Skip to content

API Reference

Packages

core.camunda.io/v1

Package v1 contains API Schema definitions for the core v1 API group.

Resource Types

AdminMappingRule

AdminMappingRule gives the admin role to every token in which the claim ClaimName holds the value ClaimValue.

Appears in: - ClusterAdminSpec

Field Description Default Validation
id string ID names the rule inside the cluster. The Admin web application lists it
under Mapping Rules.		 MaxLength: 256
MinLength: 1
claimName string ClaimName is the name of a claim, or a JSONPath expression that points
at a claim.		 MinLength: 1
claimValue string ClaimValue is the value that the claim must hold for the rule to match. MinLength: 1

AdminPasswordStatus

AdminPasswordStatus is the state of the admin credential of a basic-auth cluster.

Appears in: - CamundaClusterStatus

Field Description Default Validation
rotation string Rotation is the last admin password rotation that the operator
applied. It is the value of spec.auth.basic.passwordRotation, after the
preset merge, that produced the password in the admin Secret. A
rotation is in progress while that value is not empty and differs from
this one. A cleared value does not stop a rotation that has started.
That rotation completes, and this field then records the value that
started it. A cluster that gets the value from its preset shows none in
its own spec.		 Optional: {}

ArchiveBoundary

ArchiveBoundary is the moment when a server moved its archive to another location while no interval was open. Only a base backup that began after this moment belongs to the current archive. A base backup that began before it wrote to the old location.

Appears in: - DatabaseServerArchiveStatus

Field Description Default Validation
at Time At is when the server moved.
location string Location is the new location, in the form of ArchiveRecord.Location.
The boundary ends when the archive of that location opens a record. It
moves when the location moves again.
objectStorageRef string ObjectStorageRef is the ObjectStorageConfig of that location. It is
information for the reader only.		 Optional: {}

ArchiveRecord

ArchiveRecord is one continuous archive that a server wrote. A recovery replays it from a base backup up to the requested point. A restore can reach only a point inside the interval of a record.

Appears in: - DatabaseServerArchiveStatus

Field Description Default Validation
serverName string ServerName is the archive directory in the bucket, equal to the name of
the CloudNativePG cluster that wrote it.
objectStorageRef string ObjectStorageRef is the ObjectStorageConfig, in the namespace of this
server, that holds this archive. When the server moves to another
bucket, it closes this record and opens a new one. Thus every interval
names the bucket that a restore of that interval reads.		 Optional: {}
location string Location is where in object storage the server wrote this archive: the
provider, the bucket, and the path, as one URL. Two intervals hold the
same archive only when their locations are equal. The name of an
ObjectStorageConfig is not sufficient, because you can edit the object
or create it again with the same name. A record without a location gets
the current location of the server.		 Optional: {}
from Time From is the earliest point that a recovery from this archive can reach:
the time when its first base backup completed.
to Time To is the latest point that a recovery from this archive can reach. It
is unset while the server still writes to this archive.		 Optional: {}
unverifiedFrom Time UnverifiedFrom is the point after which this archive can miss parts of
the write-ahead log. It is set while CloudNativePG reports that the
uploads of the server fail. A restore cannot reach a point after it.
When the uploads work again, the plugin uploads the segments that it
held back. The field is then cleared, and a restore can reach the whole
interval again. Only the record that the server writes to now has it.		 Optional: {}

AttachedClusterStatus

AttachedClusterStatus is one CamundaCluster that clusterSelector matched.

Appears in: - CamundaManagementClusterStatus

Field Description Default Validation
name string Name is the name of the CamundaCluster.
namespace string Namespace is the namespace of the CamundaCluster.
attached boolean Attached shows whether the management plane serves this cluster.
Console lists the cluster, and Web Modeler deploys to it, only while
this is true.
reason string Reason names what the management plane found on this cluster. It has
one of five values. Four values tell why the cluster is not attached.
ClaimedElsewhere means that another management plane holds the
cluster. NotReady means that the cluster publishes no gateway endpoints,
or that it changed while the operator claimed it. InvalidReference
means that the operator cannot read the platform config of the cluster.
It also means that the OIDC issuer of the cluster differs from the
issuer of the management plane. WriteFailed means that the API server refused the
write of the Console ping settings. The fifth value,
BasicAuthUserFailed, is on an attached row.
The management plane serves the cluster, but the Web Modeler user on
it is missing.		 Optional: {}
message string Message explains the reason in one sentence. Optional: {}

AttachedOptimizeStatus

AttachedOptimizeStatus is one CamundaOptimize whose login callback this management plane registers.

Appears in: - CamundaManagementClusterStatus

Field Description Default Validation
name string Name is the name of the CamundaOptimize.
namespace string Namespace is the namespace of the CamundaOptimize.
externalUrl string ExternalURL is spec.externalUrl of that CamundaOptimize. The registered
callback is this URL with the login path of Optimize.

AuthenticationMethod

Underlying type: string

AuthenticationMethod selects how users and clients authenticate against an orchestration cluster.

Validation: - Enum: [basic oidc]

Appears in: - PlatformAuthSpec

Field Description
basic AuthenticationMethodBasic selects username and password authentication
against users that the orchestration cluster stores itself.
oidc AuthenticationMethodOIDC selects an external OIDC identity provider.

AzureBlobCredentials

AzureBlobCredentials holds the static key of an Azure storage account.

Appears in: - AzureBlobStorageAuth

Field Description Default Validation
secretRef LocalSecretKeyRef SecretRef names the Secret key that holds the storage account key.

AzureBlobStorage

AzureBlobStorage describes an Azure Blob Storage container.

Appears in: - ObjectStorageConfigSpec

Field Description Default Validation
accountName string AccountName is the storage account that holds the container. MinLength: 1
container string Container is the blob container that consumers write to. MinLength: 1
basePath string BasePath is the blob prefix under which consumers write objects,
without leading or trailing slashes. Empty means the container root.		 Pattern: ^[^/]+(/[^/]+)*$
Optional: {}
endpoint string Endpoint is the URL of the blob service. Empty means the public Azure
endpoint of the account. Set it for Azurite and sovereign clouds.		 Optional: {}
auth AzureBlobStorageAuth Auth selects how consumers authenticate. An absent block means
workload identity through the ServiceAccount.		 { type:workloadIdentity } Optional: {}

AzureBlobStorageAuth

AzureBlobStorageAuth selects how consumers authenticate against an Azure Blob container.

Appears in: - AzureBlobStorage

Field Description Default Validation
type ObjectStorageAuthType Type is the authentication choice. Defaults to workloadIdentity. workloadIdentity Enum: [workloadIdentity credentials]
Optional: {}
workloadIdentity AzureBlobWorkloadIdentity WorkloadIdentity names the trusted principal. It is valid only with
type workloadIdentity. With an empty or absent block, the operator adds
no annotation to the ServiceAccount. The operator still adds the
azure.workload.identity/use label to the pods.		 Optional: {}
credentials AzureBlobCredentials Credentials is a static storage account key. Required with type
credentials. Forbidden with other types.		 Optional: {}

AzureBlobWorkloadIdentity

AzureBlobWorkloadIdentity names the Azure principal that the container trusts. With an empty block, the operator adds no annotation to the ServiceAccount of the consumer. The operator still adds the azure.workload.identity/use label to the pods of the consumer.

Appears in: - AzureBlobStorageAuth

Field Description Default Validation
clientId string ClientID is the managed identity that consumers use. When set, the
operator puts it in the azure.workload.identity/client-id annotation
of a ServiceAccount that it creates for the consumer. On an existing
ServiceAccount, add the annotation yourself.		 Optional: {}

BackupCredentialsSpec

BackupCredentialsSpec configures the backup credentials Secret. The operator creates it unless it is disabled.

Appears in: - DatabaseSpec

Field Description Default Validation
disabled boolean Disabled stops the operator from creating the backup user and Secret.
Defaults to false.		 Optional: {}
secretName string SecretName is the name of the credentials Secret. The default comes
from the CR name, as the field that uses this type states.		 Optional: {}

BackupDumpSpec

BackupDumpSpec is the dump configuration of the cluster. It holds the pod settings that a backup can also set for one run, and the image that runs the dump. Only the cluster sets the image. The Job runs under the ServiceAccount of the cluster, with the cloud identity and the database credentials of the cluster. Thus the cluster owner chooses the program that the Job runs, never the person who creates a backup. A LogicalBackupRDBMS replaces all the pod settings and always uses the image of the cluster.

Appears in: - ClusterBackupSpec

Field Description Default Validation
resources ResourceRequirements Resources are the CPU and memory of the dump pod. Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of the dump pod.
In the spec.dump of a LogicalBackupRDBMS, every name that starts with
PG or UPLOAD_ is reserved, and the API server refuses it. A PG* name is
connection policy, because libpq reads PGHOSTADDR, PGSERVICE,
PGOPTIONS, and more. UPLOAD_* is the upload contract. The variables of
a backup reach only the dump container, never the upload container.
Cloud SDKs read endpoint, proxy, and configuration variables from the
environment, and the author of a backup must not change where the dump
goes.
In the spec.backup.dump of the cluster, no name is reserved, and the
variables reach every container. The cluster owner sets the connection
policy, PGSSLMODE included.
Unlike the extraEnv of a workload, this list is atomic. One field
manager owns the whole list, because no extension adds entries to a
dump pod.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources of the dump pod. In the
spec.dump of a LogicalBackupRDBMS, every source needs a prefix that
cannot make a PG* or UPLOAD_* name. The writer of the referenced object
chooses its keys. As with ExtraEnv, the sources of a
backup reach only the dump container. The block of the cluster needs no
prefix, and its sources reach every container.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels of the dump pod. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations of the dump pod. A service mesh
sidecar keeps running after the dump finishes, and the Job does not
complete. Set the injection annotation of the mesh to false here.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the dump pod. When set,
it replaces the block of a preset, with no merge.		 Optional: {}
scratchVolume ScratchVolumeSpec ScratchVolume is where the pod writes the dump before the upload. When
set, it replaces the block of a preset, with no merge. The dump pod
runs with fsGroup 999, the postgres group. Thus pg_dump can write to a
volume that a storage class gives with the root owner.		 Optional: {}
activeDeadlineSeconds integer ActiveDeadlineSeconds is the number of seconds that the dump Job can
run before it fails, counted from its start. When the dump block that
applies does not set it, the Job gets 86400 (24 hours). In the block of
the cluster, an unset value takes the value of the preset. The
spec.dump of a LogicalBackupRDBMS replaces the block of the cluster, so
an unset value there gives 86400, not the value of the cluster.
The default is large, so that a very large dump can complete. The Job
always has a deadline. A pod that cannot start uses no retry, so
without a deadline a broken Job stays active for the life of the
backup. A lower value fails a stuck dump sooner. A higher value gives a
long dump the time that it needs.		 Minimum: 1
Optional: {}
postgresImage string PostgresImage is the full image reference of the dump container. It
replaces the default postgres:<major> of the upstream registry. Set it
in an air-gapped installation, where the default image is not
available.		 Optional: {}

BackupPart

BackupPart is the observed state of one part of the backup set: the web-application indices, the exported record indices, or the Zeebe partitions.

Appears in: - LogicalBackupElasticsearchStatus

Field Description Default Validation
state BackupPartState State is the state of this part. Enum: [Pending InProgress Completed Failed]
Optional: {}
failureReason string FailureReason is set when State is Failed. Optional: {}

BackupPartState

Underlying type: string

BackupPartState is the state of one part of the backup set.

Validation: - Enum: [Pending InProgress Completed Failed]

Appears in: - BackupPart

Field Description
Pending
InProgress
Completed
Failed

BackupSchedule

BackupSchedule creates logical backups of one CamundaCluster on a cron schedule, and deletes old backups that have its label. At each trigger, the operator creates the backup kind for the storage type of the cluster. The backup has the name <schedule>-<unix-timestamp> and the labels camunda.io/cluster and camunda.io/backup-schedule. If a name is too long for a resource name or a label value, the operator shortens it. Then it adds a hash of the full name, so two long names stay different.

The backups have no owner reference to the schedule, so a deletion of the schedule never deletes its backups. The schedule skips a trigger while a reference does not resolve, and the Ready condition shows the reason. It also skips a trigger while the cluster is suspended or cannot start a backup yet. It skips a trigger too while a backup of this schedule is not in a final phase. It records an event for these three skips, and no event for a reference that does not resolve.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string BackupSchedule
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec BackupScheduleSpec spec defines the desired state of BackupSchedule Required: {}
status BackupScheduleStatus status defines the observed state of BackupSchedule Optional: {}

BackupScheduleSpec

BackupScheduleSpec is the backup policy of one cluster: when the schedule creates a backup, and how many backups it keeps.

Appears in: - BackupSchedule

Field Description Default Validation
clusterRef ClusterRef ClusterRef references the CamundaCluster to back up. At each trigger,
the operator creates the backup kind for the storage type of the
cluster: LogicalBackupElasticsearch or LogicalBackupRDBMS.		 Required: {}
schedule string Schedule is when the backups run: a five-field cron expression
(minute, hour, day of month, month, day of week), evaluated in UTC.		 Pattern: ^\s*([0-9A-Za-z*?,/-]+\s+)\{4\}[0-9A-Za-z*?,/-]+\s*$
Required: {}
retained RetainedBackups Retained limits how many backups of this schedule stay. The schedule
counts and deletes the backups in its namespace whose
camunda.io/backup-schedule label names this schedule. A backup that you
create with that label counts too, and the schedule can delete it. The
schedule never deletes a backup that is not in a final phase.		 { } Optional: {}

BackupScheduleStatus

BackupScheduleStatus is the observed state of the schedule.

Appears in: - BackupSchedule

Field Description Default Validation
lastScheduleTime Time LastScheduleTime is the last trigger that the schedule used, also when
it skipped the trigger. The schedule never tries a skipped trigger
again.		 Optional: {}
lastBackupName string LastBackupName is the backup that the schedule created most recently. Optional: {}
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current state. The Ready condition has the
reason Healthy when the references and the cron expression are valid,
and InvalidReference when one of them is not.		 Optional: {}

BasicAuthSpec

BasicAuthSpec configures the admin credential of a basic-auth cluster.

Appears in: - ClusterAuthSpec

Field Description Default Validation
adminEmail string AdminEmail is the email address of the admin user that the operator
seeds. The orchestration cluster stores it on that user, and the Admin
web application shows it. Set the address of the person or the team
that owns the cluster.
When empty, the operator uses admin@example.com. RFC 2606 reserves this
domain for documentation, so the default is not the address of a real
person.
The operator applies a changed value to the running cluster. The
cluster validates the address and refuses a domain without a dot. When
the cluster refuses an address, AdminSecretReady shows its answer.		 MaxLength: 253
Pattern: ^$\|^[^@[:space:]]+@[^@[:space:]]+\.[^@[:space:]]+$
Optional: {}
passwordRotation string PasswordRotation requests one rotation of the admin password. Set it
to a value that differs from the applied one, for example a date. The
operator generates a new password and sets it on the admin user of the
running cluster. Then it publishes the password in the admin Secret.
The connectors Deployment restarts with the new password. An empty
value never rotates. A suspended cluster rotates after it resumes.
status.adminPassword.rotation shows the applied value. A preset can set
this field. Then every cluster that references the preset rotates, and
each of these clusters reports its own status.		 MaxLength: 253
Optional: {}

CamundaCluster

CamundaCluster describes one Camunda orchestration cluster: the Zeebe brokers, the gateway, the web applications, and, when enabled, the connectors runtime. The operator creates the StatefulSets, Deployments, and Services of the cluster and keeps them in the declared state.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string CamundaCluster
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec CamundaClusterSpec spec defines the desired state of CamundaCluster Required: {}
status CamundaClusterStatus status defines the observed state of CamundaCluster Optional: {}

CamundaClusterPreset

CamundaClusterPreset is a cluster-scoped baseline configuration for CamundaCluster resources. It has no controller, creates nothing, and reports no status. A CamundaCluster reads it through its presetRef and merges its own fields over it, with the rules of the preset doc.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string CamundaClusterPreset
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec CamundaClusterPresetSpec spec defines the desired state of CamundaClusterPreset Required: {}

CamundaClusterPresetSpec

CamundaClusterPresetSpec defines the desired state of CamundaClusterPreset.

Appears in: - CamundaClusterPreset

Field Description Default Validation
cluster CamundaClusterSpec Cluster is the configuration baseline that the clusters that reference
the preset get. It uses the CamundaCluster spec type. A preset must not
set the references of one cluster: platformConfigRef, presetRef,
releaseRef, storageRef, backupStorageRef, and documentStorageRef. It
must also not set externalUrl, serviceAccount,
connectors.serviceAccount.name, monitoring, suspend, or pause.
It must also not set the fields that belong to a CamundaRelease:
version and connectors.version. An explicit zero value, such as an
empty presetRef or suspend: false, counts as unset. Templated YAML
often renders unset fields in this way. The CamundaCluster doc gives
the details of each field. The CamundaClusterPreset doc gives the merge
rules.		 Required: {}

CamundaClusterSpec

CamundaClusterSpec defines the desired state of CamundaCluster.

A CamundaClusterPreset uses the same type as its baseline. For this reason, the schema marks storageRef and platformConfigRef as optional, and the CamundaCluster requires them. A preset refuses the fields that belong to one cluster only.

Appears in: - CamundaCluster - CamundaClusterClaimSpec - CamundaClusterPresetSpec

Field Description Default Validation
platformConfigRef string PlatformConfigRef names the cluster-scoped CamundaPlatformConfig that
provides auth, license, and image repositories. Required on a
CamundaCluster, forbidden in a preset.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Optional: {}
presetRef string PresetRef names a cluster-scoped CamundaClusterPreset used as the
configuration baseline. The preset doc lists the merge rules.		 Optional: {}
releaseRef string ReleaseRef names a cluster-scoped CamundaRelease that provides the
versions, the pinned images, and the environment of a version. It
merges over the preset and under this spec. Forbidden in a preset.		 Optional: {}
version string Version is the Camunda version to deploy, as a full semantic version.
Required unless the resolved release provides it. Forbidden in a
preset. The operator refuses a version below 8.9.0, also when it comes
from the release. The operator also refuses a version below the
version that the brokers run, with Ready reason VersionDowngradeRefused.
The annotation camunda.io/allow-version-downgrade on the CamundaCluster,
set to that version, permits it.
The operator also refuses a version more than one minor above the
version that the brokers run, in the same major, with Ready reason
VersionSkipRefused. No annotation permits that move.		 Pattern: ^\d+\.\d+\.\d+$
Optional: {}
externalUrl string ExternalURL is the external base URL of the cluster. The operator uses
it for OIDC redirect URLs and web application links. It creates no
Ingress.		 Optional: {}
serviceAccount ServiceAccountSpec ServiceAccount configures the ServiceAccount of every workload except
the connectors, which connectors.serviceAccount configures. The
workloads get access to the buckets of backupStorageRef and
documentStorageRef through this identity. When the operator creates
the account, it adds the identity annotation of each bucket that names
one. When the annotations carry azure.workload.identity/client-id, the
pods of these workloads, the backup Jobs included, get the label
azure.workload.identity/use: "true". When name is unset, the account
is <name>-camunda. The pods need no account while neither the cluster
nor its preset sets this block and no referenced bucket uses workload
identity. The operator then deletes the account only when the cluster
owns it, because the operator created it or took it over. An account
of that name that you created stays.		 Optional: {}
auth ClusterAuthSpec Auth holds the credentials of this cluster and the identities that get
its admin role. Under OIDC, it holds the client credentials and the
administrators. Under basic authentication, it holds the admin
credential that the operator owns.		 Optional: {}
zeebe ZeebeSpec Zeebe configures the brokers. Optional: {}
gateway GatewaySpec Gateway configures the gateway. Optional: {}
operate WebAppSpec Operate configures the Operate web application. Optional: {}
tasklist WebAppSpec Tasklist configures the Tasklist web application. Optional: {}
admin WebAppSpec Admin configures the Admin web application (Orchestration Cluster
Identity before Camunda 8.9). Its Spring profile is admin.		 Optional: {}
connectors ConnectorsSpec Connectors configures the connectors runtime. Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of every workload. A
per-component entry wins over an entry here with the same name.
The list merges by name under server-side apply. Each field manager owns
only the entries that it applies, so an extension controller can add its
own entry next to yours. One applied manifest cannot hold two entries
with the same name.
A CamundaManagementCluster that serves this cluster owns the four
CAMUNDA_CONSOLE_PING_ entries (CAMUNDA_HUB_PING_ on Camunda 8.10 and
later). It replaces what you set under these names. If your entry under
one of these names has valueFrom, the management cluster removes it. One
entry cannot hold a value and a reference together.
Two field managers that apply the same name do not conflict, because the
merge is per field inside the entry. One manager can own value and the
other valueFrom. A container rejects an entry that has both, so the API
server refuses to store such an entry.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of
every workload.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels of every workload pod. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations of every workload pod. The keys
camunda.io/config-hash and camunda.io/service-account-hash belong to the
operator. A value for them here, or in the podAnnotations of a process,
does not reach the pods.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of every workload that does
not set its own. When set, it replaces the scheduling block of a preset,
with no merge.		 Optional: {}
storageRef string StorageRef names the SecondaryStorageConfig, in the namespace of this
cluster, that describes the secondary storage backend. Required on a
CamundaCluster, forbidden in a preset. One backend serves one
CamundaCluster. Two contracts that name one address are one backend. If
another cluster already holds the backend, the operator suspends this
cluster with Ready reason StorageAlreadyAttached. The suspension stays
until the other cluster moves to another backend or is deleted.		 Optional: {}
indexReplicas integer IndexReplicas is the replica count of each index that the cluster
creates in an Elasticsearch secondary storage. When it is not set, the
nodeCount of the storage contract gives the count: 0 on one node, 1 on
two or more nodes. Without a nodeCount, Camunda keeps its own default.
When indexReplicas is not set and the extraEnv of a process sets a
legacy replica key, that process keeps the value of the key.
The cluster applies the count to its existing indices when it starts.
If the nodes cannot place the count, the operator keeps it and records
an IndexReplicasExceedNodes Warning event on the CamundaCluster. A
relational secondary
storage ignores this field.		 Minimum: 0
Optional: {}
backupStorageRef string BackupStorageRef names an ObjectStorageConfig, in the namespace of
this cluster, for backups.		 Optional: {}
documentStorageRef string DocumentStorageRef names an ObjectStorageConfig, in the namespace of
this cluster, for document storage.		 Optional: {}
backup ClusterBackupSpec Backup configures the backups of this cluster. It sets the schedule and
the retention of the primary-storage backups that Zeebe takes, and the
pod of the database dump Job. A preset can set this block, but not
backupStorageRef. The block applies only to a cluster with relational
secondary storage. Only such a cluster has continuous and scheduled
primary-storage backups and the dump Job.		 Optional: {}
monitoring ClusterMonitoringSpec Monitoring configures the monitoring integrations. Optional: {}
suspend boolean Suspend scales every workload to zero and keeps the data. Defaults to
false. An annotation with the prefix suspension-hold.camunda.io/ on the
CamundaCluster also suspends it, whatever this field says.		 Optional: {}
pause boolean Pause stops the reconciliation of this cluster: the operator changes no
workload and writes no status. It records a Paused event instead. Other
resources that use the cluster, such as a BackupSchedule or a restore,
still act on it. When you delete a paused cluster, the operator still
releases its storage backends. Defaults to false.		 Optional: {}

CamundaClusterStatus

CamundaClusterStatus is the observed state of a CamundaCluster.

Appears in: - CamundaCluster

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
volumes VolumeStatus array Volumes lists the bound broker PersistentVolumeClaims and the capacity
that each one reports, sorted by name.		 Optional: {}
management ManagementBinding Management is the published address of the management API of this
cluster. Extensions read it and do not derive the Service name, the
port, and the authentication themselves. It is unset while the cluster
is suspended, so a consumer does not use an old endpoint.		 Optional: {}
gateway GatewayBinding Gateway is the published address of the client APIs of this cluster.
Extensions read it and do not derive the Service name and the ports
themselves. It is unset while the cluster is suspended, so a consumer
does not use an old endpoint.		 Optional: {}
endpoints Endpoint array Endpoints lists the routes of this cluster, sorted by name: each path
on the external URL, with the Service and the port that serve it. An
access extension reads it and does not derive a Service from the mode
fields. The longest matching path prefix wins, and default takes every
path that no other entry names. The entries stay while the cluster is
suspended, because the Services stay.		 Optional: {}
adminPassword AdminPasswordStatus AdminPassword is the state of the admin credential of a basic-auth
cluster. It is unset under OIDC.		 Optional: {}
serviceAccountName string ServiceAccountName is the ServiceAccount that the pods of this cluster
run under, except the connectors. It is empty when they run under the
default account of the namespace. An extension that runs a pod for
this cluster reads it and does not derive the name itself.		 Optional: {}
connectorsServiceAccountName string ConnectorsServiceAccountName is the ServiceAccount that the connectors
pods run under. It is empty when neither the cluster nor its preset
sets connectors.serviceAccount, and when connectors are not enabled.		 Optional: {}
conditions Condition array Conditions represent the current state. Ready holds the reason of a
failed pre-check, or it follows the conditions of the components that
the cluster needs. The per-process conditions (ZeebeReady, GatewayReady,
OperateReady, TasklistReady, AdminReady, ConnectorsReady) also appear
here.		 Optional: {}

CamundaManagementCluster

CamundaManagementCluster describes one Camunda management plane: Management Identity, an identity provider, and, when set, Console and Web Modeler. The operator creates its Deployments and Services. It writes the ManagementAuthConfig that Optimize reads. It attaches the management plane to the orchestration clusters that clusterSelector matches.

The creation of a CamundaManagementCluster is a task for a platform administrator. The selector reaches CamundaClusters in every namespace, and the operator adds annotations to the clusters that it matches.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string CamundaManagementCluster
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec CamundaManagementClusterSpec spec defines the desired state of CamundaManagementCluster Required: {}
status CamundaManagementClusterStatus status defines the observed state of CamundaManagementCluster Optional: {}

CamundaManagementClusterSpec

CamundaManagementClusterSpec describes one management plane: Management Identity, its identity provider, and, when set, Console and Web Modeler.

Appears in: - CamundaManagementCluster

Field Description Default Validation
platformConfigRef string PlatformConfigRef names the cluster-scoped CamundaPlatformConfig that
holds the license and the image settings. In the oidc mode, it also
holds the identity provider and every client of the management plane.		 MinLength: 1
suspend boolean Suspend scales every workload of this management cluster to zero. The
ManagementAuthConfig, the claims on the orchestration clusters, and the
Console ping settings stay. Thus nothing else must change while the
management plane is down.		 Optional: {}
clusterSelector LabelSelector ClusterSelector selects the CamundaClusters that Console and Web
Modeler serve, in every namespace that namespaceSelector permits. An
unset selector selects no cluster. An empty selector ({}) selects every
cluster.		 Optional: {}
namespaceSelector LabelSelector NamespaceSelector limits clusterSelector to the namespaces whose labels
match. It selects on the labels of the Namespace objects, as the
namespaceSelector of an admission webhook does. An unset or empty ({})
selector permits every namespace.		 Optional: {}
managementAuthConfigName string ManagementAuthConfigName is the name of the cluster-scoped
ManagementAuthConfig that this management cluster writes. A
CamundaOptimize reads it through its managementAuthRef. Empty means the
name of this resource.		 Optional: {}
serviceAccount ServiceAccountSpec ServiceAccount configures the ServiceAccount of every workload of this
management plane, except a component that sets a serviceAccount block of
its own. A PluginRequest of the plane targets this account, so the
access that a plugin grants goes to these workloads. When name is unset,
the account is <name>-management. No two accounts of one management
plane can have the same name, or Ready reports InvalidReference. The
name default needs create false.		 Optional: {}
identityProvider IdentityProviderSpec IdentityProvider selects where users authenticate. Exactly one of
keycloak, externalKeycloak, or oidc is set.
identity IdentitySpec Identity configures Management Identity. Console, Web Modeler, and
Optimize authenticate through it, so the operator always deploys it.
console ConsoleSpec Console configures Console. While it is unset, the operator does not
deploy Console.		 Optional: {}
webModeler WebModelerSpec WebModeler configures Web Modeler. While it is unset, the operator does
not deploy Web Modeler.		 Optional: {}

CamundaManagementClusterStatus

CamundaManagementClusterStatus is the observed state of a CamundaManagementCluster.

Appears in: - CamundaManagementCluster

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
managementAuthConfig string ManagementAuthConfig is the name of the ManagementAuthConfig that this
management cluster writes. A CamundaOptimize reads it through its
managementAuthRef.		 Optional: {}
serviceAccountName string ServiceAccountName is the ServiceAccount that the workloads of this
management plane run under, except a component that sets a
serviceAccount block of its own. A PluginRequest of the plane targets
it. An extension that runs a pod for this plane reads it and does not
derive the name itself.		 Optional: {}
endpoints Endpoint array Endpoints lists the routes of this management plane, sorted by name.
Each entry is a path on an external URL, with the Service and the port
that serve it. An access extension reads it and does not derive a
Service from the mode fields. The path of an entry is the path of the
external URL of its app, or / for a URL without a path. The entry
belongs to the host of that URL. keycloak is present in the keycloak
mode, console while spec.console is set, and web-modeler and
web-modeler-websockets while spec.webModeler is set. The longest
matching path prefix wins. The entries stay while the management plane
is suspended, because the Services stay.		 Optional: {}
clusters AttachedClusterStatus array Clusters lists every CamundaCluster that clusterSelector matched, and
shows whether the management plane serves it.		 Optional: {}
optimize AttachedOptimizeStatus array Optimize lists every CamundaOptimize that names the ManagementAuthConfig
of this management cluster and sets spec.externalUrl, sorted by
namespace and name. The management plane registers the login callback
of each one on the Optimize client of the realm.
The list is empty in the oidc mode. In that mode, the identity provider
of the platform config holds the callback URLs.		 Optional: {}
callbackRealm KeycloakRealmTarget CallbackRealm is the Keycloak realm that this management plane last
gave to Management Identity, in the externalKeycloak mode. Identity
registers the login callbacks of Optimize in this realm when it starts.
Thus the field appears with the realm, not with the first registration.
A value does not mean that the callbacks are still in the realm. When
the spec names another realm or the oidc mode, the operator first
removes the callbacks from this realm. The field stays until no
configuration of the old realm can write them back. That is the case
when no Management Identity pod of the old realm can run, and no
Deployment or ReplicaSet of it can start one. The field then disappears
or moves to the new realm. This change shows that the move is complete.
The field is absent after a move into the keycloak or the oidc mode.
It is also absent while no login callback of this operator is
registered anywhere and nothing can write one back. The operator runs the
Keycloak of the keycloak mode, and deletes it with the management plane
or when the plane leaves that mode. Thus the field never names the
realm of that Keycloak. During a move into either mode, the field still
names the realm that the plane leaves.
A Keycloak that is permanently gone never answers. To release its realm
with the callbacks in it, set the annotation
camunda.io/forget-callback-realm. Use the value that the
OptimizeCallbacksReady message names.		 Optional: {}
conditions Condition array Conditions represent the current state. Ready holds the reason of a
failed pre-check, or StepFailed for a failed step. When the write of
the ManagementAuthConfig is the first failed step, Ready holds
WriteFailed instead. In the oidc mode it holds ImmutableAfterStart when
spec.identity.admin changed after Management Identity first started.
Otherwise it follows the conditions of the deployed components. When
all of them are True, a failed OptimizeCallbacksReady makes Ready False
with its reason. The per-component conditions (KeycloakReady,
IdentityReady, ConsoleReady, WebModelerReady, ManagementAuthReady,
SecretsReady, MirroredSecretsReady, ServiceAccountsReady) and
OptimizeCallbacksReady also appear here.		 Optional: {}

CamundaOptimize

CamundaOptimize describes one Camunda Optimize instance attached to one CamundaCluster. The operator creates a webapp Deployment, an importer Deployment, and their Services. It also enables the Elasticsearch exporter of the referenced cluster, so Optimize has data to import.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string CamundaOptimize
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec CamundaOptimizeSpec spec defines the desired state of CamundaOptimize Required: {}
status CamundaOptimizeStatus status defines the observed state of CamundaOptimize Optional: {}

CamundaOptimizeSpec

CamundaOptimizeSpec is the desired state of one Optimize instance. It attaches to one CamundaCluster and reads the data of that cluster from Elasticsearch.

The spec has no platformConfigRef. The image repository and the license come from the CamundaPlatformConfig of the referenced cluster, so Optimize and the cluster cannot have different values.

Appears in: - CamundaOptimize

Field Description Default Validation
version string Version is the Optimize version to deploy, as a full semantic version.
Camunda releases Optimize with the minor and the patch of the
orchestration cluster, so set it to the effective version of the
referenced cluster. If the major or the minor differs, Ready reports
VersionMismatch.		 Pattern: ^\d+\.\d+\.\d+$
managementAuthRef string ManagementAuthRef names the cluster-scoped ManagementAuthConfig that
provides the Management Identity OIDC configuration. Optimize
authenticates against Management Identity, not against the built-in
auth of the orchestration cluster.		 MinLength: 1
externalUrl string ExternalURL is the URL where browsers reach this Optimize. With a path,
such as https://camunda.example.com/optimize, Optimize serves under that
path, and status.endpoints routes that path. Without a path, Optimize
serves at the root of the host.
In the two Keycloak modes, the management plane of managementAuthRef
registers <externalUrl>/api/authentication/callback on the optimize
client of the realm. Thus a person who signs in here comes back here.
Without a URL, the plane registers no callback, and Keycloak refuses
the return. The exception is a callback that somebody added to the
realm manually.
In the oidc mode, the operator registers no callback. The identity
provider of the platform config holds the callback URLs, so add
<externalUrl>/api/authentication/callback there.		 Optional: {}
clusterRef ClusterRef ClusterRef names the CamundaCluster that this Optimize instance reads.
The secondary storage of that cluster must be Elasticsearch. No other
CamundaOptimize can be attached to it.
The reference is immutable. A change to another cluster changes the pod
selectors of the Deployments, and Kubernetes does not permit that.
Also, the old cluster keeps the exporter settings of this Optimize.
webapp WorkloadSpec Webapp configures the Deployment that serves the Optimize user
interface. It runs with data import off.		 Optional: {}
importer WorkloadSpec Importer configures the Deployment that imports the exported cluster
data into the Optimize indices. Optimize supports one active importer,
so replicas must be 0 or 1. With 0, the import stops, for example
during a restore or an index rewrite. The webapp continues to serve the
data that it already imported.		 Optional: {}
indexReplicas integer IndexReplicas is the replica count of each Optimize index, and of each
zeebe-record index that the exporter of the cluster writes for this
Optimize. When it is not set, the nodeCount of the storage contract of
the cluster gives the count. The count is 0 on one node, and 1 on two or
more nodes.
Without a nodeCount, Optimize and the exporter keep their own defaults.
Optimize applies the count to its existing indices when it starts. The
exporter applies it to the next zeebe-record indices that it creates.
If the nodes cannot place the count, the operator keeps it and records
an IndexReplicasExceedNodes Warning event on the CamundaOptimize.		 Minimum: 0
Optional: {}
monitoring OptimizeMonitoringSpec Monitoring configures the monitoring integrations. Optional: {}

CamundaOptimizeStatus

CamundaOptimizeStatus is the observed state of a CamundaOptimize.

Appears in: - CamundaOptimize

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current state. Ready holds the reason of a
failed pre-check. Otherwise it follows the conditions of the two
workloads, and MirroredSecretsReady when the Optimize references a
Secret in another namespace. The per-workload conditions (WebappReady,
ImporterReady) and MirroredSecretsReady also appear here.		 Optional: {}
suspendedBy OptimizeSuspension SuspendedBy tells why the Optimize workloads are at zero with the
referenced cluster. It is empty while they follow their spec. It stays
set while a failed check keeps them at zero after the cluster resumed.		 Enum: [Cluster StorageClaim]
Optional: {}
endpoints Endpoint array Endpoints lists the routes of this Optimize: one entry, optimize, with
the webapp Service and its HTTP port. Its path prefix is the path of
spec.externalUrl without a trailing slash, or / when that path is empty.
An access extension reads it and does not derive the Service name. The entry
stays while the workloads are at zero with the cluster, because the
Service stays. It is empty before the first render. It is also empty
while another CamundaOptimize holds the cluster or the cluster is gone,
because the operator then deletes the webapp Service.		 Optional: {}

CamundaPlatformConfig

CamundaPlatformConfig is the cluster-scoped CRD that holds the platform settings of an environment: the identity provider, the license, and the image repositories. Every orchestration cluster that references it uses these settings.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string CamundaPlatformConfig
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec CamundaPlatformConfigSpec spec defines the desired state of CamundaPlatformConfig Required: {}
status CamundaPlatformConfigStatus status defines the observed state of CamundaPlatformConfig Optional: {}

CamundaPlatformConfigSpec

CamundaPlatformConfigSpec holds the settings that are the same for all orchestration clusters of an environment.

Appears in: - CamundaPlatformConfig

Field Description Default Validation
auth PlatformAuthSpec Auth holds the authentication settings of the orchestration clusters.
Unset means basic authentication.		 Optional: {}
licenseSecretRef SecretKeyRef LicenseSecretRef names the Secret key that holds the Camunda license
key. Without it, clusters run in unlicensed non-production mode.		 Optional: {}
images ImagesSpec Images changes the repositories of the images that the operator pulls,
one entry for each image, for example to a mirror. Each value is a full
repository with its registry and no tag. The tag always comes from the
version field of the resource that runs the image. A registry with a
port needs a path after the port, as in registry:5000/camunda/optimize.
The operator appends the tag to the value, as in
registry:5000/camunda/optimize:<version>.		 Optional: {}

CamundaPlatformConfigStatus

CamundaPlatformConfigStatus is the observed validation state of the platform config.

Appears in: - CamundaPlatformConfig

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current validation state. The Ready condition
has the reasons Healthy or MissingSecret.		 Optional: {}

CamundaRelease

CamundaRelease is a cluster-scoped description of what a platform runs: the versions, the pinned images, and the environment that a version needs. It has no controller, creates nothing, and reports no status. A CamundaCluster, an ElasticsearchCluster, and a DatabaseServer each read it through their releaseRef. They merge it over their preset and under their own spec.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string CamundaRelease
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec CamundaReleaseSpec spec defines the desired state of CamundaRelease Required: {}

CamundaReleaseSpec

CamundaReleaseSpec holds what a platform runs: the version of the orchestration cluster, and the versions of its storage. It also holds the image references that replace the images of these versions, and the environment that a version needs.

Appears in: - CamundaRelease

Field Description Default Validation
version string Version is the Camunda version of the orchestration cluster processes,
as a full semantic version. A cluster that references the release
refuses an effective version below 8.9.0. Its own spec.version wins over
this value.		 Pattern: ^\d+\.\d+\.\d+$
Required: {}
connectors ReleaseConnectorsSpec Connectors holds the version and the environment of the connectors
runtime.		 Optional: {}
elasticsearch ReleaseElasticsearchSpec Elasticsearch holds the version of the Elasticsearch clusters of this
release. An ElasticsearchCluster takes it through its releaseRef.		 Optional: {}
databaseServer ReleaseDatabaseServerSpec DatabaseServer holds the version of the PostgreSQL servers of this
release. A DatabaseServer takes it through its releaseRef.		 Optional: {}
images ReleaseImagesSpec Images replaces the image reference of a process. The operator uses an
entry as it is, with its tag or digest. It changes only the image that
the operator pulls. The operator still uses the version above for the
version rules, the downgrade rule, and the environment that it
computes.		 Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of every workload. The entries
merge by name over the preset entries and under the cluster entries.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of
every workload. They follow the preset sources and precede the cluster
sources.		 Optional: {}
zeebe ReleaseEnvSpec Zeebe holds the environment of the brokers. Optional: {}
gateway ReleaseEnvSpec Gateway holds the environment of the gateway. Optional: {}
operate ReleaseEnvSpec Operate holds the environment of Operate. Optional: {}
tasklist ReleaseEnvSpec Tasklist holds the environment of Tasklist. Optional: {}
admin ReleaseEnvSpec Admin holds the environment of the Admin web application. Optional: {}

ClusterAdminSpec

ClusterAdminSpec holds the identities that get the admin role of one cluster under OIDC. The identity provider authenticates a caller, and nothing else authorizes one, so an OIDC cluster without this block has no administrator. Basic authentication seeds its own administrator and ignores the block.

Appears in: - ClusterAuthSpec

Field Description Default Validation
users string array Users are the values of the username claim that get the admin role. items:MinLength: 1
Optional: {}
clients string array Clients are the values of the client id claim that get the admin role.
A client entry matches only when the platform config sets
auth.oidc.clientIdClaim.		 items:MinLength: 1
Optional: {}
mappingRules AdminMappingRule array MappingRules give the admin role to every token that holds a claim with
a given value.		 Optional: {}

ClusterAuthSpec

ClusterAuthSpec holds the credentials of one cluster and the identities that get its admin role. Under OIDC it carries the client credentials, which override the defaults of the platform config and of the preset, and the identities of the administrators. A block that sets clientId replaces the whole client: the audience and the client secret then come from this block only. A block without clientId overrides the audience and the client secret one by one. Under basic authentication it carries the basic block, which configures the admin credential that the operator owns.

Appears in: - CamundaClusterSpec

Field Description Default Validation
clientId string ClientID is the OIDC client ID of this cluster. A client ID replaces
the whole client: the audience and the client secret then come from
this block only. Requires clientSecretRef.		 Optional: {}
audience string Audience is the audience that access tokens must carry. Defaults to
the client ID that the cluster uses.		 Optional: {}
clientSecretRef LocalSecretKeyRef ClientSecretRef names the Secret that holds the OIDC client secret of
this cluster. Required when clientId is set.		 Optional: {}
admin ClusterAdminSpec Admin holds the identities that get the admin role of this cluster. It
applies under OIDC only. Basic authentication seeds its own
administrator and ignores this block.		 Optional: {}
basic BasicAuthSpec Basic configures the admin credential that the operator owns. It
applies under basic authentication only. OIDC ignores this block, like
basic authentication ignores admin.		 Optional: {}

ClusterBackupSpec

ClusterBackupSpec configures the backups of one orchestration cluster. spec.backupStorageRef sets where the backups go. This block is the policy, so a preset can hold it for many clusters.

Appears in: - CamundaClusterSpec

Field Description Default Validation
primaryStorage PrimaryStorageBackupSpec PrimaryStorage configures the backups that Zeebe takes of its own
primary storage. A point-in-time restore uses them.		 Optional: {}
dump BackupDumpSpec Dump configures the Job that writes the logical database to the backup
bucket. A LogicalBackupRDBMS can replace this block as a whole.		 Optional: {}

ClusterMonitoringSpec

ClusterMonitoringSpec groups the monitoring integrations of a CamundaCluster.

Appears in: - CamundaClusterSpec

Field Description Default Validation
serviceMonitor ServiceMonitorSpec ServiceMonitor configures the Prometheus ServiceMonitors. When enabled,
the operator creates one ServiceMonitor for each process, with the name
of the workload. It scrapes /actuator/prometheus on the management port
9600 of a unified process, and on the HTTP port 8080 of connectors.		 Optional: {}

ClusterRef

ClusterRef references a CamundaCluster by name, in the namespace of the referencing object. The reference cannot cross namespaces. For a backup, the operator reads the Secrets of the cluster, runs a Job in its namespace, and calls its management API. Thus the reference stays inside the RBAC limits of the namespace of the CR. A user who can create the CR in a namespace can back up the clusters of that namespace, and no others.

Appears in: - BackupScheduleSpec - CamundaClusterClaimStatus - CamundaOptimizeSpec - GrantSpec - LogicalBackupElasticsearchSpec - LogicalBackupRDBMSSpec - LogicalRestoreElasticsearchSpec - LogicalRestoreRDBMSSpec - PointInTimeRestoreSpec

Field Description Default Validation
name string Name is the name of the CamundaCluster, in the namespace of this
object.		 MinLength: 1

ComponentMode

Underlying type: string

ComponentMode says where a process of the unified binary runs.

Validation: - Enum: [Standalone Embedded]

Appears in: - GatewaySpec - WebAppSpec

Field Description
Standalone ComponentModeStandalone runs the process as its own Deployment of the
unified binary.
Embedded ComponentModeEmbedded runs the process inside the nearest standalone
host up the chain: the gateway when it is standalone, otherwise zeebe.

ConfidentialClientSpec

ConfidentialClientSpec is an identity provider client that authenticates with a secret.

Appears in: - ManagementClients - WebModelerAPIClientSpec

Field Description Default Validation
clientId string ClientID is the client id at the identity provider. MinLength: 1
audience string Audience is the audience that the component validates in access tokens.
Empty means the client id.		 Optional: {}
clientSecretRef SecretKeyRef ClientSecretRef names the Secret key that holds the client secret.

ConnectorsSpec

ConnectorsSpec configures the connectors runtime. It is a separate application, never part of the unified binary, and always its own Deployment.

Appears in: - CamundaClusterSpec

Field Description Default Validation
enabled boolean Enabled runs the connectors runtime when true. Defaults to false. Optional: {}
version string Version is the version of the connectors bundle image, as a full
semantic version. Use the same minor as the cluster, such as 8.9.x for
a cluster on 8.9. The patch does not follow the cluster patch. Required
when connectors are enabled, unless the resolved release provides it.
Forbidden in a preset.		 Pattern: ^\d+\.\d+\.\d+$
Optional: {}
serviceAccount ServiceAccountSpec ServiceAccount configures the ServiceAccount of the connectors pods.
When unset, they run under the default ServiceAccount of the namespace.
When set, they run under <name>-connectors, or under name. Only
the annotations of this block go on the account, never the identities
of the buckets. When they carry azure.workload.identity/client-id, the
connectors pods get the label azure.workload.identity/use: "true". The
connectors never run under the cluster ServiceAccount: name must differ
from it, and a spec.serviceAccount.name of default needs this block, or
Ready reports InvalidReference. The name default needs create false. A
preset can set this block, except name.		 Optional: {}
replicas integer Replicas is the number of pods of this process. Defaults to 1. On a
CamundaCluster it has no effect on an embedded web application.		 Minimum: 0
Optional: {}
resources ResourceRequirements Resources are the CPU and memory of the container of this process. Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of the container of this
process. On a CamundaCluster, an entry here wins over a top-level entry
with the same name. The entries of an embedded web application apply to
its host process.
The list merges by name under server-side apply. Each field manager owns
only the entries that it applies, so an extension controller can add its
own entry next to yours. One applied manifest cannot hold two entries
with the same name.
Two field managers that apply the same name do not conflict, because the
merge is per field inside the entry. One manager can own value and the
other valueFrom. A container rejects an entry that has both, so the API
server refuses to store such an entry.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of the
container of this process.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels of the pods of this process. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations of the pods of this process. In a
CamundaCluster, the keys camunda.io/config-hash and
camunda.io/service-account-hash belong to the operator, and a value for
them does not reach the pods.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the pods of this process.
When set, it replaces all other scheduling blocks for this process, with
no merge. On a CamundaCluster, these are the top-level block and the
block of a preset.		 Optional: {}

ConsoleSpec

ConsoleSpec configures Console.

Appears in: - CamundaManagementClusterSpec

Field Description Default Validation
version string Version is the Console version, as a full semantic version. The
operator supports 8.9.0 and later.		 Pattern: ^\d+\.\d+\.\d+$
externalUrl string ExternalURL is the URL where browsers reach Console. Console serves
under the path of this URL. Every selected CamundaCluster reports to
Console through its Kubernetes Service. Thus the clusters do not need
an Ingress in front of Console.
serviceAccount ServiceAccountSpec ServiceAccount gives the Console pods a ServiceAccount of their own.
When unset, they run under spec.serviceAccount. When set, they run
under <name>-console, or under name, and they do not get the access
that a plugin grants to the account of spec.serviceAccount. The name
default needs create false.		 Optional: {}
replicas integer Replicas is the number of pods of this process. Defaults to 1. On a
CamundaCluster it has no effect on an embedded web application.		 Minimum: 0
Optional: {}
resources ResourceRequirements Resources are the CPU and memory of the container of this process. Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of the container of this
process. On a CamundaCluster, an entry here wins over a top-level entry
with the same name. The entries of an embedded web application apply to
its host process.
The list merges by name under server-side apply. Each field manager owns
only the entries that it applies, so an extension controller can add its
own entry next to yours. One applied manifest cannot hold two entries
with the same name.
Two field managers that apply the same name do not conflict, because the
merge is per field inside the entry. One manager can own value and the
other valueFrom. A container rejects an entry that has both, so the API
server refuses to store such an entry.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of the
container of this process.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels of the pods of this process. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations of the pods of this process. In a
CamundaCluster, the keys camunda.io/config-hash and
camunda.io/service-account-hash belong to the operator, and a value for
them does not reach the pods.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the pods of this process.
When set, it replaces all other scheduling blocks for this process, with
no merge. On a CamundaCluster, these are the top-level block and the
block of a preset.		 Optional: {}

CredentialsSpec

CredentialsSpec names the Secret to which the operator writes generated credentials, with the keys username and password. The Secret is in the namespace of the CR.

Appears in: - BackupCredentialsSpec - DatabaseSpec

Field Description Default Validation
secretName string SecretName is the name of the credentials Secret. The default comes
from the CR name, as the field that uses this type states.		 Optional: {}

Database

Database creates a logical database and its users on an existing PostgreSQL server with SQL. It publishes the result as a DatabaseConfig in its own namespace, and, when set, as a SecondaryStorageConfig. When you delete a Database, Kubernetes deletes the published contracts and Secrets. The logical database and the SQL users stay on the server.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string Database
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec DatabaseSpec spec defines the desired state of Database Required: {}
status DatabaseStatus status defines the observed state of Database Optional: {}

DatabaseConfig

DatabaseConfig is the namespaced contract CRD that describes one logical database: its server, its name, and its application credentials. The components that connect to the database read it. Consumers find it by name in their own namespace.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string DatabaseConfig
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec DatabaseConfigSpec spec defines the desired state of DatabaseConfig Required: {}
status DatabaseConfigStatus status defines the observed state of DatabaseConfig Optional: {}

DatabaseConfigSpec

DatabaseConfigSpec describes one logical database: its server, its name, and its application credentials.

Appears in: - DatabaseConfig

Field Description Default Validation
serverRef string ServerRef names the DatabaseServerConfig of the server that holds this
database.		 MinLength: 1
databaseName string DatabaseName is the name of the logical database on the server. MinLength: 1
credentialsSecretRef LocalCredentialsSecretRef CredentialsSecretRef names an application user with read and write
access to the database.
backupCredentialsSecretRef LocalCredentialsSecretRef BackupCredentialsSecretRef names a separate user with the privileges
to dump the database. Backups use this user. A restore uses the
application user of CredentialsSecretRef.		 Optional: {}

DatabaseConfigStatus

DatabaseConfigStatus is the observed validation state of the contract.

Appears in: - DatabaseConfig

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current validation state. The Ready condition
has the reasons Healthy, InvalidReference, or MissingSecret.		 Optional: {}

DatabaseEngine

Underlying type: string

DatabaseEngine identifies the database engine of a server.

Validation: - Enum: [postgres]

Appears in: - DatabaseServerConfigSpec

Field Description
postgres

DatabaseServer

DatabaseServer runs one PostgreSQL instance through the external CloudNativePG operator. It archives the instance continuously to an object storage bucket. It publishes the connection details as a DatabaseServerConfig, which a Database and a PointInTimeRestore use. One or more orchestration clusters use the instance, each through its own Database.

A PointInTimeRestore rolls the whole instance back. It needs a server that holds the database of its cluster and nothing else.

The name of the CR is also the name of the CloudNativePG cluster. On create, the name must be a DNS-1035 label of at most 46 characters. CloudNativePG accepts 50 characters, and a rollback appends up to four ("-r99"). While the recovery index is below 100, the cluster of a rollback gets the full name. Above that, the operator shortens the name to a head and a hash. Each archive record adds one to the index: a rollback, an archive that is enabled again, and a change of bucket.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string DatabaseServer
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec DatabaseServerSpec spec defines the desired state of DatabaseServer Required: {}
status DatabaseServerStatus status defines the observed state of DatabaseServer Optional: {}

DatabaseServerArchiveSpec

DatabaseServerArchiveSpec points a server at the bucket of its continuous archive. The archive holds the write-ahead log of every instance, and the base backups that a recovery starts from. A server with an archive publishes pitr.enabled true on its contract. A server without one publishes false, and no point-in-time restore can reach it.

The archive is not the backup model of the operator. BackupSchedule and LogicalBackupRDBMS take logical dumps and never use these base backups.

Appears in: - DatabaseServerSpec

Field Description Default Validation
objectStorageRef string ObjectStorageRef names an ObjectStorageConfig in the namespace of this
server. The operator writes the archive under a prefix of that bucket
that only this server uses.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
retentionPeriodDays integer RetentionPeriodDays is how far into the past a restore can reach. The
operator enforces this value on the bucket, and the contract of this
server publishes the same value.
The maximum is 36500 days, which is a hundred years. The operator counts
the reachable window in nanoseconds, and that count overflows at about
292 years. The maximum stays well below that limit.		 Maximum: 36500
Minimum: 1
baseBackupSchedule string BaseBackupSchedule is when the server takes a base backup. It is the
six-field cron of CloudNativePG (seconds first, in UTC), or one of the
descriptors @yearly, @annually, @monthly, @weekly, @daily, @midnight,
@hourly and @every. The first base backup runs as soon as the server is
up, whatever the schedule says. A recovery from the archive is possible
only after that backup completes.
The API server refuses the five-field cron of a Kubernetes CronJob.
CloudNativePG reads the first field as seconds, so a five-field value
runs at a different time than intended.
Each field has the bounds that CloudNativePG accepts. Seconds and
minutes take 0-59, and hours take 0-23. The day of the month takes
1-31, and the month takes 1-12 or JAN-DEC. The day of the week takes
0-6 or SUN-SAT. The schema cannot find a range whose first value is
above its second, such as FRI-MON. The operator refuses such a range
with Ready reason InvalidReference, before it applies anything.
A step has at most three digits. An @every number has at most six
digits on each side of the point. These limits are stricter than the
parser of CloudNativePG. That parser accepts a longer number, then
overflows and stops taking base backups.		 0 0 2 * * * Pattern: ^(\s*([*?]\|[0-5]?\d(-[0-5]?\d)?)(/[1-9]\d\{0,2\})?(,([*?]\|[0-5]?\d(-[0-5]?\d)?)(/[1-9]\d\{0,2\})?)*\s+([*?]\|[0-5]?\d(-[0-5]?\d)?)(/[1-9]\d\{0,2\})?(,([*?]\|[0-5]?\d(-[0-5]?\d)?)(/[1-9]\d\{0,2\})?)*\s+([*?]\|([01]?\d\|2[0-3])(-([01]?\d\|2[0-3]))?)(/[1-9]\d\{0,2\})?(,([*?]\|([01]?\d\|2[0-3])(-([01]?\d\|2[0-3]))?)(/[1-9]\d\{0,2\})?)*\s+([*?]\|([1-9]\|[12]\d\|3[01])(-([1-9]\|[12]\d\|3[01]))?)(/[1-9]\d\{0,2\})?(,([*?]\|([1-9]\|[12]\d\|3[01])(-([1-9]\|[12]\d\|3[01]))?)(/[1-9]\d\{0,2\})?)*\s+([*?]\|([1-9]\|1[0-2]\|[Jj]([Aa][Nn]\|[Uu][LlNn])\|[Ff][Ee][Bb]\|[Mm][Aa][RrYy]\|[Aa]([Pp][Rr]\|[Uu][Gg])\|[Ss][Ee][Pp]\|[Oo][Cc][Tt]\|[Nn][Oo][Vv]\|[Dd][Ee][Cc])(-([1-9]\|1[0-2]\|[Jj]([Aa][Nn]\|[Uu][LlNn])\|[Ff][Ee][Bb]\|[Mm][Aa][RrYy]\|[Aa]([Pp][Rr]\|[Uu][Gg])\|[Ss][Ee][Pp]\|[Oo][Cc][Tt]\|[Nn][Oo][Vv]\|[Dd][Ee][Cc]))?)(/[1-9]\d\{0,2\})?(,([*?]\|([1-9]\|1[0-2]\|[Jj]([Aa][Nn]\|[Uu][LlNn])\|[Ff][Ee][Bb]\|[Mm][Aa][RrYy]\|[Aa]([Pp][Rr]\|[Uu][Gg])\|[Ss][Ee][Pp]\|[Oo][Cc][Tt]\|[Nn][Oo][Vv]\|[Dd][Ee][Cc])(-([1-9]\|1[0-2]\|[Jj]([Aa][Nn]\|[Uu][LlNn])\|[Ff][Ee][Bb]\|[Mm][Aa][RrYy]\|[Aa]([Pp][Rr]\|[Uu][Gg])\|[Ss][Ee][Pp]\|[Oo][Cc][Tt]\|[Nn][Oo][Vv]\|[Dd][Ee][Cc]))?)(/[1-9]\d\{0,2\})?)*\s+([*?]\|([0-6]\|[Ss]([Uu][Nn]\|[Aa][Tt])\|[Mm][Oo][Nn]\|[Tt]([Uu][Ee]\|[Hh][Uu])\|[Ww][Ee][Dd]\|[Ff][Rr][Ii])(-([0-6]\|[Ss]([Uu][Nn]\|[Aa][Tt])\|[Mm][Oo][Nn]\|[Tt]([Uu][Ee]\|[Hh][Uu])\|[Ww][Ee][Dd]\|[Ff][Rr][Ii]))?)(/[1-9]\d\{0,2\})?(,([*?]\|([0-6]\|[Ss]([Uu][Nn]\|[Aa][Tt])\|[Mm][Oo][Nn]\|[Tt]([Uu][Ee]\|[Hh][Uu])\|[Ww][Ee][Dd]\|[Ff][Rr][Ii])(-([0-6]\|[Ss]([Uu][Nn]\|[Aa][Tt])\|[Mm][Oo][Nn]\|[Tt]([Uu][Ee]\|[Hh][Uu])\|[Ww][Ee][Dd]\|[Ff][Rr][Ii]))?)(/[1-9]\d\{0,2\})?)*\s*\|@((year\|annual\|month\|week\|dai\|hour)ly\|midnight\|every (\d\{1,6\}(\.\d\{1,6\})?[hms])+))$
Optional: {}

DatabaseServerArchiveStatus

DatabaseServerArchiveStatus is the observed state of the archive of a server.

Appears in: - DatabaseServerStatus

Field Description Default Validation
history ArchiveRecord array History lists every archive that the server wrote, oldest first. A
recovery uses the record whose interval holds the requested point. The
operator never removes a record. Thus a restore can reach back across
an earlier recovery for as long as the bucket keeps the objects. When
you remove spec.archive, the open record closes and the list stays.
When you add an archive again, a new record opens. A move of
spec.archive to another bucket does the same. No restore can reach a
point in a time without an archive.		 Optional: {}
boundary ArchiveBoundary Boundary is the last move of the archive that no record holds yet. The
move happens when spec.archive is enabled again on another location,
or when the location moves again before a base backup opens a record.
It prevents a base backup of the old location from opening the
interval of the new location. It is cleared when that interval opens.		 Optional: {}
reachableFrom Time ReachableFrom is the oldest point that the objects in the bucket still
cover, rounded down to the minute. The bucket can miss up to one minute
after it. The retention period removes old objects from the bucket. A
longer retention period does not bring back what a shorter one already
removed. The window grows to the new retention period only as the
archive writes past this point. The server refuses a rollback to a
point before it. When it is unset, only the retention period limits
the window.		 Optional: {}

DatabaseServerConfig

DatabaseServerConfig is the contract CRD that describes a database server: the engine, the endpoint, the admin credentials, and the point-in-time recovery capability. The operator creates databases on the server and validates the declared capabilities. A consumer reads it in its own namespace. Thus all the RDBMS resources of a cluster are in the namespace of that cluster.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string DatabaseServerConfig
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec DatabaseServerConfigSpec spec defines the desired state of DatabaseServerConfig Required: {}
status DatabaseServerConfigStatus status defines the observed state of DatabaseServerConfig Optional: {}

DatabaseServerConfigSpec

DatabaseServerConfigSpec describes a database server: the engine, the endpoint, the admin credentials, and the point-in-time recovery capability.

Appears in: - DatabaseServerConfig

Field Description Default Validation
engine DatabaseEngine Engine is the database engine of the server. See DatabaseEngine for
the accepted values.		 Enum: [postgres]
host string Host is the host name or the address of the server. MinLength: 1
port integer Port is the port of the server. Maximum: 65535
Minimum: 1
adminCredentialsSecretRef LocalCredentialsSecretRef AdminCredentialsSecretRef names an admin user that can create databases
and roles. The operator uses it to probe the server and to create the
database and the roles of a Database. The Secret is in the namespace of
this contract.
pitr PITRCapability PITR declares the point-in-time recovery capability of the server. Optional: {}
recovery RecoveryRequest Recovery asks for a rollback of the server to a point in time. A
consumer writes it. The answer is in pitr.lastRecovery, only when
pitr.recovery is operator. The request stays on the contract after the
answer, as the record of the last request.		 Optional: {}

DatabaseServerConfigStatus

DatabaseServerConfigStatus is the observed validation state of the contract. It holds what the operator read from the server the last time that it reached the server.

Appears in: - DatabaseServerConfig

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
serverVersion string ServerVersion is the major version that the server reported the last
time that the operator reached it, for example "17". A dump of a
database on this server uses client tools of this major version. Thus
a backup waits until the operator publishes it.		 Optional: {}
systemIdentifier string SystemIdentifier is the identity of the PostgreSQL instance behind this
endpoint, as the server reported it on the last probe. It identifies
the server itself. Thus two contracts that describe one server with
different hosts publish the same value. The operator uses it to keep
each logical database unique. A change to the endpoint or to
adminCredentialsSecretRef clears it.		 Optional: {}
probedAt Time ProbedAt is when the operator last reached the server and read
ServerVersion and SystemIdentifier. The operator probes the server
again when this is older than the probe interval, or when the admin
credentials Secret changed. Between probes, it does not change.
A change to the endpoint or to adminCredentialsSecretRef clears this
field, and also ServerVersion, SystemIdentifier, ProbedEndpoint,
ProbedSecretName, ProbedSecretKeys, and ProbedSecretVersion. These
fields describe the server of the old spec. A change to another field,
for example a recovery request, does not clear them, because it cannot
move the server.		 Optional: {}
probedEndpoint string ProbedEndpoint is the host and the port that the last probe reached, as
"<host>:<port>". With it, the operator knows whether a spec change
moves the server.		 Optional: {}
probedSecretName string ProbedSecretName is the admin credentials Secret that the last probe
read. When the spec names another Secret, the operator clears the
record of the probe.		 Optional: {}
probedSecretKeys string ProbedSecretKeys are the keys of that Secret that the last probe read,
as "<usernameKey>/<passwordKey>". One Secret can hold the credentials
of more than one user, so the keys identify the user.		 Optional: {}
probedSecretVersion string ProbedSecretVersion is the resourceVersion of the admin credentials
Secret that the last probe used. When the Secret changes, the operator
probes again before the interval ends, so it validates new credentials
quickly.		 Optional: {}
conditions Condition array Conditions represent the current validation state. The Ready condition
has the reasons Healthy, MissingSecret, or ConnectionFailed.		 Optional: {}

DatabaseServerMonitoringSpec

DatabaseServerMonitoringSpec groups the Prometheus scraping integration of a database server.

Appears in: - DatabaseServerSpec

Field Description Default Validation
podMonitor PodMonitorSpec PodMonitor configures the Prometheus PodMonitor over the instance pods. Optional: {}

DatabaseServerPreset

DatabaseServerPreset is a cluster-scoped baseline configuration for DatabaseServer resources. It has no controller, creates nothing, and reports no status. A server reads it through its presetRef. A field set on the server replaces the value of the preset for that field completely.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string DatabaseServerPreset
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec DatabaseServerPresetSpec spec defines the desired state of DatabaseServerPreset Required: {}

DatabaseServerPresetSpec

DatabaseServerPresetSpec defines the desired state of DatabaseServerPreset.

Appears in: - DatabaseServerPreset

Field Description Default Validation
server DatabaseServerSpec Server is the complete configuration baseline that the servers that
reference the preset get. It uses the DatabaseServer spec type. A
preset must not set the fields that belong to one server only:
presetRef, releaseRef, databaseServerConfig, and suspend. It must also
not set the version, which belongs to a CamundaRelease. An explicit
zero value, such as an empty presetRef or suspend: false, counts as
unset. Templated YAML often renders unset fields in this way. A preset
can set archive like any other field. One bucket can serve many
servers, because every server writes under its own prefix.		 Required: {}

DatabaseServerRecoveryStatus

DatabaseServerRecoveryStatus is the recovery request that the server works on now, or the last one that it answered. With it, a recovery can continue after an interruption.

It holds the whole answer, not a reference to it. The server publishes the answer on a contract. If somebody deletes the contract and creates it again, the server publishes the answer again from this status.

Appears in: - DatabaseServerStatus

Field Description Default Validation
requestID string RequestID is the requestID of the request, as the contract carries it.
contract string Contract is the DatabaseServerConfig that carried the request. The
server answers on that contract. Until it answers, it does not change
the contract that it publishes.
requestedBy string RequestedBy is the requestedBy of the request, as the contract carries
it.
targetTime string TargetTime is the targetTime of the request, as the contract carries it.
cluster string Cluster is the CloudNativePG cluster that the recovery builds. It is
empty for a request that the server refused, also when the server had
built a cluster before.		 Optional: {}
previousCluster string PreviousCluster is the cluster that the contract pointed at before the
recovery moved it. If a recovery fails after the move, the contract
points at this cluster again, because it still holds the data.		 Optional: {}
archive RecoveryArchiveRef Archive is the archive that the recovery reads. The server records it
before the recovery builds anything. A spec change to another bucket
does not move a recovery that is already running.		 Optional: {}
result RecoveryResult Result is the result that the server published for the request. It is
unset while the recovery runs.		 Enum: [Completed Failed Unavailable]
Optional: {}
message string Message is the message that the server published with Result. Optional: {}
completedAt Time CompletedAt is when the server answered the request. It is unset while
the recovery runs.		 Optional: {}

DatabaseServerServiceAccountSpec

DatabaseServerServiceAccountSpec configures the ServiceAccount of the instance pods. The operator creates it with the name <server name>-postgres. Every CloudNativePG cluster of the server runs under it, also the cluster that a rollback builds. The operator adds the workload-identity annotations of the archive bucket. An annotation set here wins over the operator annotation with the same key.

Appears in: - DatabaseServerSpec

Field Description Default Validation
annotations object (keys:string, values:string) Annotations to set on the ServiceAccount. Usually these are
workload-identity annotations (IRSA, GCP Workload Identity, and more)
that give the instance pods access to cloud resources.		 Optional: {}

DatabaseServerSpec

DatabaseServerSpec defines the desired state of DatabaseServer.

A DatabaseServerPreset uses the same type as its baseline. For this reason, the schema marks databaseServerConfig as optional, and the DatabaseServer requires it. A preset refuses the fields that belong to one server only. A preset also refuses the version, which belongs to a CamundaRelease.

Appears in: - DatabaseServer - DatabaseServerPresetSpec

Field Description Default Validation
presetRef string PresetRef names a cluster-scoped DatabaseServerPreset to use as the
configuration baseline. A field set on the server replaces the value of
the preset for that field completely.		 Optional: {}
releaseRef string ReleaseRef names a cluster-scoped CamundaRelease that provides the
PostgreSQL major version. It merges over the preset and under this spec.
Forbidden in a preset.		 Optional: {}
platformConfigRef string PlatformConfigRef names a cluster-scoped CamundaPlatformConfig. The
server reads only its image settings. spec.images.postgres sets where
the server pulls the PostgreSQL image from, for example in an air-gapped
cluster. When empty, the server uses the default image repository.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Optional: {}
version string Version is the PostgreSQL major version to run, as a number such as
"17". It selects the image tag. Camunda 8.9 supports PostgreSQL 14 and
later. The operator refuses a version below 14, also when it comes
from the release. Required unless the resolved release provides it.
Forbidden in a preset.
The major version of a running server cannot change. The operator
refuses another major version, higher or lower, with Ready reason
VersionChangeRefused. The server then keeps the major version it has.
The same applies to a new major version from a release. To run another
major version, create a new server and move the data to it.		 Pattern: ^\d+$
Optional: {}
instances integer Instances is the number of PostgreSQL instances. Defaults to 1. One
instance has no failover. If its node goes away, the server is down
until the volume is attached again.		 Minimum: 1
Optional: {}
resources ResourceRequirements Resources are the CPU and memory of each instance. Optional: {}
storageSize Quantity StorageSize is the size of the data volume of each instance. Required
unless the resolved preset provides it. It cannot shrink, because a
PostgreSQL data volume cannot become smaller in place. The API server
refuses a change of this field in a DatabaseServer to a smaller value.
A smaller value is accepted when the field was not set before, or when
a preset lowers the size. A server whose volumes are already larger
then keeps that size and records a StorageShrinkIgnored event.		 Optional: {}
storageClassName string StorageClassName is the StorageClass of the data volumes. Defaults to
the default StorageClass of the Kubernetes cluster.		 Optional: {}
walStorageSize Quantity WALStorageSize puts the write-ahead log on a separate volume of this
size. When unset, the log stays on the data volume. It cannot shrink,
as storageSize cannot. The server ignores a smaller value from a preset
in the same way.
You can add it to a running server, but you cannot remove it again.
CloudNativePG refuses a cluster that removes the volume. If the field
is cleared, on the server or in a preset, the volume keeps its size and
the server records a WALStorageKept event.		 Optional: {}
serviceAccount DatabaseServerServiceAccountSpec ServiceAccount configures the ServiceAccount of the instance pods. Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the instance pods. When
set, it replaces the scheduling block of the preset, with no merge.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels applied to the instance pods. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations applied to the instance pods. Optional: {}
monitoring DatabaseServerMonitoringSpec Monitoring configures the Prometheus scraping integration. Optional: {}
databaseServerConfig string DatabaseServerConfig names the DatabaseServerConfig that the operator
publishes in the namespace of this server. It holds the endpoint, the
admin credentials, and the point-in-time recovery capability of the
server. Required on a DatabaseServer, forbidden in a preset.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Optional: {}
archive DatabaseServerArchiveSpec Archive points the server at the bucket that holds its continuous
archive. Without it the server takes no part in point-in-time restore.		 Optional: {}
suspend boolean Suspend stops the PostgreSQL instances and keeps their data volumes.
Defaults to false. The operator hibernates the CloudNativePG cluster:
it removes the instance pods and keeps the volumes. When you set the
field back to false, the instances start again on the same volumes.		 Optional: {}

DatabaseServerStatus

DatabaseServerStatus is the observed state of a DatabaseServer.

Appears in: - DatabaseServer

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
version string Version is the PostgreSQL major version that the server runs, as a
number such as "17". It comes from the merged spec, so it is correct
when the release or the server gives the version. While
the operator refuses a version change, it shows the major version of the
data directory. It is empty until the operator resolves the references
of the server for the first time.		 Optional: {}
cluster string Cluster is the CloudNativePG cluster that the published contract points
at. It is the name of the server until a recovery replaces it.		 Optional: {}
systemIdentifier string SystemIdentifier is the identity of the PostgreSQL instance behind the
contract, as CloudNativePG reports it. A recovery restores the
pg_control of its base backup, so the recovered instance keeps the
identity and this value does not change. A recovery replaces the
endpoint of the contract.		 Optional: {}
archive DatabaseServerArchiveStatus Archive is the observed state of the continuous archive of the server.
It is unset until the server writes an archive. A removal of
spec.archive does not clear it. The bucket still holds what the server
wrote, and a server that archives again can recover from it.		 Optional: {}
recovery DatabaseServerRecoveryStatus Recovery is the recovery request that the server works on now, or the
last one it answered. The answer itself is published on the contract,
in spec.pitr.lastRecovery.		 Optional: {}
volumes VolumeStatus array Volumes lists the bound PersistentVolumeClaims of the current cluster
and the capacity that each one reports, sorted by name. A server with a
write-ahead log volume also shows that claim. A server that does not own
the cluster of its derived name shows no claims, because they belong
to the other cluster.		 Optional: {}
conditions Condition array Conditions represent the current state. Ready holds the reason of a
failed pre-check (InvalidReference, MissingSecret, CNPGNotInstalled,
BarmanPluginNotInstalled). Otherwise it follows the cluster, the
contract, and, when the server has an archive, the archive. The
per-component conditions (ClusterReady, ArchiveReady, ContractReady,
MonitoringReady) also appear here. MonitoringReady never affects Ready,
so a broken PodMonitor does not make the server not ready. ArchiveReady
without spec.archive does not affect Ready either.		 Optional: {}

DatabaseSpec

DatabaseSpec defines the desired state of Database.

Appears in: - Database

Field Description Default Validation
serverRef string ServerRef names the DatabaseServerConfig, in this namespace, of the
server on which the operator creates the database.		 MinLength: 1
databaseName string DatabaseName is the name of the logical database to create, as a valid
PostgreSQL identifier. It must be unique on each PostgreSQL instance
that a contract reaches, not only on each contract. The operator
refuses a Database with the same databaseName as a Database of any
namespace on the same instance.		 Pattern: ^[a-z_][a-z0-9_]\{0,62\}$
applicationCredentials CredentialsSpec ApplicationCredentials configures the application credentials Secret.
The operator always creates it. The Secret name defaults to
<CR name>-credentials.		 Optional: {}
backupCredentials BackupCredentialsSpec BackupCredentials configures the backup credentials Secret. The
operator creates it unless it is disabled. The Secret name defaults to
<CR name>-backup-credentials.		 Optional: {}
databaseConfig string DatabaseConfig names the DatabaseConfig that the operator creates in
the namespace of this Database. Defaults to the CR name.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Optional: {}
secondaryStorageConfig string SecondaryStorageConfig, when set, makes the operator also create a
SecondaryStorageConfig of type rdbms with this name in the namespace of
this Database. It references the DatabaseConfig. Omit it for a database
that is not Camunda secondary storage (Keycloak, Identity, Web
Modeler).		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Optional: {}

DatabaseStatus

DatabaseStatus is the observed state of a Database.

Appears in: - Database

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
collisionKey string CollisionKey is the logical database that this Database last resolved:
the system identifier of the server and the database name. Every
Database records it, also a Database that loses the name to another.
Thus the field shows what a Database asked for, not what it owns. The
operator sets it only after it reaches the server. If the spec names a
missing server, the old key stays until that server answers. The same
applies to a server that is not probed for the current spec.
A Database whose Ready condition reports InvalidReference and names
another Database does not own the name that it shows here. The
operator never clears the field. Thus an owner whose server or
contract is gone keeps the logical database. Delete that Database to
release the name.		 Optional: {}
conditions Condition array Conditions represent the current state. Ready holds the reason of a
failed pre-check (InvalidReference, MissingSecret,
ServerIdentityUnknown, ConnectionFailed). Otherwise it takes the status
and the reason of the BindingsReady condition, which also appears here.		 Optional: {}

DumpPodSpec

DumpPodSpec configures the pod of the Job that dumps the logical database of a relational cluster and uploads it to the backup bucket. It holds all the settings that a backup can set for one run. The pod runs the dump and then the upload, so one resource block sizes both. It never names the image. BackupDumpSpec gives the reason.

Appears in: - BackupDumpSpec - LogicalBackupRDBMSSpec

Field Description Default Validation
resources ResourceRequirements Resources are the CPU and memory of the dump pod. Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of the dump pod.
In the spec.dump of a LogicalBackupRDBMS, every name that starts with
PG or UPLOAD_ is reserved, and the API server refuses it. A PG* name is
connection policy, because libpq reads PGHOSTADDR, PGSERVICE,
PGOPTIONS, and more. UPLOAD_* is the upload contract. The variables of
a backup reach only the dump container, never the upload container.
Cloud SDKs read endpoint, proxy, and configuration variables from the
environment, and the author of a backup must not change where the dump
goes.
In the spec.backup.dump of the cluster, no name is reserved, and the
variables reach every container. The cluster owner sets the connection
policy, PGSSLMODE included.
Unlike the extraEnv of a workload, this list is atomic. One field
manager owns the whole list, because no extension adds entries to a
dump pod.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources of the dump pod. In the
spec.dump of a LogicalBackupRDBMS, every source needs a prefix that
cannot make a PG* or UPLOAD_* name. The writer of the referenced object
chooses its keys. As with ExtraEnv, the sources of a
backup reach only the dump container. The block of the cluster needs no
prefix, and its sources reach every container.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels of the dump pod. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations of the dump pod. A service mesh
sidecar keeps running after the dump finishes, and the Job does not
complete. Set the injection annotation of the mesh to false here.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the dump pod. When set,
it replaces the block of a preset, with no merge.		 Optional: {}
scratchVolume ScratchVolumeSpec ScratchVolume is where the pod writes the dump before the upload. When
set, it replaces the block of a preset, with no merge. The dump pod
runs with fsGroup 999, the postgres group. Thus pg_dump can write to a
volume that a storage class gives with the root owner.		 Optional: {}
activeDeadlineSeconds integer ActiveDeadlineSeconds is the number of seconds that the dump Job can
run before it fails, counted from its start. When the dump block that
applies does not set it, the Job gets 86400 (24 hours). In the block of
the cluster, an unset value takes the value of the preset. The
spec.dump of a LogicalBackupRDBMS replaces the block of the cluster, so
an unset value there gives 86400, not the value of the cluster.
The default is large, so that a very large dump can complete. The Job
always has a deadline. A pod that cannot start uses no retry, so
without a deadline a broken Job stays active for the life of the
backup. A lower value fails a stuck dump sooner. A higher value gives a
long dump the time that it needs.		 Minimum: 1
Optional: {}

ElasticsearchCluster

ElasticsearchCluster runs an Elasticsearch cluster for secondary storage, through the external ECK operator. It publishes the connection details and generated credentials as a SecondaryStorageConfig.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string ElasticsearchCluster
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec ElasticsearchClusterSpec spec defines the desired state of ElasticsearchCluster Required: {}
status ElasticsearchClusterStatus status defines the observed state of ElasticsearchCluster Optional: {}

ElasticsearchClusterPreset

ElasticsearchClusterPreset is a cluster-scoped baseline configuration for ElasticsearchCluster resources. It has no controller, creates nothing, and reports no status. A cluster reads it through its presetRef. A field set on the cluster replaces the value of the preset for that field completely.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string ElasticsearchClusterPreset
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec ElasticsearchClusterPresetSpec spec defines the desired state of ElasticsearchClusterPreset Required: {}

ElasticsearchClusterPresetSpec

ElasticsearchClusterPresetSpec defines the desired state of ElasticsearchClusterPreset.

Appears in: - ElasticsearchClusterPreset

Field Description Default Validation
cluster ElasticsearchClusterSpec Cluster is the complete configuration baseline that the clusters that
reference the preset get. It uses the ElasticsearchCluster spec type. A
preset must not set the fields that belong to one cluster only:
presetRef, releaseRef, secondaryStorageConfig, and suspend. It must
also not set the version, which belongs to a CamundaRelease. An explicit
zero value, such as an empty presetRef or suspend: false, counts as
unset. Templated YAML often renders unset fields in this way. A preset
can set monitoring like any other field. Thus it can enable scraping
and set the exporter image and resources for every cluster that
references it.		 Required: {}

ElasticsearchClusterSpec

ElasticsearchClusterSpec defines the desired state of ElasticsearchCluster.

An ElasticsearchClusterPreset uses the same type as its baseline. For this reason, the schema marks secondaryStorageConfig as optional, and the ElasticsearchCluster requires it. A preset refuses the fields that belong to one cluster only. A preset also refuses the version, which belongs to a CamundaRelease.

Appears in: - ElasticsearchCluster - ElasticsearchClusterPresetSpec

Field Description Default Validation
presetRef string PresetRef names a cluster-scoped ElasticsearchClusterPreset to use as
the configuration baseline. A field set on the cluster replaces the
value of the preset for that field completely.		 Optional: {}
releaseRef string ReleaseRef names a cluster-scoped CamundaRelease that provides the
Elasticsearch version. It merges over the preset and under this spec.
Forbidden in a preset.		 Optional: {}
version string Version is the Elasticsearch version to deploy, as a full semantic
version. Camunda 8.9 supports Elasticsearch 8.x from 8.19, and 9.x from
9.2. The operator refuses a version below 8.19, and 9.0 and 9.1, also
when it comes from the release, with Ready reason InvalidReference. Required unless the
resolved release provides it. Forbidden in a preset.		 Pattern: ^\d+\.\d+\.\d+$
Optional: {}
replicas integer Replicas is the number of Elasticsearch nodes. Required unless the
resolved preset provides it.		 Minimum: 1
Optional: {}
resources ResourceRequirements Resources are the CPU and memory for each Elasticsearch node. Optional: {}
storageSize Quantity StorageSize is the size of the data volume of each node. Required
unless the resolved preset provides it. It cannot shrink, because an
Elasticsearch data volume cannot become smaller in place. The API
server refuses a change of this field in an ElasticsearchCluster to a
smaller value. A smaller value is accepted when the field was not set
before, or when a preset lowers the size. A cluster whose volumes are
already larger then keeps that size and records a StorageShrinkIgnored
event.		 Optional: {}
storageClassName string StorageClassName is the StorageClass of the data volumes. Defaults to
the default StorageClass of the Kubernetes cluster. The class cannot
change after the ECK Elasticsearch resource exists. A cluster whose ECK
resource exists keeps its class and records a
StorageClassChangeIgnored event. A cluster without an ECK resource
takes the new class, also a suspended cluster when it resumes. Volumes
that a suspension or whenDeleted Retain kept keep their class.		 Optional: {}
serviceAccount ServiceAccountSpec ServiceAccount configures the ServiceAccount of the Elasticsearch pods.
When name is unset, the account is <name>-es. The pods need no account
while neither the cluster nor its preset sets this block and the
snapshot bucket uses no workload identity. The operator then deletes the
account only when the cluster owns it, because the operator created it
or took it over. An account of that name that you created stays.		 Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables for every Elasticsearch node. Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) for
every Elasticsearch node.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels applied to the Elasticsearch pods. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations applied to the Elasticsearch pods.
The key camunda.io/service-account-hash belongs to the operator, and a
value for it does not reach the pods.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the Elasticsearch pods.
When set, it replaces the scheduling block of the preset, with no merge.		 Optional: {}
snapshotStorageRef string SnapshotStorageRef names an ObjectStorageConfig, in the namespace of
this cluster, for the bucket of the snapshot repository of this
cluster. When it is set, the operator does all the Elasticsearch work
for that bucket. It gives the nodes their credentials, registers the
repository, and publishes the repository name in the
SecondaryStorageConfig. A CamundaCluster on this storage needs it for
backups. The CamundaCluster must reference the same bucket.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Optional: {}
secureSettings SecureSettingsSource array SecureSettings are Secrets that ECK loads into the keystore of every
node. The operator adds the credentials of snapshotStorageRef to the
keystore itself. Use this field for all other keystore entries.		 Optional: {}
secondaryStorageConfig string SecondaryStorageConfig names the SecondaryStorageConfig that the
operator creates in the namespace of this cluster. It holds the
connection details and the generated credentials. Required on an
ElasticsearchCluster, forbidden in a preset.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Optional: {}
monitoring MonitoringSpec Monitoring configures the Prometheus scraping integration. Optional: {}
persistentVolumeClaimRetentionPolicy PersistentVolumeClaimRetentionPolicy PersistentVolumeClaimRetentionPolicy says what happens to the data
volumes when the ElasticsearchCluster is deleted. Suspension always
keeps them.		 Optional: {}
suspend boolean Suspend stops the Elasticsearch cluster and keeps its data volumes.
Defaults to false. The operator deletes the ECK Elasticsearch resource
and keeps the volumes. When you set the field back to false, the
operator creates the resource again, and ECK attaches the volumes
again.		 Optional: {}

ElasticsearchClusterStatus

ElasticsearchClusterStatus is the observed state of an ElasticsearchCluster.

Appears in: - ElasticsearchCluster

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
version string Version is the effective Elasticsearch version of the cluster, as a
full semantic version. It comes from the merged spec, so it is correct
when the release or the cluster gives the version. During
an upgrade, or when the operator cannot apply the change, the old
version can still run. It is empty
until the operator resolves the references of the cluster for the first
time.		 Optional: {}
volumes VolumeStatus array Volumes lists the bound data PersistentVolumeClaims of the cluster and
the capacity that each one reports, sorted by name.		 Optional: {}
snapshotRepository string SnapshotRepository is the snapshot repository that the operator
registered in Elasticsearch for this cluster. The published
SecondaryStorageConfig holds the same name. It is empty until the first
registration succeeds. It shows the last registration that succeeded,
not a new check that the repository still exists.		 Optional: {}
conditions Condition array Conditions represent the current state. Ready holds the reason of a
failed pre-check (InvalidReference, MissingSecret, ECKNotInstalled).
Otherwise it follows the component conditions and, when the cluster or
its preset sets snapshotStorageRef and the cluster is not suspended,
SnapshotRepositoryReady. The per-component conditions (CredentialsReady,
KeystoreReady, ElasticsearchReady, StorageContractReady) also appear
here.
MetricsReady reports the exporter and never affects Ready.		 Optional: {}

ElasticsearchStorage

ElasticsearchStorage holds Elasticsearch connection details.

Appears in: - SecondaryStorageConfigSpec

Field Description Default Validation
endpoint string Endpoint is the HTTP(S) endpoint of the Elasticsearch cluster.
credentialsSecretRef LocalCredentialsSecretRef CredentialsSecretRef names a basic-auth user with read and write
access to the Camunda indices.
caSecretRef LocalSecretKeyRef CASecretRef names the CA bundle that consumers use to verify the TLS
certificate of the endpoint. Set it when a well-known CA did not sign
the certificate of the endpoint. An example is the self-signed
certificate of a cluster that ECK runs. Omit it for an endpoint with a
publicly trusted certificate. It is valid only with an https endpoint.		 Optional: {}
snapshotRepository string SnapshotRepository names the snapshot repository in this Elasticsearch
cluster that backups write to. An ElasticsearchCluster with a
snapshotStorageRef registers the repository and sets this field in the
contract that it publishes. For an Elasticsearch cluster that this
operator does not manage, register the repository yourself and then
set this field. A cluster that takes backups needs it. Without it, the
backup components have no place to write. The name is part of a URL
path of the Elasticsearch API, so it permits only a small set of
characters.		 MaxLength: 253
Pattern: ^[a-zA-Z0-9][a-zA-Z0-9._-]*$
Optional: {}
nodeCount integer NodeCount is the number of data nodes of the Elasticsearch cluster. An
ElasticsearchCluster sets it in the contract that it publishes. For an
Elasticsearch cluster that this operator does not manage, set it
yourself.
A consumer that sets no index replica count of its own gets 0 replicas
on one node and 1 replica on two or more nodes. Without a node count,
the consumer keeps the default of the Camunda application.		 Minimum: 1
Optional: {}

Endpoint

Endpoint is one route that a resource needs: a path on the external URL and the Service and port that serve it.

Appears in: - CamundaClusterStatus - CamundaManagementClusterStatus - CamundaOptimizeStatus

Field Description Default Validation
name string Name identifies the route, for example operate or grpc.
service string Service is the name of a Service in the namespace of the resource.
port integer Port is the port of the Service.
pathPrefix string PathPrefix is the path that the route matches. It is empty for gRPC. Optional: {}
protocol EndpointProtocol Protocol is HTTP or GRPC. Enum: [HTTP GRPC]

EndpointProtocol

Underlying type: string

EndpointProtocol is the protocol of a route.

Validation: - Enum: [HTTP GRPC]

Appears in: - Endpoint

Field Description
HTTP EndpointProtocolHTTP is a route for HTTP traffic, matched by path prefix.
GRPC EndpointProtocolGRPC is a route for gRPC traffic. It has no path prefix.

ExporterSpec

ExporterSpec tunes the elasticsearch_exporter Deployment that ServiceMonitorSpec.Enabled deploys.

Appears in: - MonitoringSpec

Field Description Default Validation
image string Image overrides the exporter image. Defaults to the pinned
quay.io/prometheuscommunity/elasticsearch-exporter release of the
operator.		 Optional: {}
resources ResourceRequirements Resources are the CPU and memory of the exporter container. Optional: {}

ExternalKeycloakSpec

ExternalKeycloakSpec connects Management Identity to a Keycloak that you run.

Appears in: - IdentityProviderSpec - ManagementIdentityProvider

Field Description Default Validation
url string URL is the URL of Keycloak, with the /auth path when Keycloak has one.
Management Identity uses this URL, so it must resolve from inside the
Kubernetes cluster.
The operator appends /realms/<realm> to this URL, so the URL has no
query and no fragment. The URL is also in the annotations of the Lease
that claims the realm, so its length has a limit.
The URL has no user and no password. The operator does not support a
Keycloak behind a proxy that needs basic authentication.		 MaxLength: 2048
realm string Realm is the realm that Management Identity creates and uses. Empty
means camunda-platform. The realm is part of the issuer, the token, and
the JWKS URLs that Management Identity builds. Thus it holds only
letters, digits, dots, hyphens, and underscores, and its length has a
limit, as the URL has.		 MaxLength: 255
Optional: {}
adminCredentialsSecretRef LocalCredentialsSecretRef AdminCredentialsSecretRef names the Secret with the Keycloak
administrator credentials. Management Identity uses them to create the
realm, the clients, and the initial administrator.
caBundleSecretRef LocalSecretKeyRef CABundleSecretRef names the Secret key that holds the certificate
authority of Keycloak, in PEM form. The operator signs in to Keycloak to
register the login callbacks of Optimize. It then trusts this authority
and the trust store of its own image. Set it when a public authority did
not sign the certificate of Keycloak. It is valid only with an https
url.		 Optional: {}

GCSCredentials

GCSCredentials holds the static key of a GCS bucket.

Appears in: - GCSStorageAuth

Field Description Default Validation
secretRef LocalSecretKeyRef SecretRef names the Secret key that holds the service-account JSON
key.

GCSStorage

GCSStorage describes a Google Cloud Storage bucket.

Appears in: - ObjectStorageConfigSpec

Field Description Default Validation
bucketName string BucketName is the name of the bucket, as storage client SDKs use it. MinLength: 1
basePath string BasePath is the key prefix under which consumers write objects,
without leading or trailing slashes. Empty means the bucket root.		 Pattern: ^[^/]+(/[^/]+)*$
Optional: {}
auth GCSStorageAuth Auth selects how consumers authenticate. An absent block means
workload identity through the ServiceAccount.		 { type:workloadIdentity } Optional: {}

GCSStorageAuth

GCSStorageAuth selects how consumers authenticate against a GCS bucket.

Appears in: - GCSStorage

Field Description Default Validation
type ObjectStorageAuthType Type is the authentication choice. Defaults to workloadIdentity. workloadIdentity Enum: [workloadIdentity credentials]
Optional: {}
workloadIdentity GCSWorkloadIdentity WorkloadIdentity names the trusted principal. It is valid only with
type workloadIdentity. With an empty or absent block, the operator adds
no annotation. The identity must then be bound on the cloud side, for
example with Workload Identity Federation for GKE.		 Optional: {}
credentials GCSCredentials Credentials is a static service-account key. Required with type
credentials. Forbidden with other types.		 Optional: {}

GCSWorkloadIdentity

GCSWorkloadIdentity names the Google principal that the bucket trusts. With an empty block, the operator adds no annotation to the ServiceAccount of the consumer. The identity must then be bound on the cloud side, for example with Workload Identity Federation for GKE.

Appears in: - GCSStorageAuth

Field Description Default Validation
serviceAccountEmail string ServiceAccountEmail is the Google service account that consumers
impersonate. When set, the operator puts it in the
iam.gke.io/gcp-service-account annotation of a ServiceAccount that it
creates for the consumer. On an existing ServiceAccount, add the
annotation yourself.		 Optional: {}

GatewayBinding

GatewayBinding is the published in-cluster address of the client APIs of a cluster. A client library takes the gRPC address as a host and a port, and the REST address as a base URL. Each field holds the form that a client takes.

Appears in: - CamundaClusterStatus

Field Description Default Validation
grpcEndpoint string GRPCEndpoint is the host and the port of the gRPC API, for example
my-cluster-gateway.my-cluster-ns.svc:26500.
restEndpoint string RESTEndpoint is the base URL of the orchestration cluster REST API, for
example http://my-cluster-gateway.my-cluster-ns.svc:8080.

GatewaySpec

GatewaySpec configures the gateway.

Appears in: - CamundaClusterSpec

Field Description Default Validation
mode ComponentMode Mode selects a Deployment of the unified binary (Standalone) or the
embedded gateway of the brokers (Embedded). Defaults to Standalone.
The workload fields have an effect only in Standalone mode. The
exception is extraEnv and extraEnvFrom: in Embedded mode, they apply to
the brokers.		 Enum: [Standalone Embedded]
Optional: {}
replicas integer Replicas is the number of pods of this process. Defaults to 1. On a
CamundaCluster it has no effect on an embedded web application.		 Minimum: 0
Optional: {}
resources ResourceRequirements Resources are the CPU and memory of the container of this process. Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of the container of this
process. On a CamundaCluster, an entry here wins over a top-level entry
with the same name. The entries of an embedded web application apply to
its host process.
The list merges by name under server-side apply. Each field manager owns
only the entries that it applies, so an extension controller can add its
own entry next to yours. One applied manifest cannot hold two entries
with the same name.
Two field managers that apply the same name do not conflict, because the
merge is per field inside the entry. One manager can own value and the
other valueFrom. A container rejects an entry that has both, so the API
server refuses to store such an entry.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of the
container of this process.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels of the pods of this process. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations of the pods of this process. In a
CamundaCluster, the keys camunda.io/config-hash and
camunda.io/service-account-hash belong to the operator, and a value for
them does not reach the pods.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the pods of this process.
When set, it replaces all other scheduling blocks for this process, with
no merge. On a CamundaCluster, these are the top-level block and the
block of a preset.		 Optional: {}

IdentityAdminSpec

IdentityAdminSpec names the first administrator of the management plane. Management Identity reads it only on the first start and stores the result in its database.

In the oidc mode, the administrator is a claim of the tokens that the provider issues. Set claimName and claimValue. A later change of the claim shows ImmutableAfterStart. In the two Keycloak modes, the administrator is the first Keycloak user. Set username. A later change creates a second user, and the first user keeps its access.

Appears in: - IdentityOverrides - IdentitySpec

Field Description Default Validation
claimName string ClaimName is the token claim that identifies the administrator, for
example oid or sub. Set it in the oidc mode. The operator records the
claim as <claimName>=<claimValue> and splits it at the first equals
sign. Thus the name cannot hold an equals sign.		 MinLength: 1
Optional: {}
claimValue string ClaimValue is the value of the claim for the administrator.
Set it in the oidc mode.		 MinLength: 1
Optional: {}
username string Username is the name of the first Keycloak user. Set it in the keycloak
and the externalKeycloak modes. Management Identity creates the user on
its first start. A later change of this field creates a second user and
does not rename the first user.		 MinLength: 1
Optional: {}
passwordSecretRef LocalSecretKeyRef PasswordSecretRef names the Secret key that holds the password of the
first Keycloak user. The operator generates a password when this is
unset.		 Optional: {}
email string Email is the email address of the first Keycloak user. Web Modeler
needs an address for every person who signs in. Thus it is required
when webModeler is set in a Keycloak mode.		 MinLength: 3
Optional: {}

IdentityProviderSpec

IdentityProviderSpec holds one of the three identity provider modes.

Appears in: - CamundaManagementClusterSpec

Field Description Default Validation
keycloak ManagedKeycloakSpec Keycloak runs Keycloak through the Keycloak Operator. The Keycloak
Operator must be installed on the Kubernetes cluster.		 Optional: {}
externalKeycloak ExternalKeycloakSpec ExternalKeycloak connects Management Identity to a Keycloak that you
run. Management Identity still creates the realm, the clients, and the
initial administrator in it.		 Optional: {}
oidc ManagementOIDCSpec OIDC connects Management Identity to the identity provider of the
referenced CamundaPlatformConfig.		 Optional: {}

IdentitySpec

IdentitySpec configures Management Identity.

The operator owns the Keycloak URL and the realm of the container. Both come from spec.identityProvider, so the API server refuses an extraEnv entry for KEYCLOAK_URL or KEYCLOAK_REALM. In a Keycloak mode, this management plane claims the realm that they name. With an override, Management Identity writes the login callbacks of Optimize to another realm. status.callbackRealm does not name that realm, the operator does not remove the callbacks from it, and another management plane can hold it.

Appears in: - CamundaManagementClusterSpec

Field Description Default Validation
version string Version is the Management Identity version, as a full semantic version.
The operator supports 8.9.0 and later.		 Pattern: ^\d+\.\d+\.\d+$
externalUrl string ExternalURL is the URL where browsers reach Management Identity.
Identity registers it as the redirect URI of its own client. Identity
serves under the path of this URL, so it can share one host with
Keycloak, Console, and Web Modeler. A URL with a path other than "/"
must use https, because Camunda requires https for Identity under a
path.
databaseConfigRef string DatabaseConfigRef names the DatabaseConfig of the Management Identity
database, in the namespace of this resource. Identity needs its own
PostgreSQL database.		 MinLength: 1
serviceAccount ServiceAccountSpec ServiceAccount gives the Management Identity pods a ServiceAccount of their own.
When unset, they run under spec.serviceAccount. When set, they run
under <name>-identity, or under name, and they do not get the access that a
plugin grants to the account of spec.serviceAccount. The name default
needs create false.		 Optional: {}
admin IdentityAdminSpec Admin names the first administrator of the management plane.
replicas integer Replicas is the number of pods of this process. Defaults to 1. On a
CamundaCluster it has no effect on an embedded web application.		 Minimum: 0
Optional: {}
resources ResourceRequirements Resources are the CPU and memory of the container of this process. Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of the container of this
process. On a CamundaCluster, an entry here wins over a top-level entry
with the same name. The entries of an embedded web application apply to
its host process.
The list merges by name under server-side apply. Each field manager owns
only the entries that it applies, so an extension controller can add its
own entry next to yours. One applied manifest cannot hold two entries
with the same name.
Two field managers that apply the same name do not conflict, because the
merge is per field inside the entry. One manager can own value and the
other valueFrom. A container rejects an entry that has both, so the API
server refuses to store such an entry.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of the
container of this process.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels of the pods of this process. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations of the pods of this process. In a
CamundaCluster, the keys camunda.io/config-hash and
camunda.io/service-account-hash belong to the operator, and a value for
them does not reach the pods.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the pods of this process.
When set, it replaces all other scheduling blocks for this process, with
no merge. On a CamundaCluster, these are the top-level block and the
block of a preset.		 Optional: {}

ImagesSpec

ImagesSpec changes the repositories of the container images that the operator pulls. Each field holds a repository without a tag or a digest, for example mirror.example.com/camunda/optimize. The version of the component gives the tag. A repository name is lowercase, as the container registries require. An unset field means the default repository of that image.

Appears in: - CamundaPlatformConfigSpec

Field Description Default Validation
camunda string Camunda is the image of the orchestration cluster processes. Defaults
to camunda/camunda.		 Pattern: ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[0-9]+(/[a-z0-9]+([._-][a-z0-9]+)*)+\|(/[a-z0-9]+([._-][a-z0-9]+)*)*)/?$
Optional: {}
connectors string Connectors is the image of the connectors runtime. Defaults to
camunda/connectors-bundle.		 Pattern: ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[0-9]+(/[a-z0-9]+([._-][a-z0-9]+)*)+\|(/[a-z0-9]+([._-][a-z0-9]+)*)*)/?$
Optional: {}
optimize string Optimize is the image of Optimize. Defaults to camunda/optimize. Pattern: ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[0-9]+(/[a-z0-9]+([._-][a-z0-9]+)*)+\|(/[a-z0-9]+([._-][a-z0-9]+)*)*)/?$
Optional: {}
identity string Identity is the image of Management Identity. Defaults to
camunda/identity.		 Pattern: ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[0-9]+(/[a-z0-9]+([._-][a-z0-9]+)*)+\|(/[a-z0-9]+([._-][a-z0-9]+)*)*)/?$
Optional: {}
console string Console is the image of Console. Defaults to camunda/console. Pattern: ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[0-9]+(/[a-z0-9]+([._-][a-z0-9]+)*)+\|(/[a-z0-9]+([._-][a-z0-9]+)*)*)/?$
Optional: {}
webModelerRestapi string WebModelerRestapi is the image of the Web Modeler restapi process.
Defaults to camunda/web-modeler-restapi below 8.10, and to camunda/hub
from 8.10 on.		 Pattern: ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[0-9]+(/[a-z0-9]+([._-][a-z0-9]+)*)+\|(/[a-z0-9]+([._-][a-z0-9]+)*)*)/?$
Optional: {}
webModelerWebsockets string WebModelerWebsockets is the image of the Web Modeler websockets
process. Defaults to camunda/web-modeler-websockets below 8.10, and to
camunda/hub-websockets from 8.10 on.		 Pattern: ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[0-9]+(/[a-z0-9]+([._-][a-z0-9]+)*)+\|(/[a-z0-9]+([._-][a-z0-9]+)*)*)/?$
Optional: {}
keycloak string Keycloak is the image of the Keycloak that the operator runs. Defaults
to camunda/keycloak.		 Pattern: ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[0-9]+(/[a-z0-9]+([._-][a-z0-9]+)*)+\|(/[a-z0-9]+([._-][a-z0-9]+)*)*)/?$
Optional: {}
postgres string Postgres is the image of the PostgreSQL that a DatabaseServer runs.
Defaults to ghcr.io/cloudnative-pg/postgresql. The tag is the major
version of the server, so a replacement must publish the same tags.		 Pattern: ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[0-9]+(/[a-z0-9]+([._-][a-z0-9]+)*)+\|(/[a-z0-9]+([._-][a-z0-9]+)*)*)/?$
Optional: {}

KeycloakRealmTarget

KeycloakRealmTarget is one Keycloak realm and how the operator signs in to it. Two targets name the same realm when their url and their realm are equal. Their administrators and certificate authorities can differ.

Appears in: - CamundaManagementClusterStatus

Field Description Default Validation
url string URL is the URL of Keycloak that the operator uses, with the /auth path
when Keycloak has one.
realm string Realm is the Keycloak realm.
adminCredentialsSecretRef LocalCredentialsSecretRef AdminCredentialsSecretRef names the Secret with the Keycloak
administrator that the operator signs in with, in the namespace of this
resource.
caBundleSecretRef LocalSecretKeyRef CABundleSecretRef names the Secret key with the certificate authority of
Keycloak, in the namespace of this resource. It is absent when a public
authority signed the certificate of Keycloak.		 Optional: {}

LocalCredentialsSecretRef

LocalCredentialsSecretRef references a username and password pair in a Secret in the namespace of the object that holds the reference. Every namespaced kind uses it, so a reference never reaches the credentials of another namespace.

Appears in: - DatabaseConfigSpec - DatabaseServerConfigSpec - ElasticsearchStorage - ExternalKeycloakSpec - KeycloakRealmTarget - ManagementAuth - WebModelerMailSpec

Field Description Default Validation
name string Name is the name of the Secret that holds the credentials. MinLength: 1
usernameKey string UsernameKey is the key in the Secret that holds the plaintext username. username MinLength: 1
Optional: {}
passwordKey string PasswordKey is the key in the Secret that holds the plaintext password. password MinLength: 1
Optional: {}

LocalSecretKeyRef

LocalSecretKeyRef references one value in a Secret in the namespace of the object that holds the reference. Every namespaced kind uses it, so a reference never reaches the Secrets of another namespace.

Appears in: - AzureBlobCredentials - ClusterAuthSpec - ElasticsearchStorage - ExternalKeycloakSpec - GCSCredentials - IdentityAdminSpec - KeycloakRealmTarget

Field Description Default Validation
name string Name is the name of the Secret that holds the value. MinLength: 1
key string Key is the key in the Secret that holds the value. MinLength: 1

LogicalBackupElasticsearch

LogicalBackupElasticsearch is one backup of a CamundaCluster with Elasticsearch secondary storage. The backup is one set under one backup ID: the web-application indices, the exported Zeebe record indices, and the Zeebe partitions. The cluster continues to run during the backup, with exporting soft-paused. A restore reads a completed backup by its backup ID and its recorded snapshot names.

When you delete the resource, the operator tries to delete the stored backup data. The deletion waits while the cluster publishes no management binding, for example while it is suspended. It also waits while the pinned bucket points elsewhere. The operator removes the resource and can leave the data when the cluster is gone or was created again. The same applies when the pinned bucket is gone. It also applies when the management client cannot be built and the backup holds no pause of exporting.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string LogicalBackupElasticsearch
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec LogicalBackupElasticsearchSpec spec identifies the cluster to back up. It is immutable. A backup runs
one time. To try again, create a new resource.		 Required: {}
status LogicalBackupElasticsearchStatus status defines the observed state of the backup Optional: {}

LogicalBackupElasticsearchSpec

LogicalBackupElasticsearchSpec identifies the cluster to back up. The whole spec is immutable. A backup runs one time. To try again, create a new resource.

Appears in: - LogicalBackupElasticsearch

Field Description Default Validation
clusterRef ClusterRef ClusterRef references the CamundaCluster to back up, in the namespace
of this backup. Its secondary storage must be Elasticsearch.		 Required: {}

LogicalBackupElasticsearchStatus

LogicalBackupElasticsearchStatus is the progress of the backup to a final phase.

Appears in: - LogicalBackupElasticsearch

Field Description Default Validation
phase LogicalBackupPhase Phase is the phase of the backup. Completed and Failed are final. Enum: [Pending Running Completed Failed]
Optional: {}
step LogicalBackupElasticsearchStep Step is the current step of the backup. After an interruption, the
backup continues at this step.		 Enum: [PauseExporting BackupHistory SnapshotRecords BackupRuntime ResumeExporting]
Optional: {}
backupId integer BackupID identifies every part of the backup set: the web-application
snapshots, the record snapshot, and the partition backup. A restore
finds the set by this ID.		 Optional: {}
partitionsCount integer PartitionsCount is the partition count of the cluster when the backup
started. A restore must match it.		 Optional: {}
storageSizes LogicalBackupStorageSizes StorageSizes are the effective restore sizes. The operator computes
them when the backup starts. If a value is not available then, the
operator adds it later while exporting runs: before the pause, or after
the resume. It does not add a value while exporting is paused. Thus an
absent value can still appear later in the backup.		 Optional: {}
history BackupPart History is the backup of the web-application indices. Optional: {}
records BackupPart Records is the snapshot of the exported Zeebe record indices. Optional: {}
runtime BackupPart Runtime is the backup of the Zeebe partitions. Optional: {}
historySnapshots string array HistorySnapshots names the Elasticsearch snapshots of the
web-application indices. The operator records the names as soon as the
management API gives them. Thus the deletion of the backup and a
restore can find the snapshots after the cluster is gone.		 Optional: {}
repository string Repository records the snapshot repository of every part of the set.
The operator records it when the backup starts, and every later step
and the deletion use this name. Thus the whole set goes to one
repository, also when the storage contract changes its repository
during the backup. The deletion also goes to the correct repository.		 Optional: {}
storage PinnedStorage Storage records the Elasticsearch destination of the set: the storage
contract and its endpoint when the backup started. The repository name
alone does not identify a cluster. If the storage contract or the
endpoint changes during the backup, the step fails. The deletion never
runs against another cluster.		 Optional: {}
workloadConfigHash string WorkloadConfigHash records the configuration of Zeebe when the backup
started. It is the config hash of the Zeebe pod template. The backup
starts only after the cluster runs its current spec. Zeebe must also
run the Elasticsearch endpoint, the snapshot repository, and the bucket
that the contracts of the cluster declare. Until the runtime backup is final, each step compares
the current hash with this value, after it reads the state of its part.
If the hash differs, the step fails at once. The generation of the cluster is not sufficient, because
a change of a referenced object changes the hash but not the generation.		 Optional: {}
clusterUID string ClusterUID records the identity of the CamundaCluster of the backup. A
cluster that is deleted and created again with the same name is
another cluster. This backup never paused the exporting of the new
cluster. Every management call after the start compares the cluster
with this UID. If they differ, the backup ends and does not change the
new cluster.		 Optional: {}
version string Version is the Camunda version of the cluster when the backup started,
as the management binding reported it. A restore compares it with the
version of its target. An Elasticsearch backup restores only to the
same version. A restore can read the version only here, because a
suspended cluster has no management binding. The backup starts only
when Zeebe runs this version. If a step finds Zeebe on another version
before the runtime backup is final, the step fails at once with both
versions in the message.		 Optional: {}
historyRequestedTime Time HistoryRequestedTime is when the operator decided to request the
backup of the web-application indices. The operator writes it before
it sends the request, so the decision stays after a lost response or a
restart. It shows that this backup intended to send the request. It
does not prove that a history backup with this ID belongs to this
backup.		 Optional: {}
historyAcceptedTime Time HistoryAcceptedTime is when the cluster accepted the history backup
request of this backup. Only this field shows that the history backup
with this ID belongs to this backup. If such a history backup exists
without this field, the step fails, and the operator does not delete
its snapshots. A crash between the request and the write of this field
fails the backup. The cluster can then keep a history backup with this
ID, which you remove manually.		 Optional: {}
runtimeRequestedTime Time RuntimeRequestedTime is when the operator decided to request the
runtime backup. The operator writes it before it sends the request, so
the decision stays after a lost response or a restart. It shows that
this backup intended to send the request. It does not prove that a
runtime backup with this ID belongs to this backup.		 Optional: {}
runtimeAcceptedTime Time RuntimeAcceptedTime is when the cluster accepted the runtime backup
request of this backup. Only this field shows that the runtime backup
with this ID belongs to this backup. A runtime backup can exist without
this field, after a lost response or when another client used the ID
first. Then the step fails, and the operator does not delete that
runtime backup. A crash between the request and the write of this
field fails the backup. The cluster can then keep such a runtime
backup, which you remove manually.
The cluster registers the backup some time after it accepts it. For a
short grace period after this time, the operator waits for an absent
backup. After the grace period, an absent backup fails the step.		 Optional: {}
unreachableSince Time UnreachableSince is when a step first failed to reach its endpoint:
the management API or Elasticsearch. Exporting can be paused during
every step, so the retries have a time limit. After the limit, the step
fails, and the backup resumes exporting. The field clears when all
calls succeed again.		 Optional: {}
failureMessage string FailureMessage names the failed step and its error. The operator
records it when a step fails and exporting must still resume. Thus the
final condition shows the reason after the resume.		 Optional: {}
resumeStartedTime Time ResumeStartedTime is the start of the resume deadline. Only the time
of active resume attempts counts against the deadline. A time in which
the backup waits, for example for a suspended cluster or an
unpublished binding, moves the start forward and does not count. The
value stays after a restart of the operator.		 Optional: {}
lastResumeAttemptTime Time LastResumeAttemptTime is when the last resume attempt ended. The time
from it to the start of the next attempt decides whether the start of
the deadline moves. The time inside an attempt always counts.		 Optional: {}
terminalReason string TerminalReason is the Ready reason that the operator recorded when the
backup reached its final phase: Completed, Failed, or ResumeFailed.		 Optional: {}
resumeFailureMessage string ResumeFailureMessage is the last error of the resume of exporting,
when the backup stopped the attempts. A backup that failed a step and
then failed to resume reports this field and FailureMessage.		 Optional: {}
completionTime Time CompletionTime is when the backup reached a final phase. Optional: {}
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current state. The Ready condition shows the
backup with the reasons Progressing, Completed, Failed, ResumeFailed,
ClusterSuspended, BackupInProgress, StorageTypeMismatch,
InvalidReference, MissingSecret, and ConnectionFailed.		 Optional: {}

LogicalBackupElasticsearchStep

Underlying type: string

LogicalBackupElasticsearchStep is the current step of the backup. After a crash or a restart of the operator, the backup continues at this step. The request to pause exporting can be sent again after a restart.

Validation: - Enum: [PauseExporting BackupHistory SnapshotRecords BackupRuntime ResumeExporting]

Appears in: - LogicalBackupElasticsearchStatus

Field Description
PauseExporting
BackupHistory
SnapshotRecords
BackupRuntime
ResumeExporting

LogicalBackupPhase

Underlying type: string

LogicalBackupPhase is the phase of a backup that runs one time. Completed and Failed are final. To try again, create a new CR.

Validation: - Enum: [Pending Running Completed Failed]

Appears in: - LogicalBackupElasticsearchStatus - LogicalBackupRDBMSStatus

Field Description
Pending LogicalBackupPending means that the backup did not start its work. A
pre-check did not pass yet, or another backup of the same cluster runs.
Running LogicalBackupRunning means that the backup runs.
Completed LogicalBackupCompleted means that the backup finished and a restore can
use it.
Failed LogicalBackupFailed means that the backup failed. The message of the
Ready condition names the failed step.

LogicalBackupRDBMS

LogicalBackupRDBMS is one backup of an orchestration cluster with relational secondary storage. It is a dump of the whole logical database in the backup bucket, with one Zeebe backup. Camunda calls the Zeebe log and snapshots its "primary storage", and the exported relational data its "secondary storage". A Zeebe backup is the backup of the primary storage that Camunda writes to the backup bucket, on a request through the management API. A restore reads the exporter position from the restored dump and selects the Zeebe backups that match it. Thus the pair is a complete restore point.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string LogicalBackupRDBMS
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec LogicalBackupRDBMSSpec spec defines the desired state of LogicalBackupRDBMS Required: {}
status LogicalBackupRDBMSStatus status defines the observed state of LogicalBackupRDBMS Optional: {}

LogicalBackupRDBMSSpec

LogicalBackupRDBMSSpec identifies the cluster to back up. It is immutable. A backup runs one time. To try again, create a new CR.

Appears in: - LogicalBackupRDBMS

Field Description Default Validation
clusterRef ClusterRef ClusterRef references the CamundaCluster to back up. The cluster must
store its data in a relational database and have a backupStorageRef.		 Required: {}
dump DumpPodSpec Dump replaces all the pod settings of the spec.backup.dump block of
the cluster for this backup. When unset, the settings of the cluster
apply. The two never merge. The image of the dump is not one of these
settings. The Job runs under the ServiceAccount of the cluster, so the
image always comes from the block of the cluster.
The environment has limits too. The extraEnv of a backup cannot set a
name that starts with PG or UPLOAD_, and the API server refuses such a
name. Every extraEnvFrom source needs a prefix that cannot make such a
name. libpq prefers PGHOSTADDR over the PGHOST of the Job. Without the
limit, a source can send the dump, with the credentials of the Job, to
another host. The API server accepts a source without a safe prefix.
The backup then stays Pending with reason InvalidReference, and its Job
never starts.
The environment of this block reaches only the dump container, never
the upload container. Cloud SDKs read endpoint, proxy, and
configuration variables from the environment, and a backup must not
change where its dump goes. The block of the cluster has no prefix
limit, and its environment reaches every container.		 Optional: {}

LogicalBackupRDBMSStatus

LogicalBackupRDBMSStatus is the observed state of one backup operation.

Appears in: - LogicalBackupRDBMS

Field Description Default Validation
phase LogicalBackupPhase Phase is the phase of the backup. Completed and Failed are final. Enum: [Pending Running Completed Failed]
Optional: {}
step LogicalBackupRDBMSStep Step is the current step of the backup. After an interruption, the
backup continues at this step.		 Enum: [Dumping ZeebeBackup]
Optional: {}
backupId integer BackupID identifies the dump object in the bucket. The operator sets
it one time, when the backup leaves Pending.		 Optional: {}
jobName string JobName is the Job that dumps and uploads the database, while the Job
exists. It clears when the operator recorded the dump and removed the
Job. A failed Job stays until the backup is deleted, and its name stays
too.		 Optional: {}
objectKey string ObjectKey is the full key of the dump in the backup bucket:
<basePath>/<namespace>/<cluster>/<backupId>/<uid>/camunda.dump. The
uid is the UID of this resource. Thus a backup id that is used again
never names the dump of another backup.		 Optional: {}
zeebeBackupId integer ZeebeBackupID is the id of the Zeebe backup that the cluster generated
after the dump. It is unset until the operator requests that backup.		 Optional: {}
zeebeBackupRequestedAt Time ZeebeBackupRequestedAt is when the operator requested the Zeebe
backup. It limits how long the operator waits for the cluster to report
the backup.		 Optional: {}
workloadConfigHash string WorkloadConfigHash records the configuration of Zeebe when the backup
started. It is the config hash of the Zeebe pod template. The backup
starts only after every Zeebe pod runs this template, and the template
uses the bucket of the backup storage contract. The operator compares
it with the current hash before it renders the dump Job and before it
requests the Zeebe backup. It compares again until the Zeebe
backup is final. Before the request, a different hash fails the backup
after the grace period. After the request, a different hash fails the
backup at once, also when the Zeebe backup completed. The generation
of the cluster is not sufficient, because a change of a referenced
object changes the hash but not the generation.		 Optional: {}
clusterUID UID ClusterUID records the CamundaCluster of the backup. A cluster that is
deleted and created again with the same name is another cluster, with
other primary storage. If the UID of the cluster changes, the backup
fails. Thus a dump never pairs with the Zeebe backup of another
cluster.		 Optional: {}
version string Version is the Camunda version of the cluster when the backup started,
as the management binding reported it. A restore compares it with the
version of its target. A relational backup restores to the same Camunda
minor or to one minor newer. A restore can read the version only here,
because a suspended cluster has no management binding. The backup
starts only when Zeebe runs this version. After the Zeebe backup
request, a poll that finds Zeebe on another version fails the backup
at once with both versions in the message.		 Optional: {}
firstFailedAt Time FirstFailedAt is when a dependency of the running backup first stopped
resolving, or the management API first stopped answering. The grace
period starts at this time. It clears when the backup recovers.		 Optional: {}
bucketRef string BucketRef records the ObjectStorageConfig through which the Job wrote
the dump. On deletion, the operator uses this contract, not the
current backupStorageRef of the cluster. It removes the object only
while the cluster and this contract exist, and the contract points to
the same place. For a bucket with static credentials, the credentials
Secret must also exist.		 Optional: {}
bucketLocation string BucketLocation records where the Job wrote the object: the storage
type, the bucket, the base path, and the endpoint of the
ObjectStorageConfig at the start. On deletion, the operator removes the
object only while the contract still points there. If the contract
points somewhere else, the object stays. Thus the operator never
deletes an unrelated object with the same key.		 Optional: {}
bucketGeneration integer BucketGeneration is the generation of the recorded ObjectStorageConfig
when the backup started. It is information only. BucketLocation
decides whether a deletion can run.		 Optional: {}
storageSizes LogicalBackupStorageSizes StorageSizes are the effective restore sizes that the operator
recorded when the backup started. The RDBMS kind records only the Zeebe
size.		 Optional: {}
failureMessage string FailureMessage tells why the backup failed. It is set with the Failed
phase. The Ready condition has the same message.		 Optional: {}
completionTime Time CompletionTime is when the backup reached a final phase. Optional: {}
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current state. The Ready condition has the
phase as its reason, and its message names a failed step. For a
Pending backup, Ready has the reason of the check that holds it, and
the message explains that check.		 Optional: {}

LogicalBackupRDBMSStep

Underlying type: string

LogicalBackupRDBMSStep is the current step of the backup. After an interruption, the backup continues at this step.

Validation: - Enum: [Dumping ZeebeBackup]

Appears in: - LogicalBackupRDBMSStatus

Field Description
Dumping StepDumping runs the Job that writes the logical database to the
backup bucket.
ZeebeBackup StepZeebeBackup requests one Zeebe backup directly after the dump, so
that the two make one restore point. A Zeebe backup is the backup that
Camunda takes of its primary storage: the Zeebe log and snapshots.

LogicalBackupRef

LogicalBackupRef references a completed logical backup in the namespace of the restore. The reference never crosses a namespace. The kind of the restore sets the kind of the backup, so the reference holds only a name.

Appears in: - LogicalRestoreElasticsearchSpec - LogicalRestoreRDBMSSpec

Field Description Default Validation
name string Name is the name of the backup, in the namespace of this restore. MinLength: 1
Required: {}

LogicalBackupStorageSizes

LogicalBackupStorageSizes are the effective restore sizes of the components that hold storage. The operator records them when a backup starts, so that a restore can create volumes of the correct size. A value that the operator cannot compute stays unset. An Elasticsearch backup can add a missing value later, while exporting runs. The RDBMS kind never sets Elasticsearch, because it does not back up Elasticsearch data.

Appears in: - LogicalBackupElasticsearchStatus - LogicalBackupRDBMSStatus

Field Description Default Validation
elasticsearch Quantity Elasticsearch is the effective restore size of one Elasticsearch data
volume.		 Optional: {}
zeebe Quantity Zeebe is the effective restore size of one broker data volume. Optional: {}

LogicalRestoreElasticsearch

LogicalRestoreElasticsearch restores one completed LogicalBackupElasticsearch into one suspended CamundaCluster. It deletes the Camunda indices of the target and restores every snapshot of the backup into its Elasticsearch. Then it gives the brokers empty data volumes and runs the Camunda restore application one time for each broker.

The restore prepares the target itself. It suspends the target, waits for its brokers to stop, and sets spec.version to the Camunda version of the backup. When it completes, it removes the suspension, but only a suspension that it applied itself. A failed restore leaves the target suspended. A restore that somebody deletes while it runs also leaves the target suspended. Empty or half-written broker volumes cause more damage under running brokers.

The restore keeps spec.version, with the field manager camunda-operator/restore-version. The target runs the version of the backup until another manager takes over or removes that field. A manifest without spec.version does not change it, because server-side apply removes a field only for the manager that set it. This applies also to a target that gets its version from a release. The value of the restore wins over the release until somebody removes the field.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string LogicalRestoreElasticsearch
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec LogicalRestoreElasticsearchSpec spec names the backup to restore and the cluster to restore into. It
is immutable. A restore runs one time. To try again, create a new
resource.		 Required: {}
status LogicalRestoreElasticsearchStatus status defines the observed state of the restore Optional: {}

LogicalRestoreElasticsearchSpec

LogicalRestoreElasticsearchSpec names the backup to restore and the cluster to restore into. The whole spec is immutable. A restore runs one time. To try again, create a new resource.

Appears in: - LogicalRestoreElasticsearch

Field Description Default Validation
backupRef LogicalBackupRef BackupRef references the completed LogicalBackupElasticsearch to
restore from, in the namespace of this restore.		 Required: {}
targetClusterRef ClusterRef TargetClusterRef references the CamundaCluster to restore into. It
must name the cluster of the backup, because the restore application
reads the primary-storage backup under the prefix of that cluster. The
cluster must stay suspended for the whole restore.		 Required: {}

LogicalRestoreElasticsearchStatus

LogicalRestoreElasticsearchStatus is the progress of the restore to a final phase.

Appears in: - LogicalRestoreElasticsearch

Field Description Default Validation
phase LogicalRestorePhase Phase is the phase of the restore. After an interruption, the restore
continues at this phase.		 Enum: [Pending ValidatingCompatibility RestoringSecondaryStorage RestoringPrimaryStorage Completed Failed]
Optional: {}
backupId integer BackupID is the backup that the restore reads. The operator records it
when the restore starts. Later phases of the restore still read the
backup resource, so keep it until the restore completes.		 Optional: {}
backend string Backend is the Elasticsearch that the restore writes, as the scheme,
the host, and the port. The operator records it when the restore
starts. From then until the final phase, and after it while
recoveryHeld is true, no other CamundaCluster starts on this backend.
The restore waits while its target does not hold the backend.		 Optional: {}
contract string Contract is the SecondaryStorageConfig that held the endpoint of
Backend when the restore started. When the endpoint of that contract
moves, the restore still holds this contract.		 Optional: {}
recoveryHeld boolean RecoveryHeld is true while a failed or deleted restore keeps the
backend, because Elasticsearch can still recover snapshots that the
restore asked for. While it is true, no other CamundaCluster starts on
the backend, and the target stays suspended. No other backup or restore
of the target starts. A deleted restore stays while it is true. It is
unset on a restore that was never held, and false when the hold ends.		 Optional: {}
recoveryUnknownSince Time RecoveryUnknownSince is the start of the current period in which a held
restore cannot read the recovery from Elasticsearch. If the recovery stays unknown for ten
minutes, the restore releases the backend.		 Optional: {}
repository string Repository is the Elasticsearch snapshot repository that the restore
reads from, on the Elasticsearch of the target.		 Optional: {}
restoredSnapshots string array RestoredSnapshots names every snapshot that the restore asked
Elasticsearch to restore. After the operator records the names, the
restore does not delete the indices again when it continues after an
interruption.		 Optional: {}
targetClusterUID UID TargetClusterUID records the identity of the target cluster. A cluster
that is deleted and created again with the same name is another
cluster, and this restore does not apply to it.		 Optional: {}
brokers integer Brokers is the broker count of the broker StatefulSet. The operator
records it before the restore deletes a volume. It sets how many
volumes the restore creates again and how many Jobs run.		 Optional: {}
primaryJobNames string array PrimaryJobNames are the restore application Jobs, one for each broker,
in broker order. The operator records them before it creates the Jobs.
A completed restore removes these Jobs. The logs of these Jobs explain
a failed restore.		 Optional: {}
recreatedClaims string array RecreatedClaims names the broker data claims that the restore deleted
and created again. Thus the restore does not delete a claim two times.		 Optional: {}
firstFailedAt Time FirstFailedAt is when a dependency of the running restore first stopped
resolving. The grace period starts at this time. The field can clear if
the dependency recovers before the restore deletes target indices or
records a recreated broker volume or a broker Job. After that point, the
field stays set, so a dependency that fails and recovers again and
again does not reset the grace period.		 Optional: {}
clusterSuspended boolean ClusterSuspended records that this restore suspended its target
cluster. The restore removes that suspension when it reaches
Completed. A cluster that its owner suspended has no such record, so
it stays suspended. The cluster of a failed restore also stays
suspended.		 Optional: {}
terminalReason string TerminalReason is the Ready reason that the operator recorded when the
restore reached its final phase.		 Optional: {}
failureMessage string FailureMessage names the failed phase and its error. The Ready
condition has the same message.		 Optional: {}
completionTime Time CompletionTime is when the restore reached a final phase. Optional: {}
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current state of the restore. Optional: {}

LogicalRestorePhase

Underlying type: string

LogicalRestorePhase is the phase of a logical restore that runs one time. Completed and Failed are final. To try again, create a new resource. Both logical restore kinds use it, because their phases are the same.

Validation: - Enum: [Pending ValidatingCompatibility RestoringSecondaryStorage RestoringPrimaryStorage Completed Failed]

Appears in: - LogicalRestoreElasticsearchStatus - LogicalRestoreRDBMSStatus

Field Description
Pending LogicalRestorePending means that the restore did not start its work. A
pre-check stops it: the target cluster runs, another operation holds
the cluster, or the backup is not completed.
ValidatingCompatibility LogicalRestoreValidatingCompatibility means that the operator compares
the backup with the target. It compares the storage type, the backup
bucket, the Camunda version, and, on the Elasticsearch kind, the
partition count.
RestoringSecondaryStorage LogicalRestoreRestoringSecondaryStorage means that the operator writes
the backup into the secondary storage of the target.
RestoringPrimaryStorage LogicalRestoreRestoringPrimaryStorage means that the operator created
the broker data volumes again and runs the restore application on them.
Completed LogicalRestoreCompleted means that the restore finished. The operator
removes the Jobs of the brokers, so their pods release the broker data
volumes. It removes the suspension that it applied, so the target runs
again, unless its owner suspended it.
Failed LogicalRestoreFailed means that the restore failed. The Ready condition
names the failed phase. The operator keeps the Jobs of the brokers,
because their logs show the cause. Thus a restore that reached
RestoringPrimaryStorage holds the broker data volumes until you delete
it. A restore that failed in an earlier phase records no Job in
PrimaryJobNames and holds no broker volume.

LogicalRestoreRDBMS

LogicalRestoreRDBMS restores one completed LogicalBackupRDBMS into one suspended CamundaCluster. The operator writes the dump into the logical database of the target with pg_restore. Then it gives the brokers empty data volumes and runs the Camunda restore application on them, one time for each broker.

The restore prepares the target itself. It suspends the target, waits for its brokers to stop, and sets spec.version to the Camunda version of the backup. When it completes, it removes the suspension, but only a suspension that it applied itself. A failed restore leaves the target suspended. A restore that somebody deletes while it runs also leaves the target suspended. Empty or half-written broker volumes cause more damage under running brokers.

The restore keeps spec.version, with the field manager camunda-operator/restore-version. The target runs the version of the backup until another manager takes over or removes that field. A manifest without spec.version does not change it, because server-side apply removes a field only for the manager that set it. Thus a target of a newer minor stays on the minor of the backup, and the owner must upgrade it again.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string LogicalRestoreRDBMS
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec LogicalRestoreRDBMSSpec spec names the backup to read and the cluster to restore into. It is
immutable. A restore runs one time. To try again, create a new
resource.		 Required: {}
status LogicalRestoreRDBMSStatus status defines the observed state of the restore Optional: {}

LogicalRestoreRDBMSSpec

LogicalRestoreRDBMSSpec names the backup to restore and the cluster to restore into. The whole spec is immutable. A restore runs one time. To try again, create a new resource.

Appears in: - LogicalRestoreRDBMS

Field Description Default Validation
backupRef LogicalBackupRef BackupRef references the completed LogicalBackupRDBMS to restore from,
in the namespace of this restore.		 Required: {}
targetClusterRef ClusterRef TargetClusterRef references the CamundaCluster to restore into. It
must name the cluster of the backup, because the restore application
reads the primary-storage backup under the prefix of that cluster. The
cluster must be suspended for the whole restore.		 Required: {}

LogicalRestoreRDBMSStatus

LogicalRestoreRDBMSStatus is the progress of the restore to a final phase.

Appears in: - LogicalRestoreRDBMS

Field Description Default Validation
phase LogicalRestorePhase Phase is the phase of the restore. After an interruption, the restore
continues at this phase.		 Enum: [Pending ValidatingCompatibility RestoringSecondaryStorage RestoringPrimaryStorage Completed Failed]
Optional: {}
backupId integer BackupID is the id of the dump that the restore reads, as the backup
records it. The operator records it when the restore starts. Later
phases of the restore still read the backup resource, so keep it until
the restore completes.		 Optional: {}
backend string Backend is the logical database that the restore writes, as the host,
the port, and the database name. The operator records it when the
restore starts. From then until the final phase, no other
CamundaCluster starts on this backend. The restore waits while its
target does not hold the backend.		 Optional: {}
contract string Contract is the DatabaseServerConfig and the database name of Backend
when the restore started. When the DatabaseServerConfig moves to
another address, the restore still holds this contract.		 Optional: {}
secondaryJobName string SecondaryJobName is the Job that runs pg_restore, while the Job exists. Optional: {}
targetClusterUID UID TargetClusterUID records the identity of the target cluster. A cluster
that is deleted and created again with the same name is another
cluster, and this restore does not apply to it.		 Optional: {}
brokers integer Brokers is the broker count of the broker StatefulSet. The operator
records it before the restore deletes a volume. It sets how many
volumes the restore creates again and how many Jobs run.		 Optional: {}
primaryJobNames string array PrimaryJobNames are the restore application Jobs, one for each broker,
in broker order. The operator records them before it creates the Jobs.
A completed restore removes these Jobs. The logs of these Jobs explain
a failed restore.		 Optional: {}
recreatedClaims string array RecreatedClaims names the broker data claims that the restore deleted
and created again. Thus the restore does not delete a claim two times.		 Optional: {}
firstFailedAt Time FirstFailedAt is when a dependency of the running restore first stopped
resolving. The grace period starts at this time. The field can clear if
the dependency recovers before the restore deletes target indices or
records a recreated broker volume or a broker Job. After that point, the
field stays set, so a dependency that fails and recovers again and
again does not reset the grace period.		 Optional: {}
clusterSuspended boolean ClusterSuspended records that this restore suspended its target
cluster. The restore removes that suspension when it reaches
Completed. A cluster that its owner suspended has no such record, so
it stays suspended. The cluster of a failed restore also stays
suspended.		 Optional: {}
terminalReason string TerminalReason is the Ready reason that the operator recorded when the
restore reached its final phase.		 Optional: {}
failureMessage string FailureMessage names the failed phase and its error. The Ready
condition has the same message.		 Optional: {}
completionTime Time CompletionTime is when the restore reached a final phase. Optional: {}
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current state of the restore. Optional: {}

ManagedKeycloakSpec

ManagedKeycloakSpec configures the Keycloak that the operator runs through the Keycloak Operator.

Appears in: - IdentityProviderSpec

Field Description Default Validation
version string Version is the Keycloak version, as a full semantic version. Camunda
8.9 supports only Keycloak 26. The image is
camunda/keycloak:quay-optimized-<version>, unless the platform config
sets another repository.		 Pattern: ^\d+\.\d+\.\d+$
externalUrl string ExternalURL is the URL where browsers reach Keycloak, with the /auth
path. It is the front-channel issuer of every token. Management
Identity uses the front-channel URL since 8.5.3, so the Identity pods
must also reach it. Management Identity administers Keycloak through
the Service that the Keycloak Operator creates, not through this URL.
The operator appends /realms/<realm> to this URL, so the URL has no
query and no fragment.
databaseConfigRef string DatabaseConfigRef names the DatabaseConfig of the Keycloak database, in
the namespace of this resource. Keycloak needs its own PostgreSQL
database.		 MinLength: 1
replicas integer Replicas is the number of Keycloak instances. Defaults to 1. Minimum: 0
Optional: {}
resources ResourceRequirements Resources are the CPU and memory of the Keycloak container. Optional: {}
serviceAccount ServiceAccountSpec ServiceAccount gives the Keycloak pods a ServiceAccount of their own.
When unset, they run under spec.serviceAccount. When set, they run
under <name>-keycloak, or under name, and they do not get the access that a
plugin grants to the account of spec.serviceAccount. The name default
needs create false.		 Optional: {}
scheduling SchedulingSpec Scheduling constraints of the Keycloak pods. Optional: {}

ManagementAuth

ManagementAuth is how a consumer of the management binding authenticates.

Appears in: - ManagementBinding

Field Description Default Validation
method ManagementAuthMethod Method is the authentication method of the management port. Camunda
8.9 serves the actuator endpoints without authentication, so the
operator publishes none. The value basic is for a user who adds a
Spring Security configuration to the port, and for a later Camunda
version that secures it.		 Enum: [none basic]
credentialsSecretRef LocalCredentialsSecretRef CredentialsSecretRef names the username and password of the management
port. It is set only when Method is basic.		 Optional: {}

ManagementAuthConfig

ManagementAuthConfig is the contract CRD that holds the Management Identity OIDC configuration: the endpoints, the client credentials, and the audience. Components outside the orchestration cluster, such as Optimize, read it.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string ManagementAuthConfig
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec ManagementAuthConfigSpec spec defines the desired state of ManagementAuthConfig Required: {}
status ManagementAuthConfigStatus status defines the observed state of ManagementAuthConfig Optional: {}

ManagementAuthConfigSpec

ManagementAuthConfigSpec holds the Management Identity OIDC configuration: the endpoints, the machine-to-machine client credentials, and the audience.

Appears in: - ManagementAuthConfig

Field Description Default Validation
baseUrl string BaseURL is the base URL of the Management Identity service.
issuerUrl string IssuerURL is the OIDC issuer URL for the validation of tokens.
issuerBackendUrl string IssuerBackendURL is the issuer URL for calls between containers inside
the Kubernetes cluster. When empty, consumers use IssuerURL.		 Optional: {}
authUrl string AuthURL is the OIDC authorization endpoint for the login redirects of
the browser.
tokenUrl string TokenURL is the OIDC token endpoint for machine-to-machine tokens.
jwksUrl string JwksURL is the JWKS endpoint that gives the token signing keys.
clientId string ClientID is the ID of the client that Optimize signs in with. MinLength: 1
audience string Audience is the audience that access tokens for this client must have. MinLength: 1
clientSecretRef SecretKeyRef ClientSecretRef names the Secret key that holds the secret of that
client.

ManagementAuthConfigStatus

ManagementAuthConfigStatus is the observed validation state of the contract.

Appears in: - ManagementAuthConfig

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current validation state. The Ready condition
has the reasons Healthy or MissingSecret.		 Optional: {}

ManagementAuthMethod

Underlying type: string

ManagementAuthMethod is how a consumer authenticates against the management API of a cluster.

Validation: - Enum: [none basic]

Appears in: - ManagementAuth

Field Description
none
basic

ManagementBinding

ManagementBinding is the published address of the management API of one cluster. Extensions that operate the cluster, such as the backup kinds, read it. They do not derive the Service name, the port, or the authentication themselves. It is empty while the cluster is suspended, because the management API is then not available.

Appears in: - CamundaClusterStatus

Field Description Default Validation
endpoint string Endpoint is the base URL of the management API, for example
http://my-cluster-zeebe.my-namespace.svc:9600.
auth ManagementAuth Auth is how a consumer authenticates against the endpoint.
version string Version is the Camunda version of the cluster, for example 8.9.9. A
consumer selects its endpoint set from the minor version.
partitions integer Partitions is the partition count of the cluster. A restore must match
it, so a backup records it.
backupRepository string BackupRepository is the snapshot repository that the components write
backups to. It is set only on a cluster with Elasticsearch storage and a
backupStorageRef. It comes from the SecondaryStorageConfig.		 Optional: {}

ManagementClients

ManagementClients names the identity provider client of each component of the management plane. A CamundaManagementCluster reports InvalidReference when a component that it deploys has no client here.

Appears in: - ManagementOIDCClientsSpec

Field Description Default Validation
identity ConfidentialClientSpec Identity is the client of Management Identity. Optional: {}
optimize ConfidentialClientSpec Optimize is the client of Optimize. The ManagementAuthConfig that the
management cluster writes holds it, and Optimize reads it from there.		 Optional: {}
webModeler PublicClientSpec WebModeler is the client of the Web Modeler user interface. The browser
holds no secret, so it is a public client.		 Optional: {}
webModelerApi WebModelerAPIClientSpec WebModelerAPI is the client of the Web Modeler API. Optional: {}
console PublicClientSpec Console is the client of Console. The browser holds no secret, so it is
a public client.		 Optional: {}

ManagementOIDCClientsSpec

ManagementOIDCClientsSpec holds the identity provider clients of the management plane.

Appears in: - OIDCSpec

Field Description Default Validation
clients ManagementClients Clients holds one entry for each component of the management plane.

ManagementOIDCSpec

ManagementOIDCSpec selects the identity provider of the referenced CamundaPlatformConfig. The clients of the management plane are in that config, under spec.auth.oidc.management.clients, so this block has no fields.

Appears in: - IdentityProviderSpec - ManagementIdentityProvider

MonitoringSpec

MonitoringSpec groups the Prometheus scraping integration of the Elasticsearch cluster.

Appears in: - ElasticsearchClusterSpec

Field Description Default Validation
serviceMonitor ServiceMonitorSpec ServiceMonitor configures the exporter and the Prometheus
ServiceMonitor.		 Optional: {}
exporter ExporterSpec Exporter tunes the exporter Deployment. Optional: {}

OIDCProviderType

Underlying type: string

OIDCProviderType names the product behind an OIDC connection. Management Identity reads it and changes how it resolves users and groups.

Appears in: - OIDCSpec

Field Description
generic OIDCProviderGeneric fits any OIDC-compliant provider.
microsoft OIDCProviderMicrosoft selects Microsoft Entra ID.

OIDCSpec

OIDCSpec is the identity provider connection of a platform config. The fields use the terms of OIDC discovery and work with any OIDC-compliant provider.

Appears in: - PlatformAuthSpec

Field Description Default Validation
issuerUrl string IssuerURL is the issuer URL of the identity provider. Consumers get the
endpoints from its OIDC discovery document, unless the endpoint fields
below set them.
providerType OIDCProviderType ProviderType names the kind of identity provider. Management Identity
reads it and changes how it resolves users and groups. Empty means
generic, which fits any OIDC-compliant provider. Set microsoft for
Microsoft Entra ID.		 Enum: [generic microsoft]
Optional: {}
jwksUrl string JWKSURL is an explicit JWKS endpoint. It overrides the value from OIDC
discovery.		 Optional: {}
tokenUrl string TokenURL is an explicit token endpoint. It overrides the value from OIDC
discovery.		 Optional: {}
authUrl string AuthURL is an explicit authorization endpoint. It overrides the value
from OIDC discovery.		 Optional: {}
clientId string ClientID is the default OIDC client ID of all clusters. A preset or a
cluster can set another value.		 MinLength: 1
audience string Audience is the audience that consumers validate in access tokens.
When empty, consumers use ClientID.		 Optional: {}
usernameClaim string UsernameClaim is the token claim that holds the username of a person.
Empty means the default of the orchestration cluster, which is "sub".		 Optional: {}
clientIdClaim string ClientIDClaim is the token claim that holds the id of a machine client.
Empty means that no claim identifies a client, and every token is a
person. The tokens of persons must not have this claim, because a
token with it is always a client.		 Optional: {}
clientSecretRef SecretKeyRef ClientSecretRef names the Secret key that holds the default OIDC client
secret.
management ManagementOIDCClientsSpec Management holds the clients that the management plane uses at this
identity provider. A CamundaManagementCluster in the oidc mode reads
them. First register one client for each component at the provider.		 Optional: {}

ObjectStorageAuthType

Underlying type: string

ObjectStorageAuthType selects how consumers authenticate against a bucket.

Validation: - Enum: [workloadIdentity credentials]

Appears in: - AzureBlobStorageAuth - GCSStorageAuth - S3StorageAuth

Field Description
workloadIdentity
credentials

ObjectStorageConfig

ObjectStorageConfig is the contract CRD that describes a bucket for backups or document storage. It also describes how consumers authenticate against the bucket: with workload identity on the ServiceAccount of the consumer, or with static credentials in a Secret.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string ObjectStorageConfig
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec ObjectStorageConfigSpec spec defines the desired state of ObjectStorageConfig Required: {}
status ObjectStorageConfigStatus status defines the observed state of ObjectStorageConfig Optional: {}

ObjectStorageConfigSpec

ObjectStorageConfigSpec describes a bucket and how consumers authenticate against it. The type field selects exactly one of the s3, gcs, and azureBlob blocks.

Appears in: - ObjectStorageConfig

Field Description Default Validation
type ObjectStorageType Type selects the storage API of the bucket. Enum: [S3 GCS AzureBlob]
s3 S3Storage S3 describes an S3 or S3-compatible bucket. Required when type is S3.
Forbidden with other types.		 Optional: {}
gcs GCSStorage GCS describes a Google Cloud Storage bucket. Required when type is
GCS. Forbidden with other types.		 Optional: {}
azureBlob AzureBlobStorage AzureBlob describes an Azure Blob Storage container. Required when
type is AzureBlob. Forbidden with other types.		 Optional: {}

ObjectStorageConfigStatus

ObjectStorageConfigStatus is the observed validation state of the contract.

Appears in: - ObjectStorageConfig

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current validation state. The Ready
condition has the reasons Healthy and MissingSecret.		 Optional: {}

ObjectStorageType

Underlying type: string

ObjectStorageType identifies the storage API of a bucket.

Validation: - Enum: [S3 GCS AzureBlob]

Appears in: - ObjectStorageConfigSpec

Field Description
S3
GCS
AzureBlob

OptimizeMonitoringSpec

OptimizeMonitoringSpec groups the monitoring integrations of a CamundaOptimize.

Appears in: - CamundaOptimizeSpec - OptimizeAttachment

Field Description Default Validation
serviceMonitor ServiceMonitorSpec ServiceMonitor configures the Prometheus ServiceMonitors. When enabled,
the operator creates one ServiceMonitor for each Deployment, with the
name of the workload. It scrapes /actuator/prometheus on the management
port.		 Optional: {}

OptimizeSuspension

Underlying type: string

OptimizeSuspension names why the Optimize workloads are at zero with the cluster that they attach to.

Validation: - Enum: [Cluster StorageClaim]

Appears in: - CamundaOptimizeStatus

Field Description
Cluster OptimizeSuspensionCluster means that the referenced cluster is
suspended, by spec.suspend or by a state in which the operator keeps it
at zero.
StorageClaim OptimizeSuspensionStorageClaim means that the referenced cluster does
not hold the storage claim of its backend, or that another writer still
writes to that backend. The writer can be pods of another cluster or of
a previous Optimize instance, or a restore into another cluster.

PITRCapability

PITRCapability declares the point-in-time recovery capability of a server: continuous WAL archiving with the given retention.

Appears in: - DatabaseServerConfigSpec

Field Description Default Validation
enabled boolean Enabled reports whether the server performs continuous WAL archiving. false Optional: {}
retentionPeriodDays integer RetentionPeriodDays is how many days into the past a point-in-time
restore can go. Required when enabled is true.
The maximum is 36500 days, which is a hundred years. A reader counts
the reachable window in nanoseconds, and that count overflows at about
292 years. The maximum stays well below that limit.		 Maximum: 36500
Optional: {}
recovery RecoveryMode Recovery says who rolls the server back to a point in time. Defaults to
external. The value operator means that the publisher of this contract
answers spec.recovery. It requires enabled: true. The value external
means that nobody answers, and you roll the server back manually.		 external Enum: [operator external]
Optional: {}
lastRecovery RecoveryOutcome LastRecovery is how the last recovery request ended. It is unset until
the first answer. The answer to each later request replaces it.		 Optional: {}

PartitionPosition

PartitionPosition is the exporter position of one partition, as the pre-check read it from the restored database.

Appears in: - PointInTimeRestoreStatus

Field Description Default Validation
partitionId integer PartitionID is the Zeebe partition.
lastUpdated Time LastUpdated is the LAST_UPDATED value of the row of the partition in the
EXPORTER_POSITION table.

PersistentVolumeClaimRetentionPolicy

PersistentVolumeClaimRetentionPolicy is like the StatefulSet field of the same name, with only whenDeleted. There is no whenScaled choice. ECK deletes the volume of each Elasticsearch node that it removes in a scale down. The operator always keeps the volume of a broker that it removes in a scale down.

Appears in: - ElasticsearchClusterSpec - ZeebeSpec

Field Description Default Validation
whenDeleted PersistentVolumeClaimRetentionPolicyType WhenDeleted is what happens to the data volumes when the resource is
deleted. Defaults to Delete. Delete removes them with the resource.
Retain keeps them, and a later resource with the same name attaches
them again.		 Delete Enum: [Retain Delete]
Optional: {}

PersistentVolumeClaimRetentionPolicyType

Underlying type: string

PersistentVolumeClaimRetentionPolicyType is what happens to the data volumes of a resource (an ElasticsearchCluster, the brokers of a CamundaCluster) when the resource is deleted.

Validation: - Enum: [Retain Delete]

Appears in: - PersistentVolumeClaimRetentionPolicy

Field Description
Retain RetainPersistentVolumeClaimRetentionPolicyType keeps the data volumes.
You remove the data manually. For an ElasticsearchCluster, the ECK
resource has the volume claim delete policy DeleteOnScaledownOnly. For
a CamundaCluster, the broker StatefulSet has whenDeleted Retain.
Delete DeletePersistentVolumeClaimRetentionPolicyType deletes the data volumes
with the resource. For an ElasticsearchCluster, the ECK resource has
the volume claim delete policy DeleteOnScaledownAndClusterDeletion, the
ECK default. For a CamundaCluster, the broker StatefulSet has
whenDeleted Delete.

PinnedStorage

PinnedStorage is the destination of a backup set, recorded when the backup starts. It names the storage contract and the Elasticsearch endpoint that hold the snapshots, and the backup bucket that holds the runtime backup. status.repository records the name of the snapshot repository. Every step checks the destination before it writes, and the operator checks it before it deletes. Thus a destination that moves during the backup does not split the set or send a deletion to the wrong place.

Appears in: - LogicalBackupElasticsearchStatus

Field Description Default Validation
secondaryStorageConfig string SecondaryStorageConfig is the name of the storage contract, in the
namespace of the backup.
endpoint string Endpoint is the Elasticsearch endpoint that the contract named.
bucketRef string BucketRef is the ObjectStorageConfig that the cluster used for backups
when the backup started: its spec.backupStorageRef at that time. The
runtime backup goes to that bucket.
bucketLocation string BucketLocation is where that contract pointed: the storage type, the
bucket, the base path, and the endpoint. The steps write, and the
operator deletes, only while the contract still points there.

PlatformAuthSpec

PlatformAuthSpec selects the authentication method of every orchestration cluster that references the platform config.

Appears in: - CamundaPlatformConfigSpec

Field Description Default Validation
method AuthenticationMethod Method is the authentication method. An unset auth block and an unset
method both mean basic.		 basic Enum: [basic oidc]
Optional: {}
oidc OIDCSpec OIDC is the identity provider connection. Required when method is
oidc. Forbidden with other methods.		 Optional: {}

PodMonitorSpec

PodMonitorSpec configures the Prometheus PodMonitor of a resource whose pods serve their own metrics endpoint. A DatabaseServer scrapes the metrics port of every CloudNativePG instance. The PodMonitor is created only when the Kubernetes cluster serves the kind.

Appears in: - DatabaseServerMonitoringSpec

Field Description Default Validation
enabled boolean Enabled creates the PodMonitor when true. Defaults to false. Optional: {}
labels object (keys:string, values:string) Labels are extra labels applied to the PodMonitor. Optional: {}
annotations object (keys:string, values:string) Annotations are extra annotations applied to the PodMonitor. Optional: {}
interval string Interval is how often Prometheus scrapes the pods, as a Prometheus
duration such as 30s. Empty leaves the interval to the Prometheus
configuration.		 Pattern: ^(0\|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
Optional: {}

PointInTimeRestore

PointInTimeRestore brings the primary storage of a suspended CamundaCluster with relational secondary storage to the same point in time as its database. It reads the exporter position of every partition from that database. Then it deletes and creates the broker data volumes again. Then it runs the Camunda restore application with the requested point, one time for each broker.

The database reaches that point in one of two ways. A DatabaseServerConfig that declares pitr.recovery: operator is rolled back by its publisher. The restore writes the request on the contract and waits for the answer. A contract that declares external, the default, is rolled back before you create the restore. The restore reads the database as it is.

The restore prepares the cluster itself. It suspends the cluster and waits for its brokers to stop. When it completes, it removes the suspension, but only a suspension that it applied itself. A failed restore leaves the cluster suspended. A restore that somebody deletes while it runs also leaves the cluster suspended. Empty or half-written broker volumes cause more damage under running brokers.

It writes no version. This kind restores the primary storage of the cluster from the continuous backups of the same cluster. Thus no backup names a version other than the version that the cluster runs.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string PointInTimeRestore
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec PointInTimeRestoreSpec spec names the cluster to restore and the point that its database
holds. It is immutable. A restore runs one time. To try again, create
a new resource.		 Required: {}
status PointInTimeRestoreStatus status defines the observed state of the restore Optional: {}

PointInTimeRestorePhase

Underlying type: string

PointInTimeRestorePhase is the phase of a restore that runs one time. Completed and Failed are final. To try again, create a new resource.

Validation: - Enum: [Pending RestoringDatabase ValidatingDatabaseState RestoringPrimaryStorage Completed Failed]

Appears in: - PointInTimeRestoreStatus

Field Description
Pending PointInTimeRestorePending means that the restore did not start its
work. A pre-check stops it: the cluster runs, the storage chain does
not resolve, or the database is ahead of spec.timestamp.
RestoringDatabase PointInTimeRestoreRestoringDatabase means that the operator asked the
database server to roll back to spec.timestamp and waits for the
answer. The restore has this phase only when the DatabaseServerConfig
declares pitr.recovery: operator. A server that declares external rolls
back before you create the restore. The restore then goes directly to
ValidatingDatabaseState.
ValidatingDatabaseState PointInTimeRestoreValidatingDatabaseState means that the operator reads
the exporter position of every partition from the restored database.
This happens before the operator changes a volume.
RestoringPrimaryStorage PointInTimeRestoreRestoringPrimaryStorage means that the operator
created the broker data volumes again and runs the restore application
on them.
Completed PointInTimeRestoreCompleted means that the restore finished. The
operator removes the Jobs of the brokers, so their pods release the
broker data volumes. It removes the suspension that it applied, so the
cluster runs again, unless its owner suspended it.
Failed PointInTimeRestoreFailed means that the restore failed. The Ready
condition names the failed phase. The operator keeps the Jobs of the
brokers, because their logs show the cause. Thus a restore that reached
RestoringPrimaryStorage holds the broker data volumes until you delete
it. A restore that failed in an earlier phase records no Job in
PrimaryJobNames and holds nothing.

PointInTimeRestoreSpec

PointInTimeRestoreSpec names the cluster to roll back and the point in time to roll it back to. The whole spec is immutable.

Appears in: - PointInTimeRestore

Field Description Default Validation
clusterRef ClusterRef ClusterRef references the CamundaCluster to restore, in the namespace
of this restore. Its secondary storage must be a relational database.		 Required: {}
timestamp Time Timestamp is the point to restore to.
DatabaseServerConfig.spec.pitr.recovery sets who rolls the database
server back to it. With operator, the restore asks the server to roll
back to this point. With external, you roll the server back to it
before you create the restore.
Choose a point at least one backup interval before the cluster stopped
writing. Also choose a point inside the window in which Zeebe keeps its
primary-storage backups. The CamundaCluster sets these with
spec.backup.primaryStorage.schedule and retention.window. The defaults
are one hour and seven days. If no backup covers the point, the restore
fails after it erased the broker volumes.
The point must be inside the retention period of the database server,
and it must not be in the future. The operator does these two checks.		 Required: {}

PointInTimeRestoreStatus

PointInTimeRestoreStatus tracks the restore to a terminal phase.

Appears in: - PointInTimeRestore

Field Description Default Validation
phase PointInTimeRestorePhase Phase is the phase of the restore. The restore continues from it after
an interruption.		 Enum: [Pending RestoringDatabase ValidatingDatabaseState RestoringPrimaryStorage Completed Failed]
Optional: {}
storage PointInTimeRestoreStorage Storage records the storage chain that the restore validated. The
operator records it before it reads the database, and again after a
rollback that the restore asked for. If a later read does not agree,
the restore fails.		 Optional: {}
backend string Backend names the database that the restore holds while its server
rolls back: the host, the port, and the database name. The operator
records it just before it asks for the rollback. It follows each
endpoint that the contract names. From then until the final phase, no
other CamundaCluster starts on this database, also when the contract
names another endpoint. A restore whose server
rolls back outside the operator records no backend.		 Optional: {}
observedPositions PartitionPosition array ObservedPositions are the exporter positions that the pre-check read,
in partition order. They show what the operator saw when the restore
passed the database-state check, or what stopped it.		 Optional: {}
targetClusterUID UID TargetClusterUID records the identity of the target cluster. A cluster
that is deleted and created again with the same name is another
cluster, and this restore does not apply to it.		 Optional: {}
brokers integer Brokers is the broker count of the broker StatefulSet. The operator
records it before the restore deletes a volume. It sets how many
volumes the restore creates again and how many Jobs run.		 Optional: {}
primaryJobNames string array PrimaryJobNames are the restore application Jobs, one for each broker,
in broker order. The operator records them before it creates the Jobs.
A completed restore removes these Jobs. The logs of these Jobs explain
a failed restore.		 Optional: {}
recreatedClaims string array RecreatedClaims names the broker data claims that the restore deleted
and created again. Thus the restore does not delete a claim two times.		 Optional: {}
firstFailedAt Time FirstFailedAt is when a dependency of the running restore first stopped
resolving. The grace period starts at this time. The field can clear if
the dependency recovers before the restore deletes target indices or
records a recreated broker volume or a broker Job. After that point, the
field stays set, so a dependency that fails and recovers again and
again does not reset the grace period.		 Optional: {}
clusterSuspended boolean ClusterSuspended records that this restore suspended its target
cluster. The restore removes that suspension when it reaches
Completed. A cluster that its owner suspended has no such record, so
it stays suspended. The cluster of a failed restore also stays
suspended.		 Optional: {}
terminalReason string TerminalReason is the Ready reason that the operator recorded when the
restore reached its final phase.		 Optional: {}
failureMessage string FailureMessage names the failed phase and its error. The Ready
condition has the same message.		 Optional: {}
completionTime Time CompletionTime is when the restore reached a final phase. Optional: {}
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current state of the restore. Optional: {}

PointInTimeRestoreStorage

PointInTimeRestoreStorage is the identity of the storage chain that the restore validated. It holds the contracts that the restore resolved, the logical database that it read, and the server of that database. Each part of the chain can change. The restore checks the server and the database before it deletes anything. If a later read does not agree with this record, it is another database, and the restore fails. A rollback that the restore asked for replaces the record.

Appears in: - PointInTimeRestoreStatus

Field Description Default Validation
secondaryStorageConfig string SecondaryStorageConfig is the storage contract of the cluster.
secondaryStorageConfigUID UID SecondaryStorageConfigUID records the identity of that contract. Thus
the restore finds a contract that was deleted and created again with
the same name.		 Optional: {}
databaseConfig string DatabaseConfig is the contract of the logical database.
databaseConfigUID UID DatabaseConfigUID records the identity of that contract. Optional: {}
databaseServerConfig string DatabaseServerConfig is the contract of the server that holds the
database and declares its point-in-time recovery.
databaseServerConfigUID UID DatabaseServerConfigUID records the identity of that contract. Optional: {}
databaseName string DatabaseName is the logical database whose exporter position the
pre-check read.
endpoint string Endpoint is the host and port of the server, as the pre-check used it.
A contract that now names another endpoint names another server.
systemIdentifier string SystemIdentifier is the identity of the PostgreSQL instance behind that
endpoint, as the contract published it. The rule for a dedicated server
counted this identity. An endpoint that later reports another identity
is another instance.

PrimaryStorageBackupSpec

PrimaryStorageBackupSpec configures the backup scheduler of Zeebe. On a relational cluster, Camunda takes these backups itself, without a call from the operator. They pair with the database dump. A restore reads the exporter position from the restored database and selects the primary-storage backups that match it.

Appears in: - ClusterBackupSpec

Field Description Default Validation
continuous boolean Continuous keeps every log segment until it is backed up, so that a
restore finds a range without gaps. Defaults to true on a relational
cluster with a backupStorageRef. A preset can turn it on for many
clusters, and one cluster can still turn it off.		 Optional: {}
schedule string Schedule is the interval at which Zeebe takes a primary-storage
backup: an ISO 8601 duration, a CRON expression, or "none". Defaults
to PT1H. Always use a schedule with continuous. Otherwise the log grows
without limit.		 MinLength: 1
Optional: {}
checkpointInterval string CheckpointInterval is the interval at which Zeebe writes marker
checkpoints into the log stream, as an ISO 8601 duration of days and
time (P2DT3H, PT15M). Camunda parses no week, month, or year units.
It is the granularity of a point-in-time restore. Defaults to PT15M.		 Pattern: ^P([0-9]+D(T(([0-9]+H)([0-9]+M)?([0-9]+([.][0-9]+)?S)?\|([0-9]+M)([0-9]+([.][0-9]+)?S)?\|[0-9]+([.][0-9]+)?S))?\|T(([0-9]+H)([0-9]+M)?([0-9]+([.][0-9]+)?S)?\|([0-9]+M)([0-9]+([.][0-9]+)?S)?\|[0-9]+([.][0-9]+)?S))$
Optional: {}
retention PrimaryStorageRetentionSpec Retention bounds how long Zeebe keeps its primary-storage backups. Optional: {}

PrimaryStorageRetentionSpec

PrimaryStorageRetentionSpec bounds the primary-storage backups that Zeebe keeps. Zeebe always keeps at least one backup, even outside the window.

Appears in: - PrimaryStorageBackupSpec

Field Description Default Validation
window string Window is how far back the backups stay available for a restore, as an
ISO 8601 duration of days and time (P7D, PT12H). Camunda parses no
week, month, or year units. Defaults to P7D. It limits the restore
window, so set it at least as long as the recovery point that the
cluster needs. A BackupSchedule can keep database dumps for longer than
this window. A restore of such an old dump is not possible.		 Pattern: ^P([0-9]+D(T(([0-9]+H)([0-9]+M)?([0-9]+([.][0-9]+)?S)?\|([0-9]+M)([0-9]+([.][0-9]+)?S)?\|[0-9]+([.][0-9]+)?S))?\|T(([0-9]+H)([0-9]+M)?([0-9]+([.][0-9]+)?S)?\|([0-9]+M)([0-9]+([.][0-9]+)?S)?\|[0-9]+([.][0-9]+)?S))$
Optional: {}
cleanupSchedule string CleanupSchedule is the interval at which Zeebe looks for backups
outside the window: an ISO 8601 duration, a CRON expression, or
"none". Defaults to PT1H.		 MinLength: 1
Optional: {}

PublicClientSpec

PublicClientSpec is an identity provider client that a browser uses, so it has no secret.

Appears in: - ManagementClients

Field Description Default Validation
clientId string ClientID is the client id at the identity provider. MinLength: 1
audience string Audience is the audience that the component validates in access tokens.
Empty means the client id.		 Optional: {}

RDBMSStorage

RDBMSStorage holds relational database backend details.

Appears in: - SecondaryStorageConfigSpec

Field Description Default Validation
databaseConfigRef string DatabaseConfigRef names the DatabaseConfig of the logical database to
use, in the namespace of this contract.		 MinLength: 1

RecoveryArchiveIdentity

RecoveryArchiveIdentity is the workload identity of a bucket: what the pods of a consumer use to read the objects in it. A bucket with static credentials has none.

Appears in: - RecoveryArchiveRef

Field Description Default Validation
annotations object (keys:string, values:string) Annotations are the annotations of the ServiceAccount of the pods. Optional: {}
podLabels object (keys:string, values:string) PodLabels are the labels that the pods need. Only Azure needs one. Optional: {}

RecoveryArchiveRef

RecoveryArchiveRef names the archive that a recovery reads: the directory in the bucket, the location of that bucket, and the bucket contract that names it. It also holds the archive settings of the server at that moment. Until the rollback has an answer, the operator keeps the archive as it was. It does not apply an edit of spec.archive in that time: a moved bucket, a changed retention or schedule, or a removal.

Appears in: - DatabaseServerRecoveryStatus

Field Description Default Validation
serverName string ServerName is the archive directory, equal to the name of the
CloudNativePG cluster that wrote it.
objectStorageRef string ObjectStorageRef is the ObjectStorageConfig, in the namespace of this
server, that the archive lives in.
location string Location is where in object storage the archive is, in the form of
ArchiveRecord.Location. A running recovery reads the location that it
recorded, so an edit of the ObjectStorageConfig does not move it.		 Optional: {}
retentionPeriodDays integer RetentionPeriodDays is spec.archive.retentionPeriodDays as it stood
when the rollback started.		 Optional: {}
baseBackupSchedule string BaseBackupSchedule is spec.archive.baseBackupSchedule as it stood when
the rollback started.		 Optional: {}
identity RecoveryArchiveIdentity Identity is the workload identity of that bucket when the rollback
started. The pods keep this identity while they read the bucket. It is
unset for a bucket with static credentials, and for a bucket that
names no identity.		 Optional: {}

RecoveryMode

Underlying type: string

RecoveryMode says who rolls the server back to a point in time.

Validation: - Enum: [operator external]

Appears in: - PITRCapability

Field Description
operator RecoveryModeOperator means that the publisher of this contract rolls
the server back when spec.recovery asks for it.
external RecoveryModeExternal means that nobody answers spec.recovery. You roll
the server back manually, before the restore starts.

RecoveryOutcome

RecoveryOutcome is how a recovery request ended. It repeats the request that it answers. Thus a consumer knows whether it is the answer to its own request.

Appears in: - PITRCapability

Field Description Default Validation
requestID string RequestID is the requestID of the request that this outcome answers. Pattern: ^[0-9a-f]\{8\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{12\}$
requestedBy string RequestedBy is the requestedBy of the request that this outcome
answers.		 MaxLength: 507
Pattern: ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?/[a-z0-9]([-a-z0-9.]*[a-z0-9])?$
targetTime string TargetTime is the targetTime of the request that this outcome answers,
in the same form as in the request. Thus a consumer can compare the
two as text.		 Format: date-time
Pattern: ^\d\{4\}-\d\{2\}-\d\{2\}T\d\{2\}:\d\{2\}:\d\{2\}(\.\d+)?(Z\|[+-]\d\{2\}:\d\{2\})$
completedAt Time CompletedAt is when the request ended.
result RecoveryResult Result is how the request ended. See RecoveryResult for the values. Enum: [Completed Failed Unavailable]
message string Message says what happened. It is empty for a result of Completed. Optional: {}

RecoveryRequest

RecoveryRequest asks the publisher of this contract to roll the server back to a point in time. A consumer writes it with its own field manager. The publisher of the contract never writes this field, so the two writers never conflict.

Appears in: - DatabaseServerConfigSpec

Field Description Default Validation
requestID string RequestID identifies this request, and only this one. A controller sets
the uid of the resource that asks. A manual request can use any UUID.
Two requests can name the same resource and the same point. The
RequestID tells them apart. A resource that is deleted and created
again with the same name is another requester. The answer to the first
request says nothing about the state that the second requester asks
for.		 Pattern: ^[0-9a-f]\{8\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{12\}$
requestedBy string RequestedBy is the namespace and the name of the resource that asks, as
"<namespace>/<name>". It comes back in pitr.lastRecovery. Thus the
requester can find its own answer.		 MaxLength: 507
Pattern: ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?/[a-z0-9]([-a-z0-9.]*[a-z0-9])?$
targetTime string TargetTime is the point to roll back to, as RFC 3339 with a zone, for
example 2026-08-20T14:30:00Z. The API server refuses a timestamp
without a zone. PostgreSQL reads such a timestamp as the local time of
the server, which can be a different point from the one that the
writer intended.		 Format: date-time
Pattern: ^\d\{4\}-\d\{2\}-\d\{2\}T\d\{2\}:\d\{2\}:\d\{2\}(\.\d+)?(Z\|[+-]\d\{2\}:\d\{2\})$

RecoveryResult

Underlying type: string

RecoveryResult is how a recovery request ended.

Validation: - Enum: [Completed Failed Unavailable]

Appears in: - DatabaseServerRecoveryStatus - RecoveryOutcome

Field Description
Completed RecoveryResultCompleted means that the server now holds the state of
the requested point.
Failed RecoveryResultFailed means that the recovery started and did not
finish.
Unavailable RecoveryResultUnavailable means that the server holds no copy of the
requested point, so it attempted no recovery.

ReleaseConnectorsSpec

ReleaseConnectorsSpec is the connectors runtime of a release.

Appears in: - CamundaReleaseSpec

Field Description Default Validation
version string Version is the version of the connectors bundle image, as a full
semantic version. Use the same minor as the Camunda version of the
release. The patch does not follow the Camunda patch. A cluster that
runs connectors needs it from the release or from its own spec.		 Pattern: ^\d+\.\d+\.\d+$
Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of the container of this
process. An entry here wins over a top-level entry of the release with
the same name.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of the
container of this process.		 Optional: {}

ReleaseDatabaseServerSpec

ReleaseDatabaseServerSpec is the PostgreSQL server of a release.

Appears in: - CamundaReleaseSpec

Field Description Default Validation
version string Version is the PostgreSQL major version of the servers of this release,
as a number such as "17". A server that references the release refuses
an effective version below 14. Its own spec.version wins over this
value. A server that already runs another major version refuses the
change and keeps its major version.		 Pattern: ^\d+$
Optional: {}

ReleaseElasticsearchSpec

ReleaseElasticsearchSpec is the Elasticsearch of a release.

Appears in: - CamundaReleaseSpec

Field Description Default Validation
version string Version is the Elasticsearch version of the clusters of this release,
as a full semantic version. Elasticsearch has its own patch line, so it
does not follow the Camunda version. A cluster that references the
release refuses an effective version below 8.19 in the 8 line or below
9.2 in the 9 line. Its own spec.version wins over this value.		 Pattern: ^\d+\.\d+\.\d+$
Optional: {}

ReleaseEnvSpec

ReleaseEnvSpec is the environment of one component that a release adds.

Appears in: - CamundaReleaseSpec - ReleaseConnectorsSpec

Field Description Default Validation
extraEnv EnvVar array ExtraEnv are extra environment variables of the container of this
process. An entry here wins over a top-level entry of the release with
the same name.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of the
container of this process.		 Optional: {}

ReleaseImagesSpec

ReleaseImagesSpec holds the image references that a release pins. Each value is a complete reference, with its tag or digest.

Appears in: - CamundaReleaseSpec

Field Description Default Validation
camunda string Camunda is the image of every orchestration cluster process. Unset
means the camunda image of the platform config at the version of the
release.		 MinLength: 1
Optional: {}
connectors string Connectors is the image of the connectors runtime. Unset means the
connectors image of the platform config at connectors.version.		 MinLength: 1
Optional: {}

RestoreProgress

RestoreProgress is the part of a restore status that every restore kind has. Each restore status embeds it inline, so its fields appear directly in the status.

Appears in: - LogicalRestoreElasticsearchStatus - LogicalRestoreRDBMSStatus - PointInTimeRestoreStatus

Field Description Default Validation
targetClusterUID UID TargetClusterUID records the identity of the target cluster. A cluster
that is deleted and created again with the same name is another
cluster, and this restore does not apply to it.		 Optional: {}
brokers integer Brokers is the broker count of the broker StatefulSet. The operator
records it before the restore deletes a volume. It sets how many
volumes the restore creates again and how many Jobs run.		 Optional: {}
primaryJobNames string array PrimaryJobNames are the restore application Jobs, one for each broker,
in broker order. The operator records them before it creates the Jobs.
A completed restore removes these Jobs. The logs of these Jobs explain
a failed restore.		 Optional: {}
recreatedClaims string array RecreatedClaims names the broker data claims that the restore deleted
and created again. Thus the restore does not delete a claim two times.		 Optional: {}
firstFailedAt Time FirstFailedAt is when a dependency of the running restore first stopped
resolving. The grace period starts at this time. The field can clear if
the dependency recovers before the restore deletes target indices or
records a recreated broker volume or a broker Job. After that point, the
field stays set, so a dependency that fails and recovers again and
again does not reset the grace period.		 Optional: {}
clusterSuspended boolean ClusterSuspended records that this restore suspended its target
cluster. The restore removes that suspension when it reaches
Completed. A cluster that its owner suspended has no such record, so
it stays suspended. The cluster of a failed restore also stays
suspended.		 Optional: {}
terminalReason string TerminalReason is the Ready reason that the operator recorded when the
restore reached its final phase.		 Optional: {}
failureMessage string FailureMessage names the failed phase and its error. The Ready
condition has the same message.		 Optional: {}
completionTime Time CompletionTime is when the restore reached a final phase. Optional: {}
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current state of the restore. Optional: {}

RetainedBackups

RetainedBackups limits the backups that a schedule keeps, for each final phase. When the count of a phase is more than its limit, the operator deletes the oldest backups of that phase. The deletion also tries to remove their stored backup data.

Appears in: - BackupScheduleAttachment - BackupScheduleSpec

Field Description Default Validation
completed integer Completed is how many completed backups the schedule keeps. 7 Minimum: 1
Optional: {}
failed integer Failed is how many failed backups the schedule keeps. With zero, the
operator deletes a failed backup soon after it fails.		 3 Minimum: 0
Optional: {}

S3Credentials

S3Credentials holds the static keys of an S3 bucket.

Appears in: - S3StorageAuth

Field Description Default Validation
secretRef S3CredentialsSecretRef SecretRef names the Secret keys that hold the access-key pair.

S3CredentialsSecretRef

S3CredentialsSecretRef references an access-key pair in a Secret in the namespace of the contract.

Appears in: - S3Credentials

Field Description Default Validation
name string Name is the name of the Secret that holds the keys. MinLength: 1
accessKeyIdKey string AccessKeyIDKey is the key in the Secret that holds the access key ID. MinLength: 1
secretAccessKeyKey string SecretAccessKeyKey is the key in the Secret that holds the secret
access key.		 MinLength: 1

S3Storage

S3Storage describes an S3 or S3-compatible bucket.

Appears in: - ObjectStorageConfigSpec

Field Description Default Validation
bucketName string BucketName is the name of the bucket, as storage client SDKs use it. MinLength: 1
basePath string BasePath is the key prefix under which consumers write objects,
without leading or trailing slashes. Empty means the bucket root.		 Pattern: ^[^/]+(/[^/]+)*$
Optional: {}
region string Region is the region of the bucket. Required unless endpoint is set. Optional: {}
endpoint string Endpoint is the URL of an S3-compatible store (MinIO, Ceph, and more).
Empty means AWS S3, addressed through region.		 Optional: {}
forcePathStyle boolean ForcePathStyle forces path-style bucket addressing. Set it for
S3-compatible stores that do not serve virtual-hosted-style requests.		 Optional: {}
auth S3StorageAuth Auth selects how consumers authenticate. An absent block means
workload identity through the ServiceAccount.		 { type:workloadIdentity } Optional: {}

S3StorageAuth

S3StorageAuth selects how consumers authenticate against an S3 bucket.

Appears in: - S3Storage

Field Description Default Validation
type ObjectStorageAuthType Type is the authentication choice. Defaults to workloadIdentity. workloadIdentity Enum: [workloadIdentity credentials]
Optional: {}
workloadIdentity S3WorkloadIdentity WorkloadIdentity names the trusted principal. It is valid only with
type workloadIdentity. With an empty or absent block, the operator adds
no annotation. The identity must then be bound on the cloud side, for
example with EKS Pod Identity.		 Optional: {}
credentials S3Credentials Credentials are static keys. Required with type credentials. Forbidden
with other types.		 Optional: {}

S3WorkloadIdentity

S3WorkloadIdentity names the AWS principal that the bucket trusts. With an empty block, the operator adds no annotation to the ServiceAccount of the consumer. The identity must then be bound on the cloud side, for example with EKS Pod Identity.

Appears in: - S3StorageAuth

Field Description Default Validation
roleArn string RoleARN is the IAM role that consumers assume. When set, the operator
puts it in the eks.amazonaws.com/role-arn annotation of a ServiceAccount
that it creates for the consumer (IRSA). On an existing ServiceAccount,
add the annotation yourself.		 Optional: {}

SchedulingSpec

SchedulingSpec holds the scheduling constraints of the pods of a resource. When a resource sets its own block, it replaces the complete scheduling block of its preset. The two blocks never merge field by field.

Appears in: - BackupDumpSpec - CamundaClusterSpec - ConnectorsSpec - ConsoleOverrides - ConsoleSpec - DatabaseServerSpec - DumpPodSpec - ElasticsearchClusterSpec - GatewaySpec - IdentityOverrides - IdentitySpec - KeycloakOverrides - ManagedKeycloakSpec - WebAppSpec - WorkloadSpec - ZeebeSpec

Field Description Default Validation
nodeAffinity NodeAffinity NodeAffinity rules for the pods. Optional: {}
podAffinity PodAffinity PodAffinity rules for the pods. Optional: {}
tolerations Toleration array Tolerations for the pods. Optional: {}

ScratchVolumeSpec

ScratchVolumeSpec sizes the volume that holds a database dump until the upload. An unset block is an emptyDir with the limits of the node. A large database can fill it.

Appears in: - BackupDumpSpec - DumpPodSpec

Field Description Default Validation
sizeLimit Quantity SizeLimit is the size of the emptyDir that holds the dump. Set it to
the size the dump needs, with room to spare.		 Optional: {}
storageClassName string StorageClassName makes the scratch volume a PersistentVolumeClaim of
this class, not an emptyDir. Use it when the dump is larger than the
ephemeral storage of a node.		 Optional: {}

SecondaryStorageConfig

SecondaryStorageConfig is the namespaced contract CRD that tells an orchestration cluster where its secondary storage is and how to authenticate against it. The storage is an Elasticsearch cluster or a relational database. Consumers find it by name in their own namespace.

Field Description Default Validation
apiVersion string core.camunda.io/v1
kind string SecondaryStorageConfig
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec SecondaryStorageConfigSpec spec defines the desired state of SecondaryStorageConfig Required: {}
status SecondaryStorageConfigStatus status defines the observed state of SecondaryStorageConfig Optional: {}

SecondaryStorageConfigSpec

SecondaryStorageConfigSpec tells an orchestration cluster where its secondary storage is and how to authenticate against it.

Appears in: - SecondaryStorageConfig

Field Description Default Validation
type SecondaryStorageType Type selects the secondary storage backend that this contract
describes.		 Enum: [elasticsearch rdbms]
elasticsearch ElasticsearchStorage Elasticsearch holds the Elasticsearch connection details. Required
when type is elasticsearch. Forbidden with other types.		 Optional: {}
rdbms RDBMSStorage RDBMS holds the relational database details. Required when type is
rdbms. Forbidden with other types.		 Optional: {}

SecondaryStorageConfigStatus

SecondaryStorageConfigStatus is the observed validation state of the contract.

Appears in: - SecondaryStorageConfig

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the operator processed. Optional: {}
conditions Condition array Conditions represent the current validation state. The Ready condition
has the reasons Healthy, MissingSecret, or InvalidReference.		 Optional: {}

SecondaryStorageType

Underlying type: string

SecondaryStorageType identifies the secondary storage backend that a contract describes.

Validation: - Enum: [elasticsearch rdbms]

Appears in: - SecondaryStorageConfigSpec

Field Description
elasticsearch SecondaryStorageTypeElasticsearch selects an Elasticsearch backend.
rdbms SecondaryStorageTypeRDBMS selects a relational database backend.

SecretKeyRef

SecretKeyRef references one value in a Secret in a named namespace. A cluster-scoped kind uses it, because it has no namespace of its own. A namespaced kind uses LocalSecretKeyRef.

Appears in: - CamundaPlatformConfigSpec - ConfidentialClientSpec - ManagementAuthConfigSpec - OIDCSpec - WebModelerAPIClientSpec

Field Description Default Validation
name string Name is the name of the Secret that holds the value. MinLength: 1
namespace string Namespace is the namespace of the Secret. MinLength: 1
key string Key is the key in the Secret that holds the value. MinLength: 1

SecureSettingEntry

SecureSettingEntry projects one key of a Secret to a named entry of the Elasticsearch keystore.

Appears in: - SecureSettingsSource

Field Description Default Validation
key string Key in the Secret. MinLength: 1
path string Path is the keystore entry that the key becomes, for example
s3.client.default.access_key.		 MinLength: 1

SecureSettingsSource

SecureSettingsSource references a Secret that ECK loads into the keystore of every Elasticsearch node. Elasticsearch reads credentials only from the keystore, never from the settings of a snapshot repository.

Appears in: - ElasticsearchClusterSpec

Field Description Default Validation
secretName string SecretName is the Secret, in the namespace of the ElasticsearchCluster. MinLength: 1
entries SecureSettingEntry array Entries maps single keys to keystore entries. An empty list loads
every key of the Secret under its own name.		 Optional: {}

ServiceAccountSpec

ServiceAccountSpec configures the ServiceAccount of the pods of a resource.

Appears in: - CamundaClusterSpec - CamundaManagementClusterSpec - ConnectorsSpec - ConsoleSpec - ElasticsearchClusterSpec - IdentitySpec - ManagedKeycloakSpec - WebModelerSpec

Field Description Default Validation
name string Name is the name of the ServiceAccount. When empty, the operator
derives the name from the name of the resource, as the doc of each kind
states. The cloud provider uses this name. A workload identity that
needs no annotation, such as EKS Pod Identity, binds the principal
system:serviceaccount:<namespace>:<name>.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Optional: {}
create boolean Create makes the operator create and own the ServiceAccount. Defaults
to true. False names a ServiceAccount that already exists. The operator
then does not create, annotate, or own it. If it does not exist, Ready
reports InvalidReference. Ready does not report it on a suspended
ElasticsearchCluster or for connectors that are not enabled. It also
does not report it for a component of a CamundaManagementCluster that
does not run.
While create is false, the operator never takes ownership of the
ServiceAccount, because it deletes an owned one with the resource. A
switch to false removes the owner reference from the account that the
operator created. The account then stays when the resource is deleted.
With create true, the operator owns and annotates the account of that
name, also one that it did not create. An account that another
resource controls is not taken over, and the apply fails.		 Optional: {}
annotations object (keys:string, values:string) Annotations to set on the ServiceAccount that the operator creates.
Usually these are workload-identity annotations (IRSA, GCP Workload
Identity, and more) that give the pods access to cloud resources, such
as the snapshot bucket for backups. Except on connectors.serviceAccount
of a CamundaCluster, the operator also adds the identity annotation of
each referenced bucket that names an identity. An annotation set here
wins over it. With create false, the operator sets no annotation. Add them
to the existing ServiceAccount yourself.		 Optional: {}

ServiceMonitorSpec

ServiceMonitorSpec configures the Prometheus ServiceMonitors of a resource that runs workloads. The kind of the resource sets what Prometheus scrapes. Elasticsearch serves no Prometheus endpoint, so an ElasticsearchCluster deploys the prometheus-community elasticsearch_exporter and scrapes it. A CamundaCluster scrapes /actuator/prometheus of every process. The operator creates the ServiceMonitor only when the Kubernetes cluster serves the kind.

Appears in: - ClusterMonitoringSpec - MonitoringSpec - OptimizeMonitoringSpec

Field Description Default Validation
enabled boolean Enabled creates the ServiceMonitors (and, for an ElasticsearchCluster,
the exporter) when true. Defaults to false.		 Optional: {}
labels object (keys:string, values:string) Labels are extra labels applied to the ServiceMonitor. Optional: {}
annotations object (keys:string, values:string) Annotations are extra annotations applied to the ServiceMonitor. Optional: {}

VolumeStatus

VolumeStatus is the observed size of one data PersistentVolumeClaim of a cluster. A status lists one entry for each bound claim, sorted by name. Thus it also shows a resize of one claim outside the spec, for example by an auto-resize controller.

Appears in: - CamundaClusterStatus - DatabaseServerStatus - ElasticsearchClusterStatus

Field Description Default Validation
name string Name is the name of the PersistentVolumeClaim.
capacity Quantity Capacity is the storage capacity that the bound claim reports.

WebAppSpec

WebAppSpec configures one of the web applications Operate, Tasklist, and Admin.

Appears in: - CamundaClusterSpec

Field Description Default Validation
mode ComponentMode Mode selects a Deployment of the unified binary that serves only this
application (Standalone) or the nearest standalone host up the chain
(Embedded). Defaults to Embedded. The workload fields have an effect
only in Standalone mode. The exception is extraEnv and extraEnvFrom: in
Embedded mode, they apply to the host process.		 Enum: [Standalone Embedded]
Optional: {}
replicas integer Replicas is the number of pods of this process. Defaults to 1. On a
CamundaCluster it has no effect on an embedded web application.		 Minimum: 0
Optional: {}
resources ResourceRequirements Resources are the CPU and memory of the container of this process. Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of the container of this
process. On a CamundaCluster, an entry here wins over a top-level entry
with the same name. The entries of an embedded web application apply to
its host process.
The list merges by name under server-side apply. Each field manager owns
only the entries that it applies, so an extension controller can add its
own entry next to yours. One applied manifest cannot hold two entries
with the same name.
Two field managers that apply the same name do not conflict, because the
merge is per field inside the entry. One manager can own value and the
other valueFrom. A container rejects an entry that has both, so the API
server refuses to store such an entry.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of the
container of this process.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels of the pods of this process. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations of the pods of this process. In a
CamundaCluster, the keys camunda.io/config-hash and
camunda.io/service-account-hash belong to the operator, and a value for
them does not reach the pods.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the pods of this process.
When set, it replaces all other scheduling blocks for this process, with
no merge. On a CamundaCluster, these are the top-level block and the
block of a preset.		 Optional: {}

WebModelerAPIClientSpec

WebModelerAPIClientSpec is the client of the Web Modeler API. Web Modeler validates two audiences: one for the API that its own user interface calls, and one for the public API that your applications call.

Appears in: - ManagementClients

Field Description Default Validation
clientId string ClientID is the client id at the identity provider. MinLength: 1
audience string Audience is the audience that the component validates in access tokens.
Empty means the client id.		 Optional: {}
clientSecretRef SecretKeyRef ClientSecretRef names the Secret key that holds the client secret.
publicApiAudience string PublicAPIAudience is the audience of the Web Modeler public API. Empty
means web-modeler-public-api.		 Optional: {}

WebModelerMailSpec

WebModelerMailSpec configures the SMTP server of Web Modeler.

Appears in: - WebModelerOverrides - WebModelerSpec

Field Description Default Validation
smtpHost string SMTPHost is the host name of the SMTP server. MinLength: 1
smtpPort integer SMTPPort is the port of the SMTP server. Defaults to 587. 587 Maximum: 65535
Minimum: 1
Optional: {}
fromAddress string FromAddress is the address that Web Modeler sends from. MinLength: 3
fromName string FromName is the display name of the sender of Web Modeler mail. Optional: {}
tls boolean TLS turns STARTTLS on. Defaults to true. Optional: {}
credentialsSecretRef LocalCredentialsSecretRef CredentialsSecretRef names the Secret with the user and the password of
the SMTP server. Leave it unset for a server that needs no credentials.		 Optional: {}

WebModelerSpec

WebModelerSpec configures Web Modeler. Web Modeler runs as two workloads: the restapi process and the websockets process.

Appears in: - CamundaManagementClusterSpec

Field Description Default Validation
version string Version is the Web Modeler version, as a full semantic version. The
operator supports 8.9.0 and later.		 Pattern: ^\d+\.\d+\.\d+$
externalUrl string ExternalURL is the URL where browsers reach Web Modeler.
websocketsExternalUrl string WebsocketsExternalURL is the URL where browsers reach the websockets
process. Web Modeler sends live updates through it.
databaseConfigRef string DatabaseConfigRef names the DatabaseConfig of the Web Modeler database,
in the namespace of this resource. Web Modeler needs its own PostgreSQL
database.		 MinLength: 1
mail WebModelerMailSpec Mail configures the SMTP server that Web Modeler sends notifications
through. Web Modeler does not start without it.
serviceAccount ServiceAccountSpec ServiceAccount gives the Web Modeler pods a ServiceAccount of their own.
When unset, they run under spec.serviceAccount. When set, they run
under <name>-web-modeler, or under name, and they do not get the access that a
plugin grants to the account of spec.serviceAccount. The name default
needs create false.		 Optional: {}
restapi WorkloadSpec Restapi configures the workload of the restapi process. Optional: {}
websockets WorkloadSpec Websockets configures the workload of the websockets process. Optional: {}

WorkloadSpec

WorkloadSpec holds the settings of one process: the size, the environment, the pod metadata, and the scheduling. Every component block of a CamundaCluster uses it, and so does each workload of a CamundaOptimize.

Appears in: - CamundaOptimizeSpec - ConnectorsSpec - ConsoleOverrides - ConsoleSpec - GatewaySpec - IdentityOverrides - IdentitySpec - OptimizeAttachment - WebAppSpec - WebModelerOverrides - WebModelerSpec - ZeebeSpec

Field Description Default Validation
replicas integer Replicas is the number of pods of this process. Defaults to 1. On a
CamundaCluster it has no effect on an embedded web application.		 Minimum: 0
Optional: {}
resources ResourceRequirements Resources are the CPU and memory of the container of this process. Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of the container of this
process. On a CamundaCluster, an entry here wins over a top-level entry
with the same name. The entries of an embedded web application apply to
its host process.
The list merges by name under server-side apply. Each field manager owns
only the entries that it applies, so an extension controller can add its
own entry next to yours. One applied manifest cannot hold two entries
with the same name.
Two field managers that apply the same name do not conflict, because the
merge is per field inside the entry. One manager can own value and the
other valueFrom. A container rejects an entry that has both, so the API
server refuses to store such an entry.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of the
container of this process.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels of the pods of this process. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations of the pods of this process. In a
CamundaCluster, the keys camunda.io/config-hash and
camunda.io/service-account-hash belong to the operator, and a value for
them does not reach the pods.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the pods of this process.
When set, it replaces all other scheduling blocks for this process, with
no merge. On a CamundaCluster, these are the top-level block and the
block of a preset.		 Optional: {}

ZeebeSpec

ZeebeSpec configures the brokers. Zeebe is always a standalone StatefulSet with persistent volumes.

Appears in: - CamundaClusterSpec

Field Description Default Validation
replicas integer Replicas is the number of pods of this process. Defaults to 1. On a
CamundaCluster it has no effect on an embedded web application.		 Minimum: 0
Optional: {}
resources ResourceRequirements Resources are the CPU and memory of the container of this process. Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of the container of this
process. On a CamundaCluster, an entry here wins over a top-level entry
with the same name. The entries of an embedded web application apply to
its host process.
The list merges by name under server-side apply. Each field manager owns
only the entries that it applies, so an extension controller can add its
own entry next to yours. One applied manifest cannot hold two entries
with the same name.
Two field managers that apply the same name do not conflict, because the
merge is per field inside the entry. One manager can own value and the
other valueFrom. A container rejects an entry that has both, so the API
server refuses to store such an entry.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of the
container of this process.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels of the pods of this process. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations of the pods of this process. In a
CamundaCluster, the keys camunda.io/config-hash and
camunda.io/service-account-hash belong to the operator, and a value for
them does not reach the pods.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the pods of this process.
When set, it replaces all other scheduling blocks for this process, with
no merge. On a CamundaCluster, these are the top-level block and the
block of a preset.		 Optional: {}
partitions integer Partitions is the number of partitions. Defaults to 1. Once set, it can
neither be decreased nor removed.		 Minimum: 1
Optional: {}
replicationFactor integer ReplicationFactor is the number of brokers that hold a copy of each
partition. Defaults to 1. It must not exceed replicas.		 Minimum: 1
Optional: {}
storageClassName string StorageClassName is the StorageClass of the broker volumes. Defaults to
the default StorageClass of the Kubernetes cluster. The class cannot
change after the broker StatefulSet exists. The API server refuses a
change of a value that the CamundaCluster sets itself. A preset can
change the class, and a cluster that got its class from a preset can
set another one. A cluster whose broker StatefulSet exists, also a
suspended one, then keeps its class and records a
StorageClassChangeIgnored event. A cluster without a broker StatefulSet
takes the new class. Volumes that whenDeleted Retain kept from a
deleted cluster of the same name keep their class.		 Optional: {}
storageSize Quantity StorageSize is the size of the data volume of each broker. Defaults to
10Gi. It can only grow. The API server refuses a change of this field
in a CamundaCluster to a smaller value. A smaller value is accepted when
the field was not set before, or when a preset lowers the size. A
cluster whose volumes are already larger then keeps that size and
records a StorageShrinkIgnored event.
When the size grows, the operator expands the existing claims in place.
The storage class must support volume expansion.		 Optional: {}
persistentVolumeClaimRetentionPolicy PersistentVolumeClaimRetentionPolicy PersistentVolumeClaimRetentionPolicy says what happens to the broker
volumes when the CamundaCluster is deleted. A scale-down and a
suspension always keep them.		 Optional: {}

fleet.camunda.io/v1alpha1

Package v1alpha1 contains API Schema definitions for the fleet v1alpha1 API group. The fleet manager writes the kinds of this group. An environment sets the policy of its namespaces. A claim expands into a cluster or a management cluster.

The v1alpha1 version has no compatibility promise. A later release can change or remove any type, field, or value of this package.

Resource Types

BackupScheduleAttachment

BackupScheduleAttachment holds the BackupSchedule fields that a claim can set. The claim controller sets the cluster reference to the cluster of the claim.

Appears in: - ClusterAttachments

Field Description Default Validation
schedule string Schedule is when the backups run: a five-field cron expression
(minute, hour, day of month, month, day of week), evaluated in UTC.		 Pattern: ^\s*([0-9A-Za-z*?,/-]+\s+)\{4\}[0-9A-Za-z*?,/-]+\s*$
Required: {}
retained RetainedBackups Retained limits how many backups of the schedule stay. Unset, the
defaults of the BackupSchedule apply.		 Optional: {}

CamundaClusterClaim

CamundaClusterClaim asks for one Camunda cluster. The cluster claim controller expands it into a CamundaCluster of the same name, a PluginRequest for each selection, and the attachments. The Environment of the namespace sets which presets, releases, and registrations the claim can use. The name is a DNS-1035 label of at most 40 characters. The claim adds a suffix to it in the names of the resources that it writes, such as <claim>-es-es-http.

Field Description Default Validation
apiVersion string fleet.camunda.io/v1alpha1
kind string CamundaClusterClaim
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec CamundaClusterClaimSpec spec is the cluster that the claim asks for Required: {}
status CamundaClusterClaimStatus status is the state of the claim Optional: {}

CamundaClusterClaimSpec

CamundaClusterClaimSpec is the cluster that a claim asks for. The cluster claim controller expands it into a CamundaCluster, a PluginRequest for each selection, and the attachments.

Appears in: - CamundaClusterClaim

Field Description Default Validation
presetRef string PresetRef names the CamundaClusterPreset of the cluster. When the
namespace belongs to an Environment, the Environment must list the
preset in spec.presets.camundaCluster. The claim controller checks a
change of an existing claim against the current Environment.		 MaxLength: 253
MinLength: 1
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Required: {}
releaseRef string ReleaseRef names the CamundaRelease of the cluster, which sets its
versions. Empty means the default release of the Environment. The
claim controller checks a change of an existing claim against the
current Environment.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Optional: {}
platformConfigRef string PlatformConfigRef names the CamundaPlatformConfig of the cluster.
Empty means spec.platformConfigRef of the Environment.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Optional: {}
cluster CamundaClusterSpec Cluster holds the overrides of the cluster. It has the shape of the
CamundaCluster spec, and it merges over the preset and the release.
The API server refuses these fields here. suspend: false and an empty
presetRef, releaseRef, storageRef, or backupStorageRef count as unset.
- presetRef, releaseRef, platformConfigRef, and suspend: the claim
has its own fields for them.
- version and connectors.version: the release sets them. Use
allowVersionDowngrade for a downgrade.
- serviceAccount.name and connectors.serviceAccount.name: the claim
controller sets them.
- storageRef and backupStorageRef: the secondary-storage and
backup-storage sections fill them.
A selected section fills these fields. The claim controller refuses a
claim that sets one of them with reason SlotConflict. Without a
selection in that section, the claim can set the field.
- externalUrl: access.
- serviceAccount.annotations: cloud-identity.
- connectors.serviceAccount.annotations: connectors-permissions.
- zeebe.storageClassName: volume-encryption.		 Optional: {}
plugins PluginSelection array Plugins are the registrations that the claim selects, one item for
each section and registration. The sections and their registrations
are fixed after creation. Only the parameters of a selection can
change.		 MaxItems: 32
Optional: {}
attachments ClusterAttachments Attachments are the resources that the claim controller attaches to
the cluster.		 Optional: {}
deletionPolicy DeletionPolicy DeletionPolicy says what happens to the resources of the plugin
requests when the claim is deleted. Delete deletes them. Orphan keeps
them. Empty means the deletion default that the claim recorded from its
Environment at creation, or Delete when it recorded none. The claim
controller refuses Orphan with the reason NotAllowed when a selected
registration does not support it. The CamundaCluster and the
attachments are always deleted with the claim, under their own
retention rules.		 Enum: [Delete Orphan]
Optional: {}
allowVersionDowngrade string AllowVersionDowngrade is the target version of a confirmed downgrade,
as a full version such as 8.9.3. The claim controller sets the
annotation camunda.io/allow-version-downgrade on the CamundaCluster to
this version until the cluster reports it. The fleet manager clears
the field after the cluster reports the target version.		 Pattern: ^(\d+\.\d+\.\d+)?$
Optional: {}
suspend boolean Suspend scales every workload of the cluster to zero and keeps the
data.		 Optional: {}

CamundaClusterClaimStatus

CamundaClusterClaimStatus is the state of a CamundaClusterClaim. The cluster claim controller writes it.

Appears in: - CamundaClusterClaim

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the cluster claim
controller processed.		 Optional: {}
conditions Condition array Conditions report the state of the claim. Ready is False with reason
NoEnvironment, UnknownEnvironment, NotAllowed, MissingInput,
InvalidReference, SlotConflict, or WiringCycle when a check of the
claim fails. Otherwise Ready follows RequestsReady, ClusterReady, and
AttachmentsReady. When ClusterReady has the reason Creating, Updating,
Failing, Degraded, or Down, its message holds the Ready reason and
message of the CamundaCluster. If the CamundaCluster has no Ready
condition yet, the message says so. With other reasons, such as
Error or PrerequisiteNotMet, the message gives that cause. While the
claim is deleted and waits for objects, Ready is False with the reason
Deleting, and the message names those objects.		 Optional: {}
environment string Environment is the Environment of the namespace when the claim was
created. It is empty when no Environment applied.		 Optional: {}
resolvedPolicy ResolvedPolicy ResolvedPolicy is the policy that the claim recorded from its
Environment at creation. A later change of the Environment does not
change it.		 Optional: {}
requests RequestStatus array Requests is the state of each PluginRequest of the claim. Optional: {}
cluster ClusterRef Cluster names the CamundaCluster of the claim. It is unset until the
claim controller writes the cluster.		 Optional: {}

CamundaManagementClusterClaim

CamundaManagementClusterClaim asks for a management plane that serves the clusters of one or more environments. The plane claim controller writes a CamundaManagementCluster with the name of the claim, and the PluginRequests of the selected sections. The name is a DNS-1035 label of at most 40 characters. The claim adds a suffix to it in the names of the resources that it writes.

Field Description Default Validation
apiVersion string fleet.camunda.io/v1alpha1
kind string CamundaManagementClusterClaim
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec CamundaManagementClusterClaimSpec spec is the management plane that the claim asks for Required: {}
status CamundaManagementClusterClaimStatus status is the state of the claim Optional: {}

CamundaManagementClusterClaimSpec

CamundaManagementClusterClaimSpec is the management plane that a team asks for. The plane claim controller writes one PluginRequest for each selected section and one CamundaManagementCluster with the name of the claim.

Appears in: - CamundaManagementClusterClaim

Field Description Default Validation
environments string array Environments are the names of the Environments that the plane serves.
The plane serves the CamundaClusters in the namespaces of these
environments. The claim controller refuses a name that no Environment
has, with the reason InvalidReference.		 MaxItems: 64
MinItems: 1
items:MaxLength: 63
items:MinLength: 1
clusterSelector LabelSelector ClusterSelector selects the CamundaClusters that Console and Web
Modeler serve, in the namespaces of the environments. An unset
selector selects no cluster. An empty selector ({}) selects every
cluster.		 Optional: {}
platformConfigRef string PlatformConfigRef names the CamundaPlatformConfig of the plane. Empty
means the platformConfigRef of the Environment of the namespace of the
claim.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Optional: {}
management ManagementOverrides Management holds the settings of the plane that the claim can set: the
identity provider, Management Identity, Console, and Web Modeler. The
versions are in versions. The database references come from the
management-database section.
versions ManagementVersions Versions holds the version of each component of the plane. The fleet
manager fills them from its images table, because Identity, Console,
and Web Modeler have their own version lines. For example, with
Camunda 8.9.23, Identity is 8.9.10.
plugins PluginSelection array Plugins holds the registration that the claim selects for each
section, for example access and management-database. The sections and
their registrations are fixed after creation. Only the parameters can
change.		 MaxItems: 32
Optional: {}
managementAuthConfigName string ManagementAuthConfigName is the name of the cluster-scoped
ManagementAuthConfig that the plane writes. A CamundaOptimize reads it
through its managementAuthRef. Empty means the name of the claim.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
Optional: {}
deletionPolicy DeletionPolicy DeletionPolicy says what happens to the resources of the
PluginRequests of the claim when the claim is deleted. Delete deletes
them. Orphan keeps them. Empty means the deletion default that the
claim recorded from its Environment at creation, or Delete when it
recorded none. The claim controller refuses Orphan with the reason
NotAllowed when a selected registration does not support it. The
CamundaManagementCluster is always deleted with the claim.		 Enum: [Delete Orphan]
Optional: {}
suspend boolean Suspend scales every workload of the plane to zero. The PluginRequests
do not change.		 Optional: {}

CamundaManagementClusterClaimStatus

CamundaManagementClusterClaimStatus is the state of a plane claim. The plane claim controller writes it.

Appears in: - CamundaManagementClusterClaim

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the plane claim
controller processed.		 Optional: {}
conditions Condition array Conditions report the state of the claim. Ready is False with the
reason NoEnvironment, UnknownEnvironment, NotAllowed, MissingInput,
InvalidReference, SlotConflict, or WiringCycle when the plane claim
controller refuses the claim. The message names the cause. Otherwise
Ready follows RequestsReady and ManagementClusterReady. When
ManagementClusterReady has the reason Creating, Updating, Failing,
Degraded, or Down, its message holds the Ready reason and message of
the CamundaManagementCluster. If the CamundaManagementCluster has no
Ready condition yet, the message says so. With other reasons, such as
Error or PrerequisiteNotMet, the message gives that cause. While the
claim is deleted and waits for objects, Ready is False with the reason
Deleting, and the message names those objects.		 Optional: {}
environment string Environment is the Environment of the namespace of the claim when the
claim was created.		 Optional: {}
resolvedPolicy ResolvedPolicy ResolvedPolicy is the policy of the environment when the claim was
created. A later change of the environment does not change it.		 Optional: {}
requests RequestStatus array Requests lists the PluginRequests of the claim, one for each selected
section.		 Optional: {}
managementCluster ManagementClusterRef ManagementCluster names the CamundaManagementCluster of the claim. It
has the name of the claim.		 Optional: {}

ClusterAttachments

ClusterAttachments are the resources that a claim attaches to its cluster.

Appears in: - CamundaClusterClaimSpec

Field Description Default Validation
optimize OptimizeAttachment Optimize adds a CamundaOptimize named <claim>-optimize that reads the
cluster. Unset, the claim has no Optimize.		 Optional: {}
backupSchedule BackupScheduleAttachment BackupSchedule adds a BackupSchedule named <claim>-backups for the
cluster. Unset, the claim has no backup schedule.		 Optional: {}

ConsoleOverrides

ConsoleOverrides configures Console for a plane claim. versions.console is required while it is set.

Appears in: - ManagementOverrides

Field Description Default Validation
externalUrl string ExternalURL is the URL where browsers reach Console. The claim
controller refuses this field with the reason SlotConflict when the
access section has a selection, because the access section then gives
the URL. Without a selection, set it here.		 Optional: {}
replicas integer Replicas is the number of pods of this process. Defaults to 1. On a
CamundaCluster it has no effect on an embedded web application.		 Minimum: 0
Optional: {}
resources ResourceRequirements Resources are the CPU and memory of the container of this process. Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of the container of this
process. On a CamundaCluster, an entry here wins over a top-level entry
with the same name. The entries of an embedded web application apply to
its host process.
The list merges by name under server-side apply. Each field manager owns
only the entries that it applies, so an extension controller can add its
own entry next to yours. One applied manifest cannot hold two entries
with the same name.
Two field managers that apply the same name do not conflict, because the
merge is per field inside the entry. One manager can own value and the
other valueFrom. A container rejects an entry that has both, so the API
server refuses to store such an entry.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of the
container of this process.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels of the pods of this process. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations of the pods of this process. In a
CamundaCluster, the keys camunda.io/config-hash and
camunda.io/service-account-hash belong to the operator, and a value for
them does not reach the pods.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the pods of this process.
When set, it replaces all other scheduling blocks for this process, with
no merge. On a CamundaCluster, these are the top-level block and the
block of a preset.		 Optional: {}

Environment

Environment sets the policy for the claims in its namespaces. The policy names the releases, presets, and plugin registrations that a claim can use. It also sets the parameter values and the deletion default. A namespace belongs to the Environment that its label fleet.camunda.io/environment names. Without any Environment, the modes and the parameter values of the registrations apply. The name is at most 63 characters, because other objects carry it in a label value.

Field Description Default Validation
apiVersion string fleet.camunda.io/v1alpha1
kind string Environment
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec EnvironmentSpec spec is the policy of the environment Required: {}
status EnvironmentStatus status is the state of the environment Optional: {}

EnvironmentPresets

EnvironmentPresets lists the presets that the claims of an environment can use, for each preset kind.

Appears in: - EnvironmentSpec

Field Description Default Validation
camundaCluster string array CamundaCluster are the names of the CamundaClusterPresets that a
cluster claim can use.		 items:MinLength: 1
Optional: {}
elasticsearchCluster string array ElasticsearchCluster are the names of the ElasticsearchClusterPresets
that the built-in Elasticsearch of a claim can use.		 items:MinLength: 1
Optional: {}
databaseServer string array DatabaseServer are the names of the DatabaseServerPresets that the
built-in PostgreSQL of a claim can use.		 items:MinLength: 1
Optional: {}

EnvironmentReleases

EnvironmentReleases lists the releases that the claims of an environment can use.

Appears in: - EnvironmentSpec

Field Description Default Validation
allowed string array Allowed are the names of the CamundaReleases that a claim can use. MaxItems: 64
items:MaxLength: 253
items:MinLength: 1
Optional: {}
default string Default is the release of a claim that names none. It is one of
allowed.		 MaxLength: 253
Optional: {}

EnvironmentSpec

EnvironmentSpec is the policy that an Environment sets for the claims in its namespaces. A namespace belongs to the Environment that its label fleet.camunda.io/environment names.

Appears in: - Environment

Field Description Default Validation
displayName string DisplayName is the name that the fleet manager shows for the
environment, at most 64 characters. It changes nothing for a claim.		 MaxLength: 64
Optional: {}
color string Color is the color that the fleet manager shows for the environment,
as a hex color such as #2E7D32. It changes nothing for a claim.		 Pattern: ^#[0-9a-fA-F]\{6\}$
Optional: {}
platformConfigRef string PlatformConfigRef names the CamundaPlatformConfig of a claim of the
environment that names none itself.		 Optional: {}
presets EnvironmentPresets Presets lists, for each preset kind, the presets that a claim of the
environment can use. The claim controller checks a new claim, and a
preset change of an existing claim, against the current lists.		 Optional: {}
releases EnvironmentReleases Releases lists the CamundaReleases that a claim of the environment can
use. The claim controller checks a new claim, and a release change of
an existing claim, against the current list.		 Optional: {}
sections object (keys:string, values:SectionPolicy) Sections holds the policy of each PluginSection, by section name. A
claim of the environment can select only a registration that the
policy of its section allows. A section that is not listed offers
only the empty option. A change applies to new claims only.		 MaxProperties: 64
Optional: {}
parameters object (keys:string, values:ParameterPolicies) Parameters holds the policy of the parameters of each
PluginRegistration, by registration name and then by parameter name.
A parameter without a policy keeps the value of its registration, and
a claim cannot change it. A change applies to new claims only.		 MaxProperties: 64
Optional: {}
deletionPolicy DeletionPolicy DeletionPolicy is the deletion policy of a claim of the environment
that sets none itself. Delete deletes the resources of its plugin
requests with the claim. Orphan keeps them. Unset means Delete. A
change applies to new claims only.		 Delete Enum: [Delete Orphan]
Optional: {}
namespaceCreation NamespaceCreation NamespaceCreation lets the create flow of the fleet manager create a
namespace in the environment. Unset, the create flow cannot create a
namespace.		 Optional: {}

EnvironmentStatus

EnvironmentStatus is the state of an Environment. The environment controller writes it.

Appears in: - Environment

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation that the environment
controller processed.		 Optional: {}
conditions Condition array Conditions report the state of the environment. Ready is False with
reason InvalidReference when a release, preset, platform config,
section, or registration that the spec names does not exist. The
message names each missing object.		 Optional: {}
namespaces integer Namespaces is the number of namespaces that carry the label of this
environment. It is unset until the environment controller counts the
namespaces.		 Optional: {}

IdentityOverrides

IdentityOverrides configures Management Identity for a plane claim.

Appears in: - ManagementOverrides

Field Description Default Validation
externalUrl string ExternalURL is the URL where browsers reach Management Identity. A URL
with a path other than / must use https. The claim controller refuses
this field with the reason SlotConflict when the access section has a
selection, because the access section then gives the URL. Without a
selection, set it here.		 Optional: {}
admin IdentityAdminSpec Admin names the first administrator of the plane. Set claimName and
claimValue in the oidc mode, and username in the Keycloak modes.
Management Identity reads it only on its first start.
replicas integer Replicas is the number of pods of this process. Defaults to 1. On a
CamundaCluster it has no effect on an embedded web application.		 Minimum: 0
Optional: {}
resources ResourceRequirements Resources are the CPU and memory of the container of this process. Optional: {}
extraEnv EnvVar array ExtraEnv are extra environment variables of the container of this
process. On a CamundaCluster, an entry here wins over a top-level entry
with the same name. The entries of an embedded web application apply to
its host process.
The list merges by name under server-side apply. Each field manager owns
only the entries that it applies, so an extension controller can add its
own entry next to yours. One applied manifest cannot hold two entries
with the same name.
Two field managers that apply the same name do not conflict, because the
merge is per field inside the entry. One manager can own value and the
other valueFrom. A container rejects an entry that has both, so the API
server refuses to store such an entry.		 Optional: {}
extraEnvFrom EnvFromSource array ExtraEnvFrom are extra environment sources (ConfigMaps, Secrets) of the
container of this process.		 Optional: {}
podLabels object (keys:string, values:string) PodLabels are extra labels of the pods of this process. Optional: {}
podAnnotations object (keys:string, values:string) PodAnnotations are extra annotations of the pods of this process. In a
CamundaCluster, the keys camunda.io/config-hash and
camunda.io/service-account-hash belong to the operator, and a value for
them does not reach the pods.		 Optional: {}
scheduling SchedulingSpec Scheduling holds the scheduling constraints of the pods of this process.
When set, it replaces all other scheduling blocks for this process, with
no merge. On a CamundaCluster, these are the top-level block and the
block of a preset.		 Optional: {}

KeycloakOverrides

KeycloakOverrides configures the Keycloak that the operator runs for a plane claim.

Appears in: - ManagementIdentityProvider

Field Description Default Validation
externalUrl string ExternalURL is the URL where browsers reach Keycloak, with the /auth
path and no query and no fragment. The claim controller refuses this
field with the reason SlotConflict when the access section has a
selection, because the access section then gives the URL. Without a
selection, set it here.		 Optional: {}
replicas integer Replicas is the number of Keycloak instances. Defaults to 1. Minimum: 0
Optional: {}
resources ResourceRequirements Resources are the CPU and memory of the Keycloak container. Optional: {}
scheduling SchedulingSpec Scheduling constraints of the Keycloak pods. Optional: {}

LabelValue

Underlying type: string

LabelValue is the value of a Kubernetes label.

Validation: - MaxLength: 63 - Pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$

Appears in: - NamespaceCreation

ManagementClusterRef

ManagementClusterRef names a CamundaManagementCluster in the namespace of the claim.

Appears in: - CamundaManagementClusterClaimStatus

Field Description Default Validation
name string Name is the name of the CamundaManagementCluster. MinLength: 1

ManagementIdentityProvider

ManagementIdentityProvider holds one of the three identity provider modes of a plane claim.

Appears in: - ManagementOverrides

Field Description Default Validation
keycloak KeycloakOverrides Keycloak runs Keycloak through the Keycloak Operator. The Keycloak
Operator must be installed on the Kubernetes cluster. versions.keycloak
is required in this mode.		 Optional: {}
externalKeycloak ExternalKeycloakSpec ExternalKeycloak connects Management Identity to a Keycloak that you
run.		 Optional: {}
oidc ManagementOIDCSpec OIDC connects Management Identity to the identity provider of the
CamundaPlatformConfig of the plane.		 Optional: {}

ManagementOverrides

ManagementOverrides holds the settings of a management plane that a plane claim can set. The claim controller writes them to the CamundaManagementCluster.

Appears in: - CamundaManagementClusterClaimSpec

Field Description Default Validation
identityProvider ManagementIdentityProvider IdentityProvider selects where users sign in. Exactly one of keycloak,
externalKeycloak, or oidc is set. The mode can change after creation.
identity IdentityOverrides Identity configures Management Identity. The plane always runs it.
console ConsoleOverrides Console configures Console. While it is unset, the plane has no
Console.		 Optional: {}
webModeler WebModelerOverrides WebModeler configures Web Modeler. While it is unset, the plane has no
Web Modeler.		 Optional: {}

ManagementVersions

ManagementVersions holds the version of each component of a plane claim, each as a full semantic version.

Appears in: - CamundaManagementClusterClaimSpec

Field Description Default Validation
identity string Identity is the Management Identity version, for example 8.9.10. Pattern: ^\d+\.\d+\.\d+$
keycloak string Keycloak is the Keycloak version. It is required in the keycloak mode.
Camunda 8.9 supports only Keycloak 26.		 Pattern: ^\d+\.\d+\.\d+$
Optional: {}
console string Console is the Console version. It is required while
management.console is set.		 Pattern: ^\d+\.\d+\.\d+$
Optional: {}
webModeler string WebModeler is the Web Modeler version. It is required while
management.webModeler is set.		 Pattern: ^\d+\.\d+\.\d+$
Optional: {}

NamedValue

NamedValue is one choice of a claim-editable parameter.

Appears in: - ParameterPolicy

Field Description Default Validation
name string Name is what the claim stores when it picks the choice, for example
sqs. It is unique in the list.		 MaxLength: 63
MinLength: 1
label string Label is what the fleet manager shows for the choice, for example SQS
access.		 MaxLength: 64
MinLength: 1
value JSON Value is what the request gets, for example the ARN of a policy. It
can be any JSON value.

NamespaceCreation

NamespaceCreation controls how the create flow of the fleet manager creates a namespace in an environment. The create flow always sets the label fleet.camunda.io/environment on the new namespace.

Appears in: - EnvironmentSpec

Field Description Default Validation
allowed boolean Allowed lets the create flow create a namespace in the environment. Optional: {}
labels object (keys:string, values:LabelValue) Labels are fixed labels of a new namespace. Each is a valid label. The
label fleet.camunda.io/environment is not allowed here, because the
create flow sets it.		 MaxProperties: 32
Optional: {}
requiredLabelKeys string array RequiredLabelKeys are label keys, for example team. The create flow
asks for a value of each key and sets the label on the new namespace.
Each key is a valid label key. The key fleet.camunda.io/environment is
not allowed here.		 MaxItems: 16
items:MaxLength: 317
Optional: {}

OptimizeAttachment

OptimizeAttachment holds the CamundaOptimize fields that a claim can set. The claim controller sets the version from the release and the cluster reference to the cluster of the claim.

Appears in: - ClusterAttachments

Field Description Default Validation
managementAuthConfigRef string ManagementAuthConfigRef names the cluster-scoped ManagementAuthConfig
that Optimize signs in against. The claim controller writes it to
managementAuthRef of the CamundaOptimize.		 MaxLength: 253
MinLength: 1
Required: {}
externalUrl string ExternalURL is the URL where browsers reach this Optimize, with the
rules of externalUrl on the CamundaOptimize. The claim controller
refuses it with reason SlotConflict when the access section has a
selection, because that section fills it.		 Optional: {}
webapp WorkloadSpec Webapp configures the Deployment that serves the Optimize user
interface.		 Optional: {}
importer WorkloadSpec Importer configures the Deployment that imports the cluster data into
the Optimize indices. Optimize supports one active importer, so
replicas must be 0 or 1.		 Optional: {}
indexReplicas integer IndexReplicas is the replica count of each Optimize index. Unset, the
storage of the cluster gives the count, as on the CamundaOptimize.		 Minimum: 0
Optional: {}
monitoring OptimizeMonitoringSpec Monitoring configures the monitoring integrations of Optimize. Optional: {}

ParameterPolicies

Underlying type: object (keys:string, values:ParameterPolicy)

ParameterPolicies holds the policy of each parameter of one PluginRegistration, by parameter name.

Validation: - MaxProperties: 64

Appears in: - EnvironmentSpec - ResolvedPolicy

ParameterPolicy

ParameterPolicy is the policy of an Environment for one parameter of a PluginRegistration.

Appears in: - ParameterPolicies

Field Description Default Validation
value JSON Value replaces the value that the registration gives the parameter. Optional: {}
claimEditable boolean ClaimEditable lets a claim of the environment change the parameter.
Without it, the claim gets the value of the policy or of the
registration.		 Optional: {}
allowed NamedValue array Allowed are the choices that a claim can pick for the parameter. The
claim stores the name of a choice, or a list of names for an array
parameter. The claim controller puts the value of each choice in the
request, and refuses an unknown name with NotAllowed. Allowed needs
claimEditable.		 MaxItems: 32
Optional: {}

PluginSelection

PluginSelection is the registration that a claim selects for one section.

Appears in: - CamundaClusterClaimSpec - CamundaManagementClusterClaimSpec

Field Description Default Validation
section string Section is the name of the PluginSection. MaxLength: 253
MinLength: 1
registration string Registration is the name of the PluginRegistration. MaxLength: 253
MinLength: 1
parameters JSON Parameters are the parameter values of the selection. Only the
claim-editable parameters of the policy can differ from the policy
values. The claim controller refuses another change with NotAllowed.		 Optional: {}

RequestStatus

RequestStatus is the state of one PluginRequest of a claim.

Appears in: - CamundaClusterClaimStatus - CamundaManagementClusterClaimStatus

Field Description Default Validation
section string Section is the name of the PluginSection of the request.
registration string Registration is the name of the PluginRegistration of the request.
name string Name is the name of the PluginRequest.
outputsReady ConditionStatus OutputsReady is the status of the OutputsReady condition of the
request.		 Optional: {}
ready ConditionStatus Ready is the status of the Ready condition of the request. Optional: {}

ResolvedPolicy

ResolvedPolicy is the policy that a claim recorded from its environment at creation. A later change of the environment does not change it.

Appears in: - CamundaClusterClaimStatus - CamundaManagementClusterClaimStatus

Field Description Default Validation
sections object (keys:string, values:SectionPolicy) Sections holds the policy of each section, by section name. MaxProperties: 64
Optional: {}
parameters object (keys:string, values:ParameterPolicies) Parameters holds the parameter values and the claim-editable
parameters, by registration name.		 MaxProperties: 64
Optional: {}
deletionPolicy DeletionPolicy DeletionPolicy is the deletion default of the environment. Enum: [Delete Orphan]
Optional: {}

SectionPolicy

SectionPolicy is the policy of an Environment for one PluginSection.

Appears in: - EnvironmentSpec - ResolvedPolicy

Field Description Default Validation
required boolean Required makes a claim of the environment select a registration of the
section. The fleet manager then hides the empty option.		 Optional: {}
default string Default is the registration that the create flow of the fleet manager
preselects. It is empty or one of allowed.		 MaxLength: 253
Optional: {}
allowed string array Allowed are the names of the PluginRegistrations of the section that a
claim of the environment can select. With no item, a claim can select
only the empty option.		 MaxItems: 64
items:MaxLength: 253
items:MinLength: 1
Optional: {}

WebModelerOverrides

WebModelerOverrides configures Web Modeler for a plane claim. versions.webModeler is required while it is set.

Appears in: - ManagementOverrides

Field Description Default Validation
externalUrl string ExternalURL is the URL where browsers reach Web Modeler. The claim
controller refuses this field with the reason SlotConflict when the
access section has a selection, because the access section then gives
the URL. Without a selection, set it here.		 Optional: {}
websocketsExternalUrl string WebsocketsExternalURL is the URL where browsers get the live updates
of Web Modeler. The claim controller refuses this field with the
reason SlotConflict when the access section has a selection, because
the access section then gives the URL. Without a selection, set it
here.		 Optional: {}
mail WebModelerMailSpec Mail configures the SMTP server that Web Modeler sends notifications
through. Web Modeler does not start without it.
restapi WorkloadSpec Restapi configures the workload of the restapi process. Optional: {}
websockets WorkloadSpec Websockets configures the workload of the websockets process. Optional: {}

plugins.camunda.io/v1alpha1

Package v1alpha1 contains API Schema definitions for the plugins v1alpha1 API group. The kinds of this group connect the claims of the fleet manager to the plugin controllers that serve them.

The v1alpha1 version has no compatibility promise. A later release can change or remove any type, field, or value of this package.

Resource Types

Choice

Choice is a preset or an existing resource that a claim can pick for a parameter of a registration.

Appears in: - PluginRegistrationSpec

Field Description Default Validation
name string Name is the value that the claim stores when it picks the choice. MinLength: 1
specs ChoiceSpec array Specs are the facts that the fleet manager shows for the choice, for
example the version, the node count, or the memory.		 Optional: {}

ChoiceSpec

ChoiceSpec is one fact of a choice.

Appears in: - Choice

Field Description Default Validation
label string Label names the fact. MinLength: 1
value string Value is the value of the fact.

ClaimKind

Underlying type: string

ClaimKind names a claim kind of the fleet.camunda.io group.

Validation: - Enum: [CamundaClusterClaim CamundaManagementClusterClaim]

Appears in: - ClaimRef - PluginSectionSpec

Field Description
CamundaClusterClaim ClaimKindCamundaClusterClaim is the claim of a CamundaCluster.
CamundaManagementClusterClaim ClaimKindCamundaManagementClusterClaim is the claim of a
CamundaManagementCluster.

ClaimRef

ClaimRef names the claim that wrote a request.

Appears in: - PluginRequestSpec

Field Description Default Validation
kind ClaimKind Kind is the kind of the claim. Enum: [CamundaClusterClaim CamundaManagementClusterClaim]
name string Name is the name of the claim, in the namespace of the request. MinLength: 1

ControllerInfo

ControllerInfo identifies the plugin controller that serves a registration.

Appears in: - PluginRegistrationSpec

Field Description Default Validation
name string Name is the name of the plugin controller. MinLength: 1
version string Version is the version of the plugin controller, from its build info. Optional: {}

DeletionPolicy

Underlying type: string

DeletionPolicy says what happens to the resources of a request when the request is deleted.

Validation: - Enum: [Delete Orphan]

Appears in: - CamundaClusterClaimSpec - CamundaManagementClusterClaimSpec - EnvironmentSpec - PluginRegistrationSpec - PluginRequestSpec - ResolvedPolicy

Field Description
Delete DeletionPolicyDelete deletes the resources that the plugin wrote.
Orphan DeletionPolicyOrphan keeps the resources and removes their owner
reference to the request.

Grant

Grant asks the identity of a cluster for one permission on behalf of a PluginRequest. A plugin controller writes the spec, and the identity extension of the cluster writes the status. The name is at most 63 characters, because other objects carry it in a label value.

Field Description Default Validation
apiVersion string plugins.camunda.io/v1alpha1
kind string Grant
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec GrantSpec spec defines the desired state of Grant Required: {}
status GrantStatus status defines the observed state of Grant Optional: {}

GrantFormat

Underlying type: string

GrantFormat is the format of the fragment of a grant. A later version adds gcp-iam-binding and azure-role-assignment.

Validation: - Enum: [aws-iam-statement]

Appears in: - GrantSpec - GrantTemplate

Field Description
aws-iam-statement

GrantSpec

GrantSpec is the desired state of a Grant. A plugin controller writes it.

Appears in: - Grant

Field Description Default Validation
cluster ClusterRef Cluster names the CamundaCluster whose identity gets the permission,
in the namespace of the grant. It cannot change after the grant is
created.
template string Template is the name of the grant template in the registration that
the fragment is rendered from. It cannot change after the grant is
created.		 MinLength: 1
format GrantFormat Format is the format of the fragment. It cannot change after the
grant is created.		 Enum: [aws-iam-statement]
fragment JSON Fragment is one permission statement, filled in from the template. It
is a JSON object.		 Type: object

GrantStatus

GrantStatus is the observed state of a Grant. The identity extension of the cluster writes it.

Appears in: - Grant

Field Description Default Validation
conditions Condition array Conditions are Applied, MatchesTemplate, and Ready. Applied is False
with reason OverCeiling, OverSizeLimit, or Rejected when the identity
extension refuses the fragment. MatchesTemplate is False with reason
TemplateChanged when the fragment no longer matches its template.
Ready is True with reason Healthy when both are True. Otherwise Ready
has the reason and the message of the first of them that is False.		 Optional: {}

GrantTemplate

GrantTemplate is one permission statement that a registration asks for, with placeholders that the plugin fills for each request.

Appears in: - PluginRegistrationSpec

Field Description Default Validation
name string Name is the name of the template. A Grant names the template it was
rendered from.		 MinLength: 1
format GrantFormat Format is the format of the statement. Enum: [aws-iam-statement]
template JSON Template is the statement, with Go template placeholders such as
{{ .parameters.x }} and {{ .outputs.x }}. It is a JSON object, like
the fragment of a Grant.		 Type: object
description string Description says what the permission is for. Optional: {}
requiresInputs string array RequiresInputs names the inputs that must have a value before the
plugin writes the grant.		 MaxItems: 32
items:MaxLength: 63
Optional: {}

InputDecl

InputDecl declares a value that a registration reads from the output of another section.

Appears in: - PluginRegistrationSpec

Field Description Default Validation
name string Name is the name of the input. The request carries its value under
this name.		 MaxLength: 63
MinLength: 1
from string From names the output that gives the value, in the form
<section>/<output>.		 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/[A-Za-z][A-Za-z0-9]*$
required boolean Required refuses a selection of the option when the input has no value. Optional: {}
formats string array Formats lists the formats of the value that the registration accepts,
for example aws-kms-arn. Empty accepts every format.		 Optional: {}

Limit

Limit is a value that the plugin chart fixes, which no Environment and no claim can change.

Appears in: - PluginRegistrationSpec

Field Description Default Validation
label string Label names the limit. MinLength: 1
value string Value is the value of the limit.
description string Description says what the limit means for a claim. Optional: {}

Link is a named URL that a plugin reports for a request, for example the console page of a bucket.

Appears in: - PluginRequestStatus

Field Description Default Validation
name string Name names the link. MinLength: 1
url string URL is the address of the link. MinLength: 1

MetricQuery

MetricQuery is a Prometheus query that the fleet manager shows for a request of the registration.

Appears in: - PluginRegistrationSpec

Field Description Default Validation
label string Label names the metric. MinLength: 1
query string Query is PromQL with Go template placeholders, for example
{{ .namespace }} and {{ .pods }}.		 MinLength: 1
unit string Unit is the unit of the value, for example bytes. Optional: {}

Mode

Underlying type: string

Mode is the fallback of a registration when no Environment exists.

Validation: - Enum: [Default Optional]

Appears in: - PluginRegistrationSpec

Field Description
Default ModeDefault selects the option in a new claim.
Optional ModeOptional offers the option, and a new claim does not select it.

OnOrphan

Underlying type: string

OnOrphan says what happens to a resource of a request with the deletion policy Orphan.

Validation: - Enum: [Kept Deleted]

Appears in: - ResourceRef

Field Description
Kept OnOrphanKept keeps the resource.
Deleted OnOrphanDeleted deletes the resource, for example a route to a Service
that is gone.

OutputDecl

OutputDecl declares a value that a plugin writes to the status of a request.

Appears in: - PluginRegistrationSpec - PluginSectionSpec

Field Description Default Validation
key string Key is the key of the output in the status of the request. It starts
with a letter and holds only letters and digits.		 Pattern: ^[A-Za-z][A-Za-z0-9]*$
description string Description says what the value is. Optional: {}
format string Format is the format of the value, for example aws-kms-arn. Optional: {}

PluginRegistration

PluginRegistration is one option that a plugin offers to the sections of the create flow of a claim. The plugin controller writes it at startup from its chart values, and the operator writes the built-in registrations. The name is at most 63 characters, because other objects carry it in a label value.

Field Description Default Validation
apiVersion string plugins.camunda.io/v1alpha1
kind string PluginRegistration
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec PluginRegistrationSpec spec defines the option Required: {}
status PluginRegistrationStatus status defines the observed state of PluginRegistration Optional: {}

PluginRegistrationSpec

PluginRegistrationSpec describes one option that a plugin offers in one or more sections: what it needs, what it writes, and which permissions it asks for.

Appears in: - PluginRegistration

Field Description Default Validation
sections string array Sections lists the names of the PluginSections that the option serves.
label string Label is the name of the option in the fleet manager. It names the
outcome, for example "New S3 bucket". Display only. No controller reads
it.		 MinLength: 1
description string Description says what the option does. Display only. No controller
reads it.		 Optional: {}
docsUrl string DocsURL is the address of the documentation of the option. Display
only. No controller reads it.		 Optional: {}
mode Mode Mode says whether a new claim selects the option when no Environment
exists.		 Enum: [Default Optional]
controller ControllerInfo Controller names the plugin controller that serves the option and its
version. Display only. No controller reads it.		 Optional: {}
serviceAccount ServiceAccountRef ServiceAccount is the ServiceAccount of the plugin controller. The app
shows it. The API server admits a Grant for the option only from a
requester that has the RBAC verb serve on this registration.
operatorVersions string OperatorVersions is the semver range of the operator versions that the
plugin supports, for example ">=0.3.0 <1.0.0". The operator reports a
range that does not hold its version, or that is not a valid range.		 Optional: {}
parameters JSON Parameters is the OpenAPI v3 schema of the parameters of a request for
the option.		 Optional: {}
parameterValues JSON ParameterValues are the parameter values that the admin set in the
plugin chart. An Environment can override them.		 Optional: {}
claimEditable string array ClaimEditable lists the parameters that a claim can change when no
Environment says otherwise.		 Optional: {}
choices Choice array Choices are the presets or existing resources that a claim can pick
for a parameter. The claim stores the name of the pick in its
parameters. Display only. No controller reads it.		 Optional: {}
inputs InputDecl array Inputs declares the values that the option reads from the outputs of
other sections. Each name is unique.		 MaxItems: 32
Optional: {}
outputs OutputDecl array Outputs declares the values that the plugin writes to the status of a
request. It includes the outputs of each section that the option
serves. Each key is unique.		 Optional: {}
limits Limit array Limits are the values that the plugin chart fixes, which no
Environment and no claim can change, for example a permissions
boundary. The plugin enforces them from its chart. Display only. No
controller reads it.		 Optional: {}
grantTemplates GrantTemplate array GrantTemplates are the permission statements that the option asks for,
one Grant for each template. Each name is unique.		 MaxItems: 32
Optional: {}
deletionPolicies DeletionPolicy array DeletionPolicies lists the deletion policies that the plugin supports.
Every plugin supports Delete.		 Enum: [Delete Orphan]
MaxItems: 2
metricQueries MetricQuery array MetricQueries are the Prometheus queries that the fleet manager shows
for a request of the option. Display only. No controller reads it.		 Optional: {}

PluginRegistrationStatus

PluginRegistrationStatus is the observed state of a PluginRegistration.

Appears in: - PluginRegistration

Field Description Default Validation
observedGeneration integer ObservedGeneration is the last generation of the registration that the
plugin controller processed. Only the plugin controller sets it, so the
field is absent until the plugin controller processes the registration.
The operator is the plugin controller of the built-in registrations
whose requests it serves.		 Optional: {}
conditions Condition array Conditions holds Accepted and Ready. The operator sets Accepted. Its
False reasons are SectionMissing, OperatorVersionUnsupported, and
DefaultConflict. The plugin controller sets Ready from its health and
its credentials. On the built-in registrations whose requests the
operator serves, the operator sets Ready. The fleet manager offers the
option only when both are True.		 Optional: {}

PluginRequest

PluginRequest asks a plugin for the resources of one section of a claim. A claim controller writes the spec, and the plugin controller that serves the registration writes the status. The claim names a request <claim>-<section>, or <claim>-<section>-<registration> in a section with selection Many. The name is at most 63 characters, because other objects carry it in a label value. A longer name is cut and ends with a hash.

Field Description Default Validation
apiVersion string plugins.camunda.io/v1alpha1
kind string PluginRequest
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec PluginRequestSpec spec defines the desired state of PluginRequest Required: {}
status PluginRequestStatus status defines the observed state of PluginRequest Optional: {}

PluginRequestSpec

PluginRequestSpec is the desired state of a PluginRequest. A claim controller writes it.

Appears in: - PluginRequest

Field Description Default Validation
section string Section is the name of the PluginSection that the request fills. It
cannot change after the request is created.		 MinLength: 1
registration string Registration is the name of the PluginRegistration that serves the
request. It cannot change after the request is created.		 MinLength: 1
claimRef ClaimRef ClaimRef names the claim that wrote the request. It cannot change
after the request is created.
target TargetRef Target names the resource that the request serves, before the
resource exists. target.kind and target.name cannot change after the
request is created.
inputs object (keys:string, values:string) Inputs are the values of the inputs of the registration, by input
name. The claim controller resolves them from the outputs of other
requests of the same claim.		 Optional: {}
parameters JSON Parameters are the settings of the request, as free-form JSON. The
plugin checks them against the parameter schema of the registration.		 Optional: {}
deletionPolicy DeletionPolicy DeletionPolicy says what the plugin does with the resources of the
request when the request is deleted. The claim controller copies it
from the claim before it deletes the request.		 Enum: [Delete Orphan]

PluginRequestStatus

PluginRequestStatus is the observed state of a PluginRequest. The plugin controller that serves the registration writes it.

Appears in: - PluginRequest

Field Description Default Validation
observedGeneration integer ObservedGeneration is the generation of the spec that the plugin
processed last.		 Optional: {}
conditions Condition array Conditions are OutputsReady and Ready. OutputsReady is True when the
outputs are written for the current generation. Ready is False with
reason GrantRejected while a Grant of the request has Ready=False.
Ready is False with reason WaitingForGrants while no Grant of the
request has Ready=False and a Grant does not have Ready=True yet. Ready
is False with reason WaitingForEndpoints while an access request waits
for the endpoints of its target. Ready is False with reason
InvalidParameters when the parameters do not pass the registration.
The plugin sets the other reasons.		 Optional: {}
outputs object (keys:string, values:string) Outputs are the values that the plugin publishes for the request, by
output key. A reader trusts them only while OutputsReady is True and
the observedGeneration of that condition equals metadata.generation.		 Optional: {}
summary SummaryItem array Summary is a list of facts about the request, for display only. No
controller reads it. The first item is the headline.		 Optional: {}
summaryTime Time SummaryTime is when the plugin wrote the summary last, for display
only.		 Optional: {}
links Link array Links are named URLs about the request, for example the console page
of a bucket, for display only.		 Optional: {}
podSelector LabelSelector PodSelector selects the pods that the plugin runs for the request, for
display only.		 Optional: {}
resources ResourceRef array Resources are the resources that the plugin made for the request, in
the cluster or in a cloud, for display only.		 Optional: {}

PluginSection

PluginSection is one section of the create flow of a claim, such as "Backup storage" or "Access". The operator writes the core sections, and a plugin chart writes a section that it brings. The name is at most 63 characters, because other objects carry it in a label value.

Field Description Default Validation
apiVersion string plugins.camunda.io/v1alpha1
kind string PluginSection
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec PluginSectionSpec spec defines the section Required: {}

PluginSectionSpec

PluginSectionSpec describes one section of the create flow of a claim. The registrations that serve the section are its options.

Appears in: - PluginSection

Field Description Default Validation
label string Label is the name of the section in the fleet manager, for example
"Backup storage". Display only. No controller reads it.		 MinLength: 1
description string Description says what the section is for. Display only. No controller
reads it.		 Optional: {}
order integer Order is the position of the section in the create flow. A section
with a lower value comes first. Display only. No controller reads it.		 Optional: {}
selection Selection Selection says how many options of the section one claim can select. Enum: [One Many]
emptyOptionLabel string EmptyOptionLabel is the label of the option that selects nothing, for
example "No backups". When it is empty, the section has no empty
option. Display only. No controller reads it.		 Optional: {}
slot Slot Slot names the fields of the generated resource that the outputs of
the section fill. When it is empty, the outputs are only inputs of
other registrations.		 Enum: [workloadIdentity volumeEncryption backupStorage secondaryStorage externalAccess managementDatabases connectorsIdentity]
Optional: {}
appliesTo ClaimKind array AppliesTo lists the claim kinds that can select an option of the
section. A claim of another kind that selects one is refused with
NotAllowed. For that kind, the section is never required, also when the
Environment marks it required.		 Enum: [CamundaClusterClaim CamundaManagementClusterClaim]
outputs OutputDecl array Outputs declares the outputs that every registration of the section
writes.		 Optional: {}

ResourceRef

ResourceRef is one resource that a plugin made for a request, in the cluster or in a cloud.

Appears in: - PluginRequestStatus

Field Description Default Validation
kind string Kind is the kind of the resource, for example S3Bucket or StorageClass. MinLength: 1
name string Name is the name of the resource. MinLength: 1
id string ID is the identifier of the resource in its system, for example an ARN. Optional: {}
location string Location is where the resource is, for example a cloud region. Optional: {}
role string Role says what the resource does for the request. Optional: {}
onOrphan OnOrphan OnOrphan says what happens to the resource with the deletion policy
Orphan.		 Enum: [Kept Deleted]

Selection

Underlying type: string

Selection says how many options of a section one claim can select.

Validation: - Enum: [One Many]

Appears in: - PluginSectionSpec

Field Description
One SelectionOne lets a claim select at most one option of the section.
Many SelectionMany lets a claim select more than one option of the section.

ServiceAccountRef

ServiceAccountRef names a ServiceAccount in a named namespace.

Appears in: - PluginRegistrationSpec

Field Description Default Validation
namespace string Namespace is the namespace of the ServiceAccount. MaxLength: 63
MinLength: 1
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
name string Name is the name of the ServiceAccount. MaxLength: 253
MinLength: 1
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

Severity

Underlying type: string

Severity is the weight of a summary item.

Validation: - Enum: [Info Warning Error]

Appears in: - SummaryItem

Field Description
Info SeverityInfo is a fact that needs no action.
Warning SeverityWarning is a fact that needs attention soon.
Error SeverityError is a fact that needs action now.

Slot

Underlying type: string

Slot names the fields of the generated resource that the outputs of a section fill. The set is closed.

Validation: - Enum: [workloadIdentity volumeEncryption backupStorage secondaryStorage externalAccess managementDatabases connectorsIdentity]

Appears in: - PluginSectionSpec

Field Description
workloadIdentity SlotWorkloadIdentity fills the ServiceAccount annotations of the cluster.
volumeEncryption SlotVolumeEncryption fills the storage class of the Zeebe volumes.
backupStorage SlotBackupStorage fills the backup storage reference of the cluster.
secondaryStorage SlotSecondaryStorage fills the secondary storage reference of the cluster.
externalAccess SlotExternalAccess fills the external URLs of a cluster or a
management cluster.
managementDatabases SlotManagementDatabases fills the database references of Keycloak,
Identity, and Web Modeler in a management cluster.
connectorsIdentity SlotConnectorsIdentity fills the ServiceAccount annotations of the
Connectors.

SummaryItem

SummaryItem is one fact that a plugin reports about a request.

Appears in: - PluginRequestStatus

Field Description Default Validation
label string Label names the fact. MinLength: 1
value string Value is the value of the fact.
severity Severity Severity is the weight of the fact. The fleet manager lists Warning
and Error items as warnings.		 Info Enum: [Info Warning Error]
Optional: {}

TargetRef

TargetRef names the resource that a request serves. The claim names it before the resource exists.

Appears in: - PluginRequestSpec

Field Description Default Validation
kind string Kind is the kind of the resource, for example CamundaCluster. MinLength: 1
name string Name is the name of the resource, in the namespace of the request. MinLength: 1
serviceAccountName string ServiceAccountName is the ServiceAccount that the pods of the resource
run under.		 MaxLength: 253
Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
Optional: {}
additionalServiceAccounts string array AdditionalServiceAccounts are the names of more ServiceAccounts that
the cloud identity of the request also trusts. Examples are the
ServiceAccounts of the built-in storage that takes the backup storage
input. Each name is a ServiceAccount in the namespace of the request.
A name with a namespace part is refused, so that a request never makes
a cloud identity trust a ServiceAccount of another namespace.		 items:MaxLength: 253
items:Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
Optional: {}