PocketIDInstance
pocketid.internal / v1alpha1
apiVersion: pocketid.internal/v1alpha1
kind: PocketIDInstance
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec object required
spec defines the desired state of PocketIDInstance.
OIDCClientRotation object
OIDCClientRotation configures instance-wide throttling of OIDC client secret rotations.
minSpacing
string required
MinSpacing is the minimum time between any two client secret rotations on this instance.
Prevents a thundering herd when many clients become due simultaneously.
analyticsDisabled
boolean
Disable anonymous usage analytics.
Sets ANALYTICS_DISABLED. See https://pocket-id.org/docs/configuration/environment-variables.
annotations
object
Additional annotations to add to the workload and pod.
appUrl
string
Public URL of Pocket-ID.
Sets APP_URL. See https://pocket-id.org/docs/configuration/environment-variables.
auditLogRetentionDays
integer
Audit log retention in days.
Sets AUDIT_LOG_RETENTION_DAYS. See https://pocket-id.org/docs/configuration/environment-variables.
format:
int32
cimdUrlAllowlist
[]string
Allowed OAuth Client ID Metadata Document URLs. The operator sets UI_CONFIG_DISABLED=true when this field is set.
JSON-encoded into CIMD_URL_ALLOWLIST. See https://pocket-id.org/docs/configuration/environment-variables.
containerSecurityContext object
Container security context.
allowPrivilegeEscalation
boolean
AllowPrivilegeEscalation controls whether a process can gain more
privileges than its parent process. This bool directly controls if
the no_new_privs flag will be set on the container process.
AllowPrivilegeEscalation is true always when the container is:
1) run as Privileged
2) has CAP_SYS_ADMIN
Note that this field cannot be set when spec.os.name is windows.
appArmorProfile object
appArmorProfile is the AppArmor options to use by this container. If set, this profile
overrides the pod's appArmorProfile.
Note that this field cannot be set when spec.os.name is windows.
localhostProfile
string
localhostProfile indicates a profile loaded on the node that should be used.
The profile must be preconfigured on the node to work.
Must match the loaded name of the profile.
Must be set if and only if type is "Localhost".
type
string required
type indicates which kind of AppArmor profile will be applied.
Valid options are:
Localhost - a profile pre-loaded on the node.
RuntimeDefault - the container runtime's default profile.
Unconfined - no AppArmor enforcement.
capabilities object
The capabilities to add/drop when running containers.
Defaults to the default set of capabilities granted by the container runtime.
Note that this field cannot be set when spec.os.name is windows.
add
[]string
Added capabilities
drop
[]string
Removed capabilities
privileged
boolean
Run container in privileged mode.
Processes in privileged containers are essentially equivalent to root on the host.
Defaults to false.
Note that this field cannot be set when spec.os.name is windows.
procMount
string
procMount denotes the type of proc mount to use for the containers.
The default value is Default which uses the container runtime defaults for
readonly paths and masked paths.
Note that this field cannot be set when spec.os.name is windows.
readOnlyRootFilesystem
boolean
Whether this container has a read-only root filesystem.
Default is false.
Note that this field cannot be set when spec.os.name is windows.
runAsGroup
integer
The GID to run the entrypoint of the container process.
Uses runtime default if unset.
May also be set in PodSecurityContext. If set in both SecurityContext and
PodSecurityContext, the value specified in SecurityContext takes precedence.
Note that this field cannot be set when spec.os.name is windows.
format:
int64
runAsNonRoot
boolean
Indicates that the container must run as a non-root user.
If true, the Kubelet will validate the image at runtime to ensure that it
does not run as UID 0 (root) and fail to start the container if it does.
If unset or false, no such validation will be performed.
May also be set in PodSecurityContext. If set in both SecurityContext and
PodSecurityContext, the value specified in SecurityContext takes precedence.
runAsUser
integer
The UID to run the entrypoint of the container process.
Defaults to user specified in image metadata if unspecified.
May also be set in PodSecurityContext. If set in both SecurityContext and
PodSecurityContext, the value specified in SecurityContext takes precedence.
Note that this field cannot be set when spec.os.name is windows.
format:
int64seLinuxOptions object
The SELinux context to be applied to the container.
If unspecified, the container runtime will allocate a random SELinux context for each
container. May also be set in PodSecurityContext. If set in both SecurityContext and
PodSecurityContext, the value specified in SecurityContext takes precedence.
Note that this field cannot be set when spec.os.name is windows.
level
string
Level is SELinux level label that applies to the container.
role
string
Role is a SELinux role label that applies to the container.
type
string
Type is a SELinux type label that applies to the container.
user
string
User is a SELinux user label that applies to the container.
seccompProfile object
The seccomp options to use by this container. If seccomp options are
provided at both the pod & container level, the container options
override the pod options.
Note that this field cannot be set when spec.os.name is windows.
localhostProfile
string
localhostProfile indicates a profile defined in a file on the node should be used.
The profile must be preconfigured on the node to work.
Must be a descending path, relative to the kubelet's configured seccomp profile location.
Must be set if type is "Localhost". Must NOT be set for any other type.
type
string required
type indicates which kind of seccomp profile will be applied.
Valid options are:
Localhost - a profile defined in a file on the node should be used.
RuntimeDefault - the container runtime default profile should be used.
Unconfined - no profile should be applied.
windowsOptions object
The Windows specific settings applied to all containers.
If unspecified, the options from the PodSecurityContext will be used.
If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
Note that this field cannot be set when spec.os.name is linux.
gmsaCredentialSpec
string
GMSACredentialSpec is where the GMSA admission webhook
(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
GMSA credential spec named by the GMSACredentialSpecName field.
gmsaCredentialSpecName
string
GMSACredentialSpecName is the name of the GMSA credential spec to use.
hostProcess
boolean
HostProcess determines if a container should be run as a 'Host Process' container.
All of a Pod's containers must have the same effective HostProcess value
(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
In addition, if HostProcess is true then HostNetwork must also be set to true.
runAsUserName
string
The UserName in Windows to run the entrypoint of the container process.
Defaults to the user specified in image metadata if unspecified.
May also be set in PodSecurityContext. If set in both SecurityContext and
PodSecurityContext, the value specified in SecurityContext takes precedence.
databaseUrl object
Database connection string.
Sets DB_CONNECTION_STRING. See https://pocket-id.org/docs/configuration/environment-variables.
value
string
Plain text value.
valueFrom object
Source for the value (e.g. secretKeyRef, configMapKeyRef).
configMapKeyRef object
Selects a key of a ConfigMap.
key
string required
The key to select from the ConfigMap's Data field.
Keys in the BinaryData field are not currently propagated to container env vars.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the ConfigMap or its key must be defined
fieldRef object
Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
apiVersion
string
Version of the schema the FieldPath is written in terms of, defaults to "v1".
fieldPath
string required
Path of the field to select in the specified API version.
fileKeyRef object
FileKeyRef selects a key of the env file.
Requires the EnvFiles feature gate to be enabled.
key
string required
The key within the env file. An invalid key will prevent the pod from starting.
The keys defined within a source may consist of any printable ASCII characters except '='.
During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
optional
boolean
Specify whether the file or its key must be defined. If the file or key
does not exist, then the env var is not published.
If optional is set to true and the specified key does not exist,
the environment variable will not be set in the Pod's containers.
If optional is set to false and the specified key does not exist,
an error will be returned during Pod creation.
path
string required
The path within the volume from which to select the file.
Must be relative and may not contain the '..' path or start with '..'.
volumeName
string required
The name of the volume mount containing the env file.
resourceFieldRef object
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
containerName
string
Container name: required for volumes, optional for env vars
divisor
string | integer
Specifies the output format of the exposed resources, defaults to "1"
string pattern:
^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
resource
string required
Required: resource to select
secretKeyRef object
Selects a key of a secret in the pod's namespace
key
string required
The key of the secret to select from. Must be a valid secret key.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the Secret or its key must be defined
deploymentType
string
Kind of workload to create: Deployment or StatefulSet. Defaults to Deployment and is immutable after creation.
enum:
Deployment, StatefulSetemailNotifications object
Email notification settings. Requires smtp. The operator sets UI_CONFIG_DISABLED=true when this section is configured.
apiKeyExpiration
boolean
API key expiration notifications.
Sets EMAIL_API_KEY_EXPIRATION_ENABLED. See https://pocket-id.org/docs/configuration/environment-variables.
loginNotification
boolean
Deprecated: use loginNotificationMode instead.
loginNotificationMode
string
When users receive a sign-in notification email. Requires Pocket-ID v2.19.0 or newer; takes precedence over loginNotification.
Sets EMAIL_LOGIN_NOTIFICATION_MODE. See https://pocket-id.org/docs/configuration/environment-variables.
enum:
disabled, always, ipAndUserAgent, browserRecognition
oneTimeAccessAsAdmin
boolean
Admin-sent login codes.
Sets EMAIL_ONE_TIME_ACCESS_AS_ADMIN_ENABLED. See https://pocket-id.org/docs/configuration/environment-variables.
oneTimeAccessAsUnauthenticated
boolean
Email login codes for unauthenticated users.
Sets EMAIL_ONE_TIME_ACCESS_AS_UNAUTHENTICATED_ENABLED. See https://pocket-id.org/docs/configuration/environment-variables.
verification
boolean
Deprecated: use verificationMode instead.
verificationMode
string
Email verification mode. Requires Pocket-ID v2.19.0 or newer; takes precedence over verification.
With required, non-admin users (including operator-managed ones) must verify their email before using Pocket-ID.
Sets EMAIL_VERIFICATION. See https://pocket-id.org/docs/configuration/environment-variables.
enum:
disabled, optional, requiredencryptionKey object
Encryption key. Required when deploying an instance; omit for external instances.
Sets ENCRYPTION_KEY. See https://pocket-id.org/docs/configuration/environment-variables.
value
string
Plain text value.
valueFrom object
Source for the value (e.g. secretKeyRef, configMapKeyRef).
configMapKeyRef object
Selects a key of a ConfigMap.
key
string required
The key to select from the ConfigMap's Data field.
Keys in the BinaryData field are not currently propagated to container env vars.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the ConfigMap or its key must be defined
fieldRef object
Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
apiVersion
string
Version of the schema the FieldPath is written in terms of, defaults to "v1".
fieldPath
string required
Path of the field to select in the specified API version.
fileKeyRef object
FileKeyRef selects a key of the env file.
Requires the EnvFiles feature gate to be enabled.
key
string required
The key within the env file. An invalid key will prevent the pod from starting.
The keys defined within a source may consist of any printable ASCII characters except '='.
During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
optional
boolean
Specify whether the file or its key must be defined. If the file or key
does not exist, then the env var is not published.
If optional is set to true and the specified key does not exist,
the environment variable will not be set in the Pod's containers.
If optional is set to false and the specified key does not exist,
an error will be returned during Pod creation.
path
string required
The path within the volume from which to select the file.
Must be relative and may not contain the '..' path or start with '..'.
volumeName
string required
The name of the volume mount containing the env file.
resourceFieldRef object
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
containerName
string
Container name: required for volumes, optional for env vars
divisor
string | integer
Specifies the output format of the exposed resources, defaults to "1"
string pattern:
^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
resource
string required
Required: resource to select
secretKeyRef object
Selects a key of a secret in the pod's namespace
key
string required
The key of the secret to select from. Must be a valid secret key.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the Secret or its key must be defined
env []object
Additional environment variables to set. Uses Kubernetes env var syntax (secretKeyRef, configMapKeyRef, etc.).
name
string required
Name of the environment variable.
May consist of any printable ASCII characters except '='.
value
string
Variable references $(VAR_NAME) are expanded
using the previously defined environment variables in the container and
any service environment variables. If a variable cannot be resolved,
the reference in the input string will be unchanged. Double $$ are reduced
to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
"$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
Escaped references will never be expanded, regardless of whether the variable
exists or not.
Defaults to "".
valueFrom object
Source for the environment variable's value. Cannot be used if value is not empty.
configMapKeyRef object
Selects a key of a ConfigMap.
key
string required
The key to select from the ConfigMap's Data field.
Keys in the BinaryData field are not currently propagated to container env vars.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the ConfigMap or its key must be defined
fieldRef object
Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
apiVersion
string
Version of the schema the FieldPath is written in terms of, defaults to "v1".
fieldPath
string required
Path of the field to select in the specified API version.
fileKeyRef object
FileKeyRef selects a key of the env file.
Requires the EnvFiles feature gate to be enabled.
key
string required
The key within the env file. An invalid key will prevent the pod from starting.
The keys defined within a source may consist of any printable ASCII characters except '='.
During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
optional
boolean
Specify whether the file or its key must be defined. If the file or key
does not exist, then the env var is not published.
If optional is set to true and the specified key does not exist,
the environment variable will not be set in the Pod's containers.
If optional is set to false and the specified key does not exist,
an error will be returned during Pod creation.
path
string required
The path within the volume from which to select the file.
Must be relative and may not contain the '..' path or start with '..'.
volumeName
string required
The name of the volume mount containing the env file.
resourceFieldRef object
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
containerName
string
Container name: required for volumes, optional for env vars
divisor
string | integer
Specifies the output format of the exposed resources, defaults to "1"
string pattern:
^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
resource
string required
Required: resource to select
secretKeyRef object
Selects a key of a secret in the pod's namespace
key
string required
The key of the secret to select from. Must be a valid secret key.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the Secret or its key must be defined
external object
External adopts an existing Pocket-ID instead of deploying one. When set, no workload/service/PVC is created and the operator manages OIDC clients, users, and groups on that instance via its API.
Mutually exclusive with encryptionKey and the other deployment fields.
apiKeySecretRef object required
APIKeySecretRef references a Secret key holding a Pocket-ID API key with permission to manage clients, users, and groups on the instance.
key
string required
The key of the secret to select from. Must be a valid secret key.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the Secret or its key must be defined
url
string required
URL is the base URL of the existing Pocket-ID instance (e.g. https://auth.example.com).
pattern:
^https?://
fileBackend
string
File storage backend. Automatically set to "s3" when s3 config is present.
Sets FILE_BACKEND. See https://pocket-id.org/docs/configuration/environment-variables.
geoip object
GeoIP/MaxMind integration for audit log geolocation.
dbPath
string
GeoLite2 database path.
Sets GEOLITE_DB_PATH. See https://pocket-id.org/docs/configuration/environment-variables.
dbUrl object
GeoLite2 database download URL.
Sets GEOLITE_DB_URL. See https://pocket-id.org/docs/configuration/environment-variables.
value
string
Plain text value.
valueFrom object
Source for the value (e.g. secretKeyRef, configMapKeyRef).
configMapKeyRef object
Selects a key of a ConfigMap.
key
string required
The key to select from the ConfigMap's Data field.
Keys in the BinaryData field are not currently propagated to container env vars.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the ConfigMap or its key must be defined
fieldRef object
Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
apiVersion
string
Version of the schema the FieldPath is written in terms of, defaults to "v1".
fieldPath
string required
Path of the field to select in the specified API version.
fileKeyRef object
FileKeyRef selects a key of the env file.
Requires the EnvFiles feature gate to be enabled.
key
string required
The key within the env file. An invalid key will prevent the pod from starting.
The keys defined within a source may consist of any printable ASCII characters except '='.
During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
optional
boolean
Specify whether the file or its key must be defined. If the file or key
does not exist, then the env var is not published.
If optional is set to true and the specified key does not exist,
the environment variable will not be set in the Pod's containers.
If optional is set to false and the specified key does not exist,
an error will be returned during Pod creation.
path
string required
The path within the volume from which to select the file.
Must be relative and may not contain the '..' path or start with '..'.
volumeName
string required
The name of the volume mount containing the env file.
resourceFieldRef object
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
containerName
string
Container name: required for volumes, optional for env vars
divisor
string | integer
Specifies the output format of the exposed resources, defaults to "1"
string pattern:
^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
resource
string required
Required: resource to select
secretKeyRef object
Selects a key of a secret in the pod's namespace
key
string required
The key of the secret to select from. Must be a valid secret key.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the Secret or its key must be defined
maxmindLicenseKey object
MaxMind license key.
Sets MAXMIND_LICENSE_KEY. See https://pocket-id.org/docs/configuration/environment-variables.
value
string
Plain text value.
valueFrom object
Source for the value (e.g. secretKeyRef, configMapKeyRef).
configMapKeyRef object
Selects a key of a ConfigMap.
key
string required
The key to select from the ConfigMap's Data field.
Keys in the BinaryData field are not currently propagated to container env vars.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the ConfigMap or its key must be defined
fieldRef object
Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
apiVersion
string
Version of the schema the FieldPath is written in terms of, defaults to "v1".
fieldPath
string required
Path of the field to select in the specified API version.
fileKeyRef object
FileKeyRef selects a key of the env file.
Requires the EnvFiles feature gate to be enabled.
key
string required
The key within the env file. An invalid key will prevent the pod from starting.
The keys defined within a source may consist of any printable ASCII characters except '='.
During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
optional
boolean
Specify whether the file or its key must be defined. If the file or key
does not exist, then the env var is not published.
If optional is set to true and the specified key does not exist,
the environment variable will not be set in the Pod's containers.
If optional is set to false and the specified key does not exist,
an error will be returned during Pod creation.
path
string required
The path within the volume from which to select the file.
Must be relative and may not contain the '..' path or start with '..'.
volumeName
string required
The name of the volume mount containing the env file.
resourceFieldRef object
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
containerName
string
Container name: required for volumes, optional for env vars
divisor
string | integer
Specifies the output format of the exposed resources, defaults to "1"
string pattern:
^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
resource
string required
Required: resource to select
secretKeyRef object
Selects a key of a secret in the pod's namespace
key
string required
The key of the secret to select from. Must be a valid secret key.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the Secret or its key must be defined
hostUsers
boolean
Deprecated: use spec.podTemplate.hostUsers instead.
image
string
Container image to run. When unset, the operator uses the latest version tested against this release.
internalAppUrl
string
Internal base URL for split-horizon DNS.
Sets INTERNAL_APP_URL. See https://pocket-id.org/docs/configuration/environment-variables.
labels
object
Additional labels to add to the workload and pod.
ldap object
LDAP authentication. When present, the operator sets LDAP_ENABLED=true and UI_CONFIG_DISABLED=true.
adminGroupName
string
Group that grants admin privileges.
Sets LDAP_ADMIN_GROUP_NAME. See https://pocket-id.org/docs/configuration/environment-variables.
attributeMapping object
LDAP attribute mappings.
groupMember
string
Group membership attribute.
Sets LDAP_ATTRIBUTE_GROUP_MEMBER. See https://pocket-id.org/docs/configuration/environment-variables.
groupName
string
Group name attribute.
Sets LDAP_ATTRIBUTE_GROUP_NAME. See https://pocket-id.org/docs/configuration/environment-variables.
groupUniqueIdentifier
string
Group unique identifier attribute.
Sets LDAP_ATTRIBUTE_GROUP_UNIQUE_IDENTIFIER. See https://pocket-id.org/docs/configuration/environment-variables.
userDisplayName
string
Display name attribute.
Sets LDAP_ATTRIBUTE_USER_DISPLAY_NAME. See https://pocket-id.org/docs/configuration/environment-variables.
userEmail
string
Email attribute.
Sets LDAP_ATTRIBUTE_USER_EMAIL. See https://pocket-id.org/docs/configuration/environment-variables.
userFirstName
string
First name attribute.
Sets LDAP_ATTRIBUTE_USER_FIRST_NAME. See https://pocket-id.org/docs/configuration/environment-variables.
userLastName
string
Last name attribute.
Sets LDAP_ATTRIBUTE_USER_LAST_NAME. See https://pocket-id.org/docs/configuration/environment-variables.
userProfilePicture
string
Profile picture attribute.
Sets LDAP_ATTRIBUTE_USER_PROFILE_PICTURE. See https://pocket-id.org/docs/configuration/environment-variables.
userUniqueIdentifier
string
User unique identifier attribute.
Sets LDAP_ATTRIBUTE_USER_UNIQUE_IDENTIFIER. See https://pocket-id.org/docs/configuration/environment-variables.
userUsername
string
Username attribute.
Sets LDAP_ATTRIBUTE_USER_USERNAME. See https://pocket-id.org/docs/configuration/environment-variables.
base
string required
Search base DN.
Sets LDAP_BASE. See https://pocket-id.org/docs/configuration/environment-variables.
bindDN
string required
Bind DN.
Sets LDAP_BIND_DN. See https://pocket-id.org/docs/configuration/environment-variables.
bindPassword object required
Bind password.
Sets LDAP_BIND_PASSWORD. See https://pocket-id.org/docs/configuration/environment-variables.
value
string
Plain text value.
valueFrom object
Source for the value (e.g. secretKeyRef, configMapKeyRef).
configMapKeyRef object
Selects a key of a ConfigMap.
key
string required
The key to select from the ConfigMap's Data field.
Keys in the BinaryData field are not currently propagated to container env vars.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the ConfigMap or its key must be defined
fieldRef object
Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
apiVersion
string
Version of the schema the FieldPath is written in terms of, defaults to "v1".
fieldPath
string required
Path of the field to select in the specified API version.
fileKeyRef object
FileKeyRef selects a key of the env file.
Requires the EnvFiles feature gate to be enabled.
key
string required
The key within the env file. An invalid key will prevent the pod from starting.
The keys defined within a source may consist of any printable ASCII characters except '='.
During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
optional
boolean
Specify whether the file or its key must be defined. If the file or key
does not exist, then the env var is not published.
If optional is set to true and the specified key does not exist,
the environment variable will not be set in the Pod's containers.
If optional is set to false and the specified key does not exist,
an error will be returned during Pod creation.
path
string required
The path within the volume from which to select the file.
Must be relative and may not contain the '..' path or start with '..'.
volumeName
string required
The name of the volume mount containing the env file.
resourceFieldRef object
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
containerName
string
Container name: required for volumes, optional for env vars
divisor
string | integer
Specifies the output format of the exposed resources, defaults to "1"
string pattern:
^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
resource
string required
Required: resource to select
secretKeyRef object
Selects a key of a secret in the pod's namespace
key
string required
The key of the secret to select from. Must be a valid secret key.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the Secret or its key must be defined
skipCertVerify
boolean
Skip LDAP certificate verification.
Sets LDAP_SKIP_CERT_VERIFY. See https://pocket-id.org/docs/configuration/environment-variables.
softDeleteUsers
boolean
Disable removed users instead of deleting them.
Sets LDAP_SOFT_DELETE_USERS. See https://pocket-id.org/docs/configuration/environment-variables.
url
string required
LDAP server URL.
Sets LDAP_URL. See https://pocket-id.org/docs/configuration/environment-variables.
userGroupSearchFilter
string
Group search filter.
Sets LDAP_USER_GROUP_SEARCH_FILTER. See https://pocket-id.org/docs/configuration/environment-variables.
userSearchFilter
string
User search filter.
Sets LDAP_USER_SEARCH_FILTER. See https://pocket-id.org/docs/configuration/environment-variables.
livenessProbe object
Liveness probe configuration.
exec object
Exec specifies a command to execute in the container.
command
[]string
Command is the command line to execute inside the container, the working directory for the
command is root ('/') in the container's filesystem. The command is simply exec'd, it is
not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
a shell, you need to explicitly call out to that shell.
Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
failureThreshold
integer
Minimum consecutive failures for the probe to be considered failed after having succeeded.
Defaults to 3. Minimum value is 1.
format:
int32grpc object
GRPC specifies a GRPC HealthCheckRequest.
mode
string
mode specifies the connection mode for the gRPC health probe.
Set to "TLS" to use TLS without certificate verification.
Set to "Plaintext" to use a plaintext (insecure) connection explicitly.
If not specified, the probe uses a plaintext (insecure) connection.
port
integer required
Port number of the gRPC service. Number must be in the range 1 to 65535.
format:
int32
service
string
Service is the name of the service to place in the gRPC HealthCheckRequest
(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
If this is not specified, the default behavior is defined by gRPC.
httpGet object
HTTPGet specifies an HTTP GET request to perform.
host
string
Host name to connect to, defaults to the pod IP. You probably want to set
"Host" in httpHeaders instead.
httpHeaders []object
Custom headers to set in the request. HTTP allows repeated headers.
name
string required
The header field name.
This will be canonicalized upon output, so case-variant names will be understood as the same header.
value
string required
The header field value
path
string
Path to access on the HTTP server.
port
string | integer required
Name or number of the port to access on the container.
Number must be in the range 1 to 65535.
Name must be an IANA_SVC_NAME.
protocol
string
Protocol selects the wire protocol for the probe connection.
Nil defaults to HTTP/1.1.
scheme
string
Scheme to use for connecting to the host.
Defaults to HTTP.
initialDelaySeconds
integer
Number of seconds after the container has started before liveness probes are initiated.
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
format:
int32
periodSeconds
integer
How often (in seconds) to perform the probe.
Default to 10 seconds. Minimum value is 1.
format:
int32
successThreshold
integer
Minimum consecutive successes for the probe to be considered successful after having failed.
Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
format:
int32tcpSocket object
TCPSocket specifies a connection to a TCP port.
host
string
Optional: Host name to connect to, defaults to the pod IP.
port
string | integer required
Number or name of the port to access on the container.
Number must be in the range 1 to 65535.
Name must be an IANA_SVC_NAME.
terminationGracePeriodSeconds
integer
Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
The grace period is the duration in seconds after the processes running in the pod are sent
a termination signal and the time when the processes are forcibly halted with a kill signal.
Set this value longer than the expected cleanup time for your process.
If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
value overrides the value provided by the pod spec.
Value must be non-negative integer. The value zero indicates stop immediately via
the kill signal (no opportunity to shut down).
This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
format:
int64
timeoutSeconds
integer
Number of seconds after which the probe times out.
Defaults to 1 second. Minimum value is 1.
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
format:
int32
localIPv6Ranges
string
Local IPv6 ranges (comma-separated CIDRs).
Sets LOCAL_IPV6_RANGES. See https://pocket-id.org/docs/configuration/environment-variables.
logging object
Logging configuration.
json
boolean
JSON log output.
Sets LOG_JSON. See https://pocket-id.org/docs/configuration/environment-variables.
level
string
Log level.
Sets LOG_LEVEL. See https://pocket-id.org/docs/configuration/environment-variables.
queryArgs
boolean
Include SQL query arguments in debug logs and traces.
Sets LOG_QUERY_ARGS. See https://pocket-id.org/docs/configuration/environment-variables.
metrics object
Prometheus metrics configuration. When enabled, the operator injects the required OTEL environment variables and exposes a metrics port on the Service.
enabled
boolean required
Enables the Prometheus metrics endpoint.
port
integer
Port for the Prometheus metrics endpoint.
format:
int32outboundAllowedHosts object
Private or reserved destinations Pocket-ID may reach when fetching URLs, per feature.
backchannelLogout
[]string
Back-channel logout requests. Pocket-ID defaults to private,loopback.
Sets OUTBOUND_ALLOWED_HOSTS_BACKCHANNEL_LOGOUT. See https://pocket-id.org/docs/configuration/environment-variables.
clientLogo
[]string
Client logo downloads. The icon library host is always allowed.
Sets OUTBOUND_ALLOWED_HOSTS_CLIENT_LOGO. See https://pocket-id.org/docs/configuration/environment-variables.
clientMetadata
[]string
OAuth Client ID Metadata Document fetches.
Sets OUTBOUND_ALLOWED_HOSTS_CLIENT_METADATA. See https://pocket-id.org/docs/configuration/environment-variables.
federatedJwks
[]string
Federated identity JWKS fetches. Pocket-ID defaults to private,loopback.
Sets OUTBOUND_ALLOWED_HOSTS_FEDERATED_JWKS. See https://pocket-id.org/docs/configuration/environment-variables.
ldapPicture
[]string
LDAP profile picture downloads.
Sets OUTBOUND_ALLOWED_HOSTS_LDAP_PICTURE. See https://pocket-id.org/docs/configuration/environment-variables.
scim
[]string
SCIM provisioning requests. Pocket-ID defaults to private,loopback.
Sets OUTBOUND_ALLOWED_HOSTS_SCIM. See https://pocket-id.org/docs/configuration/environment-variables.
persistence object
Configures persistence for Pocket-ID. Pocket-ID can be run statelessly; see https://pocket-id-operator.pages.dev/examples/pocketidinstance/#stateless-deployment.
If not enabled, an emptyDir is mounted instead.
accessModes
[]string
AccessModes for the PVC.
enabled
boolean required
Enables mounting a persistent volume.
existingClaim
string
Name of an existing, externally-managed PVC to mount.
extraVolumeMounts []object
Extra volume mounts to add to the pocket-id container. This is useful for mounting volumes defined in spec.podTemplate.
bindMountOptions
[]string
bindMountOptions is the list of additional bind mount options to apply when
mounting this volume into the container. Allowed values are noexec,
nodev, and nosuid. These are Linux mount options and have no effect on
Windows nodes.
This field is not supported with image volumes.
This is an alpha field and requires enabling the VolumeBindMountOptions feature gate.
mountPath
string required
Path within the container at which the volume should be mounted.
mountPropagation
string
mountPropagation determines how mounts are propagated from the host
to container and the other way around.
When not set, MountPropagationNone is used.
This field is beta in 1.10.
When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
(which defaults to None).
name
string required
This must match the Name of a Volume.
readOnly
boolean
Mounted read-only if true, read-write otherwise (false or unspecified).
Defaults to false.
recursiveReadOnly
string
RecursiveReadOnly specifies whether read-only mounts should be handled
recursively.
If ReadOnly is false, this field has no meaning and must be unspecified.
If ReadOnly is true, and this field is set to Disabled, the mount is not made
recursively read-only. If this field is set to IfPossible, the mount is made
recursively read-only, if it is supported by the container runtime. If this
field is set to Enabled, the mount is made recursively read-only if it is
supported by the container runtime, otherwise the pod will not be started and
an error will be generated to indicate the reason.
If this field is set to IfPossible or Enabled, MountPropagation must be set to
None (or be unspecified, which defaults to None).
If this field is not specified, it is treated as an equivalent of Disabled.
subPath
string
Path within the volume from which the container's volume should be mounted.
Defaults to "" (volume's root).
subPathExpr
string
Expanded path within the volume from which the container's volume should be mounted.
Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
Defaults to "" (volume's root).
SubPathExpr and SubPath are mutually exclusive.
path
string
Path where the data volume is mounted in the container.
size
string | integer
Size of the claim to dynamically provision.
string pattern:
^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
storageClass
string
Name of the StorageClass to provision a volume from.
subPath
string
SubPath within the volume to mount (volumeMount.subPath).
podSecurityContext object
Pod security context.
appArmorProfile object
appArmorProfile is the AppArmor options to use by the containers in this pod.
Note that this field cannot be set when spec.os.name is windows.
localhostProfile
string
localhostProfile indicates a profile loaded on the node that should be used.
The profile must be preconfigured on the node to work.
Must match the loaded name of the profile.
Must be set if and only if type is "Localhost".
type
string required
type indicates which kind of AppArmor profile will be applied.
Valid options are:
Localhost - a profile pre-loaded on the node.
RuntimeDefault - the container runtime's default profile.
Unconfined - no AppArmor enforcement.
fsGroup
integer
A special supplemental group that applies to all containers in a pod.
Some volume types allow the Kubelet to change the ownership of that volume
to be owned by the pod:
1. The owning GID will be the FSGroup
2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
3. The permission bits are OR'd with rw-rw----
If unset, the Kubelet will not modify the ownership and permissions of any volume.
Note that this field cannot be set when spec.os.name is windows.
format:
int64
fsGroupChangePolicy
string
fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
before being exposed inside Pod. This field will only apply to
volume types which support fsGroup based ownership(and permissions).
It will have no effect on ephemeral volume types such as: secret, configmaps
and emptydir.
Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
Note that this field cannot be set when spec.os.name is windows.
runAsGroup
integer
The GID to run the entrypoint of the container process.
Uses runtime default if unset.
May also be set in SecurityContext. If set in both SecurityContext and
PodSecurityContext, the value specified in SecurityContext takes precedence
for that container.
Note that this field cannot be set when spec.os.name is windows.
format:
int64
runAsNonRoot
boolean
Indicates that the container must run as a non-root user.
If true, the Kubelet will validate the image at runtime to ensure that it
does not run as UID 0 (root) and fail to start the container if it does.
If unset or false, no such validation will be performed.
May also be set in SecurityContext. If set in both SecurityContext and
PodSecurityContext, the value specified in SecurityContext takes precedence.
runAsUser
integer
The UID to run the entrypoint of the container process.
Defaults to user specified in image metadata if unspecified.
May also be set in SecurityContext. If set in both SecurityContext and
PodSecurityContext, the value specified in SecurityContext takes precedence
for that container.
Note that this field cannot be set when spec.os.name is windows.
format:
int64
seLinuxChangePolicy
string
seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.
It has no effect on nodes that do not support SELinux or to volumes does not support SELinux.
Valid values are "MountOption" and "Recursive".
"Recursive" means relabeling of all files on all Pod volumes by the container runtime.
This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.
"MountOption" mounts all eligible Pod volumes with `-o context` mount option.
This requires all Pods that share the same volume to use the same SELinux label.
It is not possible to share the same volume among privileged and unprivileged Pods.
Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
CSIDriver instance. Other volumes are always re-labelled recursively.
If not specified, "MountOption" is used.
This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.
Note that this field cannot be set when spec.os.name is windows.
seLinuxOptions object
The SELinux context to be applied to all containers.
If unspecified, the container runtime will allocate a random SELinux context for each
container. May also be set in SecurityContext. If set in
both SecurityContext and PodSecurityContext, the value specified in SecurityContext
takes precedence for that container.
Note that this field cannot be set when spec.os.name is windows.
level
string
Level is SELinux level label that applies to the container.
role
string
Role is a SELinux role label that applies to the container.
type
string
Type is a SELinux type label that applies to the container.
user
string
User is a SELinux user label that applies to the container.
seccompProfile object
The seccomp options to use by the containers in this pod.
Note that this field cannot be set when spec.os.name is windows.
localhostProfile
string
localhostProfile indicates a profile defined in a file on the node should be used.
The profile must be preconfigured on the node to work.
Must be a descending path, relative to the kubelet's configured seccomp profile location.
Must be set if type is "Localhost". Must NOT be set for any other type.
type
string required
type indicates which kind of seccomp profile will be applied.
Valid options are:
Localhost - a profile defined in a file on the node should be used.
RuntimeDefault - the container runtime default profile should be used.
Unconfined - no profile should be applied.
supplementalGroups
[]integer
A list of groups applied to the first process run in each container, in
addition to the container's primary GID and fsGroup (if specified). If
the SupplementalGroupsPolicy feature is enabled, the
supplementalGroupsPolicy field determines whether these are in addition
to or instead of any group memberships defined in the container image.
If unspecified, no additional groups are added, though group memberships
defined in the container image may still be used, depending on the
supplementalGroupsPolicy field.
Note that this field cannot be set when spec.os.name is windows.
supplementalGroupsPolicy
string
Defines how supplemental groups of the first container processes are calculated.
Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
(Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
and the container runtime must implement support for this feature.
Note that this field cannot be set when spec.os.name is windows.
sysctls []object
Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
sysctls (by the container runtime) might fail to launch.
Note that this field cannot be set when spec.os.name is windows.
name
string required
Name of a property to set
value
string required
Value of a property to set
windowsOptions object
The Windows specific settings applied to all containers.
If unspecified, the options within a container's SecurityContext will be used.
If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
Note that this field cannot be set when spec.os.name is linux.
gmsaCredentialSpec
string
GMSACredentialSpec is where the GMSA admission webhook
(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
GMSA credential spec named by the GMSACredentialSpecName field.
gmsaCredentialSpecName
string
GMSACredentialSpecName is the name of the GMSA credential spec to use.
hostProcess
boolean
HostProcess determines if a container should be run as a 'Host Process' container.
All of a Pod's containers must have the same effective HostProcess value
(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
In addition, if HostProcess is true then HostNetwork must also be set to true.
runAsUserName
string
The UserName in Windows to run the entrypoint of the container process.
Defaults to the user specified in image metadata if unspecified.
May also be set in PodSecurityContext. If set in both SecurityContext and
PodSecurityContext, the value specified in SecurityContext takes precedence.
podTemplate
object
Pod template to merge with the operator-built pod spec. Operator-managed fields including the pocket-id container always take precedence.
rateLimitingDisabled
boolean
Disable rate limiting. Pocket-ID's rate limits are permissive enough for the operator, so keeping them is recommended.
Sets DISABLE_RATE_LIMITING. See https://pocket-id.org/docs/configuration/environment-variables.
readinessProbe object
Readiness probe configuration.
exec object
Exec specifies a command to execute in the container.
command
[]string
Command is the command line to execute inside the container, the working directory for the
command is root ('/') in the container's filesystem. The command is simply exec'd, it is
not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
a shell, you need to explicitly call out to that shell.
Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
failureThreshold
integer
Minimum consecutive failures for the probe to be considered failed after having succeeded.
Defaults to 3. Minimum value is 1.
format:
int32grpc object
GRPC specifies a GRPC HealthCheckRequest.
mode
string
mode specifies the connection mode for the gRPC health probe.
Set to "TLS" to use TLS without certificate verification.
Set to "Plaintext" to use a plaintext (insecure) connection explicitly.
If not specified, the probe uses a plaintext (insecure) connection.
port
integer required
Port number of the gRPC service. Number must be in the range 1 to 65535.
format:
int32
service
string
Service is the name of the service to place in the gRPC HealthCheckRequest
(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
If this is not specified, the default behavior is defined by gRPC.
httpGet object
HTTPGet specifies an HTTP GET request to perform.
host
string
Host name to connect to, defaults to the pod IP. You probably want to set
"Host" in httpHeaders instead.
httpHeaders []object
Custom headers to set in the request. HTTP allows repeated headers.
name
string required
The header field name.
This will be canonicalized upon output, so case-variant names will be understood as the same header.
value
string required
The header field value
path
string
Path to access on the HTTP server.
port
string | integer required
Name or number of the port to access on the container.
Number must be in the range 1 to 65535.
Name must be an IANA_SVC_NAME.
protocol
string
Protocol selects the wire protocol for the probe connection.
Nil defaults to HTTP/1.1.
scheme
string
Scheme to use for connecting to the host.
Defaults to HTTP.
initialDelaySeconds
integer
Number of seconds after the container has started before liveness probes are initiated.
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
format:
int32
periodSeconds
integer
How often (in seconds) to perform the probe.
Default to 10 seconds. Minimum value is 1.
format:
int32
successThreshold
integer
Minimum consecutive successes for the probe to be considered successful after having failed.
Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
format:
int32tcpSocket object
TCPSocket specifies a connection to a TCP port.
host
string
Optional: Host name to connect to, defaults to the pod IP.
port
string | integer required
Number or name of the port to access on the container.
Number must be in the range 1 to 65535.
Name must be an IANA_SVC_NAME.
terminationGracePeriodSeconds
integer
Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
The grace period is the duration in seconds after the processes running in the pod are sent
a termination signal and the time when the processes are forcibly halted with a kill signal.
Set this value longer than the expected cleanup time for your process.
If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
value overrides the value provided by the pod spec.
Value must be non-negative integer. The value zero indicates stop immediately via
the kill signal (no opportunity to shut down).
This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
format:
int64
timeoutSeconds
integer
Number of seconds after which the probe times out.
Defaults to 1 second. Minimum value is 1.
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
format:
int32resources object
Resource requests and limits for the container.
claims []object
Claims lists the names of resources, defined in spec.resourceClaims,
that are used by this container.
This field depends on the
DynamicResourceAllocation feature gate.
This field is immutable. It can only be set for containers.
name
string required
Name must match the name of one entry in pod.spec.resourceClaims of
the Pod where this field is used. It makes that resource available
inside a container.
request
string
Request is the name chosen for a request in the referenced claim.
If empty, everything from the claim is made available, otherwise
only the result of this request.
limits
object
Limits describes the maximum amount of compute resources allowed.
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
requests
object
Requests describes the minimum amount of compute resources required.
If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
otherwise to an implementation-defined value. Requests cannot exceed Limits.
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
route object
Configures an HTTPRoute when enabled. Requires Gateway API CRDs to be installed.
annotations
object
Additional annotations for the HTTPRoute.
enabled
boolean required
Enables creation of an HTTPRoute.
hostnames
[]string
Hostnames for the route.
Automatically set to the hostname from spec.appUrl if not specified.
labels
object
Additional labels for the HTTPRoute.
name
string
Name override for the HTTPRoute (defaults to the instance name).
parentRefs []object required
Gateway parent references.
minItems:
1
group
string
Group is the group of the referent.
When unspecified, "gateway.networking.k8s.io" is inferred.
To set the core API group (such as for a "Service" kind referent),
Group must be explicitly set to "" (empty string).
Support: Core
pattern:
^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253
kind
string
Kind is kind of the referent.
There are two kinds of parent resources with "Core" support:
* Gateway (Gateway conformance profile)
* Service (Mesh conformance profile, ClusterIP Services only)
Support for other resources is Implementation-Specific.
pattern:
^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$minLength:
1maxLength:
63
name
string required
Name is the name of the referent.
Support: Core
minLength:
1maxLength:
253
namespace
string
Namespace is the namespace of the referent. When unspecified, this refers
to the local namespace of the Route.
Note that there are specific rules for ParentRefs which cross namespace
boundaries. Cross-namespace references are only valid if they are explicitly
allowed by something in the namespace they are referring to. For example:
Gateway has the AllowedRoutes field, and ReferenceGrant provides a
generic way to enable any other kind of cross-namespace reference.
<gateway:experimental:description>
ParentRefs from a Route to a Service in the same namespace are "producer"
routes, which apply default routing rules to inbound connections from
any namespace to the Service.
ParentRefs from a Route to a Service in a different namespace are
"consumer" routes, and these routing rules are only applied to outbound
connections originating from the same namespace as the Route, for which
the intended destination of the connections are a Service targeted as a
ParentRef of the Route.
</gateway:experimental:description>
Support: Core
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?$minLength:
1maxLength:
63
port
integer
Port is the network port this Route targets. It can be interpreted
differently based on the type of parent resource.
When the parent resource is a Gateway, this targets all listeners
listening on the specified port that also support this kind of Route(and
select this Route). It's not recommended to set `Port` unless the
networking behaviors specified in a Route must apply to a specific port
as opposed to a listener(s) whose port(s) may be changed. When both Port
and SectionName are specified, the name and port of the selected listener
must match both specified values.
<gateway:experimental:description>
When the parent resource is a Service, this targets a specific port in the
Service spec. When both Port (experimental) and SectionName are specified,
the name and port of the selected port must match both specified values.
</gateway:experimental:description>
Implementations MAY choose to support other parent resources.
Implementations supporting other types of parent resources MUST clearly
document how/if Port is interpreted.
For the purpose of status, an attachment is considered successful as
long as the parent resource accepts it partially. For example, Gateway
listeners can restrict which Routes can attach to them by Route kind,
namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
from the referencing Route, the Route MUST be considered successfully
attached. If no Gateway listeners accept attachment from this Route,
the Route MUST be considered detached from the Gateway.
Support: Extended
format:
int32minimum:
1maximum:
65535
sectionName
string
SectionName is the name of a section within the target resource. In the
following resources, SectionName is interpreted as the following:
* Gateway: Listener name. When both Port (experimental) and SectionName
are specified, the name and port of the selected listener must match
both specified values.
* Service: Port name. When both Port (experimental) and SectionName
are specified, the name and port of the selected listener must match
both specified values.
Implementations MAY choose to support attaching Routes to other resources.
If that is the case, they MUST clearly document how SectionName is
interpreted.
When unspecified (empty string), this will reference the entire resource.
For the purpose of status, an attachment is considered successful if at
least one section in the parent resource accepts it. For example, Gateway
listeners can restrict which Routes can attach to them by Route kind,
namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
the referencing Route, the Route MUST be considered successfully
attached. If no Gateway listeners accept attachment from this Route, the
Route MUST be considered detached from the Gateway.
Support: Core
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$minLength:
1maxLength:
253
template
object
Template is merged with the operator-built HTTPRoute spec.
Operator-managed fields (parentRefs, hostnames, and the default backend rule to the Service) always take precedence.
s3 object
S3 file backend. When present, the operator sets FILE_BACKEND=s3.
accessKeyId object required
S3 access key ID.
Sets S3_ACCESS_KEY_ID. See https://pocket-id.org/docs/configuration/environment-variables.
value
string
Plain text value.
valueFrom object
Source for the value (e.g. secretKeyRef, configMapKeyRef).
configMapKeyRef object
Selects a key of a ConfigMap.
key
string required
The key to select from the ConfigMap's Data field.
Keys in the BinaryData field are not currently propagated to container env vars.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the ConfigMap or its key must be defined
fieldRef object
Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
apiVersion
string
Version of the schema the FieldPath is written in terms of, defaults to "v1".
fieldPath
string required
Path of the field to select in the specified API version.
fileKeyRef object
FileKeyRef selects a key of the env file.
Requires the EnvFiles feature gate to be enabled.
key
string required
The key within the env file. An invalid key will prevent the pod from starting.
The keys defined within a source may consist of any printable ASCII characters except '='.
During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
optional
boolean
Specify whether the file or its key must be defined. If the file or key
does not exist, then the env var is not published.
If optional is set to true and the specified key does not exist,
the environment variable will not be set in the Pod's containers.
If optional is set to false and the specified key does not exist,
an error will be returned during Pod creation.
path
string required
The path within the volume from which to select the file.
Must be relative and may not contain the '..' path or start with '..'.
volumeName
string required
The name of the volume mount containing the env file.
resourceFieldRef object
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
containerName
string
Container name: required for volumes, optional for env vars
divisor
string | integer
Specifies the output format of the exposed resources, defaults to "1"
string pattern:
^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
resource
string required
Required: resource to select
secretKeyRef object
Selects a key of a secret in the pod's namespace
key
string required
The key of the secret to select from. Must be a valid secret key.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the Secret or its key must be defined
bucket
string required
S3 bucket name.
Sets S3_BUCKET. See https://pocket-id.org/docs/configuration/environment-variables.
disableDefaultIntegrityChecks
boolean
Disable default S3 integrity checks.
Sets S3_DISABLE_DEFAULT_INTEGRITY_CHECKS. See https://pocket-id.org/docs/configuration/environment-variables.
endpoint
string
S3 endpoint URL.
Sets S3_ENDPOINT. See https://pocket-id.org/docs/configuration/environment-variables.
forcePathStyle
boolean
Use path-style S3 URLs.
Sets S3_FORCE_PATH_STYLE. See https://pocket-id.org/docs/configuration/environment-variables.
region
string required
S3 region.
Sets S3_REGION. See https://pocket-id.org/docs/configuration/environment-variables.
secretAccessKey object required
S3 secret access key.
Sets S3_SECRET_ACCESS_KEY. See https://pocket-id.org/docs/configuration/environment-variables.
value
string
Plain text value.
valueFrom object
Source for the value (e.g. secretKeyRef, configMapKeyRef).
configMapKeyRef object
Selects a key of a ConfigMap.
key
string required
The key to select from the ConfigMap's Data field.
Keys in the BinaryData field are not currently propagated to container env vars.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the ConfigMap or its key must be defined
fieldRef object
Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
apiVersion
string
Version of the schema the FieldPath is written in terms of, defaults to "v1".
fieldPath
string required
Path of the field to select in the specified API version.
fileKeyRef object
FileKeyRef selects a key of the env file.
Requires the EnvFiles feature gate to be enabled.
key
string required
The key within the env file. An invalid key will prevent the pod from starting.
The keys defined within a source may consist of any printable ASCII characters except '='.
During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
optional
boolean
Specify whether the file or its key must be defined. If the file or key
does not exist, then the env var is not published.
If optional is set to true and the specified key does not exist,
the environment variable will not be set in the Pod's containers.
If optional is set to false and the specified key does not exist,
an error will be returned during Pod creation.
path
string required
The path within the volume from which to select the file.
Must be relative and may not contain the '..' path or start with '..'.
volumeName
string required
The name of the volume mount containing the env file.
resourceFieldRef object
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
containerName
string
Container name: required for volumes, optional for env vars
divisor
string | integer
Specifies the output format of the exposed resources, defaults to "1"
string pattern:
^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
resource
string required
Required: resource to select
secretKeyRef object
Selects a key of a secret in the pod's namespace
key
string required
The key of the secret to select from. Must be a valid secret key.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the Secret or its key must be defined
serviceTemplate
object
ServiceTemplate is merged with the operator-built Service spec.
Operator-managed fields (the selector and the number, protocol, and appProtocol of the http/metrics ports) always take precedence.
smtp object
SMTP email transport. When present, the operator sets SMTP_ENABLED=true and UI_CONFIG_DISABLED=true.
from
string required
Sender email address.
Sets SMTP_FROM. See https://pocket-id.org/docs/configuration/environment-variables.
host
string required
SMTP server hostname.
Sets SMTP_HOST. See https://pocket-id.org/docs/configuration/environment-variables.
password object
SMTP password.
Sets SMTP_PASSWORD. See https://pocket-id.org/docs/configuration/environment-variables.
value
string
Plain text value.
valueFrom object
Source for the value (e.g. secretKeyRef, configMapKeyRef).
configMapKeyRef object
Selects a key of a ConfigMap.
key
string required
The key to select from the ConfigMap's Data field.
Keys in the BinaryData field are not currently propagated to container env vars.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the ConfigMap or its key must be defined
fieldRef object
Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
apiVersion
string
Version of the schema the FieldPath is written in terms of, defaults to "v1".
fieldPath
string required
Path of the field to select in the specified API version.
fileKeyRef object
FileKeyRef selects a key of the env file.
Requires the EnvFiles feature gate to be enabled.
key
string required
The key within the env file. An invalid key will prevent the pod from starting.
The keys defined within a source may consist of any printable ASCII characters except '='.
During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
optional
boolean
Specify whether the file or its key must be defined. If the file or key
does not exist, then the env var is not published.
If optional is set to true and the specified key does not exist,
the environment variable will not be set in the Pod's containers.
If optional is set to false and the specified key does not exist,
an error will be returned during Pod creation.
path
string required
The path within the volume from which to select the file.
Must be relative and may not contain the '..' path or start with '..'.
volumeName
string required
The name of the volume mount containing the env file.
resourceFieldRef object
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
containerName
string
Container name: required for volumes, optional for env vars
divisor
string | integer
Specifies the output format of the exposed resources, defaults to "1"
string pattern:
^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
resource
string required
Required: resource to select
secretKeyRef object
Selects a key of a secret in the pod's namespace
key
string required
The key of the secret to select from. Must be a valid secret key.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional
boolean
Specify whether the Secret or its key must be defined
port
integer required
SMTP server port.
Sets SMTP_PORT. See https://pocket-id.org/docs/configuration/environment-variables.
format:
int32
skipCertVerify
boolean
Skip SMTP certificate verification.
Sets SMTP_SKIP_CERT_VERIFY. See https://pocket-id.org/docs/configuration/environment-variables.
tls
string
SMTP TLS mode.
Sets SMTP_TLS. See https://pocket-id.org/docs/configuration/environment-variables.
user
string
SMTP username.
Sets SMTP_USER. See https://pocket-id.org/docs/configuration/environment-variables.
timezone
string
Timezone (e.g. "America/New_York").
Sets TZ.
tls object
TLS terminates HTTPS in the Pocket-ID pod from a mounted certificate Secret.
secretRef object required
SecretRef names a kubernetes.io/tls Secret in the instance's namespace holding tls.crt and tls.key.
name
string
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
tracing object
OpenTelemetry tracing. When present, the operator sets OTEL_TRACES_EXPORTER=otlp.
Configure other OTEL_* variables via spec.env.
endpoint
string
OTLP traces endpoint, including the path.
Sets OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. See https://pocket-id.org/docs/configuration/environment-variables.
trustedProxies object
TrustedProxies configures which proxies Pocket-ID trusts for X-Forwarded-* headers. When unset, the operator trusts the private/loopback ranges if spec.route.enabled is set.
Sets TRUST_PROXY. See https://pocket-id.org/docs/configuration/environment-variables#trust_proxy.
cidrs
[]string
CIDRs is the list of trusted proxy IPs/CIDRs. Only used when enabled is true. When empty, TRUST_PROXY is set to "true", trusting all upstream sources.
To restrict trust, list explicit ranges, e.g. the cluster pod network or a CDN's published ranges when it connects directly to the pod.
enabled
boolean required
Enabled turns on trust of X-Forwarded-* headers. When false, TRUST_PROXY is set to "false".
ui object
UI settings. The operator sets UI_CONFIG_DISABLED=true when this section is configured.
accentColor
string
UI accent color.
Sets ACCENT_COLOR. See https://pocket-id.org/docs/configuration/environment-variables.
appName
string
Application name.
Sets APP_NAME. See https://pocket-id.org/docs/configuration/environment-variables.
disableAnimations
boolean
Disable UI animations.
Sets DISABLE_ANIMATIONS. See https://pocket-id.org/docs/configuration/environment-variables.
homePageUrl
string
Post-login redirect page.
Sets HOME_PAGE_URL. See https://pocket-id.org/docs/configuration/environment-variables.
sessionDuration
integer
Session duration in minutes.
Sets SESSION_DURATION. See https://pocket-id.org/docs/configuration/environment-variables.
format:
int32userManagement object
User registration and account settings. The operator sets UI_CONFIG_DISABLED=true when this section is configured.
allowOwnAccountEdit
boolean
Allow users to edit their own account.
Sets ALLOW_OWN_ACCOUNT_EDIT. See https://pocket-id.org/docs/configuration/environment-variables.
allowUserSignups
string
User signup mode.
Sets ALLOW_USER_SIGNUPS. See https://pocket-id.org/docs/configuration/environment-variables.
emailsVerified
boolean
Mark emails as verified.
Sets EMAILS_VERIFIED. See https://pocket-id.org/docs/configuration/environment-variables.
requireUserEmail
boolean
Require an email address.
Sets REQUIRE_USER_EMAIL. See https://pocket-id.org/docs/configuration/environment-variables.
signupDefaultCustomClaims
string
Default custom claims for new users.
Sets SIGNUP_DEFAULT_CUSTOM_CLAIMS. See https://pocket-id.org/docs/configuration/environment-variables.
signupDefaultUserGroupIds
[]string
Default user group IDs for new users.
JSON-encoded into SIGNUP_DEFAULT_USER_GROUP_IDS. See https://pocket-id.org/docs/configuration/environment-variables.
versionCheckDisabled
boolean
Disable version checks.
Sets VERSION_CHECK_DISABLED. See https://pocket-id.org/docs/configuration/environment-variables.
webauthn object
Passkey restrictions. The operator sets UI_CONFIG_DISABLED=true when this section is configured.
allowSyncedPasskeys
boolean
Allow synced passkeys.
Sets WEBAUTHN_ALLOW_SYNCED_PASSKEYS. See https://pocket-id.org/docs/configuration/environment-variables.
authenticatorAttachment
string
Accepted authenticator type.
Sets WEBAUTHN_AUTHENTICATOR_ATTACHMENT. See https://pocket-id.org/docs/configuration/environment-variables.
userVerification
string
Passkey user verification requirement.
Sets WEBAUTHN_USER_VERIFICATION. See https://pocket-id.org/docs/configuration/environment-variables.
status object
status defines the observed state of PocketIDInstance.
conditions []object
Conditions represent the current state of the Instance resource.
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition.
This may be an empty string.
maxLength:
32768
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
format:
int64minimum:
0
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition.
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty.
pattern:
^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$minLength:
1maxLength:
1024
status
string required
status of the condition, one of True, False, Unknown.
enum:
True, False, Unknown
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
pattern:
^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$maxLength:
316
lastRotatedClientSecret
string
LastRotatedClientSecret is the timestamp of the most recent OIDC client secret rotation on this instance.
Used to enforce spec.OIDCClientRotation.minSpacing.
format:
date-time
staticApiKeySecretName
string
StaticAPIKeySecretName is the name of the Secret containing the STATIC_API_KEY.
version
string
Version is the current deployed version of the Pocket-ID instance, retrieved from the /api/version/current endpoint.
No matches. Try .spec.OIDCClientRotation for an exact path