Skip to content

API Reference#

Tenant Operator#

Packages#

tenantoperator.stakater.com/v1alpha1#

Package v1alpha1 contains API Schema definitions for the tenantoperator v1alpha1 API group

Extensions#

Extensions is the Schema for the extensions API

Field Description Default Validation
apiVersion string tenantoperator.stakater.com/v1alpha1
kind string Extensions
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec ExtensionsSpec
status ExtensionsStatus
ExtensionsSpec#

ExtensionsSpec defines the desired state of Extensions

Appears in: - Extensions

Field Description Default Validation
tenantName string TenantName is the name of the tenant to which the extension belongs Required: {}
argoCD ArgoCDConfig ArgoCDConfig defines ArgoCD configurations for the tenant
ArgoCDConfig#

ArgoCDConfig contains details about source repositories and AppProjects

Appears in: - ExtensionsSpec

Field Description Default Validation
appProject AppProjectConfig AppProject contains details about argocd AppProjects
onDeletePurgeAppProject boolean OnDeletePurgeAppProject is used to enable or disable the AppProject purge feature Optional: {}
AppProjectConfig#

AppProject contains details about argocd AppProjects

Appears in: - ArgoCDConfig

Field Description Default Validation
sourceRepos string array SourceRepos contains list of repository URLs which can be used for deployment
namespaceResourceBlacklist GroupKind array NamespaceResourceBlacklist contains list of blacklisted namespace level resources
clusterResourceWhitelist GroupKind array ClusterResourceWhitelist contains list of whitelisted cluster level resources
ExtensionsStatus#

ExtensionsStatus defines the observed state of Extensions

Appears in: - Extensions

Field Description Default Validation
argocd ArgoCDConfigStatus
ArgoCDConfigStatus#

ArgoCDStatus defines the observed state of the ArgoCD extension

Appears in: - ExtensionsStatus

Field Description Default Validation
appProjectState boolean
argoNamespace string
conditions Condition array

IntegrationConfig#

IntegrationConfig is the Schema for the integrationConfigs API

Field Description Default Validation
apiVersion string tenantoperator.stakater.com/v1alpha1
kind string IntegrationConfig
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec IntegrationConfigSpec
status IntegrationConfigStatus
IntegrationConfigSpec#

IntegrationConfigSpec defines the desired state of IntegrationConfig

Appears in: - IntegrationConfig

Field Description Default Validation
openshift OpenshiftConfig Openshift is the config containing labels and annotations
tenantRoles TenantRoles TenantRoles sets the default Owner/Editor/Viewer and/or custom roles for each tenant { default:map[editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]]] }
nexus ManagedNexus Nexus is the config for managed Nexus.
rhsso ManagedRHSSO Nexus is the config for managed RHSSO.
vault ManagedVault Nexus is the config for managed Vault.
argocd ArgoCD ArgoCD contains details about argocd Applications and AppProjects
provision Provision Provision is used to enable/disable the provision feature such as mto-console and showback { console:true showback:true }
OpenshiftConfig#

OpenshiftConfig is the config containing labels and annotations

Appears in: - IntegrationConfigSpec

Field Description Default Validation
project Metadata Project contains labels and annotations applied to the namespace
group Metadata Group contains labels and annotations applied to the group
sandbox Metadata Sandbox contains labels and annotations applied to the sandbox
privilegedNamespaces string array PrivilegedNamespaces contains list of privileged namespaces regex
privilegedServiceAccounts string array PrivilegedServiceAccounts contains list of privileged serviceAccounts regex
namespaceAccessPolicy NamespaceAccessPolicy NamespaceAccessPolicy contains groups/users which are denied access over managed namespaces
clusterAdminGroups string array ClusterAdminGroups contains groups which are admins of tenants
Metadata#

Appears in: - OpenshiftConfig

Field Description Default Validation
labels object (keys:string, values:string)
annotations object (keys:string, values:string)
NamespaceAccessPolicy#

NamespaceAccessPolicy contains access and deny policies for namespaces

Appears in: - OpenshiftConfig

Field Description Default Validation
deny Policy
Policy#

Policy contains policies relating to privilegedNamespaces

Appears in: - NamespaceAccessPolicy

Field Description Default Validation
privilegedNamespaces PrivilegedNamespaces
PrivilegedNamespaces#

PrivilegedNamespaces contains groups/users

Appears in: - Policy

Field Description Default Validation
users string array
groups string array
TenantRoles#

TenantRoles is used to configure custom RBAC rules for tenants

Appears in: - IntegrationConfigSpec

Field Description Default Validation
default UserRoles DefaultRoles contains the default roles that will be applied to each tenant. Required field. { editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]] }
custom MatchNamespaceLabel array CustomRoles is an optional Label selector method to apply roles to specific namespaces.
These roles will override the existing Default Roles
UserRoles#

UserRoles is the list of roles applied to owners/editors/viewers

Appears in: - MatchNamespaceLabel - TenantRoles

MatchNamespaceLabel#

Appears in: - TenantRoles

Field Description Default Validation
labelSelector LabelSelector LabelSelector is the label selector that will be used to find namespaces to apply roles to
UserRoles UserRoles Custom roles applied to the namespaces selected by the label selector Required: {}
ManagedNexus#

ManagedNexus is the config for Nexus.

Appears in: - IntegrationConfigSpec

Field Description Default Validation
ManagedApp ManagedApp
ManagedApp#

ManagedApp is the config for a managed application.

Appears in: - ManagedNexus - ManagedRHSSO

Field Description Default Validation
enabled boolean false
endpoint Endpoint
sso SSO
Endpoint#

Endpoint is used to connect to an application

Appears in: - ManagedApp

Field Description Default Validation
url string
secretReference SecretReference
SecretReference#

SecretReference contains details of a secret

Appears in: - Endpoint

Field Description Default Validation
name string
namespace string
SSO#

SSO contains details for single sign on

Appears in: - ManagedApp

Field Description Default Validation
clientName string
accessorID string
ManagedRHSSO#

ManagedRHSSO is the config for RedHat Single Sign-On.

Appears in: - IntegrationConfigSpec

Field Description Default Validation
ManagedApp ManagedApp
realm string
ManagedVault#

ManagedVault is the config for Vault.

Appears in: - IntegrationConfigSpec

Field Description Default Validation
enabled boolean false
address string
accessorPath string
roleName string
sso VaultSSO
VaultSSO#

Appears in: - ManagedVault

Field Description Default Validation
clientName string
ArgoCD#

Appears in: - IntegrationConfigSpec

Field Description Default Validation
namespace Namespace Namespace should contain the name of the namespace in which to deploy ArgoCD AppProjects Required: {}
namespaceResourceBlacklist GroupKind array NamespaceResourceBlacklist contains list of blacklisted namespace level resources
clusterResourceWhitelist GroupKind array ClusterResourceWhitelist contains list of whitelisted cluster level resources
Provision#

Appears in: - IntegrationConfigSpec

Field Description Default Validation
console boolean Console is used to enable/disable the mto-console true Optional: {}
showback boolean Showback is used to enable/disable the showback feature true Optional: {}
ingress IngressConfig the following are used to configure the ingress for the provisioned services
trustedRootCert string TrustedRootCert is the name of the secret containing the trusted root CA certificate
This certificate is used for SSL/TLS communication with other services		 Optional: {}
IngressConfig#

Appears in: - Provision

Field Description Default Validation
keycloak Ingress
console Ingress
gateway Ingress
ingressClassName string ingressClassName is the ingress class name Optional: {}
Ingress#

Appears in: - IngressConfig

Field Description Default Validation
host string Host specifies the hostname for the ingress
tlsSecretName string TLSSecretName is the name of the secret containing the TLS certificate Optional: {}
IntegrationConfigStatus#

IntegrationConfigStatus defines the observed state of IntegrationConfig

Appears in: - IntegrationConfig

Field Description Default Validation
roleBindingsToDelete object (keys:string, values:string array) RoleBindingsToDelete contains all of the rolebindings that have been whenever the roles cache config map gets updated
PolicyMembers#

Appears in: - PrivilegedNamespaces

Field Description Default Validation
users string array
groups string array

tenantoperator.stakater.com/v1beta1#

Package v1beta1 contains API Schema definitions for the tenantoperator v1beta1 API group

IntegrationConfig#

IntegrationConfig is the Schema for the integrationconfigs API

Field Description Default Validation
apiVersion string tenantoperator.stakater.com/v1beta1
kind string IntegrationConfig
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec IntegrationConfigSpec
status IntegrationConfigStatus
IntegrationConfigSpec#

IntegrationConfigSpec defines the desired state of IntegrationConfig

Appears in: - IntegrationConfig

Field Description Default Validation
accessControl AccessControl { rbac:map[tenantRoles:map[default:map[editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]]]]] }
components Components
metadata Metadata Refer to Kubernetes API documentation for fields of metadata.
integrations Integrations
tenantPolicies TenantPolicies
AccessControl#

AccessControl defines the access control settings for IntegrationConfig

Appears in: - IntegrationConfigSpec

Field Description Default Validation
rbac RBAC { tenantRoles:map[default:map[editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]]]] }
namespaceAccessPolicy NamespaceAccessPolicy
privileged Privileged
RBAC#

RBAC defines the RBAC settings for IntegrationConfig

Appears in: - AccessControl

Field Description Default Validation
tenantRoles TenantRoles TenantRoles sets the default Owner/Editor/Viewer and/or custom roles for each tenant { default:map[editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]]] }
TenantRoles#

Appears in: - RBAC

Field Description Default Validation
default UserRoles DefaultRoles contains the default roles that will be applied to each tenant. Required field. { editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]] }
custom MatchNamespaceLabel array CustomRoles is an optional Label selector method to apply roles to specific namespaces.
These roles will override the existing Default Roles
UserRoles#

Appears in: - MatchNamespaceLabel - TenantRoles

MatchNamespaceLabel#

Appears in: - TenantRoles

Field Description Default Validation
labelSelector LabelSelector LabelSelector is the label selector that will be used to find namespaces to apply roles to
UserRoles UserRoles Custom roles applied to the namespaces selected by the label selector
NamespaceAccessPolicy#

NamespaceAccessPolicy defines the namespace access policy settings

Appears in: - AccessControl

Field Description Default Validation
deny Deny
Deny#

Deny defines the deny settings for namespace access policy

Appears in: - NamespaceAccessPolicy

Field Description Default Validation
privilegedNamespaces PrivilegedNamespaces
PrivilegedNamespaces#

PrivilegedNamespaces defines the list of privileged namespaces and associated users/groups

Appears in: - Deny

Field Description Default Validation
users string array
groups string array
Privileged#

Privileged defines the privileged settings for IntegrationConfig

Appears in: - AccessControl

Field Description Default Validation
namespaces string array
serviceAccounts string array
users string array
groups string array
Components#

Components defines the components settings for IntegrationConfig

Appears in: - IntegrationConfigSpec

Field Description Default Validation
console boolean false
showback boolean false
showbackOpts ShowbackOpts ShowbackOpts is used to configure the showback for the Component
ShowbackOpts is deprecated and will be removed in a future release. See docs.stakater.com/mto/latest for more details on the replacement for showback configuration.
ingress IngressConfig the following are used to configure the ingress for the Component's services
prometheus PrometheusComponentConfig Defines configuration for prometheus component Optional: {}
opencost OpenCostComponentConfig Defines configuration for opencost component Optional: {}
postgres PostgresComponentConfig Defines configuration for postgres component Optional: {}
dex DexComponentConfig Defines configuration for dex component Optional: {}
finopsOperator FinOpsOperator Defines configuration for finops operator component Optional: {}
dexConfigOperator DexConfigOperatorConfig Defines configuration for dex config operator component Optional: {}
templateOperatorV2 TemplateOperatorV2Config Defines configuration for the template-operator-v2 component Optional: {}
ShowbackOpts#

Appears in: - Components

Field Description Default Validation
custom Custom Custom is used to define custom pricing for opencost. If not provided, the default pricing will be used.
Custom field is deprecated and will be removed in a future release. Please use the spec.components.finopsOperator.priceBook field instead to configure custom pricing for OpenCost.		 Optional: {}
cloudPricingSecretRef SecretRef CloudPricingSecretRef is the reference to the secret containing the opeconst config for AWS/Azure.
This field is deprecated and will be removed in a future release. Please use the spec.components.opencost.cloudIntegrationSecret field instead to configure the cloud integration for OpenCost.		 Optional: {}
retentionPeriod string RetentionPeriod defines the retention period of prometheus server
This field is deprecated and will be removed in a future release. Please use the spec.components.prometheus.retention field instead to configure the retention period for Prometheus.		 7d
Custom#

Appears in: - ShowbackOpts

Field Description Default Validation
CPU string
spotCPU string
RAM string
spotRAM string
GPU string
storage string
zoneNetworkEgress string
regionNetworkEgress string
internetNetworkEgress string
provider string
description string
projectId string
awsSpotDataBucket string
awsSpotDataRegion string
awsSpotDataPrefix string
spotLabel string
spotLabelValue string
SecretRef#

SecretReference defines the reference to a secret

Appears in: - PostgresExternalConfig - ShowbackOpts - VaultAccessInfo

Field Description Default Validation
name string
namespace string
IngressConfig#

Appears in: - Components

Field Description Default Validation
host string Host, when set, enables consolidated mode: all components are served under
this single shared hostname via distinct path prefixes. When empty, the
per-component Console/Gateway/Dex/FinOpsGateway hosts are used (legacy).		 Optional: {}
tlsSecretName string TLSSecretName is the TLS secret for the shared host (consolidated mode). Optional: {}
console Ingress
gateway Ingress
dex Ingress
finopsGateway Ingress
ingressClassName string ingressClassName is the ingress class name Optional: {}
Ingress#

Appears in: - IngressConfig

Field Description Default Validation
host string Host specifies the hostname for the ingress (legacy per-component mode).
tlsSecretName string TLSSecretName is the name of the secret containing the TLS certificate. Optional: {}
path string Path is the path prefix under the shared host in consolidated mode.
Defaults: Console "/", Gateway "/gateway", Dex "/dex", FinOps "/finops".		 Optional: {}
PrometheusComponentConfig#

PrometheusComponentConfig describes how Prometheus is configured for tenant operations

Appears in: - Components

Field Description Default Validation
mode DependencyMode Managed Enum: [Managed External Disabled]
values RawExtension Values allows customization of the Prometheus Helm chart values when mode is Managed
external ExternalServerConfig External defines information required when using an externally managed Prometheus
DependencyMode#

Underlying type: string

DependencyMode describes how a dependency is provided

Validation: - Enum: [Managed External Disabled]

Appears in: - DexComponentConfig - OpenCostComponentConfig - PostgresComponentConfig - PrometheusComponentConfig - TemplateOperatorV2Config

Field Description
Managed DependencyModeManaged indicates the operator should provision and manage the dependency
External DependencyModeExternal indicates the dependency is supplied by the user
Disabled DependencyModeDisabled indicates the dependency is not deployed at all.
Currently only supported by templateOperatorV2; the webhook rejects it
for the other components.
ExternalServerConfig#

ExternalServerConfig stores references to an external Prometheus deployment

Appears in: - OpenCostComponentConfig - PrometheusComponentConfig

Field Description Default Validation
serverURL string ServerURL is the base URL that the operator should use for query API access
OpenCostComponentConfig#

OpenCostComponentConfig describes how OpenCost is configured for showback features

Appears in: - Components

Field Description Default Validation
mode DependencyMode Managed Enum: [Managed External Disabled]
values RawExtension Values allows customization of the OpenCost Helm chart values when mode is Managed
external ExternalServerConfig External defines information required when using an externally managed OpenCost deployment
PostgresComponentConfig#

PostgresComponentConfig describes how Postgres is configured for application persistence

Appears in: - Components

Field Description Default Validation
mode DependencyMode Managed Enum: [Managed External Disabled]
values RawExtension Values allows customization of the Postgres Helm chart values when mode is Managed
external PostgresExternalConfig External defines information required when using an externally managed Postgres instance
PostgresExternalConfig#

PostgresExternalConfig stores references to an external Postgres instance

Appears in: - PostgresComponentConfig

Field Description Default Validation
secretRef SecretRef SecretRef references a secret containing a DSN or discrete connection details
DexComponentConfig#

Appears in: - Components

Field Description Default Validation
mode DependencyMode Managed Enum: [Managed External Disabled]
values RawExtension Values allows customization of the Prometheus Helm chart values when mode is Managed
external DexExternalConfig External defines information required when using an externally managed Dex deployment
DexExternalConfig#

Appears in: - DexComponentConfig

Field Description Default Validation
issuer string Issuer is the URL of the Dex issuer, used for OIDC discovery
FinOpsOperator#

FinOpsOperator defines the configuration for FinOps Operator components See https://docs.stakater.com/finops-operator/latest for more details

Appears in: - Components

Field Description Default Validation
values RawExtension Values allows customization of the FinOps Operator Helm chart values when mode is Managed Optional: {}
DexConfigOperatorConfig#

Appears in: - Components

Field Description Default Validation
values RawExtension Values allows customization of the Prometheus Helm chart values
TemplateOperatorV2Config#

TemplateOperatorV2Config defines the configuration for the template-operator-v2 component

Appears in: - Components

Field Description Default Validation
mode DependencyMode Mode selects how template-operator-v2 is provided. Disabled (default)
deploys nothing; Managed deploys and manages it. External is not
supported yet.		 Disabled Enum: [Managed External Disabled]
Optional: {}
values RawExtension Values allows customization of the template-operator-v2 Helm chart values when mode is Managed Optional: {}
Metadata#

Metadata defines the metadata settings for IntegrationConfig

Appears in: - IntegrationConfigSpec

Field Description Default Validation
groups MetadataType Groups contains labels and annotations applied to the groups
namespaces MetadataType Namespaces contains labels and annotations applied to the namespaces
sandboxes MetadataType Sandboxes contains labels and annotations applied to the sandbox
MetadataType#

Appears in: - Metadata

Field Description Default Validation
labels object (keys:string, values:string)
annotations object (keys:string, values:string)
Integrations#

Integrations defines the integration settings for IntegrationConfig

Appears in: - IntegrationConfigSpec

Field Description Default Validation
argocd ArgoCDIntegration
vault VaultIntegration
ArgoCDIntegration#

ArgoCD defines the ArgoCD integration settings

Appears in: - Integrations

Field Description Default Validation
clusterResourceWhitelist GroupKind array ClusterResourceWhitelist contains list of whitelisted cluster level resources
namespaceResourceBlacklist GroupKind array NamespaceResourceWhitelist contains list of whitelisted namespace level resources
namespace Namespace Namespace should contain the name of the namespace in which to deploy ArgoCD AppProjects Required: {}
VaultIntegration#

Vault defines the Vault integration settings

Appears in: - Integrations

Field Description Default Validation
enabled boolean false
authMethod string AuthMethod defines the authentication method for Vault, Possible values are: "kubernetes", "token" kubernetes Enum: [kubernetes token]
accessInfo VaultAccessInfo AccessInfo defines the access information for Vault
config VaultConfig Config defines the Vault configuration
policies VaultPolicy array Policies defines custom Vault policies Optional: {}
VaultAccessInfo#

VaultAccessInfo defines the access information for Vault

Appears in: - VaultIntegration

Field Description Default Validation
accessorPath string
address string
roleName string
secretRef SecretRef
VaultConfig#

VaultConfig defines the Vault configuration

Appears in: - VaultIntegration

Field Description Default Validation
ssoClient string
commonSecretsPath string CommonSecretsPath defines a secrets path in Vault which is shared by all tenants Optional: {}
VaultPolicy#

VaultPolicy defines the Vault policy details

Appears in: - VaultIntegration

Field Description Default Validation
name string Name is the name of the policy
rules PolicyRule array Rules is the policy rules
tenantRoles string array TenantRoles is the list of tenant roles to apply the policy to
PolicyRule#

PolicyRule defines the policy rule

Appears in: - VaultPolicy

Field Description Default Validation
path string Path is the path to the resource
capabilities string array Capabilities is the list of capabilities
TenantPolicies#

Appears in: - IntegrationConfigSpec

Field Description Default Validation
network TenantPoliciesNetwork
TenantPoliciesNetwork#

Appears in: - TenantPolicies

Field Description Default Validation
disableIntraTenantNetworking boolean
disableNodePortServices boolean
disableHostPorts boolean
IntegrationConfigStatus#

IntegrationConfigStatus defines the observed state of IntegrationConfig

Appears in: - IntegrationConfig

Field Description Default Validation
roleBindingsToDelete object (keys:string, values:string array)
conditions Condition array Status conditions

Quota#

Quota is the Schema for the quotas API

Field Description Default Validation
apiVersion string tenantoperator.stakater.com/v1beta1
kind string Quota
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec QuotaSpec
status QuotaStatus
QuotaSpec#

Appears in: - Quota

Field Description Default Validation
resourcequota ResourceQuotaSpec ResourceQuota defines the allocated ResourceQuota for the tenant
limitrange LimitRangeSpec LimitRange defines the allocated LimitRange for the namespace inside tenant Optional: {}
QuotaStatus#

QuotaStatus defines the observed state of Quota

Appears in: - Quota

Field Description Default Validation
TenantQuotaStatus TenantQuotaStatus
conditions Condition array Status conditions for quota
TenantQuotaStatus#

Appears in: - QuotaStatus

Field Description Default Validation
tenants object (keys:string, values:TenantResourceStatus)
TenantResourceStatus#

Appears in: - TenantQuotaStatus

Field Description Default Validation
status ResourceQuotaStatus

tenantoperator.stakater.com/v1beta3#

Package v1beta3 contains API Schema definitions for the tenantoperator v1beta3 API group

Tenant#

Tenant is the Schema for the tenants API

Field Description Default Validation
apiVersion string tenantoperator.stakater.com/v1beta3
kind string Tenant
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec TenantSpec
status TenantStatus
TenantSpec#

TenantSpec defines the desired state of Tenant

Appears in: - Tenant

Field Description Default Validation
quota string Quota field is used to link relevant Tenant Operator Quota CR Required: {}
accessControl AccessControl AccessControl defines the list of admins, editors and viewers
namespaces Namespaces namespaces defines namespaces and their metadata
desc string Desc can contains description about the tenant
hostValidationConfig HostValidationConfig HostValidationConfig defines the allowed ingress and route host names for the tenant Optional: {}
AccessControl#

Appears in: - TenantSpec

Field Description Default Validation
owners Members owners represents the list of owners
editors Members editors represents the list of editors
viewers Members viewers represents the list of viewers
Namespaces#

Appears in: - TenantSpec

Field Description Default Validation
sandboxes Sandboxes sandboxes is used to enable or disable the sandbox feature
withoutTenantPrefix Namespace array WithoutTenantPrefix will create new namespaces mentioned in it
withTenantPrefix Namespace array WithTenantPrefix will create new namespaces mentioned in it and add a prefix of the tenant name to them
onDeletePurgeNamespaces boolean ondeletepurgenamespaces is used to enable or disable the namespace purge feature false
metadata Metadata Refer to Kubernetes API documentation for fields of metadata.
Sandboxes#

Appears in: - Namespaces

Field Description Default Validation
enabled boolean enabled is used to enable or disable the sandbox feature
private boolean private is used to enable or disable the private sandbox feature
Metadata#

Appears in: - Namespaces

Field Description Default Validation
common Metadata commonmetadata applies given labels and annotations
sandbox Metadata sandboxmetadata applies given labels and annotation across sandbox namespaces
specific MetadataOnNamespaces array specificmetadata applies given labels and annotation across specific namespaces
HostValidationConfig#

Appears in: - TenantSpec

Field Description Default Validation
denyWildcards boolean DenyWildcards indicates whether wildcard host names are allowed or not
If true, wildcard host names are not allowed
If false, wildcard host names are allowed		 false Optional: {}
Type: boolean
allowedRegex string AllowedRegex is a regular expression that defines the allowed host names
If specified, host names must match this regex to be allowed		 Optional: {}
Type: string
allowed string array Allowed is a list of allowed host names
If specified, host names must be in this list to be allowed		 Optional: {}
Type: array
TenantStatus#

TenantStatus defines the observed state of Tenant

Appears in: - Tenant

Field Description Default Validation
namespaces NamespacesStatus namespacesStatus stores the previous state of namespaces, if mentioned in spec
sandboxState boolean SandboxState stores the previous state of sandbox field, if mentioned in spec
deployedSandboxes object (keys:string, values:string) DeployedSandboxes maps users to the sandbox namespaces created from spec. It is a
prune ledger: entries no longer implied by spec are deleted. See ManagedNamespaces
for the full list of namespaces belonging to the tenant
deployedNamespaces string array DeployedNamespaces lists the namespaces created from spec.namespaces. It is a prune
ledger: entries no longer in spec are deleted. See ManagedNamespaces for the full list
managedNamespaces string array ManagedNamespaces lists every namespace carrying the tenant label, whether created
from spec, self served by an owner or a sandbox. Sorted. Report only, never drives deletion
storageClasses StorageStatus StorageClasses is the status for currently available StorageClasses for the tenant
ingressClasses IngressClassStatus IngressClasses is the status for currently available IngressClasses for the tenant
podPriorityClasses PodPriorityClassStatus PodPriorityClasses is the status for currently available PodPriorityClasses for the tenant
quota QuotaStatus Quota is the status for the tenant's Quota
ready boolean Ready mirrors the Ready condition: true only when the last reconcile hit no
error and no sub sync left a warning condition		 Optional: {}
conditions Condition array Status conditions for tenant
NamespacesStatus#

Appears in: - TenantStatus

Field Description Default Validation
commonStatus Metadata CommonStatus stores the previous state of labels and annotation applied across all tenant namespaces, if mentioned in spec
sandboxStatus Metadata SandboxStatus stores the previous state of labels and annotation applied across all sandbox namespaces, if mentioned in spec
specificStatus MetadataOnNamespaces array SpecificStatus stores the previous state of labels and annotations applied across specific tenant namespaces, if mentioned in spec
StorageStatus#

Appears in: - TenantStatus

Field Description Default Validation
available StorageClassEntry array
StorageClassEntry#

Appears in: - StorageStatus

Field Description Default Validation
name string
IngressClassStatus#

Appears in: - TenantStatus

Field Description Default Validation
available IngressClassEntry array
IngressClassEntry#

Appears in: - IngressClassStatus

Field Description Default Validation
name string
PodPriorityClassStatus#

Appears in: - TenantStatus

Field Description Default Validation
available PodPriorityClassEntry array
PodPriorityClassEntry#

Appears in: - PodPriorityClassStatus

Field Description Default Validation
name string
QuotaStatus#

Appears in: - TenantStatus

Field Description Default Validation
available QuotaEntry array
QuotaEntry#

Appears in: - QuotaStatus

Field Description Default Validation
name string

Template Operator v2#

Packages#

templates.v2.stakater.com/v2alpha1#

Package v2alpha1 contains API Schema definitions for the templates v2alpha1 API group.

Template#

Template is a reusable blueprint that defines Kubernetes resources which can be instantiated multiple times across different namespaces using TemplateInstances. Templates are scoped to a provider namespace and contain go templates or Helm charts that render into one or more Kubernetes manifests when instantiated.

Namespace Scope (Provider): The Template may only reference other resources in its own namespace.

Security Implication: Anyone who can create a Template in a namespace can expose any resource that the template-operator service account is allowed to read within that namespace.

Field Description Default Validation
apiVersion string templates.v2.stakater.com/v2alpha1
kind string Template
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec TemplateSpec
status TemplateStatus Optional: {}
TemplateSpec#

TemplateSpec defines the desired state of Template

Appears in: - Template

Field Description Default Validation
gotemplate string Exactly one of gotemplate or helm must be specified.
gotemplate is rendered using Go text/template.
It may emit one or more Kubernetes manifests.
Sprig functions are also available https://masterminds.github.io/sprig/
If a namespace-scoped resource omits the namespace field,
it will be created in the TemplateInstance's namespace (consumer namespace),
NOT in the 'default' namespace or the Template's namespace.
Available context (non-exhaustive):
- .parameters : resolved parameter values
- .instance : metadata of the TemplateInstance (name, namespace, labels)
Referencing a value that does not exist (a typo, or an instance label
that is not set) fails the render; the TemplateInstance reports the
missing key in its Rendered condition. For optional values, look up
through index, which returns an empty value instead of failing:
{{ index .instance.labels "env" | default "dev" }}
{{ if index .instance.labels "env" }} ... {{ end }}
helm HelmSpec Helm renders a Helm chart instead of a raw Go template.
Exactly one of gotemplate or helm must be specified.		 Optional: {}
parameters TemplateParameterDefinition array Parameters define the inputs required to render the template.
Rules:
- type is a hint used for validation/coercion (operator-defined).		 Optional: {}
targetNamespaces TargetNamespaces TargetNamespaces controls where this Template may be instantiated.
Default behavior:
If this field is omitted entirely, the Template may ONLY be instantiated
in the same namespace as this Template.
A namespace is eligible if it matches the explicit list OR the selector.		 Optional: {}
sync SyncConfig Sync controls drift protection for rendered resources. Optional: {}
outputs TemplateOutput array Outputs declare named extractions from this Template's rendered resources,
surfaced on TemplateInstance.status.outputs. Each entry chooses exactly one
iteration mode by field combination:
- from only single-resource extraction
- fromAll only iterate all rendered resources of a GVK
- from + forEach iterate an array of objects inside one resource		 MaxItems: 50
Optional: {}
HelmSpec#

HelmSpec defines a Helm chart source and rendering configuration.

Appears in: - TemplateSpec

Field Description Default Validation
chart HelmChart Chart defines where the Helm chart is sourced from. Required: {}
releaseName string ReleaseName is the Helm release name used during rendering.
If omitted, defaults to the TemplateInstance name at render time.		 MaxLength: 53
Optional: {}
version HelmVersion Version selects the Helm rendering engine.
Defaults to "v3" if omitted: existing templates are written against
Helm v3 behavior, so migrated charts render the same as before.
Set "v4" to opt in to the Helm v4 engine.		 v3 Enum: [v3 v4]
Optional: {}
valuesTemplate string ValuesTemplate is a Go template that renders into YAML used as Helm values.
The rendered YAML is parsed and passed as Helm value overrides
(merged over the chart's default values.yaml).
Available context (same as gotemplate):
- .parameters : resolved parameter values
- .instance : metadata of the TemplateInstance (name, namespace, labels)
Like gotemplate, referencing a value that does not exist fails the
render; use index (with default) for optional lookups.		 Optional: {}
HelmChart#

HelmChart identifies a Helm chart source.

Appears in: - HelmSpec

Field Description Default Validation
repository HelmRepository Repository defines the repository location, chart name, version,
and optional authentication.		 Required: {}
HelmRepository#

HelmRepository defines the location, chart identity, and optional authentication for a Helm chart repository or OCI registry.

Appears in: - HelmChart

Field Description Default Validation
url string URL is the repository URL.
For HTTP/HTTPS repositories: https://charts.example.com
For OCI registries: oci://ghcr.io/org/charts		 MinLength: 1
Pattern: ^(https?\|oci)://
Required: {}
name string Name is the chart name within the repository. MinLength: 1
Required: {}
version string Version is the exact chart version to pull (SemVer 2, e.g. "1.2.3").
Must follow SemVer 2 (https://semver.org): MAJOR.MINOR.PATCH with
optional pre-release and build metadata.		 MinLength: 5
Pattern: ^v?(0\|[1-9][0-9]*)\.(0\|[1-9][0-9]*)\.(0\|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$
Required: {}
auth HelmAuth Auth provides optional authentication credentials.
The referenced Secret MUST live in the same namespace as this Template.
Supported credential layouts by source type:
1. HTTP(S) Helm repositories
- username / password keys
- token key
2. OCI registries (oci://)
- username / password
- token
- or standard Docker config (.dockerconfigjson)		 Optional: {}
HelmAuth#

HelmAuth references a Secret containing repository credentials.

Appears in: - HelmRepository

Field Description Default Validation
secretRef SecretRef SecretRef references a Secret in the same namespace as the Template. Required: {}
SecretRef#

SecretRef is a reference to a Secret by name.

Appears in: - HelmAuth

Field Description Default Validation
name string Name of the Secret. MinLength: 1
Required: {}
HelmVersion#

Underlying type: string

HelmVersion specifies which Helm SDK to use for rendering.

Validation: - Enum: [v3 v4]

Appears in: - HelmSpec

Field Description
v3
v4
TemplateParameterDefinition#

TemplateParameterDefinition defines a single parameter for the template.

Appears in: - TemplateSpec

Field Description Default Validation
name string Name is the name of the parameter MinLength: 1
Required: {}
value JSON Value provides the parameter's literal default. It may be a scalar
(string, number, bool), a list, or an object, matching the declared type.		 Schemaless: {}
Optional: {}
type ParameterType Type declares the expected type for validation of both template
default values and instance overrides.		 Enum: [string number bool array object]
Optional: {}
required boolean Required, if true, means the TemplateInstance MUST provide a value
for this parameter, regardless of whether the template has a default.		 Optional: {}
exposeInStatus boolean ExposeInStatus controls whether the resolved value appears in
TemplateInstance status resolvedParameters. Defaults to false (hidden).		 Optional: {}
disableOverride boolean DisableOverride controls whether a TemplateInstance may supply its own
value for this parameter. Defaults to false (allow override) when omitted.		 Optional: {}
ParameterType#

Underlying type: string

ParameterType declares the expected type for validation.

Validation: - Enum: [string number bool array object]

Appears in: - TemplateParameterDefinition

Field Description
string
number
bool
array
object
TargetNamespaces#

TargetNamespaces defines namespace restrictions for Template instantiation

Appears in: - TemplateSpec

Field Description Default Validation
explicit AllowDeny Explicit defines allowed (and in future, denied) consumer namespaces
where this Template may be instantiated.		 Optional: {}
selector LabelSelector Selector dynamically selects namespaces via labels. Optional: {}
SyncConfig#

SyncConfig controls drift protection for rendered resources.

Appears in: - TemplateSpec

Field Description Default Validation
mode SyncMode Mode selects the drift protection strategy.
- off (default): create once, then freeze — no Template, instance or
valueFrom source change re-applies, and manual edits survive.
- revert: the controller continuously reconciles rendered resources,
reverting external drift back to the desired state.
- strict: same as revert, plus an admission webhook proactively blocks
unauthorized UPDATE/DELETE on rendered resources.		 off Enum: [off revert strict]
Optional: {}
ignoreFields string array IgnoreFields defines field paths that are exempt from enforcement.
Changes to these fields are allowed even when sync is enabled.
Field paths use dot-separated notation and are evaluated per rendered object.
Array wildcards are supported via [] notation.
Examples: "metadata.annotations", "spec.replicas", "spec.template.spec.containers[].env"		 Optional: {}
SyncMode#

Underlying type: string

SyncMode controls the level of drift protection for rendered resources.

Validation: - Enum: [off revert strict]

Appears in: - SyncConfig

Field Description
off SyncModeOff creates the resources once, then freezes the instance: no
Template, instance or valueFrom source change re-applies, and manual
edits survive. A defaultValue used at the first clean apply is kept.
Flip to revert/strict to resume.
revert SyncModeRevert enables reconciliation-based drift correction.
The controller continuously reconciles rendered resources to the
desired state, reverting any drift. No webhook enforcement.
strict SyncModeStrict enables reconciliation and webhook enforcement.
In addition to continuous reconciliation, an admission webhook
proactively blocks unauthorized UPDATE/DELETE on rendered resources.
TemplateOutput#

TemplateOutput declares a named extraction from this Template's rendered resources.

Appears in: - TemplateSpec

Field Description Default Validation
name string Name is the parent identifier for this output entry, unique across outputs[].
It is NOT surfaced in TemplateInstance status; the user-visible status keys
come from each fields[].name below.		 MaxLength: 63
MinLength: 1
Pattern: ^[a-zA-Z][a-zA-Z0-9]*$
Required: {}
from OutputSourceRef From selects a single rendered resource. Required for single-resource and
forEach modes; must be absent in fromAll mode.		 Optional: {}
fromAll OutputSourceAll FromAll iterates every rendered resource matching the GVK. Mutually exclusive
with from and forEach.		 Optional: {}
forEach string ForEach iterates an array OF OBJECTS inside the resource named by from.
JSONPath query wrapped in {...}; "{.__index}" (zero-based position) is
available to keyTemplate. Required for forEach mode; absent otherwise.		 MaxLength: 256
MinLength: 1
Optional: {}
keyTemplate string KeyTemplate renders the inner status-map key (JSONPath template, {...}).
Required for forEach. Optional for fromAll (runtime scope-aware default:
namespaced -> "{.metadata.namespace}/{.metadata.name}", cluster-scoped ->
"{.metadata.name}"). Optional for single mode (defaults to "{.metadata.name}").		 MaxLength: 256
MinLength: 1
Optional: {}
fields OutputField array Fields are the JSONPath extractions performed against each matched resource
(or, for forEach, each array element).		 MaxItems: 50
MinItems: 1
Required: {}

OutputSourceRef#

OutputSourceRef identifies a single rendered resource (from / forEach modes).

Appears in: - TemplateOutput

Field Description Default Validation
apiVersion string APIVersion of the source resource (e.g. "v1", "apps/v1"). MaxLength: 253
Required: {}
kind string Kind of the source resource. Kind: Secret is refused at admission because
TemplateInstance status is broadly readable to anyone with get templateinstance.		 MaxLength: 63
Required: {}
name string Name is a JSONPath template ({...}) evaluated against the Template context
({"parameters": {...}, "instance": {name, namespace, labels}}). The rendered
name must exist in status.renderedResources at extraction time.
With sync.mode off, parameters referenced here need exposeInStatus: true —
a frozen instance resolves selectors from status.resolvedParameters, never
from live values.		 MaxLength: 256
MinLength: 1
Required: {}
namespace string Namespace is a JSONPath template ({...}); defaults to the TemplateInstance's
namespace when omitted. Ignored for cluster-scoped kinds.		 MaxLength: 253
Optional: {}

OutputSourceAll#

OutputSourceAll selects all rendered resources of a GVK (fromAll mode).

Appears in: - TemplateOutput

Field Description Default Validation
apiVersion string APIVersion of the source resources (e.g. "apps/v1"). MaxLength: 253
Required: {}
kind string Kind of the source resources. Kind: Secret is refused at admission. MaxLength: 63
Required: {}
namespace string Namespace is a JSONPath template ({...}) scoping the iteration; when omitted,
iterates across every namespace this instance rendered into.		 MaxLength: 253
Optional: {}
OutputField#

OutputField is a single JSONPath extraction mapped to one outer status key.

Appears in: - TemplateOutput

Field Description Default Validation
name string Name is the OUTER key under status.outputs. Must be unique across the
FLATTENED set of all outputs[].fields[].name in this Template (enforced by
the Template reconciler).		 MaxLength: 63
MinLength: 1
Pattern: ^[a-zA-Z][a-zA-Z0-9]*$
Required: {}
jsonPath string JSONPath query wrapped in {...}. A scalar result is stored as-is; an
array/object result is JSON-encoded (e.g. "{.foo[*].ip}" -> '["v4","v6"]').		 MaxLength: 256
MinLength: 1
Required: {}
TemplateStatus#

TemplateStatus defines the observed state of Template.

Appears in: - Template

Field Description Default Validation
observedGeneration integer observedGeneration is the last generation of the Template
that has been processed by the controller.		 Optional: {}
phase TemplatePhase phase summarizes the overall validation state of the Template.
Typical values: Valid, Invalid, Error		 Enum: [Valid Invalid Error]
Optional: {}
conditions Condition array conditions describe fine-grained validation and availability states
following standard Kubernetes condition conventions.		 Optional: {}
TemplatePhase#

Underlying type: string

TemplatePhase represents the validation state of a Template.

Validation: - Enum: [Valid Invalid Error]

Appears in: - TemplateStatus

Field Description
Valid
Invalid
Error

TemplateInstance#

TemplateInstance represents a consumer's request to instantiate a Template. It creates actual Kubernetes resources in the consumer's namespace by rendering the referenced Template with provided or overridden parameters.

Namespace Scope (Consumer): The TemplateInstance is created in a consumer namespace. Any instance-provided overrides that read from ConfigMaps, Secrets, or other resources are resolved from the namespace specified in the KeyRef or ObjectFieldRef. When a KeyRef omits the namespace, it defaults to the TemplateInstance's namespace.

Field Description Default Validation
apiVersion string templates.v2.stakater.com/v2alpha1
kind string TemplateInstance
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec TemplateInstanceSpec
status TemplateInstanceStatus Optional: {}
TemplateInstanceSpec#

TemplateInstanceSpec defines the desired state of TemplateInstance.

Appears in: - TemplateInstance

Field Description Default Validation
templateRef TemplateReference templateRef points to the provider-scoped Template to instantiate.
This is a cross-namespace reference by design
serviceAccountRef ServiceAccountRef serviceAccountRef names the ServiceAccount, in this TemplateInstance's own
namespace, whose identity is used to resolve valueFrom parameters from the
cluster and to watch their source resources. The ServiceAccount needs RBAC
(get, and list/watch for change detection) on every referenced resource, and
list on namespaces when a parameter uses namespaceSelector.
If the named ServiceAccount does not exist, the instance fails with reason
ServiceAccountNotFound before any parameter is resolved — parameter
defaultValue fallbacks do not apply to a missing identity.
Using this field also requires the cluster to have granted the operator's
own service account the 'impersonate' verb on 'serviceaccounts'; the
operator does not ship with it, because granting it cluster-wide and
unscoped is equivalent to cluster-admin. Without the grant the instance
fails with reason ImpersonationNotPermitted, again before any resolution.
When omitted, parameters resolve with the operator's own service account.		 Optional: {}
parameters TemplateParameter array Parameters override the parameters defined in the referenced Template.
Validation:
- A parameter override is only allowed if the corresponding Template parameter has
disableOverride: false set (or omitted, since it defaults to false).
- If a parameter is not overridden here, the Template's default definition is used.		 Optional: {}
TemplateReference#

TemplateReference defines the Template to instantiate

Appears in: - TemplateInstanceSpec

Field Description Default Validation
name string Name of the Template resource
namespace string Namespace where the Template resource is located
ServiceAccountRef#

ServiceAccountRef names a ServiceAccount in the TemplateInstance's namespace. It intentionally has no namespace field: the referenced ServiceAccount is always resolved in the TemplateInstance's own namespace, so an instance can never assume an identity from another tenant's namespace.

Appears in: - TemplateInstanceSpec

Field Description Default Validation
name string Name of the ServiceAccount. MaxLength: 253
MinLength: 1
Required: {}
TemplateParameter#

TemplateParameter defines a single parameter for TemplateInstance overrides.

Appears in: - TemplateInstanceSpec

Field Description Default Validation
name string Name is the name of the parameter MinLength: 1
Required: {}
value string Option 1 (literal): string|number|bool
Value provides a literal parameter value (string, number, or bool).		 Optional: {}
valueFrom ValueFrom Option 2: read a value dynamically from a cluster resource.
Exactly one of value or valueFrom must be set.		 MaxProperties: 1
MinProperties: 1
Optional: {}
defaultValue string DefaultValue is used when valueFrom fails.
Only valid with valueFrom.
With sync.mode off, a fallback at the first clean apply is final: the
instance freezes with the default and does not re-read the source if it is
created, or becomes readable, after the first clean apply.		 Optional: {}
ValueFrom#

ValueFrom specifies a dynamic source for a parameter value.

Exactly one sub-field must be set.

Validation: - MaxProperties: 1 - MinProperties: 1

Appears in: - ResolvedParameter - TemplateParameter

Field Description Default Validation
secretKeyRef KeyRef SecretKeyRef reads a key from a Secret. Optional: {}
configMapKeyRef KeyRef ConfigMapKeyRef reads a key from a ConfigMap. Optional: {}
objectFieldRef ObjectFieldRef ObjectFieldRef reads a field via JSONPath from an arbitrary resource. Optional: {}
KeyRef#

KeyRef references a specific key in a Secret or ConfigMap.

Appears in: - ValueFrom

Field Description Default Validation
name string Name of the Secret or ConfigMap. MinLength: 1
Required: {}
key string Key within the Secret or ConfigMap data to read. MinLength: 1
Required: {}
namespace string Namespace of the Secret or ConfigMap.
When omitted, defaults to the TemplateInstance's namespace.		 Optional: {}

ObjectFieldRef#

ObjectFieldRef reads a field from an arbitrary Kubernetes resource via JSONPath.

The operator watches the target GVK for change detection. With sync.mode off that watch is released once the instance freezes after its first clean apply, and later changes to the target are ignored. When Name is set, the operator GETs that specific resource. When Name is omitted, the operator LISTs all resources of the given GVK and evaluates JSONPath over the list result. RBAC: requires get, list, and watch on the target resource.

Namespace scoping (mutually exclusive options): - Namespace set: operate in that namespace only. - NamespaceSelector set: LIST/watch across every namespace whose labels match the selector. Only valid in LIST mode (Name empty). - Both empty: for namespaced resources, operates across all namespaces; for cluster-scoped resources (Nodes, PVs, etc.), ignored.

Appears in: - ValueFrom

Field Description Default Validation
apiVersion string APIVersion of the target resource (e.g., "networking.k8s.io/v1"). MinLength: 1
Required: {}
kind string Kind of the target resource (e.g., "Ingress"). MinLength: 1
Required: {}
name string Name of the target resource. When omitted, the operator LISTs all
resources of this GVK and evaluates JSONPath over the list result.		 Optional: {}
namespace string Namespace of the target resource.
When empty, namespaced resources are listed across all namespaces;
cluster-scoped resources ignore this field.
Mutually exclusive with NamespaceSelector.		 Optional: {}
namespaceSelector LabelSelector NamespaceSelector matches the namespaces in which to LIST/watch the
target GVK. Only meaningful in LIST mode (Name empty). The matched
namespace set is kept current as namespaces are created, deleted, or
relabeled.
A terminating namespace is omitted, even while it still carries the labels.
Mutually exclusive with Namespace. Has no effect on cluster-scoped
target GVKs (operator surfaces an error at resolution time).
RBAC: requires the operator's ServiceAccount to have
namespaces: list, watch.		 Optional: {}
jsonPath string JSONPath expression to extract the value (without curly braces).
Must start with a dot (e.g., ".metadata.name", not "{.metadata.name}").
Examples: .status.loadBalancer.ingress[0].ip, .metadata.name, .items[*].metadata.name		 MinLength: 1
Required: {}
TemplateInstanceStatus#

TemplateInstanceStatus defines the observed state of TemplateInstance.

Appears in: - TemplateInstance

Field Description Default Validation
observedGeneration integer observedGeneration is the .metadata.generation the controller most recently
reconciled. A frozen sync-off instance advances it without applying the
change; the Synced condition (reason Frozen) reports that.		 Optional: {}
phase TemplateInstancePhase phase summarizes the overall validation state of the Template. Enum: [Ready Failed]
Optional: {}
resolvedParameters ResolvedParameter array resolvedParameters exposes the final parameter values used for rendering
AFTER merging Template defaults and Instance overrides.		 Optional: {}
renderedResources ResourceReference array renderedResources list the resources created by this TemplateInstance.
IMPORTANT:
This list contains ONLY the minimum identifying information required
to locate the rendered resources (apiVersion, kind, name, namespace).
It MUST NOT be treated as a source of truth for desired or live state,
and MUST NOT embed full object specs or status.		 MaxItems: 500
Optional: {}
trackedGVKs string array trackedGVKs is the set of GroupVersionKinds this TemplateInstance has rendered. Optional: {}
matchedNamespaces string array matchedNamespaces lists the namespaces resolved by any parameter whose
objectFieldRef.namespaceSelector matched a non-empty set on the last
reconcile. Populated only when at least one such parameter exists.
Useful for debugging "why does my TI include / exclude this namespace?".
The list is bounded — selectors matching more than 100 namespaces are
truncated and the truncated set is logged.		 MaxItems: 100
Optional: {}
resolvedTemplateRef ResolvedTemplateRef resolvedTemplateRef shows the exact Template used for rendering,
including its namespace and resourceVersion.		 Optional: {}
conditions Condition array conditions represent the latest available observations of the TemplateInstance's state. Optional: {}
outputs object (keys:string, values:object) outputs maps each Template output field name (outer key) to a map of
rendered keyTemplate (inner key) -> extracted value. Populated from
Template.spec.outputs against this instance's rendered resources.		 Optional: {}
outputsObservedAt Time outputsObservedAt is the time the output values (the outputs map) last changed.
It advances only when a resolution produces a different map than the stored one,
not on every check and not when only the OutputsResolved condition message
changes while the values are unchanged. It is a last-value-change marker, not a
liveness probe; condition status transitions are timestamped separately by the
OutputsResolved condition's own lastTransitionTime.		 Optional: {}
firstAppliedAt Time firstAppliedAt is set once, at the first clean pass: every rendered
resource applied and no orphan left to dispose. A defaultValue fallback
counts as clean. With sync.mode off the instance is then frozen: no
Template, instance or valueFrom source change re-applies, and manual
edits survive. Flip the mode to revert/strict to resume.		 Optional: {}
TemplateInstancePhase#

Underlying type: string

Validation: - Enum: [Ready Failed]

Appears in: - TemplateInstanceStatus

Field Description
Ready
Failed
ResolvedParameter#

ResolvedParameter records the source and optionally the value used for a parameter after merging Template defaults and Instance overrides.

Appears in: - TemplateInstanceStatus

Field Description Default Validation
name string Name of the parameter.
value string Value is the resolved parameter value. Only populated when the
Template parameter has exposeInStatus: true.		 Optional: {}
valueFrom ValueFrom ValueFrom records the source that was used to resolve this parameter,
when the value came from a dynamic source (secret, configmap, resource).		 MaxProperties: 1
MinProperties: 1
Optional: {}
usedDefault boolean UsedDefault is true when the parameter's valueFrom could not be read
(source missing or access denied) and the value came from defaultValue
instead. The parameters that fell back are also listed in the
ParametersValid condition message.		 Optional: {}
fallbackReason FallbackReason FallbackReason categorizes why defaultValue was used. Set only when
UsedDefault is true; empty means the parameter resolved from its source.		 Enum: [AccessDenied SourceNotFound ResolutionFailed]
Optional: {}
FallbackReason#

Underlying type: string

FallbackReason labels why a parameter fell back to its defaultValue. The empty value is not one of the reasons below: it means no fallback happened and the parameter resolved from its source.

Validation: - Enum: [AccessDenied SourceNotFound ResolutionFailed]

Appears in: - ResolvedParameter

Field Description
AccessDenied FallbackReasonAccessDenied: the resolving identity lacks RBAC for the
source — typically a missing RoleBinding.
SourceNotFound FallbackReasonSourceNotFound: the referenced source does not exist.
ResolutionFailed FallbackReasonResolutionFailed: any other maskable failure (e.g. a
JSONPath that matched nothing, or a namespaceSelector matching zero
namespaces).

ResourceReference#

Appears in: - TemplateInstanceStatus

Field Description Default Validation
apiVersion string apiVersion of the resource (e.g., "v1", "apps/v1") MinLength: 1
Required: {}
kind string kind of the resource (e.g, "ConfigMap, "Deployment") MinLength: 1
Required: {}
name string name of the resource MaxLength: 253
MinLength: 1
Required: {}
namespace string namespace of the resource MaxLength: 63
Optional: {}
observedGeneration integer observedGeneration is the metadata.generation of this resource
at the time it was last successfully applied by the controller.		 Optional: {}
status ResourceReferenceStatus status indicates the health of this resource. Empty means successfully applied. Enum: [ Failed]
Optional: {}
ResourceReferenceStatus#

Underlying type: string

ResourceReferenceStatus indicates the health of a rendered resource.

Validation: - Enum: [ Failed]

Appears in: - ResourceReference

Field Description
``
Failed
ResolvedTemplateRef#

ResolvedTemplateRef shows the exact Template used for rendering, including its namespace and generation.

Appears in: - TemplateInstanceStatus

Field Description Default Validation
name string Name of the Template resource
namespace string Namespace where the Template resource is located
generation integer Generation of the Template which increments on spec changes

Template Operator v1 – Legacy#

Packages#

templates.stakater.com/v1alpha1#

Package v1alpha1 contains API Schema definitions for the templates.stakater.com v1alpha1 API group

ClusterTemplateInstance#

ClusterTemplateInstance is the Schema for the clustertemplateinstances API

Field Description Default Validation
apiVersion string templates.stakater.com/v1alpha1
kind string ClusterTemplateInstance
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec ClusterTemplateInstanceSpec
status ClusterTemplateInstanceStatus
ClusterTemplateInstanceSpec#

ClusterTemplateInstanceSpec defines the desired state of ClusterTemplateInstance

Appears in: - ClusterTemplateInstance

Field Description Default Validation
template string Template is used to tell what to deploy in matched namespaces
selector LabelSelector Selector is used to filter namespaces where template needs to be deployed
sync boolean Sync is used to keep deployed instance and template in sync
parameters TemplateInstanceParameter array Parameters hold the values of the defined parameters in the template Optional: {}
TemplateInstanceParameter#

Appears in: - ClusterTemplateInstanceSpec - TemplateInstanceSpec

Field Description Default Validation
name string Name is the name of the parameter to set
value string Value is the value of the parameter to set
ClusterTemplateInstanceStatus#

ClusterTemplateInstanceStatus defines the observed state of ClusterTemplateInstance

Appears in: - ClusterTemplateInstance

Field Description Default Validation
conditions Condition array Status conditions Optional: {}
deployedNamespaces object (keys:string, values:DeployedNamespaceState) DeployedNamespaces is a list of namespaces where template has been deployed along with its state. Optional: {}
mappedSecrets object (keys:string, values:map[string]MappedResourcesState) MappedSecrets is a list of secrets which have been mapped along with its state. Optional: {}
mappedConfigmaps object (keys:string, values:map[string]MappedResourcesState) MappedConfigmaps is a list of configmaps which have been mapped along with its state. Optional: {}
templateManifestsHash string TemplateManifestsHash is used to ignore false-positive template.manifests update events Optional: {}
templateResourceMappingHash string TemplateResourceMappingHash is used to ignore false-positive template.resourceMappings update events Optional: {}
namespaceCount integer NamespaceCount tells the number of namespaces CTI matches Optional: {}
DeployedNamespaceState#

Appears in: - ClusterTemplateInstanceStatus

Field Description Default Validation
templateManifests string TemplateManifests are the manifests that were rendered before Optional: {}
status InstanceDeploymentStatus
InstanceDeploymentStatus#

Underlying type: string

InstanceDeploymentStatus describes the status of template instance deployment as {"Deployed", "Failed", ""}

Appears in: - DeployedNamespaceState - MappedResourcesState - TemplateInstanceStatus

Field Description
Deployed InstanceDeploymentStatusDeployed describes a succeeded instance deployment
Failed InstanceDeploymentStatusFailed describes a failed instance deployment
`` InstanceDeploymentStatusPending describes a not yet deployed instance

Template#

Template is the Schema for the templates API

Field Description Default Validation
apiVersion string templates.stakater.com/v1alpha1
kind string Template
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
resources TemplateResources Optional: {}
spec TemplateSpec
status TemplateStatus Optional: {}
parameters TemplateParameter array Parameters can be used to replace certain parts of the template. A parameter is referenced
by this format: ${NAME}, to parse the value as an expression write ${{NAME}} instead. Besides the
parameters defined here, the following predefined parameters can be used:
- ${NAMESPACE}: the namespace where the template instance was created
- ${TENANT}: the tenant name of the tenant that owns the namespace (if any)		 Optional: {}
TemplateResources#

TemplateResources defines a templates resources

Appears in: - Template

Field Description Default Validation
manifests EmbeddedResource array manifest represents kubernetes resources that will be deployed into the target namespace Optional: {}
helm HelmConfiguration helm defines the configuration for a helm deployment Optional: {}
resourceMappings ResourceMapping ResourceMappings defines the secrets/configmaps which will be mapped into the target namespaces Optional: {}
gotemplate string gotemplate is a Go template with Sprig functions support which will be rendered to generate Kubernetes resources. Optional: {}
EmbeddedResource#

EmbeddedResource holds a kubernetes resource

Appears in: - TemplateResources

HelmConfiguration#

HelmConfiguration holds the helm configuration

Appears in: - TemplateResources

Field Description Default Validation
releaseName string The helm release name. If omitted the template name will be used Optional: {}
setValues HelmSetValue array Values in the form of name=value that will be passed to the helm command during
helm template		 Optional: {}
values string The additional helm values to use. Expected block string Optional: {}
chart HelmChart Tells us where to find the helm chart to deploy
HelmSetValue#

HelmSetValue defines a name=value pair that will be passed to helm template

Appears in: - HelmConfiguration

Field Description Default Validation
name string The path of the value to set
value string The value to set
forceString boolean ForceString specifies if the parameter --set or --set-string should be used Optional: {}
HelmChart#

HelmChart holds the information needed to find a chart to deploy

Appears in: - HelmConfiguration

Field Description Default Validation
repository HelmChartRepository Load helm chart from a repository Optional: {}
HelmChartRepository#

HelmChartRepository defines a helm repository where TO can load a chart from

Appears in: - HelmChart

Field Description Default Validation
name string Name of the chart to deploy
version string Version is the version of the chart to deploy Optional: {}
repoUrl string The repo url to use Optional: {}
username HelmSecretRef The username to use for the selected repository Optional: {}
password HelmSecretRef The password to use for the selected repository Optional: {}
HelmSecretRef#

HelmSecretRef holds a secret reference to a secret

Appears in: - HelmChartRepository

Field Description Default Validation
key string
name string
namespace string Optional: {}
ResourceMapping#

Appears in: - TemplateResources

Field Description Default Validation
secrets Resource array Secrets consist of secrets which will be mapped to matching namespaces Optional: {}
configMaps Resource array ConfigMaps consist of configMaps which will be mapped to matching namespaces Optional: {}
Resource#

Appears in: - ResourceMapping

Field Description Default Validation
name string Name is the name of the resource Required: {}
namespace string Namespace is the namespace where the resource lives Required: {}
TemplateSpec#

Appears in: - Template

TemplateStatus#

Appears in: - Template

TemplateParameter#

Appears in: - Template

Field Description Default Validation
name string Name is the name of the parameter
value string Value is the default value of the parameter Optional: {}
required boolean If required is true, the template instance must
define this parameter, otherwise the deployment will fail.		 Optional: {}
validation string Validation takes a regular expression as value to
verify the provided value does match expected values.		 Optional: {}

TemplateInstance#

TemplateInstance is the Schema for the templatesinstance API

Field Description Default Validation
apiVersion string templates.stakater.com/v1alpha1
kind string TemplateInstance
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec TemplateInstanceSpec
status TemplateInstanceStatus Optional: {}
TemplateInstanceSpec#

TemplateInstanceSpec holds the expected cluster status of the template instance

Appears in: - TemplateInstance

Field Description Default Validation
template string The template to instantiate. This is an immutable field
sync boolean If true the template instance will keep the deployed resources in sync with the template. Optional: {}
parameters TemplateInstanceParameter array Parameters hold the values of the defined parameters in the template Optional: {}
TemplateInstanceStatus#

TemplateInstanceStatus describes the current status of the template instance in the cluster

Appears in: - TemplateInstance

Field Description Default Validation
status InstanceDeploymentStatus Status holds the template instances status
message string A human readable message indicating details about why the namespace is in this condition. Optional: {}
reason string A brief CamelCase message indicating details about why the namespace is in this state. Optional: {}
templateHash string TemplateHash is used to ignore false-positive template update events Optional: {}
templateManifests string TemplateManifests are the manifests that were rendered before Optional: {}
mappedSecrets object (keys:string, values:MappedResourcesState) MappedSecrets is a list of secrets which have been mapped along with its state. Optional: {}
mappedConfigmaps object (keys:string, values:MappedResourcesState) MappedConfigmaps is a list of configmaps which have been mapped along with its state. Optional: {}
observedAt Time LastAppliedAt indicates when the template was last applied Optional: {}
MappedResourcesState#

Appears in: - ClusterTemplateInstanceStatus - TemplateInstanceStatus

Field Description Default Validation
reason string Reason of resource mapping if failed Optional: {}
status InstanceDeploymentStatus

FinOps Operator#

Packages#

finops.stakater.com/v1alpha1#

Package v1alpha1 contains API Schema definitions for the finops v1alpha1 API group.

CostJob#

CostJob is the Schema for the costjobs API.

Field Description Default Validation
apiVersion string finops.stakater.com/v1alpha1
kind string CostJob
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec CostJobSpec
status CostJobStatus
CostJobSpec#

CostJobSpec defines the desired state of CostJob.

Appears in: - CostJob

Field Description Default Validation
type CostJobType Type of the cost collection job, e.g., "ResourceCostCollection" ResourceCostCollection Enum: [ResourceCostCollection SubscriptionChargeCollection]
Optional: {}
databaseInitTimeout Duration DatabaseInitTimeout is the timeout for database initialization 2m Optional: {}
kubernetesOperationTimeout Duration KubernetesOperationTimeout is the timeout for Kubernetes API operations 1m Optional: {}
openCostFetchTimeout Duration OpenCostFetchTimeout is the timeout for fetching data from OpenCost 2m Optional: {}
databaseInsertTimeout Duration DatabaseInsertTimeout is the timeout for database insert operations 3m Optional: {}
databaseViewsRefreshTimeout Duration DatabaseViewsRefreshTimeout is retained for API compatibility and has no
effect. The cost ingestion job no longer refreshes any database view: the
mv_provider_allocations_summary materialized view it used to rebuild on
every run had no readers and was dropped in migration 14.
Deprecated: no-op. Setting this value changes nothing.		 Optional: {}
statusUpdateTimeout Duration StatusUpdateTimeout is the timeout for status update operations 1m Optional: {}
httpClientTimeout Duration HTTPClientTimeout is the timeout for HTTP client requests 90s Optional: {}
interval Duration 24h
resources ResourceRequirements Resources overrides compute resources for the generated CronJob's loader container.
Setting this replaces the whole block, so a partial value does not inherit the
template defaults for the keys it omits. Unset means the operator defaults apply.		 Optional: {}
sharding CostJobSharding Sharding splits the OpenCost allocation query into several smaller
namespace-filtered queries run in parallel, instead of one cluster-wide
query per hour. Set this when the single query times out or exhausts
memory on a large cluster. Unset means the single cluster-wide query.		 Optional: {}
CostJobType#

Underlying type: string

Validation: - Enum: [ResourceCostCollection SubscriptionChargeCollection]

Appears in: - CostJobSpec

Field Description
ResourceCostCollection
SubscriptionChargeCollection
CostJobSharding#

CostJobSharding configures how the OpenCost allocation query is split up.

Appears in: - CostJobSpec

Field Description Default Validation
namespacesPerShard integer NamespacesPerShard is the maximum number of namespaces covered by a single
OpenCost query. Lower values mean more, smaller requests.		 25 Minimum: 1
Optional: {}
concurrency integer Concurrency is how many shard queries are in flight at once. It also bounds
the job's peak memory, since that many responses can be held at a time.		 4 Maximum: 32
Minimum: 1
Optional: {}
CostJobStatus#

CostJobStatus defines the observed state of CostJob

Appears in: - CostJob

Field Description Default Validation
lastExecutionTime Time Last execution time
lastSuccessfulExecutionTime Time Last successful execution time
lastExecutionStatus string Status of the last execution Enum: [Success Failed Error Pending]
executionHistory ExecutionRecord array History of the last 10 executions
ExecutionRecord#

ExecutionRecord represents a single execution attempt

Appears in: - CostJobStatus

Field Description Default Validation
executionTime Time The time when this execution started
status string Status of the execution (Success, Failed, Error) Enum: [Success Failed Error]
duration string Duration of the execution
error string Error message if the execution failed

FinOpsProvider#

FinOpsProvider is the Schema for the finopsproviders API.

Field Description Default Validation
apiVersion string finops.stakater.com/v1alpha1
kind string FinOpsProvider
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec FinOpsProviderSpec
status FinOpsProviderStatus
FinOpsProviderSpec#

ProviderOptions holds provider-specific configuration options. Exactly one of AWS, GCP, Azure, or OnPrem must be set. These validations operate on the Go field names (AWS, GCP, Azure, OnPrem). Se https://opencost.io/docs/configuration/ for possible options todo: +kubebuilder:validation:XValidation:rule="has(self.Aws) || has(self.Gcp) || has(self.Azure) || has(self.OnPrem)", message="At least one provider option (awsoptions, gcpoptions, azureoptions, onpremoptions) must be set" todo: +kubebuilder:validation:XValidation:rule="(has(self.Aws) ? 1 : 0) + (has(self.Gcp) ? 1 : 0) + (has(self.Azure) ? 1 : 0) + (has(self.OnPrem) ? 1 : 0) == 1", message="Exactly one provider option (awsoptions, gcpoptions, azureoptions, onpremoptions) must be set"

Appears in: - FinOpsProvider

Field Description Default Validation
awsoptions AWSOptions AWS specific options. Optional: {}
gcpoptions GCPOptions GCP specific options. Optional: {}
azureoptions AzureOptions Azure specific options. Optional: {}
onpremoptions OnPremOptions OnPrem specific options. Optional: {}
AWSOptions#

AWSOptions defines AWS-specific options.

Appears in: - FinOpsProviderSpec

Field Description Default Validation
cloudIntegrationSecret string CloudIntegrationSecret is the Azure Subscription ID. Optional: {}
pricingModelSource string PricingModelSource indicates how the pricing model is provided to OpenCost.
e.g., "Pricebook" if derived from PriceBook CRs.		 Optional: {}
GCPOptions#

GCPOptions defines GCP-specific options.

Appears in: - FinOpsProviderSpec

Field Description Default Validation
cloudIntegrationSecret string CloudIntegrationSecret is the Azure Subscription ID. Optional: {}
pricingModelSource string PricingModelSource indicates how the pricing model is provided to OpenCost.
e.g., "Pricebook" if derived from PriceBook CRs.		 Optional: {}
AzureOptions#

AzureOptions defines Azure-specific options.

Appears in: - FinOpsProviderSpec

Field Description Default Validation
cloudIntegrationSecret string CloudIntegrationSecret is the Azure Subscription ID. Optional: {}
pricingModelSource string PricingModelSource indicates how the pricing model is provided to OpenCost.
e.g., "Pricebook" if derived from PriceBook CRs.		 Optional: {}
OnPremOptions#

OnPremOptions defines On-Premise specific options.

Appears in: - FinOpsProviderSpec

Field Description Default Validation
pricingModelSource string PricingModelSource indicates how the pricing model is provided to OpenCost.
e.g., "Pricebook" if derived from PriceBook CRs.		 Optional: {}
FinOpsProviderStatus#

FinOpsProviderStatus defines the observed state of FinOpsProvider.

Appears in: - FinOpsProvider

Field Description Default Validation
observedGeneration integer ObservedGeneration reflects the generation of the most recently observed spec. Optional: {}
conditions Condition array Conditions represent the latest available observations of the FinOpsProvider's state. Optional: {}
lastSyncTime Time LastSyncTime is the timestamp of the last successful sync of OpenCost configuration. Optional: {}

Offering#

Offering describes a cost driving entity It owns the rules for how the base cost for that entity is collected and calculated

Field Description Default Validation
apiVersion string finops.stakater.com/v1alpha1
kind string Offering
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec OfferingSpec
status OfferingStatus
OfferingSpec#

OfferingSpec defines the desired state of Offering.

Appears in: - Offering

Field Description Default Validation
pricing Pricing Pricing specifies how the price for this offering is calculated Required: {}
compatibility Compatibility Compatibility can be used for ensuring that any subscription created for this offering
has the required offerings in its parents or siblings		 Optional: {}
lifecycle Lifecycle Lifecycle defines how subscriptions to this offering behave during certain lifecycle events Optional: {}
Pricing#

Pricing defines pricing rules for the offering

Appears in: - OfferingSpec

Field Description Default Validation
resourcePricing Meter array ResourcePricing defines per-meter pricing adjustments applied to raw usage.
Each meter can optionally define:
- includedUsage: an amount of usage included for free per subscription (same unit as the meter)
- margins: either an absolute add-on (in micro-currency) or a multiplicative factor (in milli-units)		 Optional: {}
subscriptionFee SubscriptionFee SubscriptionFee defines the recurring fee charged for the subscription being active,
independent of resource usage		 Optional: {}
Meter#

Meter defines pricing adjustments for a specific meter

Appears in: - Pricing

Field Description Default Validation
name MeterName Name is the name of the meter along with unit (e.g., "cpuHour", "ramGbHour"). Enum: [subscription cpuHour gpuHour ramGbHour pvGbHour networkGb]
Required: {}
margins Margins Margins adjusts the price derived from raw usage for this meter.
You can specify either:
- absoluteMicros: an additive margin in micro-currency units (10^-6 of the currency), or
- factorMilli: a multiplicative factor in milli-units (1000 = 1.000x, 1020 = 1.020x).		 Optional: {}
MeterName#

Underlying type: string

MeterName defines the name of a usage meter for pricing adjustments

Validation: - Enum: [subscription cpuHour gpuHour ramGbHour pvGbHour networkGb]

Appears in: - CostMetric - Meter - ResolvedMeter

Field Description
subscription
cpuHour
gpuHour
ramGbHour
pvGbHour
networkGb MeterNetworkGB bills total data transferred (transfer + receive) per GiB.
No time dimension — the rate is per-GB, not per-GB-hour — hence no "Hour".
Margins#

Margins defines pricing adjustments. AbsoluteMicros and FactorMilli are mutually exclusive — pick one mode per meter. Both must be non-negative: a negative margin would drive the per-unit price (and thus the usage charge) below zero, which usage meters don't support. Express a discount with a factorMilli below 1000 (e.g. 980 = 0.98x), not a negative absoluteMicros.

Appears in: - Meter

Field Description Default Validation
absoluteMicros integer AbsoluteMicros is an additive margin in micro-currency units (10^-6 of the currency)
1,000,000 micros = 1.00 currency unit
Example: 0.02 cents = 0.0002 currency units = 200 micros		 Optional: {}
factorMilli integer FactorMilli is a multiplicative factor in milli-units
1000 = 1.000x, 1020 = 1.020x (adds 2%), 980 = 0.980x (discount 2%)		 Optional: {}
SubscriptionFee#

SubscriptionFee defines the recurring fee charged for the subscription being active, independent of resource usage.

Billing model: - The fee accrues over time in discrete "ticks" of length period. - Each tick contributes priceMicros to the total. - Ticks are aligned according to tickAlignment.

Tick alignment: - ActivatedAt: ticks start at status.activatedAt (tick boundaries are: activatedAt + N*period). Best for per-subscription billing cycles (common for add-ons). - HourBoundary / DayBoundary / MonthBoundary: ticks align to wall-clock boundaries. Best for synchronized billing windows across subscriptions (common for reporting).

Charging rule (deterministic per time window): For a time bucket [start, endExclusive), the subscription fee charged in that bucket is:

ticks(t) = number of full tick boundaries strictly before time t
feeInBucket = priceMicros * (ticks(endExclusive) - ticks(start))

This ensures exports are idempotent: the same [start, endExclusive) always yields the same fee.

Minimum commitment (minPeriods): - minPeriods defines the minimum number of periods to bill once the subscription becomes active. - If the subscription deactivates before minPeriods have elapsed, the remaining periods are billed as an adjustment at deactivation time, so the total billed periods is at least minPeriods.

All monetary values are expressed in micro-currency units (10^-6 of the currency).

The period bounds below are derived in PeriodCount's doc; change them together.

Appears in: - Pricing - ResolvedPricing

Field Description Default Validation
period string Period is the tick interval. It must be greater than zero, and its form
depends on tickAlignment:
- ActivatedAt: a Go duration string (e.g., "30m", "1h", "24h").
- HourBoundary: hours, bare or "h"-suffixed (e.g., "1", "2h"), max 999999.
- DayBoundary: days, bare or "d"-suffixed (e.g., "1", "7d"), max 99999.
- MonthBoundary: months, bare or "mo"-suffixed (e.g., "1", "3mo"), max 999.
The unit suffix is optional, but a suffix belonging to a different
alignment is rejected. status.resolvedPricing republishes this value in
canonical suffixed form.		 MaxLength: 8
tickAlignment TickAlignment TickAlignment defines where tick boundaries occur.
ActivatedAt: ticks start at status.activatedAt (tick boundaries are: activatedAt + N*period).
Best for per-subscription billing cycles (common for add-ons).
HourBoundary / DayBoundary / MonthBoundary: ticks align to wall-clock boundaries.
Best for synchronized billing windows across subscriptions (common for reporting).
For boundary-aligned modes, the first tick after activation covers a partial period
and is prorated: charge = priceMicros * actualDuration / periodDuration.
For MonthBoundary, the period duration denominator is a fixed 365.25/12 days (30.4375 days).		 Enum: [ActivatedAt HourBoundary DayBoundary MonthBoundary]
minPeriods integer MinPeriods is the minimum number of full tick periods before deletion is allowed.
The collection job keeps the subscription finalizer until at least minPeriods ticks
have elapsed since activation. The subscription continues accruing charges normally
until the finalizer is removed.		 Minimum: 1
Optional: {}
priceMicros integer PriceMicros is the price per tick, in micro-currency units Minimum: 1
Required: {}
TickAlignment#

Underlying type: string

TickAlignment defines where tick boundaries occur for subscription fee billing.

Validation: - Enum: [ActivatedAt HourBoundary DayBoundary MonthBoundary]

Appears in: - SubscriptionFee

Field Description
ActivatedAt ActivatedAt: ticks start at status.activatedAt (tick boundaries are: activatedAt + N*period).
Best for per-subscription billing cycles (common for add-ons).
HourBoundary HourBoundary ticks align to wall-clock hour boundaries (e.g., 1:00, 2:00, etc.).
DayBoundary DayBoundary ticks align to wall-clock day boundaries (e.g., 1 calender day).
MonthBoundary MonthBoundary ticks align to wall-clock month boundaries (e.g., 1st of each month).
Compatibility#

Compatibility defines compatibility requirements for subscriptions bound to this offering

Appears in: - OfferingSpec

Field Description Default Validation
requiredOfferings ObjectReference array RequiredOfferings lists offerings that must exist in parent or sibling subscriptions Optional: {}
ObjectReference#

Appears in: - Compatibility - SubscriptionParent - SubscriptionSpec

Field Description Default Validation
name string Required: {}
namespace string Namespace of the Offering. If empty, defaults to the Subscription's namespace. Optional: {}
Lifecycle#

Lifecycle defines lifecycle behavior for subscriptions

Appears in: - OfferingSpec

Field Description Default Validation
onParentDeactivate ParentDeactivateAction OnParentDeactivate toggles whether subscriptions to this offering should be deactivated when their parent subscription is deactivated
- Deactivate: this subscription also deactivates.
- Orphan: this subscription stays active independently, while retaining the parent reference for traceability.		 Deactivate Enum: [Deactivate Orphan]
allowOverride boolean AllowOverride allows the subscription to override the lifecycle settings Optional: {}
ParentDeactivateAction#

Underlying type: string

ParentDeactivateAction defines the behavior when a parent subscription is deactivated.

Validation: - Enum: [Deactivate Orphan]

Appears in: - Lifecycle - SubscriptionLifecycle

Field Description
Deactivate
Orphan
OfferingStatus#

OfferingStatus defines the observed state of Offering.

Appears in: - Offering

Field Description Default Validation
resolvedPricing ResolvedPricing ResolvedPricing contains the effective pricing derived from the offering spec Optional: {}
conditions Condition array Conditions represent the latest available observations of the Offering's state Optional: {}
ready ConditionStatus Ready indicates whether the offering is ready to be subscribed to (i.e., all required offerings are present and no circular dependencies detected)
ResolvedPricing#

ResolvedPricing contains the effective pricing that consumers see. It is derived from the offering spec and stamped on status during reconciliation.

Appears in: - OfferingStatus

Field Description Default Validation
resolvedAt Time ResolvedAt is the timestamp when pricing was last resolved
meters ResolvedMeter array Meters contains per-meter resolved unit prices after margins are applied.
Empty when no resource pricing is configured.
subscriptionFee SubscriptionFee SubscriptionFee contains the resolved subscription fee, if configured Optional: {}
ResolvedMeter#

ResolvedMeter contains the effective per-unit price for a specific meter

Appears in: - ResolvedPricing

Field Description Default Validation
name MeterName Name is the meter name (e.g., "cpuHour", "ramGbHour") Enum: [subscription cpuHour gpuHour ramGbHour pvGbHour networkGb]
Required: {}
unitPriceMicros integer UnitPriceMicros is the effective per-unit price in micro-currency units (10^-6)
includedUsage ResolvedIncludedUsage IncludedUsage is the free usage included per subscription for this meter Optional: {}
ResolvedIncludedUsage#

ResolvedIncludedUsage contains the resolved included usage with its unit of measurement

Appears in: - ResolvedMeter

Field Description Default Validation
value integer Value is the amount of free usage included per subscription
unit string Unit is the unit of measurement (e.g., "GbHour", "CoreHour")

PriceBook#

PriceBook is the Schema for the pricebooks API

Field Description Default Validation
apiVersion string finops.stakater.com/v1alpha1
kind string PriceBook
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec PriceBookSpec
status PriceBookStatus
PriceBookSpec#

PriceBookSpec defines the desired state of PriceBook

Appears in: - PriceBook

Field Description Default Validation
currency string The base currency for financial reporting and calculations (e.g., EUR, USD). Pattern: ^[A-Z]\{3\}$
Required: {}
valuationMode string The mode of valuation - either 'currency' for direct monetary rates or 'percent' for weighted scoring. Enum: [currency percent]
Required: {}
rates PriceRates Rates used for valuation in 'currency' mode. Defines cost per unit of resource. Required if valuationMode is 'currency'. Optional: {}
PriceRates#

PriceRates defines the cost rates for different resources. Each rate is a non-negative decimal string (e.g. "0.031"); empty means "unset". The pattern ^([0-9]+(\.[0-9]+)?)?$ rejects malformed values at admission while allowing empty.

Appears in: - PriceBookSpec

Field Description Default Validation
cpuHour string Cost per vCPU-hour (e.g., 0.031). Pattern: ^([0-9]+(\.[0-9]+)?)?$
Optional: {}
spotCPUHour string Cost per vCPU-hour (e.g., 0.031). Pattern: ^([0-9]+(\.[0-9]+)?)?$
Optional: {}
ramGbHour string Cost per GB-hour of RAM (e.g., 0.004). Pattern: ^([0-9]+(\.[0-9]+)?)?$
Optional: {}
spotRAMGbHour string Cost per GB-hour of spotRAM (e.g., 0.004). Pattern: ^([0-9]+(\.[0-9]+)?)?$
Optional: {}
pvGbHour string Cost per GB-hour of Persistent Volume (e.g., 0.00012). Pattern: ^([0-9]+(\.[0-9]+)?)?$
Optional: {}
gpuHour string Cost per GPU-hour (e.g., 1.8). Pattern: ^([0-9]+(\.[0-9]+)?)?$
Optional: {}
networkGiB string Cost per GiB of network data transferred (e.g., 0.09). Pattern: ^([0-9]+(\.[0-9]+)?)?$
Optional: {}
PriceBookStatus#

PriceBookStatus defines the observed state of PriceBook

Appears in: - PriceBook

Field Description Default Validation
active boolean Active indicates whether this PriceBook instance is currently designated as the active one
used for pricing calculations. This field is managed by the operator.		 Optional: {}
ready ConditionStatus Ready indicates whether this PriceBook's rates are valid and it is usable
for pricing resolution. Managed by the operator.		 Optional: {}
observedGeneration integer ObservedGeneration reflects the generation of the most recently observed spec. Optional: {}
conditions Condition array Conditions represent the latest available observations of the PriceBook's state. Optional: {}
activePricing object (keys:string, values:string) ActivePricing mirrors the OpenCost custom-pricing document (default.json)
this PriceBook has applied to OpenCost. Populated only on the active, ready
PriceBook (the one driving OpenCost); nil on every other PriceBook.
Managed by the operator.		 Optional: {}

Subscription#

Subscription is the Schema for the subscriptions API.

Field Description Default Validation
apiVersion string finops.stakater.com/v1alpha1
kind string Subscription
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec SubscriptionSpec
status SubscriptionStatus
SubscriptionSpec#

SubscriptionSpec defines the desired state of Subscription. A Subscription creates a binding to an Offering, starting the clock and instantiating the offering. Effectively it starts consuming the cost-driving entity from a billing perspective.

Appears in: - Subscription

Field Description Default Validation
offeringRef ObjectReference OfferingRef is the reference to the Offering which is being subscribed to. Required: {}
parent SubscriptionParent Parent is an optional reference to a parent subscription for traceability.
For example, a storage subscription attached to a VM would reference the VM subscription.		 Optional: {}
usageSources UsageSource array UsageSources defines from where the data for the resource usage of this subscription comes. Optional: {}
lifecycle SubscriptionLifecycle Lifecycle allows overriding lifecycle behavior if the Offering permits it.
If both parent and targetRef are set:
- activation requires BOTH (parent active AND target Ready)
- deactivation happens if EITHER stops applying, except parent deactivation is ignored when onParentDeactivate=Orphan		 Optional: {}
SubscriptionParent#

Appears in: - SubscriptionSpec

Field Description Default Validation
subscriptionRef ObjectReference SubscriptionRef is a reference to the parent subscription. Required: {}
UsageSource#

Appears in: - SubscriptionSpec

Field Description Default Validation
resourceType string ResourceType is the type of resource to track (e.g., Deployment, StatefulSet, Pod). Enum: [Deployment StatefulSet Pod DaemonSet Job CronJob ReplicaSet]
name string Name is the name of the specific resource instance. Optional: {}
namespace string Namespace is the namespace of the resource. Optional: {}
SubscriptionLifecycle#

Appears in: - SubscriptionSpec

Field Description Default Validation
onParentDeactivate ParentDeactivateAction OnParentDeactivate controls what happens when the parent subscription deactivates:
- Deactivate: this subscription also deactivates.
- Orphan: this subscription stays active independently, while retaining the parent reference for traceability.		 Deactivate Enum: [Deactivate Orphan]
targetRef TargetReference TargetRef ties the lifecycle of the subscription to a target resource.
The subscription will not activate until the target status is Ready.
When the target is deleted, the subscription will be deactivated.		 Optional: {}

TargetReference#

Appears in: - SubscriptionLifecycle

Field Description Default Validation
apiVersion string APIVersion is the API version of the target resource.
kind string Kind is the kind of the target resource.
namespace string Namespace is the namespace of the target resource. Optional: {}
name string Name is the name of the target resource.
SubscriptionStatus#

SubscriptionStatus defines the observed state of Subscription. Non-active subscriptions are ignored by scrape jobs. A subscription becomes active when: - parent.SubscriptionRef is set and the parent is active, and/or - targetRef is set and the target is Ready. Unset references are ignored. If neither reference is set, the subscription activates after spec validation.

Appears in: - Subscription

Field Description Default Validation
ready ConditionStatus Ready indicates whether the subscription is active and ready.
activatedAt Time ActivatedAt is the time when the subscription became active. Optional: {}
deactivatedAt Time DeactivatedAt is the time when the subscription was deactivated. Optional: {}
costs CostBucket array Costs contains rolling cost summaries for the current hour, day, and month.
When populated, contains exactly 3 entries — one per granularity. // +optional
conditions Condition array Conditions represent the latest available observations of the Subscription's state. Optional: {}
CostBucket#

Appears in: - SubscriptionStatus

Field Description Default Validation
granularity string Granularity is the time granularity of this bucket (e.g., hour, day, month). Enum: [hour day month]
start Time Start is the start time of the bucket (inclusive).
endExclusive Time EndExclusive is the end time of the bucket (exclusive).
current integer Current is the current accumulated spend for the period in micro-currency units. Optional: {}
projected integer Projected is the projected spend for the full period cycle in micro-currency units. Optional: {}
breakdown CostMetric array Breakdown contains the cost breakdown by component. Optional: {}
CostMetric#

Appears in: - CostBucket

Field Description Default Validation
name MeterName Name is the name of the cost metric (e.g., "cpuHour", "pvGbHour"). Enum: [subscription cpuHour gpuHour ramGbHour pvGbHour networkGb]
Required: {}
current integer Current is the current accumulated value in micro-currency units. Optional: {}
projected integer Projected is the projected value in micro-currency units. Optional: {}

Hibernation Operator#

Packages#

hibernation.stakater.com/v1beta1#

ClusterResourceSupervisor#

ClusterResourceSupervisor is the Schema for the resourcesupervisors API

Field Description Default Validation
apiVersion string hibernation.stakater.com/v1beta1
kind string ClusterResourceSupervisor
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec ClusterResourceSupervisorSpec
status ClusterResourceSupervisorStatus
ClusterResourceSupervisorSpec#

ClusterResourceSupervisorSpec defines the desired state of ClusterResourceSupervisor

Appears in: - ClusterResourceSupervisor

Field Description Default Validation
schedule Hibernation Required: {}
namespaces Namespaces Namespaces is a list of namespaces to which the schedule will be applied Optional: {}
argocd ArgoCDHibernation ArgoCD contains details about ArgoCD to which the schedule will be applied
ClusterResourceSupervisorStatus#

ClusterResourceSupervisorStatus defines the observed state of ClusterResourceSupervisor

Appears in: - ClusterResourceSupervisor

Field Description Default Validation
nextReconcileTime Time NextReconcileTime contains the next time at which the namespace resources will sleep or wake up
currentStatus Status CurrentStatus shows the state the tenant's resources Enum: [sleeping running error]
sleepingNamespaces SleepingNamespace array SleepingResources contains the previous states for each of the deployments currently scaled down
watchedNamespaces string array WatchedNamespaces contains the namespaces this supervisor may hibernate
ignoreNamespaces string array IgnoreNamespaces contains the namespaces this supervisor was asked to hibernate but may not
conditions Condition array Conditions holds Ready, which says whether the last pass did what the schedule
asked and if not why. An Event expires and nothing queries it, so without it a
failed pass or an unparseable cron would leave no trace on the resource at all.		 Optional: {}

ResourceSupervisor#

ResourceSupervisor is the Schema for the resourcesupervisors API

Field Description Default Validation
apiVersion string hibernation.stakater.com/v1beta1
kind string ResourceSupervisor
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec ResourceSupervisorSpec
status ResourceSupervisorStatus
ResourceSupervisorSpec#

ResourceSupervisorSpec defines the desired state of ResourceSupervisor API

Appears in: - ResourceSupervisor

Field Description Default Validation
schedule Hibernation Required: {}
ResourceSupervisorStatus#

ResourceSupervisorStatus defines the observed state of ResourceSupervisor

Appears in: - ResourceSupervisor

Field Description Default Validation
nextReconcileTime Time NextReconcileTime contains the next time at which the namespace resources will sleep or wake up
currentStatus Status CurrentStatus shows the state the tenant's resources Enum: [sleeping running error]
sleepingNamespaces SleepingNamespace array SleepingResources contains the previous states for each of the deployments currently scaled down
watchedNamespaces string array WatchedNamespaces contains the namespaces this supervisor may hibernate
ignoreNamespaces string array IgnoreNamespaces contains the namespaces this supervisor was asked to hibernate but may not
conditions Condition array Conditions holds Ready, which says whether the last pass did what the schedule
asked and if not why. An Event expires and nothing queries it, so without it a
failed pass or an unparseable cron would leave no trace on the resource at all.		 Optional: {}