KafkaCluster

Field reference for the KafkaCluster resource (gitops.monedula.dev/v1alpha1): every spec and status field with its type, default and validation rules.

Summary

apiVersion	`gitops.monedula.dev/v1alpha1`
kind	`KafkaCluster`
Scope	Namespaced
`kubectl get` columns	Phase, Age

Example

kafka-cluster.yaml

apiVersion: gitops.monedula.dev/v1alpha1
kind: KafkaCluster
metadata:
  name: sample-cluster
  namespace: monedula-system
spec:
  bootstrapServers: kafka-bootstrap.kafka.svc:9093
  tls:
    enabled: true
  auth:
    mechanism: SCRAM-SHA-512
    scram:
      username:
        valueFrom:
          secretKeyRef:
            name: kafka-admin-credentials
            key: username
      password:
        valueFrom:
          secretKeyRef:
            name: kafka-admin-credentials
            key: password
  defaults:
    replicationFactor: 3
    topicDeletionPolicy: Orphan
  # authorization.mds enables Confluent RBAC role-binding management.
  # The MDS endpoint is the Confluent metadata service REST API; clusters.kafkaCluster
  # is the Kafka logical-cluster ID used as the base scope for all role bindings.
  authorization:
    mds:
      endpoint: https://kafka-mds.kafka.svc:8090
      auth:
        type: basic
        username:
          valueFrom:
            secretKeyRef:
              name: kafka-admin-credentials
              key: username
        password:
          valueFrom:
            secretKeyRef:
              name: kafka-admin-credentials
              key: password
      clusters:
        kafkaCluster: lkc-abc123
        schemaRegistryCluster: lsrc-xyz789

Spec

spec.auth object

spec.auth.mechanism string required

One of: None, PLAIN, SCRAM-SHA-256, SCRAM-SHA-512, OAUTHBEARER, mTLS

spec.auth.oauth object

OAuthConfig is the OIDC client-credentials flow: the client fetches bearer tokens from TokenEndpoint with ClientID/ClientSecret.

spec.auth.oauth.clientId object required

spec.auth.oauth.clientId.valueFrom object required

spec.auth.oauth.clientId.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.auth.oauth.clientId.valueFrom.configMapKeyRef.key string required

spec.auth.oauth.clientId.valueFrom.configMapKeyRef.name string required

spec.auth.oauth.clientId.valueFrom.env string

spec.auth.oauth.clientId.valueFrom.file string

spec.auth.oauth.clientId.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.auth.oauth.clientId.valueFrom.secretKeyRef object

spec.auth.oauth.clientId.valueFrom.secretKeyRef.key string required

spec.auth.oauth.clientId.valueFrom.secretKeyRef.name string required

spec.auth.oauth.clientSecret object required

spec.auth.oauth.clientSecret.valueFrom object required

spec.auth.oauth.clientSecret.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.auth.oauth.clientSecret.valueFrom.configMapKeyRef.key string required

spec.auth.oauth.clientSecret.valueFrom.configMapKeyRef.name string required

spec.auth.oauth.clientSecret.valueFrom.env string

spec.auth.oauth.clientSecret.valueFrom.file string

spec.auth.oauth.clientSecret.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.auth.oauth.clientSecret.valueFrom.secretKeyRef object

spec.auth.oauth.clientSecret.valueFrom.secretKeyRef.key string required

spec.auth.oauth.clientSecret.valueFrom.secretKeyRef.name string required

spec.auth.oauth.scope string

spec.auth.oauth.tokenEndpoint string required

spec.auth.oauth.tokenEndpointCA object

TokenEndpointCA is the PEM CA (bundle) to trust when connecting to the IdP's TokenEndpoint over TLS, resolved like any other secret value: file/env/inline in CLI mode, secretKeyRef in operator mode. The IdP is a DIFFERENT trust domain than the Kafka brokers: this is intentionally separate from (and never falls back to) spec.tls.caCert, since a private-CA broker cluster and a private-CA IdP are not necessarily signed by the same authority. Nil = system trust store (the default http transport), matching today's behavior.

spec.auth.oauth.tokenEndpointCA.valueFrom object required

spec.auth.oauth.tokenEndpointCA.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.auth.oauth.tokenEndpointCA.valueFrom.configMapKeyRef.key string required

spec.auth.oauth.tokenEndpointCA.valueFrom.configMapKeyRef.name string required

spec.auth.oauth.tokenEndpointCA.valueFrom.env string

spec.auth.oauth.tokenEndpointCA.valueFrom.file string

spec.auth.oauth.tokenEndpointCA.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.auth.oauth.tokenEndpointCA.valueFrom.secretKeyRef object

spec.auth.oauth.tokenEndpointCA.valueFrom.secretKeyRef.key string required

spec.auth.oauth.tokenEndpointCA.valueFrom.secretKeyRef.name string required

spec.auth.scram object

spec.auth.scram.password object required

spec.auth.scram.password.valueFrom object required

spec.auth.scram.password.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.auth.scram.password.valueFrom.configMapKeyRef.key string required

spec.auth.scram.password.valueFrom.configMapKeyRef.name string required

spec.auth.scram.password.valueFrom.env string

spec.auth.scram.password.valueFrom.file string

spec.auth.scram.password.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.auth.scram.password.valueFrom.secretKeyRef object

spec.auth.scram.password.valueFrom.secretKeyRef.key string required

spec.auth.scram.password.valueFrom.secretKeyRef.name string required

spec.auth.scram.username object required

spec.auth.scram.username.valueFrom object required

spec.auth.scram.username.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.auth.scram.username.valueFrom.configMapKeyRef.key string required

spec.auth.scram.username.valueFrom.configMapKeyRef.name string required

spec.auth.scram.username.valueFrom.env string

spec.auth.scram.username.valueFrom.file string

spec.auth.scram.username.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.auth.scram.username.valueFrom.secretKeyRef object

spec.auth.scram.username.valueFrom.secretKeyRef.key string required

spec.auth.scram.username.valueFrom.secretKeyRef.name string required

spec.authorization object

AuthorizationConfig configures authorization backends beyond plain ACLs. MDS enables Confluent RBAC role bindings. AccessBackends selects how a KafkaTopic.spec.access block is realized on this cluster: - unset/empty → ["acl"] (back-compat: ACLs only); - ["rbac"] → MDS role bindings only; - ["acl","rbac"] → both (dual-emit).

"rbac" requires MDS to be configured.

spec.authorization.accessBackends array<string>

spec.authorization.mds object

MDSConfig is the Confluent Metadata Service (RBAC) connection. Scope cluster IDs are configured explicitly (auto-discovery deferred). KafkaCluster id is required; the others are needed only for their respective scope types.

spec.authorization.mds.auth object

MDSAuth authenticates to MDS. Type selects the method; credentials resolve via the secret machinery (basic: Username/Password; bearer: Token; mtls: TLS client cert).

spec.authorization.mds.auth.password object

spec.authorization.mds.auth.password.valueFrom object required

spec.authorization.mds.auth.password.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.authorization.mds.auth.password.valueFrom.configMapKeyRef.key string required

spec.authorization.mds.auth.password.valueFrom.configMapKeyRef.name string required

spec.authorization.mds.auth.password.valueFrom.env string

spec.authorization.mds.auth.password.valueFrom.file string

spec.authorization.mds.auth.password.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.authorization.mds.auth.password.valueFrom.secretKeyRef object

spec.authorization.mds.auth.password.valueFrom.secretKeyRef.key string required

spec.authorization.mds.auth.password.valueFrom.secretKeyRef.name string required

spec.authorization.mds.auth.token object

spec.authorization.mds.auth.token.valueFrom object required

spec.authorization.mds.auth.token.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.authorization.mds.auth.token.valueFrom.configMapKeyRef.key string required

spec.authorization.mds.auth.token.valueFrom.configMapKeyRef.name string required

spec.authorization.mds.auth.token.valueFrom.env string

spec.authorization.mds.auth.token.valueFrom.file string

spec.authorization.mds.auth.token.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.authorization.mds.auth.token.valueFrom.secretKeyRef object

spec.authorization.mds.auth.token.valueFrom.secretKeyRef.key string required

spec.authorization.mds.auth.token.valueFrom.secretKeyRef.name string required

spec.authorization.mds.auth.type string required

One of: basic, bearer, mtls

spec.authorization.mds.auth.username object

spec.authorization.mds.auth.username.valueFrom object required

spec.authorization.mds.auth.username.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.authorization.mds.auth.username.valueFrom.configMapKeyRef.key string required

spec.authorization.mds.auth.username.valueFrom.configMapKeyRef.name string required

spec.authorization.mds.auth.username.valueFrom.env string

spec.authorization.mds.auth.username.valueFrom.file string

spec.authorization.mds.auth.username.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.authorization.mds.auth.username.valueFrom.secretKeyRef object

spec.authorization.mds.auth.username.valueFrom.secretKeyRef.key string required

spec.authorization.mds.auth.username.valueFrom.secretKeyRef.name string required

spec.authorization.mds.clusters object required

MDSClusters holds the scope cluster IDs for MDS role bindings. kafkaCluster is the base scope id required on every binding; the sub-cluster ids (schemaRegistryCluster, connectCluster, ksqlCluster) are required only for their respective scope.type values.

spec.authorization.mds.clusters.connectCluster string

spec.authorization.mds.clusters.kafkaCluster string required

spec.authorization.mds.clusters.ksqlCluster string

spec.authorization.mds.clusters.schemaRegistryCluster string

spec.authorization.mds.endpoint string required

spec.authorization.mds.tls object

spec.authorization.mds.tls.caCert object

CACert is the PEM of the CA (bundle) to trust for server verification, resolved like any other secret value: file/env/inline in CLI mode, secretKeyRef in operator mode. Nil = system trust store.

spec.authorization.mds.tls.caCert.valueFrom object required

spec.authorization.mds.tls.caCert.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.authorization.mds.tls.caCert.valueFrom.configMapKeyRef.key string required

spec.authorization.mds.tls.caCert.valueFrom.configMapKeyRef.name string required

spec.authorization.mds.tls.caCert.valueFrom.env string

spec.authorization.mds.tls.caCert.valueFrom.file string

spec.authorization.mds.tls.caCert.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.authorization.mds.tls.caCert.valueFrom.secretKeyRef object

spec.authorization.mds.tls.caCert.valueFrom.secretKeyRef.key string required

spec.authorization.mds.tls.caCert.valueFrom.secretKeyRef.name string required

spec.authorization.mds.tls.clientCert object

spec.authorization.mds.tls.clientCert.valueFrom object required

spec.authorization.mds.tls.clientCert.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.authorization.mds.tls.clientCert.valueFrom.configMapKeyRef.key string required

spec.authorization.mds.tls.clientCert.valueFrom.configMapKeyRef.name string required

spec.authorization.mds.tls.clientCert.valueFrom.env string

spec.authorization.mds.tls.clientCert.valueFrom.file string

spec.authorization.mds.tls.clientCert.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.authorization.mds.tls.clientCert.valueFrom.secretKeyRef object

spec.authorization.mds.tls.clientCert.valueFrom.secretKeyRef.key string required

spec.authorization.mds.tls.clientCert.valueFrom.secretKeyRef.name string required

spec.authorization.mds.tls.clientKey object

spec.authorization.mds.tls.clientKey.valueFrom object required

spec.authorization.mds.tls.clientKey.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.authorization.mds.tls.clientKey.valueFrom.configMapKeyRef.key string required

spec.authorization.mds.tls.clientKey.valueFrom.configMapKeyRef.name string required

spec.authorization.mds.tls.clientKey.valueFrom.env string

spec.authorization.mds.tls.clientKey.valueFrom.file string

spec.authorization.mds.tls.clientKey.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.authorization.mds.tls.clientKey.valueFrom.secretKeyRef object

spec.authorization.mds.tls.clientKey.valueFrom.secretKeyRef.key string required

spec.authorization.mds.tls.clientKey.valueFrom.secretKeyRef.name string required

spec.authorization.mds.tls.enabled boolean required

spec.authorization.mds.tls.insecureSkipVerify boolean

spec.bootstrapServers string required

spec.defaults object

spec.defaults.replicationFactor integer

spec.defaults.topicDeletionPolicy string

spec.schemaRegistry object

spec.schemaRegistry.auth object

spec.schemaRegistry.auth.password object

spec.schemaRegistry.auth.password.valueFrom object required

spec.schemaRegistry.auth.password.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.schemaRegistry.auth.password.valueFrom.configMapKeyRef.key string required

spec.schemaRegistry.auth.password.valueFrom.configMapKeyRef.name string required

spec.schemaRegistry.auth.password.valueFrom.env string

spec.schemaRegistry.auth.password.valueFrom.file string

spec.schemaRegistry.auth.password.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.schemaRegistry.auth.password.valueFrom.secretKeyRef object

spec.schemaRegistry.auth.password.valueFrom.secretKeyRef.key string required

spec.schemaRegistry.auth.password.valueFrom.secretKeyRef.name string required

spec.schemaRegistry.auth.type string

spec.schemaRegistry.auth.username object

spec.schemaRegistry.auth.username.valueFrom object required

spec.schemaRegistry.auth.username.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.schemaRegistry.auth.username.valueFrom.configMapKeyRef.key string required

spec.schemaRegistry.auth.username.valueFrom.configMapKeyRef.name string required

spec.schemaRegistry.auth.username.valueFrom.env string

spec.schemaRegistry.auth.username.valueFrom.file string

spec.schemaRegistry.auth.username.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.schemaRegistry.auth.username.valueFrom.secretKeyRef object

spec.schemaRegistry.auth.username.valueFrom.secretKeyRef.key string required

spec.schemaRegistry.auth.username.valueFrom.secretKeyRef.name string required

spec.schemaRegistry.endpoint string required

spec.schemaRegistry.tls object

TLS configures the HTTPS connection to the Schema Registry (custom CA, optional client cert, dev-only insecureSkipVerify). Same shape as spec.tls and authorization.mds.tls.

spec.schemaRegistry.tls.caCert object

CACert is the PEM of the CA (bundle) to trust for server verification, resolved like any other secret value: file/env/inline in CLI mode, secretKeyRef in operator mode. Nil = system trust store.

spec.schemaRegistry.tls.caCert.valueFrom object required

spec.schemaRegistry.tls.caCert.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.schemaRegistry.tls.caCert.valueFrom.configMapKeyRef.key string required

spec.schemaRegistry.tls.caCert.valueFrom.configMapKeyRef.name string required

spec.schemaRegistry.tls.caCert.valueFrom.env string

spec.schemaRegistry.tls.caCert.valueFrom.file string

spec.schemaRegistry.tls.caCert.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.schemaRegistry.tls.caCert.valueFrom.secretKeyRef object

spec.schemaRegistry.tls.caCert.valueFrom.secretKeyRef.key string required

spec.schemaRegistry.tls.caCert.valueFrom.secretKeyRef.name string required

spec.schemaRegistry.tls.clientCert object

spec.schemaRegistry.tls.clientCert.valueFrom object required

spec.schemaRegistry.tls.clientCert.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.schemaRegistry.tls.clientCert.valueFrom.configMapKeyRef.key string required

spec.schemaRegistry.tls.clientCert.valueFrom.configMapKeyRef.name string required

spec.schemaRegistry.tls.clientCert.valueFrom.env string

spec.schemaRegistry.tls.clientCert.valueFrom.file string

spec.schemaRegistry.tls.clientCert.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.schemaRegistry.tls.clientCert.valueFrom.secretKeyRef object

spec.schemaRegistry.tls.clientCert.valueFrom.secretKeyRef.key string required

spec.schemaRegistry.tls.clientCert.valueFrom.secretKeyRef.name string required

spec.schemaRegistry.tls.clientKey object

spec.schemaRegistry.tls.clientKey.valueFrom object required

spec.schemaRegistry.tls.clientKey.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.schemaRegistry.tls.clientKey.valueFrom.configMapKeyRef.key string required

spec.schemaRegistry.tls.clientKey.valueFrom.configMapKeyRef.name string required

spec.schemaRegistry.tls.clientKey.valueFrom.env string

spec.schemaRegistry.tls.clientKey.valueFrom.file string

spec.schemaRegistry.tls.clientKey.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.schemaRegistry.tls.clientKey.valueFrom.secretKeyRef object

spec.schemaRegistry.tls.clientKey.valueFrom.secretKeyRef.key string required

spec.schemaRegistry.tls.clientKey.valueFrom.secretKeyRef.name string required

spec.schemaRegistry.tls.enabled boolean required

spec.schemaRegistry.tls.insecureSkipVerify boolean

spec.tenancy object

TenancyConfig restricts which namespaces may reference this cluster and which topic-name prefixes each namespace may manage.

spec.tenancy.allowedNamespaces array<string>

AllowedNamespaces: glob patterns (path.Match syntax); empty = any namespace may reference this cluster.

spec.tenancy.topicPrefixes array<object>

spec.tenancy.topicPrefixes[].namespaces array<string> required

spec.tenancy.topicPrefixes[].prefixes array<string> required

spec.tls object

spec.tls.caCert object

CACert is the PEM of the CA (bundle) to trust for server verification, resolved like any other secret value: file/env/inline in CLI mode, secretKeyRef in operator mode. Nil = system trust store.

spec.tls.caCert.valueFrom object required

spec.tls.caCert.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.tls.caCert.valueFrom.configMapKeyRef.key string required

spec.tls.caCert.valueFrom.configMapKeyRef.name string required

spec.tls.caCert.valueFrom.env string

spec.tls.caCert.valueFrom.file string

spec.tls.caCert.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.tls.caCert.valueFrom.secretKeyRef object

spec.tls.caCert.valueFrom.secretKeyRef.key string required

spec.tls.caCert.valueFrom.secretKeyRef.name string required

spec.tls.clientCert object

spec.tls.clientCert.valueFrom object required

spec.tls.clientCert.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.tls.clientCert.valueFrom.configMapKeyRef.key string required

spec.tls.clientCert.valueFrom.configMapKeyRef.name string required

spec.tls.clientCert.valueFrom.env string

spec.tls.clientCert.valueFrom.file string

spec.tls.clientCert.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.tls.clientCert.valueFrom.secretKeyRef object

spec.tls.clientCert.valueFrom.secretKeyRef.key string required

spec.tls.clientCert.valueFrom.secretKeyRef.name string required

spec.tls.clientKey object

spec.tls.clientKey.valueFrom object required

spec.tls.clientKey.valueFrom.configMapKeyRef object

ConfigMapKeyRef reads a ConfigMap key (operator mode only). Uses the same {Name, Key} shape as SecretKeyRef; no Secret is involved.

spec.tls.clientKey.valueFrom.configMapKeyRef.key string required

spec.tls.clientKey.valueFrom.configMapKeyRef.name string required

spec.tls.clientKey.valueFrom.env string

spec.tls.clientKey.valueFrom.file string

spec.tls.clientKey.valueFrom.inline string

Inline is the literal value verbatim (intended for schema bodies).

spec.tls.clientKey.valueFrom.secretKeyRef object

spec.tls.clientKey.valueFrom.secretKeyRef.key string required

spec.tls.clientKey.valueFrom.secretKeyRef.name string required

spec.tls.enabled boolean required

spec.tls.insecureSkipVerify boolean

Status

Written by the operator; read-only for users.

status.conditions array<object>

status.conditions[].lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

status.conditions[].message string required

message is a human readable message indicating details about the transition. This may be an empty string.

max length: 32768

status.conditions[].observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64, min: 0

status.conditions[].reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$, min length: 1, max length: 1024

status.conditions[].status string required

status of the condition, one of True, False, Unknown.

One of: True, False, Unknown

status.conditions[].type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$, max length: 316

status.lastCheckedTime string

format: date-time

status.observedGeneration integer

format: int64

status.phase string