PVC. Only used when `create` is true. nullable: true type: string required: - claimName type: object s3: description: S3 bucket configuration for wheelhouse download. nullable: true properties: bucket: description: S3 bucket name. type: string credentialsSecret: description: Reference to Secret containing S3 credentials. properties: accessKeyId: default: AWS_ACCESS_KEY_ID description: 'Key within the secret for the access key ID (default: AWS_ACCESS_KEY_ID).' type: string name: description: Name of the Kubernetes Secret containing S3 credentials. type: string secretAccessKey: default: AWS_SECRET_ACCESS_KEY description: 'Key within the secret for the secret access key (default: AWS_SECRET_ACCESS_KEY).' type: string required: - name type: object endpoint: description: S3-compatible endpoint URL (optional, uses AWS default if not specified). nullable: true type: string key: default: media/wheelhouse.tar.gz description: 'Object key within the bucket (default: media/wheelhouse.tar.gz).' type: string region: default: us-east-1 description: 'AWS region (default: us-east-1).' type: string verifySSL: default: true description: 'Whether to verify SSL certificates (default: true).' type: boolean required: - bucket - credentialsSecret type: object type: object type: object postgres: description: PostgreSQL connection configuration (derived from spec.postgresql if not provided). nullable: true properties: database: default: netbox description: Database name for NetBox. maxLength: 63 minLength: 1 type: string password: description: Password reference (auto-generated if not provided). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object user: default: netbox description: Database username for NetBox. maxLength: 63 minLength: 1 type: string users: default: - databases: - netbox name: netbox options: SUPERUSER - databases: - copilot name: copilot options: SUPERUSER - databases: - diode name: diode options: SUPERUSER - databases: - hydra name: hydra options: SUPERUSER description: Users to create in PostgreSQL (for PGO). items: description: PostgreSQL user specification for PGO. properties: databases: description: Databases the user can access. items: maxLength: 63 minLength: 1 type: string type: array name: description: Username. maxLength: 63 minLength: 1 type: string options: description: PostgreSQL user options (e.g., "SUPERUSER"). type: string required: - databases - name - options type: object type: array type: object redis: description: Redis connection configuration (derived from spec.redis if not provided). nullable: true properties: cachingDatabase: description: |- Redis DB index for the caching connection. Defaults to 1. Set to 0 for Redis Enterprise, which only supports DB index 0. No upper bound is enforced; see `tasksDatabase`. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer host: description: Redis hostname. type: string password: description: |- Password reference for Redis authentication. This password is used for both the tasks queue and cache connections. If not provided and `requireAuth` is true, authentication will fail. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object port: default: 6379 description: Redis port number. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer tasksDatabase: description: |- Redis DB index for the tasks (RQ) connection. Defaults to 0. Redis Enterprise only supports DB index 0; this is already the tasks default, but the field is exposed for symmetry with `cachingDatabase`. No upper bound is enforced: the real ceiling is the target Redis's `databases` setting (stock OSS is 16, Enterprise is 1), which the operator can't know — an out-of-range index fails at `SELECT` time. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer username: description: |- Redis username for ACL authentication (Redis 6.0+). If not specified, defaults to empty string (legacy auth mode). nullable: true type: string required: - host type: object secretKey: description: Django secret key reference (auto-generated if not provided). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object storage: default: s3: accessKeyId: null bucketName: null enabled: false endpointUrl: null regionName: '' secretAccessKey: null tlsConfig: null description: Storage configuration (S3, etc.) for NetBox media files. properties: s3: default: accessKeyId: null bucketName: null enabled: false endpointUrl: null regionName: '' secretAccessKey: null tlsConfig: null description: S3 storage configuration. properties: accessKeyId: description: AWS access key ID reference (from a Kubernetes Secret). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object bucketName: description: S3 bucket name. nullable: true type: string enabled: default: false description: Enable S3 storage for media files. type: boolean endpointUrl: description: Custom S3 endpoint URL (for MinIO, Garage, or other S3-compatible services). nullable: true type: string regionName: default: us-east-1 description: 'AWS region name (default: us-east-1).' type: string secretAccessKey: description: AWS secret access key reference (from a Kubernetes Secret). nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object tlsConfig: description: |- TLS configuration referencing certificates from the cluster's `tlsKeychain`. When present, enables: - Custom CA certificates for server verification (via keychain) - Client certificates for mutual TLS (mTLS) authentication - Insecure skip verification (disabling SSL certificate verification) nullable: true properties: insecureSkipVerify: default: false description: |- Skip TLS certificate verification. **Warning**: Setting this to `true` disables certificate verification and should only be used for testing or development environments. **PostgreSQL caveat**: This field has no effect on PostgreSQL certificate verification when CA certificates are configured via `keychainCaCertificates`. For backward compatibility, libpq verifies the server certificate whenever `PGSSLROOTCERT` is set and `sslmode=require`, effectively upgrading it to `verify-ca` behavior. Since the operator sets `PGSSLROOTCERT` when any CA certificates are provided, `insecureSkipVerify: true` will not prevent certificate validation for PostgreSQL connections. To skip verification, remove the CA certificates instead. type: boolean keychainCaCertificates: description: |- Names of CA certificates from the cluster's `tlsKeychain` to use for verifying server certificates. These names must match entries in `tlsKeychain.caCertificateSecrets[].name`. items: type: string type: array keychainClientCertificate: description: |- Name of a client certificate from the cluster's `tlsKeychain` to use for mutual TLS (mTLS) authentication. This name must match an entry in `tlsKeychain.clientCertificateSecrets[].name`. nullable: true type: string type: object type: object type: object superuser: description: |- Superuser secret references. If provided, username, email and password are required and `apiToken` is optional. If None, operator generates all credentials. Nothing reads `apiToken`'s value, but naming a key its Secret does not carry stops the NetBox pod from starting — see that field's own description. nullable: true properties: apiToken: description: |- Secret reference for superuser API token. Optional, and nothing reads its value: NetBox 4.5+ tokens are peppered v2 tokens that cannot be planted from a plaintext secret, so the NetBox bootstrap seeds no token at all (see `superuser_upsert_section` in `netbox-workload`'s `config::entrypoint`). It stays accepted so specs that already set it keep applying, but requiring it forced operators to invent a value that does nothing and 403s if used (NBE-2219). Unread is not the same as harmless to set. Naming a key here adds it to the NetBox pod's projected `secrets` volume, from a source that is not marked optional. Name a key the Secret does not carry and kubelet fails the whole volume — `MountVolume.SetUp failed for volume "secrets" : references non-existent secret key` — so the NetBox pod never starts. The operator reports that on the resource as `SuperuserSecret=False`, with a Warning event when the state is entered, but still projects what the resource declares. Point this at a key that really exists, or leave it unset. This field's own `name` is not consulted. The projected volume carries `password` and `apiToken` together and sources both from the Secret named by `password.name`, so point this key at a Secret that one holds. nullable: true properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object email: description: Secret reference for superuser email. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object password: description: Secret reference for superuser password. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object username: description: Secret reference for superuser username. properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object required: - email - password - username type: object type: object diodePlugin: description: |- NetBox-side deadlines for outbound calls to Diode. These bound how long the NetBox Diode/Assurance plugins wait on Hydra token introspection (`authTimeout`) and Diode gRPC calls (`grpcTimeout`). Tune these when raising the cluster-wide ingress/gateway timeouts so the app layer doesn't cap the higher ingress bound. nullable: true properties: authTimeout: description: |- Timeout for Hydra token introspection calls from the NetBox plugins. Default: `500ms`. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string grpcTimeout: description: |- Timeout for Diode gRPC calls from the NetBox plugins. Default: `5s`. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object env: default: [] description: Environment variables for NetBox containers. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array httpPort: default: 8080 description: HTTP port for NetBox web interface. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer image: description: |- Container image specification. When not specified, uses operator defaults allowing automatic version updates. nullable: true properties: digest: description: Image digest for pinning specific versions. nullable: true type: string imagePullSecrets: description: Pull secrets for private registries. items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string required: - name type: object nullable: true type: array pullPolicy: default: IfNotPresent description: Image pull policy. enum: - IfNotPresent - Always - Never type: string registry: default: docker.io description: Container registry hostname. type: string repository: default: netboxcommunity/netbox description: Repository path within the registry. type: string tag: default: v4.7.1 description: Image tag. type: string type: object limits: default: cpu: 1000 memory: 1500 description: Resource limits for NetBox pods. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object mediaStorageSize: default: 10Gi description: Media storage PVC size (e.g., "10Gi"). pattern: ^$|^(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[kMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ type: string migrationStatementTimeout: default: 15m description: |- Per-statement timeout for index reconciliation. Prevents a single slow index creation from consuming the entire job deadline. Accepts durations (`15m`, `900s`) or bare seconds (`900`). Default: 15m. pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string migrationTimeout: default: 1h description: |- Maximum time for the migration Job to run before Kubernetes terminates it. Accepts durations (`1h`, `30m`) or bare seconds (`3600`). Default: 1h. pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string replicas: default: 1 description: Number of NetBox web application replicas. format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 200 memory: 750 description: Resource requests for NetBox pods. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object scriptsStorageSize: default: 1Gi description: |- Scripts storage PVC size (e.g., "1Gi"). This volume stores custom scripts uploaded by users. pattern: ^$|^(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[kMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ type: string statusPort: description: |- Deprecated: no longer used. Retained for CRD backwards compatibility. Previously configured the nginx unit status port; ignored since the switch to granian in nbe-core 4.5.x. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer storageAccessMode: description: |- Access mode for the media and scripts PVCs. Defaults to `ReadWriteOnce`, which pins all NetBox replicas to a single node. Set `ReadWriteMany` (and pair with an RWX-capable `storageClassName`) to allow `replicas > 1` to schedule across nodes for HA. S3-backed media (configured via `spec.netbox.config.storage`) bypasses these PVCs entirely and is the recommended HA path when available. enum: - ReadWriteOnce - ReadOnlyMany - ReadWriteMany - ReadWriteOncePod - null nullable: true type: string storageClassName: description: Storage class for the media and scripts PVCs. nullable: true type: string timeouts: description: |- Per-service timeout overrides for the NetBox Ingress and HTTPRoute. Field-level merges over the cluster-wide `spec.ingress.timeouts` and `spec.gateway.timeouts` defaults. nullable: true properties: gateway: description: Gateway API HTTPRoute rule timeout overrides. nullable: true properties: backendRequest: description: |- BackendRequest specifies a timeout for an individual request from the gateway to a backend. This covers the time from when the request first starts being sent from the gateway to when the full response has been received from the backend. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. An entire client HTTP transaction with a gateway, covered by the Request timeout, may result in more than one call from the gateway to the destination backend, for example, if automatic retries are supported. The value of BackendRequest must be a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, its behavior is implementation-specific; when specified, the value of BackendRequest must be no more than the value of the Request timeout (since the Request timeout encompasses the BackendRequest timeout). Support: Extended nullable: true type: string request: description: |- Request specifies the maximum duration for a gateway to respond to an HTTP request. If the gateway has not been able to respond before this deadline is met, the gateway MUST return a timeout error. For example, setting the `rules.timeouts.request` field to the value `10s` in an `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds to complete. Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout completely. Implementations that cannot completely disable the timeout MUST instead interpret the zero duration as the longest possible value to which the timeout can be set. This timeout is intended to cover as close to the whole request-response transaction as possible although an implementation MAY choose to start the timeout after the entire request stream has been received instead of immediately after the transaction is initiated by the client. The value of Request is a Gateway API Duration string as defined by GEP-2257. When this field is unspecified, request timeout behavior is implementation-specific. Support: Extended nullable: true type: string type: object ingress: description: Ingress-level timeout overrides (nginx annotation translation). nullable: true properties: connect: description: Time allowed to establish a TCP connection to the upstream. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string read: description: Time between successive reads from the upstream response. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string send: description: Time between successive writes to the upstream request. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object topologySpreadConstraints: description: |- Topology spread constraints for NetBox web pods. When configured, controls how pods are distributed across topology domains (nodes, zones). Useful for HA deployments with multiple replicas. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array urls: description: |- External URLs at which the NetBox service is reachable. Each entry's host portion drives an `IngressRule.host` on the NetBox Ingress, producing one rule per URL. The scheme, port, and path are ignored — only the hostname is used. Unparseable entries are skipped with a warning; when no entries parse, the Ingress falls back to a single wildcard rule. TLS termination is configured independently via `spec.ingress.tls`. When both are set, `urls` drives the rule hosts and `spec.ingress.tls` is preserved verbatim in the Ingress `tls` block. items: type: string nullable: true type: array worker: default: env: [] limits: cpu: 1000 memory: 1500 replicas: 1 resources: cpu: 100 memory: 128 description: Background worker configuration. properties: affinity: description: |- Pod affinity for worker pods. When omitted, the operator emits a required `kubernetes.io/hostname` pod affinity binding each worker to a NetBox pod (so the worker can mount the same single-node media and scripts PVCs) only when both: - `spec.netbox.storageAccessMode` is unset, `ReadWriteOnce`, or `ReadWriteOncePod` — i.e., the PVCs are single-node attach; and - `spec.netbox.replicas == 1` — i.e., NetBox runs as a single replica. The default is skipped when either condition fails: - `ReadWriteMany` / `ReadOnlyMany` — the PVCs can mount on multiple nodes, so colocation is unnecessary and would block HA scheduling. - `spec.netbox.replicas > 1` — required hostname colocation would force every worker onto whichever subset of nodes runs a NetBox pod, leaving extra workers Pending when worker replicas exceed that subset. Provide an explicit `Affinity` to override; the operator will inject NetBox's selector labels (`app.kubernetes.io/component=netbox`, `app.kubernetes.io/instance=`, ...) into any `podAffinity` or `podAntiAffinity` term whose `labelSelector` is empty, using the same pattern as `topologySpreadConstraints`. To disable all affinity regardless of access mode or replica count, supply an explicit empty object `affinity: {}`. nullable: true properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. properties: preferredDuringSchedulingIgnoredDuringExecution: description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. items: description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). properties: preference: description: A node selector term, associated with the corresponding weight. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchFields: description: A list of node selector requirements by node's fields. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array type: object weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. format: int32 type: integer required: - preference - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. items: description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchFields: description: A list of node selector requirements by node's fields. items: description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array type: object type: array required: - nodeSelectorTerms type: object type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer required: - podAffinityTerm - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. items: description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object type: array type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer required: - podAffinityTerm - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. items: description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running properties: labelSelector: description: A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array mismatchLabelKeys: description: MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). items: type: string type: array namespaceSelector: description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object namespaces: description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object type: array type: object type: object env: default: [] description: Environment variables for worker containers. items: description: EnvVar represents an environment variable present in a Container. properties: name: description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".' type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key - name type: object fieldRef: description: 'Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object resourceFieldRef: description: 'Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.' properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: description: Specifies the output format of the exposed resources, defaults to "1" nullable: true x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: description: 'Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key - name type: object type: object required: - name type: object type: array limits: default: cpu: 1000 memory: 1500 description: Resource limits for worker pods. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object replicas: default: 1 description: Number of worker replicas. format: uint8 maximum: 255.0 minimum: 0.0 type: integer resources: default: cpu: 100 memory: 128 description: Resource requests for worker pods. properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object topologySpreadConstraints: description: |- Topology spread constraints for NetBox worker pods. When configured, controls how pods are distributed across topology domains (nodes, zones). Useful for HA deployments with multiple replicas. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array yamlEnv: description: |- YAML string containing environment variables as key-value pairs. This will be converted to EnvVar array format by the operator. Example: "FOO: bar\nBAZ: qux" nullable: true type: string type: object yamlEnv: description: |- YAML string containing environment variables as key-value pairs. This will be converted to EnvVar array format by the operator. Example: "FOO: bar\nBAZ: qux" nullable: true type: string type: object plugins: default: assetLifecycle: enabled: false ndx: enabled: true description: |- Cross-service plugin enablement (`spec.plugins`). Groups plugins whose setup spans more than one service. Holds NDX (NetBox Data Exchange) and Asset Lifecycle; see [`Plugins`]. properties: assetLifecycle: default: enabled: false description: |- Asset Lifecycle plugin (`netbox_asset_lifecycle`, Premium tier, off by default). See [`AssetLifecycleApp`]. properties: enabled: default: false description: |- Enable or disable Asset Lifecycle (the `netbox_asset_lifecycle` plugin). Defaults to `false`. Requires a Premium-tier license to take effect — the plugin is not deployed on lower tiers regardless of this setting. Disabling drops the plugin from the rendered plugin config. Existing Asset Lifecycle tables are retained (not dropped), and re-enabling restores access to them. type: boolean type: object ndx: default: enabled: true description: NDX (NetBox Data Exchange) plugin (paid-only). See [`NdxApp`]. properties: enabled: default: true description: |- Enable or disable the NDX plugin (the user lever). Default `true`. Effective only when the license carries a paid NDX token entitlement — the operator gates on the token and renders no NDX config without one, rather than shipping a config that fails NetBox boot. type: boolean type: object type: object postgresql: description: PostgreSQL database configuration (operator-managed or external). properties: backups: description: |- pgBackRest backup configuration (NBE-1695). Ignored when `external` is true — an external DB's backups are the customer's to run. Deliberately a bare `#[serde(default)]` `Option` rather than a populated default: the v1alpha2 → v1alpha1 conversion bridge asserts the exact set of default-bearing `postgresql` fields (see `v1alpha2::convert`), and the resolved values live on [`PostgresBackups`]' accessors instead. nullable: true properties: enabled: description: |- Whether pgBackRest is enabled. Defaults to [`DEFAULT_POSTGRES_BACKUPS_ENABLED`]. Setting this to `false` leaves the database backed up by **nothing**. It removes the pgBackRest repository, and `PGDATA` stays excluded from Velero's filesystem backup — deliberately, because a file-by-file copy of a live data directory is a torn copy, and one that looks restorable is worse than none. So this is opting out of Postgres disaster recovery, not selecting a different mechanism. Note also that disabling it on a running cluster does not remove the repository host: PGO leaves the StatefulSet (and its PVC) in place, so this is not a clean revert. nullable: true type: boolean fullSchedule: description: |- Cron schedule for full backups. Defaults to [`DEFAULT_POSTGRES_BACKUPS_FULL_SCHEDULE`]. An empty string disables scheduled full backups. nullable: true type: string incrementalSchedule: description: |- Cron schedule for incremental backups. Defaults to [`DEFAULT_POSTGRES_BACKUPS_INCREMENTAL_SCHEDULE`]. An empty string disables scheduled incremental backups. nullable: true type: string repoStorageClassName: description: |- Storage class for the pgBackRest repo PVC. Falls back to the PostgreSQL data storage class, then the cluster default. nullable: true type: string repoStorageSize: description: |- Storage size for the pgBackRest repo PVC. Defaults to [`DEFAULT_POSTGRES_BACKUPS_REPO_STORAGE_SIZE`]. nullable: true pattern: ^(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[kMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ type: string retentionFull: description: |- Number of full backups to retain. Defaults to [`DEFAULT_POSTGRES_BACKUPS_RETENTION_FULL`]. Minimum 1. pgBackRest's `repo1-retention-full` accepts 1..=9999999, so `0` renders a config the repo host rejects at parse time — which surfaces as a repo host that cannot configure itself and therefore no backups at all, with nothing in the CR status naming the field at fault. The schema bound makes the API server reject it at admission instead. format: uint8 maximum: 255.0 minimum: 1.0 nullable: true type: integer type: object external: default: false description: Whether PostgreSQL is externally managed (not deployed by operator). type: boolean instances: default: 0 description: |- Number of PostgreSQL instances (replicas). Set to 0 for auto-scaling based on node count (min(nodes, 3)). Auto-scaling requires cluster-scoped RBAC (rbac.scope: cluster). For manual HA, set to 3 or more. format: uint8 maximum: 255.0 minimum: 0.0 type: integer limits: description: |- Resource limits for PostgreSQL pods (CPU in millicores, memory in MiB). When `None`, no resource limits are set on PostgreSQL pods. **Warning**: Without limits, pods may consume more resources than available on the node, potentially causing node instability. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object postgresqlProfile: description: |- Name of a PostgreSQL profile from [`NetBoxEnterpriseSpec::postgresql_profiles`]. When set, the PostgreSQL connection inherits TLS configuration, host, and port from the named profile. Used to centralize external PostgreSQL settings so they are specified once rather than per-component. See also: [`PostgreSQLProfile`] for the profile schema. nullable: true type: string registry: description: Container registry override for PostgreSQL images. nullable: true type: string resources: description: |- Resource requests for PostgreSQL pods (CPU in millicores, memory in MiB). When `None`, no resource requests are set on PostgreSQL pods, allowing PGO to use Kubernetes defaults (effectively unlimited). This is the default behavior for backward compatibility. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object storageClassName: description: |- Storage class name for PostgreSQL PVCs. If not specified, the cluster's default storage class will be used. Required if the cluster has no default storage class configured. nullable: true type: string storageSize: default: 4Gi description: Storage size for PostgreSQL PVC (e.g., "10Gi"). pattern: ^$|^(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[kMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ type: string version: default: '18' description: PostgreSQL major version. type: string type: object postgresqlProfiles: additionalProperties: description: |- A named PostgreSQL connection profile. Bundles connection details (host, port, username) and TLS configuration under a single name so that multiple components can reference it instead of duplicating inline settings. All fields are optional — a profile may specify only TLS settings, only connection details, or both. Components resolve each field independently: inline config takes priority, then the profile, then defaults. # Example ```yaml postgresqlProfiles: netbox: host: db.example.com port: 5432 username: netbox tlsConfig: sslmode: verify-full keychainCaCertificates: ['pgo'] ``` properties: host: description: PostgreSQL hostname. nullable: true type: string port: description: PostgreSQL port number. format: uint16 maximum: 65535.0 minimum: 0.0 nullable: true type: integer tlsConfig: description: TLS configuration for the PostgreSQL connection. nullable: true properties: insecureSkipVerify: default: false description: |- Skip TLS certificate verification. **Warning**: Setting this to `true` disables certificate verification and should only be used for testing or development environments. **PostgreSQL caveat**: This field has no effect on PostgreSQL certificate verification when CA certificates are configured via `keychainCaCertificates`. For backward compatibility, libpq verifies the server certificate whenever `PGSSLROOTCERT` is set and `sslmode=require`, effectively upgrading it to `verify-ca` behavior. Since the operator sets `PGSSLROOTCERT` when any CA certificates are provided, `insecureSkipVerify: true` will not prevent certificate validation for PostgreSQL connections. To skip verification, remove the CA certificates instead. type: boolean keychainCaCertificates: description: |- Names of CA certificates from the cluster's `tlsKeychain` to use for verifying server certificates. These names must match entries in `tlsKeychain.caCertificateSecrets[].name`. items: type: string type: array keychainClientCertificate: description: |- Name of a client certificate from the cluster's `tlsKeychain` to use for mutual TLS (mTLS) authentication. This name must match an entry in `tlsKeychain.clientCertificateSecrets[].name`. nullable: true type: string sslmode: default: prefer description: |- SSL mode for PostgreSQL connection. Effective defaults depend on deployment mode: - **External PostgreSQL**: `prefer` (safe fallback that opportunistically uses TLS) - **Operator-managed PostgreSQL**: `require` (PGO always enables TLS) For production external databases, consider using `verify-full` with proper CA certificates configured via `keychainCaCertificates`. **Important**: For backward compatibility, libpq verifies server certificates whenever `PGSSLROOTCERT` is set and `sslmode=require`. Since the operator sets `PGSSLROOTCERT` when `keychainCaCertificates` is non-empty, providing a CA certificate effectively upgrades `require` to behave like `verify-ca`. Ensure the CA certificate matches the server, or omit it to use `require` without verification. enum: - disable - allow - prefer - require - verify-ca - verify-full type: string type: object username: description: PostgreSQL username. nullable: true type: string type: object description: |- Named PostgreSQL connection profiles for component reuse. Each profile bundles connection details (host, port, username) and TLS configuration under a name. Components like Diode and Hydra can reference a profile via `postgresqlProfile` instead of duplicating inline settings. For example, KOTS populates a `"netbox"` profile with the cluster-level PostgreSQL settings, then Diode/Hydra reference it when "reuse NetBox config" is selected. type: object proxy: description: |- Egress proxy settings (NBE-1501). When set, the operator injects HTTP_PROXY/HTTPS_PROXY/NO_PROXY into every workload it creates. Absence means no proxy (direct-connection install). nullable: true properties: httpProxy: description: HTTP proxy URL (e.g. `http://proxy.corp:3128`). nullable: true type: string httpsProxy: description: HTTPS proxy URL — used for license/S3/external HTTPS egress. nullable: true type: string noProxy: description: |- Comma-separated extra `NO_PROXY` entries, appended to the cluster-internal defaults the operator always includes. nullable: true type: string type: object reconcileInterval: description: |- How often the operator re-checks external state even when no Kubernetes events are received. Covers changes that don't produce watch events: PGO secret rotations, wheelhouse uploads, etc. Accepts Kubernetes-style duration strings (`5m`, `1h`) or bare seconds (`300`). When omitted, falls back to the `--reconcile-interval-secs` CLI flag (default `5m`). Useful for debugging: lower values surface external-state convergence issues faster without redeploying the operator. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string redis: description: Redis cache/queue configuration (operator-managed or external). properties: additionalConfig: description: |- Raw Redis configuration directives appended to the server config. Written verbatim into an operator-managed ConfigMap that OpsTree mounts via `redisConfig.additionalRedisConfig`, after any directives generated by `aofEnabled`, `maxMemoryPercent`, `maxMemoryPolicy`, and `dynamicConfig`. Raw directives take precedence over typed fields (Redis uses the last occurrence). Only applies to operator-managed Redis (`external: false`). Example — set absolute memory cap and RDB snapshot interval: ```yaml redis: additionalConfig: | maxmemory 512mb save 3600 1 ``` nullable: true type: string aofEnabled: description: |- Whether to enable AOF (Append-Only File) persistence. `false` disables AOF, preventing the OOM death spiral: without AOF, a Redis restart does not replay the log and re-fill memory. Streams and in-flight Diode events are lost on crash, but the NetBox cache (the durable state) is preserved via RDB snapshots. `true` enables AOF for maximum durability. Redis default is `false`. `null` (omit) leaves the Redis server default unchanged. Only applies to operator-managed Redis (`external: false`). nullable: true type: boolean clusterSize: default: 0 description: |- Number of Redis replicas. Set to 0 for auto-scaling based on node count (min(nodes, 3)). Auto-scaling requires cluster-scoped RBAC (rbac.scope: cluster). Sentinel is deployed when effective size > 1. format: uint8 maximum: 255.0 minimum: 0.0 type: integer dynamicConfig: description: |- Extra Redis configuration directives, applied on the next pod roll. Each entry is appended to the operator-managed Redis config ConfigMap (alongside the directives generated by `aofEnabled`, `maxMemoryPercent`, and `maxMemoryPolicy`). When the ConfigMap content changes, the operator rolls the Redis pod automatically so the new directives take effect — values land on that restart, not live (NBE-1214). The OpsTree Redis Operator's `redisConfig.dynamicConfig` runtime `CONFIG SET` path is not used; it never reaches the running instance. Prefer the typed `maxMemoryPercent`, `maxMemoryPolicy`, and `aofEnabled` fields when they cover what you need; reach for `dynamicConfig` only for tuning that has no typed equivalent. Example: ```yaml redis: dynamicConfig: - "hz 15" - "latency-monitor-threshold 100" ``` Only applies to operator-managed Redis (`external: false`). items: type: string nullable: true type: array external: default: false description: Whether Redis is externally managed (not deployed by operator). type: boolean limits: description: |- Resource limits for Redis pods (CPU in millicores, memory in MiB). When `None`, no resource limits are set on Redis pods. **Warning**: Without limits, pods may consume more resources than available on the node, potentially causing node instability. nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object maxMemoryPercent: description: |- Cap Redis memory at N% of the container memory limit (0–100). Resolves to a `maxmemory ` directive emitted into the Redis server config. Requires `limits.memory` to be set; silently no-ops otherwise. The operator bypasses OpsTree's `redisConfig.maxMemoryPercentOfLimit` field because the upstream entrypoint never plumbs the `REDIS_MAX_MEMORY` env var it produces into Redis's config or argv. Combine with `maxMemoryPolicy` to control what happens when the cap is reached. Without a policy, Redis defaults to `noeviction` (reject writes). Only applies to operator-managed Redis (`external: false`). format: uint8 maximum: 100.0 minimum: 0.0 nullable: true type: integer maxMemoryPolicy: description: |- Redis key eviction policy applied when `maxmemory` is reached. Maps directly to Redis's `maxmemory-policy` configuration directive. Combined with `maxMemoryPercent` to control OOM behavior: set `maxMemoryPercent` to cap memory usage, then choose an eviction policy that matches your workload (LRU for general caches, `noeviction` to reject writes instead of evicting data). See for details. enum: - noeviction - allkeys-lru - volatile-lru - allkeys-random - volatile-random - volatile-ttl - allkeys-lfu - volatile-lfu nullable: true type: string name: default: redis description: Redis instance name. type: string persistence: default: true description: Whether to enable persistence for Redis data. type: boolean requireAuth: default: false description: |- Whether authentication is required for Redis connections. Default behavior: - Operator-managed: false (Redis operator doesn't enable auth by default) - External: false (assume no auth unless explicitly configured) Set to true when connecting to Redis instances that require authentication. type: boolean resources: description: |- Resource requests for Redis pods (CPU in millicores, memory in MiB). When `None`, no resource requests are set on Redis pods (unlimited). nullable: true properties: cpu: description: CPU allocation in millicores (1000m = 1 core). format: uint64 minimum: 0.0 type: integer memory: description: Memory allocation in mebibytes (MiB). format: uint64 minimum: 0.0 type: integer required: - cpu - memory type: object sentinelMasterName: description: |- Sentinel master group name. Required when `sentinels` is configured. Identifies which master group the Sentinels are monitoring (e.g., "netbox-redis"). Ignored for operator-managed Redis. nullable: true type: string sentinels: description: |- Sentinel endpoints for external Redis HA. When configured, NetBox uses Redis Sentinel for master discovery instead of connecting directly. Each endpoint is a Sentinel instance. Ignored for operator-managed Redis (operator auto-configures Sentinel). items: description: A Redis Sentinel endpoint address. properties: host: description: Sentinel hostname. type: string port: default: 26379 description: Sentinel port number. format: uint16 maximum: 65535.0 minimum: 0.0 type: integer required: - host type: object nullable: true type: array storageClassName: description: |- Storage class name for Redis PVCs. If not specified, the cluster's default storage class will be used. Required if the cluster has no default storage class configured. Only used when `persistence: true`. nullable: true type: string storageSize: default: 1Gi description: |- Storage size for the Redis PVC (e.g., "1Gi"). Only used when `persistence: true`. pattern: ^$|^(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[kMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ type: string tlsConfig: description: |- TLS configuration for external Redis connections. Uses the cluster's `tlsKeychain` to reference CA and client certificates for secure connections. The presence of this section enables TLS. Only used when `external: true`. nullable: true properties: insecureSkipVerify: default: false description: |- Skip TLS certificate verification. **Warning**: Setting this to `true` disables certificate verification and should only be used for testing or development environments. **PostgreSQL caveat**: This field has no effect on PostgreSQL certificate verification when CA certificates are configured via `keychainCaCertificates`. For backward compatibility, libpq verifies the server certificate whenever `PGSSLROOTCERT` is set and `sslmode=require`, effectively upgrading it to `verify-ca` behavior. Since the operator sets `PGSSLROOTCERT` when any CA certificates are provided, `insecureSkipVerify: true` will not prevent certificate validation for PostgreSQL connections. To skip verification, remove the CA certificates instead. type: boolean keychainCaCertificates: description: |- Names of CA certificates from the cluster's `tlsKeychain` to use for verifying server certificates. These names must match entries in `tlsKeychain.caCertificateSecrets[].name`. items: type: string type: array keychainClientCertificate: description: |- Name of a client certificate from the cluster's `tlsKeychain` to use for mutual TLS (mTLS) authentication. This name must match an entry in `tlsKeychain.clientCertificateSecrets[].name`. nullable: true type: string type: object type: object registry: description: |- Container registry host override for all images. When set, replaces the registry portion of every container image. Use with `registry_namespace` for flat-namespace registries (e.g., Replicated local registry in airgap installs). nullable: true type: string registryNamespace: description: |- Registry namespace for flat-namespace registries. When set alongside `registry`, all repository paths are flattened to `{namespace}/{basename}`. For example, `docker.io/oryd/hydra:v2.3.0` becomes `{registry}/{namespace}/hydra:v2.3.0`. When only `registry` is set (no namespace), the full original repository path is preserved. nullable: true type: string replicatedApp: description: |- Replicated-specific tuning knobs (SDK, license fallback, etc.). Groups configuration that only applies when NBE is installed via the Replicated channel. Defaults are appropriate for typical installs; the fields here exist for debugging and airgap-specific tuning. nullable: true properties: licenseFallback: description: |- License-retry tuning. When the Replicated SDK is unreachable and no license is cached, the operator blocks reconciliation and issues fresh SDK fetches on subsequent reconciles — there is no longer a "proceed as Community" fallback (NBE-1341). These knobs tune how long it retries before escalating: once the budget is exhausted the operator emits a `warn!` and surfaces the license-unavailable UI banner, but keeps blocking until a license becomes available. See NBE-863, NBE-1341. (The `licenseFallback` field name is retained for CRD compatibility.) nullable: true properties: retryInterval: description: |- Delay between retry attempts. Accepts Kubernetes-style durations (`5s`) or bare seconds (`5`). Defaults to 5 seconds. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string totalTimeout: description: |- Total time budget for the retry loop before escalating. Once exhausted, the operator emits a `warn!` and shows the license-unavailable banner but keeps blocking — it does not proceed without a license. Accepts Kubernetes-style durations (`2m`, `1m30s`) or bare seconds (`120`). Defaults to 120 seconds. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string type: object type: object replication: default: {} description: |- Cluster-wide replication and HA configuration. Top-level `topologySpreadConstraints` here apply to every operator-managed deployment unless overridden at the component level. properties: topologySpreadConstraints: description: |- Default `topologySpreadConstraints` applied to every operator-managed deployment's pod spec. Per-component `topologySpreadConstraints` fields override this default for that component. The operator injects each deployment's own selector labels into every constraint's `labelSelector` so spread is scoped to that deployment's pods — leave `labelSelector` empty (`{}`) unless you need extra filtering. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array maxSkew: description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object nullable: true type: array type: object routing: description: |- North/south routing selector. Chooses whether the operator emits Gateway API objects or Ingress objects. `auto` (default) detects the Gateway API and falls back to Ingress. nullable: true properties: mode: default: auto description: |- Which north/south routing path the operator emits. `auto` (the default) emits Gateway API objects when `spec.gateway` is enabled and the operator can list Gateway API resources (CRDs installed and RBAC granted), and Ingress objects otherwise; `gateway`/`ingress` pin a path explicitly. enum: - auto - gateway - ingress type: string type: object secretChecksumDebounce: description: |- How long the external secret checksum must be stable before being embedded in pod template annotations (which triggers a rolling restart). PGO rewrites secrets during initial cluster setup, so `resourceVersion` increments on every housekeeping write. The debounce window prevents those transient changes from causing unnecessary rolling restarts. Accepts Kubernetes-style duration strings (`30s`, `1m`) or bare seconds. When omitted, defaults to `30s`. Lower values speed up convergence in test environments; raise it for slow-bootstrapping clusters. nullable: true pattern: ^[0-9]+(\.[0-9]+)?(h|m|s|ms)?([0-9]+(m|s|ms)?)*$ type: string storageBackend: default: pvc description: |- Where NetBox media/scripts storage lives (NBE-1691): `pvc` (default), `external` (user-provided S3), or `in-cluster` (operator-provisioned Garage). Resolved from v1alpha2 through the conversion bridge. enum: - pvc - external - in-cluster type: string suspend: default: false description: |- Suspend reconciliation/annealing of resources while debugging. When set to `true`, the operator will skip applying downstream resources and wait for the field to be cleared before resuming reconciliation. type: boolean tlsKeychain: description: |- TLS keychain configuration for CA and client certificates. Allows specifying trusted CA certificates and client certificates for secure connections to external services. nullable: true properties: caCertificateSecrets: description: |- CA certificate secrets to trust for TLS connections. These certificates will be added to the trust store for validating server certificates when connecting to external services. items: description: |- Reference to a Kubernetes secret containing a CA certificate. Used for configuring trusted CA certificates for TLS verification. The secret should contain the CA certificate in PEM format. # Example ```yaml - name: my-ca-secret key: ca.crt - name: aliased-ca secret: actual-secret-name ``` properties: key: default: ca.crt description: |- Key within the secret that contains the CA certificate data. Defaults to `ca.crt` if not specified. type: string name: description: |- Logical name for this CA certificate entry. If `secret` is not specified, this name is also used as the Kubernetes secret name. type: string secret: description: |- Name of the Kubernetes secret containing the CA certificate. If not specified, the `name` field is used as the secret name. nullable: true type: string required: - name type: object type: array clientCertificateSecrets: description: |- Client certificate secrets for mutual TLS (mTLS) authentication. These certificates can be used to authenticate the client when connecting to services that require client certificate authentication. items: description: |- Reference to a Kubernetes secret containing a client certificate and private key. Used for configuring client certificates for mutual TLS (mTLS) authentication. The secret should be of type `kubernetes.io/tls` or contain equivalent keys. # Example ```yaml - name: my-client-cert certKey: tls.crt privateKey: tls.key - name: aliased-client secret: actual-secret-name ``` properties: certKey: default: tls.crt description: |- Key within the secret that contains the client certificate data. Defaults to `tls.crt` (standard key for `kubernetes.io/tls` secrets). type: string name: description: |- Logical name for this client certificate entry. If `secret` is not specified, this name is also used as the Kubernetes secret name. type: string privateKey: default: tls.key description: |- Key within the secret that contains the private key data. Defaults to `tls.key` (standard key for `kubernetes.io/tls` secrets). type: string secret: description: |- Name of the Kubernetes secret containing the client certificate. If not specified, the `name` field is used as the secret name. nullable: true type: string required: - name type: object type: array type: object turbobulk: default: enableWrites: false enabled: true description: |- TurboBulk bulk data API plugin (Premium tier). `enabled` is the user lever (default on); the operator additionally requires a Premium-tier license before activating the plugin. properties: enableWrites: default: false description: |- Enable TurboBulk write APIs (bulk load / delete). Default `false`. Bulk writes can modify or delete large numbers of objects in one transaction; keep disabled until write workflows are validated. type: boolean enabled: default: true description: |- Enable or disable the TurboBulk plugin (the user lever). Default `true`. Effective only on Premium-tier licenses — the operator gates on tier. type: boolean type: object required: - netbox - postgresql - redis type: object status: description: Status of the NetBoxEnterprise custom resource. nullable: true properties: components: default: copilot: ready: false diode: ready: false netbox: ready: false postgresql: ready: false redis: ready: false worker: ready: false description: Detailed status for each component. properties: copilot: default: ready: false description: Copilot backend component status (if enabled). properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object diode: default: ready: false description: Diode application component status (if enabled). properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object netbox: default: ready: false description: NetBox web application component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object postgresql: default: ready: false description: PostgreSQL database component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object redis: default: ready: false description: Redis cache/queue component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object worker: default: ready: false description: NetBox worker component status. properties: conditions: description: Conditions specific to this component. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array message: description: Human-readable message about component state. nullable: true type: string ready: default: false description: Whether the component is ready. type: boolean type: object type: object conditions: description: Kubernetes standard conditions array. items: description: Kubernetes standard condition following the condition conventions. properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. type: string message: description: Human-readable message indicating details about the transition. type: string observedGeneration: description: Generation observed when this condition was set. format: int64 nullable: true type: integer reason: description: Machine-readable reason for the condition's last transition. type: string status: description: 'Status of the condition: "True", "False", or "Unknown".' type: string type: description: Type of condition (e.g., "Ready", "Progressing", "Degraded"). type: string required: - lastTransitionTime - message - reason - status - type type: object type: array convergedGeneration: description: |- Highest CR generation that has reached all-components-ready. When this equals `metadata.generation`, the current config rollout has converged and the progress sentinel reports Ready. (NBE-1255) format: int64 nullable: true type: integer customPythonConfigRefDigest: description: |- Last resolved content digest of the ConfigMap key named by `spec.netbox.config.customPythonConfigRef`. Persisted for the same fail-safe reason as `wheelhouse_fingerprint`: a ConfigMap that is momentarily absent (deleted and re-applied by a GitOps prune, say) must not move the migration hash, because moving it deletes an in-flight `manage.py migrate`. Held across an absence so the input can only advance, never regress. (NBE-1883/NBE-1564) nullable: true type: string dependencyWaitStartedAt: description: |- RFC3339 timestamp of when the operator first observed a dependency-wait timeout for the current generation. Used to measure how long a wait has persisted so a brief wait (`WaitingForDependencies`) can be distinguished from a hanging one (`DependencyWaitStalled`) without ever asserting failure. Cleared on the first successful reconcile. (NBE-1401) nullable: true type: string lastReconcileTime: description: Timestamp of the last successful reconciliation (RFC3339 format). nullable: true type: string license: default: edition: Community isAssuranceEntitled: false isCopilotEntitled: false tier: Community description: License associated with the deployment properties: channelName: description: Channel name (e.g., stable, beta, dev) nullable: true type: string customerEmail: description: Customer email from license nullable: true type: string customerName: description: Customer name from license nullable: true type: string edition: default: Community description: NetBox edition (Community or Enterprise) enum: - Community - Enterprise type: string entitlements: additionalProperties: properties: title: description: Entitlement title type: string value: description: Entitlement value (can be any JSON type) x-kubernetes-preserve-unknown-fields: true type: object description: Raw entitlements for additional checks type: object expiresAt: description: Expiration date (ISO 8601 format) nullable: true type: string isAssuranceEntitled: default: false description: Whether NetBox Assurance is entitled type: boolean isCopilotEntitled: default: false description: Whether Copilot is entitled type: boolean isNdxEntitled: default: false description: Whether the NDX plugin is entitled (paid NDX token present) type: boolean isVisualExplorerEntitled: default: false description: Whether Visual Explorer (the first UI Platform app) is entitled type: boolean licenseId: description: Unique license identifier nullable: true type: string licenseType: description: License type (dev, trial, prod, paid) nullable: true type: string platformOrgId: description: Platform organization ID nullable: true type: string tier: default: Community description: NetBox tier from license entitlement enum: - Community - Starter - Professional - Premium type: string type: object licenseStatus: description: |- Computed license display string for the `kubectl get` LICENSE printer column. Shows the license type ("Dev", "Trial", "Paid") when the license is healthy, or the condition reason ("LicenseMismatch", "LicenseExpired", "LicenseUnavailable") when it is not. `None` until the first reconcile completes. nullable: true type: string message: description: Human-readable message about the current state. nullable: true type: string migrationHash: description: |- SHA-256 hash of migration-relevant inputs (image tag, wheelhouse, plugin config). When this changes, the operator runs a migration Job before updating NetBox Deployments. nullable: true type: string migrationPhase1Hash: description: |- SHA-256 hash of Phase 1 migration inputs (image + core config, no plugins). When this hash matches, Phase 1 (core migrations) is considered complete and the operator proceeds directly to Phase 2. (NBE-902) nullable: true type: string observedGeneration: description: Generation observed by the controller during last reconciliation. format: int64 nullable: true type: integer phase: description: |- Coarse startup phase the operator reports on `status.phase` so install progress is visible from `kubectl`, the e2e serving gate, and the KOTS UI instead of an opaque multi-minute 503 (NBE-1529). Variants are ordered along the install timeline. The operator observes `WaitingForDependencies`, `Migrating`, `Serving`, and `Degraded` directly (dependency-wait timer, migration Job status, component readiness, existing conditions). The in-pod phases — `InstallingPlugins`, `CollectingStatic`, `Booting` — happen inside the NetBox entrypoint and are reported back via the `nbe_startup` table the operator reads. Serializes to its PascalCase variant name (k8s phase convention), which is serde's default for fieldless variants — so the serde wire form and the `strum::Display` form match without explicit renames. enum: - WaitingForDependencies - Migrating - InstallingPlugins - CollectingStatic - Booting - Serving - Degraded nullable: true type: string ready: default: false description: Overall cluster readiness indicator. type: boolean secretChecksum: description: |- Aggregate hash of all external secret `resourceVersion` values. Used by the debounce logic to detect when PGO secrets have stabilized. nullable: true type: string secretChecksumObservedAt: description: |- RFC 3339 timestamp recording when `secret_checksum` was first observed to change. The operator only embeds external-secret checksums in pod template annotations once this timestamp is older than the debounce window, preventing deployment thrashing during PGO's initial secret setup phase. nullable: true type: string version: default: '' description: Netbox Labs Operator Version type: string wheelhouseFingerprint: description: |- Last-seen wheelhouse content fingerprint from the wheelhouse-watcher sidecar (`_` or `absent`). Persisted in status so the migration hash is a pure function of stored state (never cleared on a failed live read — fail-safe). (NBE-1320) nullable: true type: string type: object required: - spec title: NetBoxEnterprise type: object served: true storage: false subresources: status: {}