API Reference

Packages

deployments.plural.sh/v1alpha1

deployments.plural.sh/v1alpha1

Package v1alpha1 contains API Schema definitions for the deployments v1alpha1 API group

Resource Types

AWSProviderCredentials

Appears in:

ProviderCredentials

Field	Description	Validation
`region` string	Region is the name of the AWS region cluster lives in.	Required: {}
`accessKeyID` string	AccessKeyID is your access key ID used to authenticate against AWS API.	Optional: {}
`secretAccessKeyRef` SecretReference	SecretAccessKeyRef is a reference to the secret that contains secret access key. Since UpgradeInsights is a cluster-scoped resource we can't use local reference. SecretAccessKey must be stored in a key named "secretAccessKey". An example secret can look like this: apiVersion: v1 kind: Secret metadata: name: eks-credentials namespace: upgrade-insights-test stringData: secretAccessKey: "changeme" Then it can be referenced like this: ... secretAccessKeyRef: name: eks-credentials namespace: upgrade-insights-test	Optional: {}

AgentConfiguration

AgentConfiguration is the deployment operator configuration

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`AgentConfiguration`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` AgentConfigurationSpec

AgentConfigurationSpec

AgentConfigurationSpec defines the desired state of AgentConfiguration

Appears in:

AgentConfiguration

Field	Description	Validation
`servicePollInterval` string	ServicePollInterval defines how often the agent polls for services. Expected format is a duration string (e.g., "30s", "5m"). Set to "0s" to disable service polling.
`managedNamespacePollInterval` string	ManagedNamespacePollInterval defines how often the agent polls for managed namespaces. Set to "0s" to disable managed namespace polling.
`clusterPingInterval` string	ClusterPingInterval specifies the interval at which the agent pings the cluster. Set to "0s" to disable cluster pings.
`compatibilityUploadInterval` string	CompatibilityUploadInterval determines how frequently the agent uploads compatibility data. Set to "0s" to disable compatibility uploads.
`stackPollInterval` string	StackPollInterval sets how often the agent polls for stack updates or changes. Set to "0s" to disable stack polling.
`sentinelPollInterval` string	SentinelPollInterval sets how often the agent polls for sentinel run jobs. Set to "0s" to disable sentinel run job polling.
`pipelineGateInterval` string	PipelineGateInterval specifies how frequently the agent checks pipeline gates. Set to "0s" to disable pipeline gate checks.
`componentShaCacheTTL` string	ComponentShaCacheTTL specifies how long duplicate component updates are cached.
`maxConcurrentReconciles` integer	MaxConcurrentReconciles controls the maximum number of concurrent reconcile loops. Higher values can increase throughput at the cost of resource usage.
`vulnerabilityReportUploadInterval` string	VulnerabilityReportUploadInterval sets how often vulnerability reports are uploaded. Set to "0s" to disable vulnerability report uploads.
`baseRegistryURL` string	BaseRegistryURL allows overriding the default base registry URL. For stack run jobs, agent run pods, sentinel run jobs.
`maxSentinelRunJobs` integer	MaxSentinelRunJobs limits the number of concurrent SentinelRunJobs that can be active at any given time. Must be greater than 0. Set this field to nil (omit) to disable the limit.	Minimum: 1
`maxStackRunJobs` integer	MaxStackRunJobs limits the number of concurrent StackRunJobs that can be active at any given time. Must be greater than 0. Set this field to nil (omit) to disable the limit.	Minimum: 1
`maxAgentRunPods` integer	MaxAgentRunPods limits the number of concurrent agent run pods that can be active at any given time. Must be greater than 0. Set this field to nil (omit) to disable the limit.	Minimum: 1
`disableWebsocket` boolean	DisableWebsocket disables the cluster websocket connection to the Console. When enabled, the agent will rely exclusively on polling instead of receiving push updates. This is useful in large-scale edge deployments where maintaining persistent websocket connections has an infeasible network cost.
`pollImmediately` boolean	PollImmediately determines whether the agent should poll immediately upon startup. When set to true, the agent will perform an initial poll as soon as it starts. By default, it's set to true.

AgentHelmConfiguration

Appears in:

Field	Description	Validation
`chartName` string	ChartName is a helm chart name.
`repoUrl` string	RepoUrl is a url that points to this helm chart.	Optional: {} Type: string
`values` RawExtension	Values allows defining arbitrary YAML values to pass to the helm as values.yaml file. Use only one of: - Values - ValuesSecretRef - ValuesConfigMapRef	Optional: {}
`valuesSecretRef` SecretKeySelector	ValuesSecretRef fetches helm values from a secret in this cluster. Use only one of: - Values - ValuesSecretRef - ValuesConfigMapRef	Optional: {}
`valuesConfigMapRef` ConfigMapKeySelector	ValuesConfigMapRef fetches helm values from a config map in this cluster. Use only one of: - Values - ValuesSecretRef - ValuesConfigMapRef	Optional: {}

AgentRun

AgentRun is the Schema for the agentruns API

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`AgentRun`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` AgentRunSpec

AgentRunPhase

Underlying type: string

AgentRunPhase represents the phase of an agent run

Validation:

Enum: [Pending Running Succeeded Failed Cancelled]

Appears in:

AgentRunStatus

Field	Description
`Pending`
`Running`
`Succeeded`
`Failed`
`Cancelled`

AgentRunSpec

AgentRunSpec defines the desired state of AgentRun

Appears in:

AgentRun

Field	Description	Validation
`runtimeRef` AgentRuntimeReference		Required: {}
`prompt` string	Prompt is the task/prompt given to the agent	Required: {}
`repository` string	Repository is the git repository the agent will work with	Required: {}
`branch` string	Branch is the repository branch the agent should operate on. If omitted, the repository default branch is used.	Optional: {}
`mode` AgentRunMode	Mode defines how the agent should run (ANALYZE, WRITE, REVIEW)	Required: {}
`reviewDepth` AgentReviewDepth	ReviewDepth controls how far a review run explores code adjacent to the pull request changes.	Optional: {}
`flowId` string	FlowID is the flow this agent run is associated with (optional)	Optional: {}
`workbenchMcpUrl` string	WorkbenchMCPURL is the Console MCP endpoint for the workbench that originated this run. It is populated by the AgentRuntime controller.	Optional: {}
`language` AgentRunLanguage	Language is the programming language used in the agent run. Deprecated: No longer used for image selection. Enable dind on the AgentRuntime instead.	Optional: {}
`languageVersion` string	LanguageVersion is the version of the language to use, if you wish to specify. Deprecated: No longer used for image selection. Enable dind on the AgentRuntime instead.	Optional: {}

AgentRuntime

AgentRuntime is the Schema for the agentruntimes API

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`AgentRuntime`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` AgentRuntimeSpec

AgentRuntimeBindings

Appears in:

AgentRuntimeSpec

Field	Description	Default	Validation
`create` Binding array	Create bindings control who can generate new agent runtimes.		Optional: {}

AgentRuntimeConfig

AgentRuntimeConfig contains typed configuration for the agent runtime.

Appears in:

AgentRuntimeSpec

Field	Description	Validation
`claude` ClaudeConfig	Config for Claude CLI runtime.	Optional: {}
`opencode` OpenCodeConfig	Config for OpenCode CLI runtime.	Optional: {}
`gemini` GeminiConfig	Config for Gemini CLI runtime.	Optional: {}
`codex` CodexConfig	Codex config for Codex CLI runtime.	Optional: {}
`pi` PiConfig	Pi config for Pi coding-agent CLI runtime.	Optional: {}

AgentRuntimeReference

Appears in:

AgentRunSpec

Field	Description	Default	Validation
`name` string			Required: {}

AgentRuntimeSpec

AgentRuntimeSpec defines the desired state of AgentRuntime

Appears in:

AgentRuntime

Field	Description	Validation
`name` string	Name of this AgentRuntime. If not provided, the name from AgentRuntime.ObjectMeta will be used.	Optional: {}
`default` boolean	Default indicates whether this is the default agent runtime for coding agents.	Optional: {}
`targetNamespace` string		Required: {}
`type` AgentRuntimeType	Type specifies the agent runtime to use for executing the stack. One of CLAUDE, OPENCODE, GEMINI, CODEX, PI, CUSTOM.	Enum: [CLAUDE OPENCODE GEMINI CODEX PI CUSTOM] Required: {}
`bindings` AgentRuntimeBindings	Bindings define the creation permissions for this agent runtime.	Optional: {}
`template` PodTemplateSpec	Template defines the pod template for this agent runtime.
`config` AgentRuntimeConfig	Config contains typed configuration depending on the chosen runtime type.	Optional: {}
`aiProxy` boolean	AiProxy routes LLM requests through the Console AI proxy (/ext/ai) using the deploy token, which the in-pod mcpserver sidecar adds, so provider API keys in spec.config are optional. Set the model on the runtime-specific config block (for example spec.config.codex.model). The proxy expects models in provider/name format (for example openai/gpt-5.4, anthropic/claude-sonnet-4-5, vertex/gemini-2.5-pro). Values that already include a "/" are passed through unchanged. When only a bare model id is given, the harness may prefix it by runtime type: - CLAUDE: anthropic/{model} (for example claude-sonnet-4-5 -> anthropic/claude-sonnet-4-5) - CODEX, OPENCODE: openai/{model} (for example gpt-5.4 -> openai/gpt-5.4) - GEMINI: vertex/{model} - CUSTOM: no automatic prefix; use provider/name explicitly
`streamingProxy` boolean	StreamingProxy routes OpenAI-compatible LLM requests through the in-pod mcpserver sse conversion proxy before they reach the Console AI proxy (/ext/ai). Only valid when aiProxy is enabled. Applies to CODEX and OPENCODE runtimes.	Optional: {}
`dind` boolean	Dind enables Docker-in-Docker for this agent runtime. When true, the runtime will be configured to run with DinD support.	Optional: {}
`memory` boolean	Memory enables team-shared codebase-memory persistence for this agent runtime. When true, agents may create and commit .codebase-memory/ graph artifacts by default so future runs can bootstrap from the persisted index. When false or unset, codebase-memory indexes stay in the pod-local cache and generated .codebase-memory/ artifacts are excluded from commits.	Optional: {}
`repositoryImage` string	RepositoryImage is an OCI image of precloned git repositories plus manifest.json. When set, an init container copies it into /plural/shared/repos before bootstrap so a matching repo can be copied locally instead of git clone.	Optional: {}
`prewarm` RepositoryImagePrewarm	Prewarm periodically pulls RepositoryImage onto selected nodes before agent runs are scheduled.	Optional: {}
`allowedRepositories` string array	AllowedRepositories the git repositories allowed to be used with this runtime.	Optional: {}
`browser` BrowserConfig	Browser configuration augments agent runtime with a headless browser. When provided, the runtime will be configured to run with a headless browser available for the agent to use.	Optional: {}
`bootstrapScript` string	BootstrapScript is a bash script that will be executed inside the cloned repository directory before the coding agent starts. It can be used to install dependencies, configure tooling, or perform any other setup required by the agent.	Optional: {}
`readOnlyRootFilesystem` boolean	ReadOnlyRootFilesystem controls the default container securityContext. When unset, the root filesystem stays writable (the current default). Set true when extending a finished image that already contains compilers. Set false (or leave unset) together with mise.config to run `mise bootstrap --yes` at boot: https://mise.jdx.dev/bootstrap.html	Optional: {}
`mise` MiseSpec	Mise supplies a mise.toml applied before the coding agent starts. When the default container root is writable, the harness runs `mise trust` and `mise bootstrap --yes`. When readOnlyRootFilesystem is true, the config is still mounted so mise exec can use [tools] and [env], but bootstrap is skipped.	Optional: {}
`git` GitSpec	Git configure commit signing on agent run. When provided, the runtime will be configured to sign git commits using the provided key reference.
`babysitInterval` Duration	BabysitInterval configures the interval for the operator to check on the health of the agent runtime and perform necessary babysitting actions (e.g. restarting unhealthy runtimes). When not provided, a default interval of 1 minute will be used.
`agentTTL` Duration	AgentTTL configures the maximum lifetime for agent run pods on this runtime. When not provided, a default TTL of 12 hours will be used.	Optional: {}
`scmConnection` string	ScmConnection is the name of an ScmConnection in Console to use for git operations on agent runs using this runtime. This should match the name of an existing ScmConnection resource or connection created in the Plural UI.	Optional: {}
`exaConnection` ExaConnection	ExaConnection enables Exa web search and content retrieval tools on the Plural MCP server.
`mcpServers` MCPServer array	MCPServers are additional remote MCP servers made available to coding agents on this runtime. Servers are expected to already be deployed and reachable at the given URL. Built-in servers named "plural" and "codebase-memory-mcp" are reserved and cannot be overridden.	Optional: {}
`workbenchMcp` WorkbenchMCPConfig	WorkbenchMCP exposes the originating workbench's read-only tools to coding agents through the credential-isolating MCP sidecar.	Optional: {}

Binding

Binding ...

Appears in:

Field	Description	Default	Validation
`id` string			Optional: {}
`UserID` string			Optional: {}
`userEmail` string			Optional: {}
`groupID` string			Optional: {}
`groupName` string			Optional: {}

Bindings

Bindings represents a policy bindings that can be used to define read/write permissions to this resource for users/groups in the system.

Appears in:

ClusterSpec

Field	Description	Default	Validation
`read` Binding array	Read bindings.		Optional: {}
`write` Binding array	Write bindings.		Optional: {}

Browser

Underlying type: string

Browser defines the browser to use for the agent runtime.

Appears in:

BrowserConfig

Field	Description
`chrome`
`chromium`
`firefox`
`selenium-chrome`
`selenium-chromium`
`selenium-firefox`
`selenium-edge`
`puppeteer`
`custom`

BrowserConfig

BrowserConfig is the configuration for the browser runtime. It allows AgentRuntime to leverage a headless browser for executing and testing code.

Appears in:

AgentRuntimeSpec

Field	Description	Default	Validation
`enabled` boolean	Enabled controls whether the browser runtime is enabled for this agent runtime.		Required: {}
`browser` Browser	Browser defines the browser to use. When using non-custom options, predefined images with validated configurations will be used. Default configuration can be overridden by specifying a custom Container. When using a "custom" browser, a custom Container configuration must be provided. Available options are: - chrome - uses browserless/chrome image - chromium - uses browserless/chromium image - firefox - uses browserless/firefox image - selenium-chrome - uses selenium/standalone-chrome image - selenium-chromium - uses selenium/standalone-chromium image - selenium-firefox - uses selenium/standalone-firefox image - selenium-edge - uses selenium/standalone-edge image - puppeteer - uses browserless/chromium image - custom Default: chrome	chrome	Enum: [chrome chromium firefox selenium-chrome selenium-chromium selenium-firefox selenium-edge puppeteer custom] Optional: {}
`container` Container	Container defines the container to use for the browser runtime. For custom images, ensure the container starts a browser server and binds to the predetermined port 3000 for remote access from the main agent container. When using a predefined image, only partial overrides are allowed, including: - environment variables - resource limits - image pull policy # Examples Selenium: name: browser image: selenium/standalone-chrome:144.0 env: - name: SE_OPTS value: "--port 3000"		Optional: {}

CapiConfigurationClusterSpec

Appears in:

PluralCAPICluster

Field	Description	Validation
`cluster` ClusterSpec	Cluster is a simplified representation of the Console API cluster object. See [ClusterSpec] for more information.	Optional: {}
`consoleTokenSecretRef` SecretKeySelector	TokenSecretRef contains the reference to the secret holding the token to access the Console API	Required: {}
`capiClusterRef` ObjectReference	CapiClusterRef contains the reference to the CAPI cluster	Required: {}
`agent` AgentHelmConfiguration	Agent allows configuring agent specific helm chart options.	Optional: {}

ClaudeConfig

ClaudeConfig contains configuration for the Claude CLI runtime.

Appears in:

AgentRuntimeConfig

Field	Description	Validation
`apiKeySecretRef` SecretKeySelector	ApiKeySecretRef references a Secret containing the Claude API key. Optional when aiProxy is enabled; authentication uses the Console deploy token instead.	Optional: {}
`model` string	Model Name of the model to use.
`endpoint` string	Endpoint is the base URL for the Claude API (supports Bedrock/Anthropic-compatible endpoints).	Optional: {}
`extraArgs` string array	ExtraArgs CLI args for advanced flags not modeled here
`timeout` Duration	Timeout bounds a single claude CLI run invocation.	Optional: {}
`bashTimeout` Duration	BashTimeout is the default timeout for any bash command Claude execute.	Optional: {}
`bashMaxTimeout` Duration	BashMaxTimeout is the maximum time Claude is permitted to wait for a command before it is terminated.	Optional: {}

ClaudeConfigRaw

ClaudeConfigRaw contains configuration for the Claude CLI runtime.

NOTE: Do not embed this struct directly, use ClaudeConfig instead. This is only used to read original ClaudeConfig secret data and be able to inject it into the pod as env vars.

Appears in:

AgentRuntimeConfigRaw

Field	Description	Validation
`apiKey` string	ApiKey is the raw API key to use.
`model` string	Model Name of the model to use.
`endpoint` string	Endpoint is the base URL for the Claude API (supports Bedrock/Anthropic-compatible endpoints).	Optional: {}
`extraArgs` string array	ExtraArgs CLI args for advanced flags not modeled here
`timeout` Duration	Timeout bounds a single claude CLI run invocation.	Optional: {}
`bashTimeout` Duration	BashTimeout is the default timeout for any bash command Claude executes.	Optional: {}
`bashMaxTimeout` Duration	BashMaxTimeout is the maximum time Claude is permitted to wait for a command before it is terminated.	Optional: {}

ClusterDrain

ClusterDrain is the Schema for the ClusterDrain object

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`ClusterDrain`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ClusterDrainSpec

ClusterDrainSpec

ClusterDrainSpec defines the desired state of ClusterDrain

Appears in:

ClusterDrain

Field	Description	Default	Validation
`flowControl` FlowControl
`labelSelector` LabelSelector

ClusterSpec

Appears in:

Field	Description	Validation
`handle` string	Handle is a short, unique human-readable name used to identify this cluster. Does not necessarily map to the cloud resource name.	Optional: {}
`tags` object (keys:string, values:string)	Tags used to filter clusters.	Optional: {}
`metadata` RawExtension	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`bindings` Bindings	Bindings contain read and write policies of this cluster	Optional: {}

CodexConfig

Appears in:

AgentRuntimeConfig

Field	Description	Validation
`apiKeySecretRef` SecretKeySelector	ApiKeySecretRef references a Secret containing the Codex API key. Optional when aiProxy is enabled; authentication uses the Console deploy token instead.	Optional: {}
`model` string	Model to use.
`method` OpenAiMethod	Method configures which OpenAI API Codex should use. AUTO omits wire_api and lets Codex choose. CHAT forces /chat/completions. RESPONSES forces /responses.	Enum: [CHAT RESPONSES AUTO] Optional: {}
`endpoint` string	Endpoint is the base URL for the Codex API (supports OpenAI/Azure-compatible endpoints).	Optional: {}
`timeout` Duration	Timeout bounds a single codex run invocation.	Optional: {}

CodexConfigRaw

Appears in:

AgentRuntimeConfigRaw

Field	Description	Validation
`apiKey` string	ApiKey is the raw API key to use.
`model` string	Model to use.
`method` OpenAiMethod	Method configures which OpenAI API Codex should use. AUTO omits wire_api and lets Codex choose. CHAT forces /chat/completions. RESPONSES forces /responses.	Enum: [CHAT RESPONSES AUTO] Optional: {}
`endpoint` string	Endpoint is the base URL for the Codex API (supports OpenAI/Azure-compatible endpoints).	Optional: {}
`timeout` Duration	Timeout bounds a single codex run invocation.	Optional: {}

CostProvider

Underlying type: string

CostProvider identifies which cost allocation backend to query.

Appears in:

KubecostExtractorSpec

Field	Description
`Kubecost`
`OpenCost`

CustomHealth

CustomHealth is the Schema for the HealthConverts API

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`CustomHealth`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` CustomHealthSpec

CustomHealthSpec

CustomHealthSpec defines the desired state of CustomHealth

Appears in:

CustomHealth

Field	Description	Validation
`script` string	Script is a Lua health-assessment script. The target resource is available as the global `Obj`. The script must assign a Lua table to the global `healthStatus`; a Lua `return \{ ... \}` is not consumed. The table uses `status` and an optional `message`, for example: `healthStatus = \{ status = "Healthy", message = "resource is ready" \}`. Supported/intended status values are `Healthy`, `Degraded`, `Paused`, `Unknown`, `Progressing`, `Suspended`, and `Missing`. See https://docs.plural.sh/plural-features/continuous-deployment/deployment-operator/custom-health for the full guide.
`group` string		Optional: {}
`version` string		Optional: {}
`kind` string		Optional: {}

ExaConnection

Appears in:

AgentRuntimeSpec

Field	Description	Validation
`url` string	URL is the Exa API base URL. Defaults to https://api.exa.ai when unset.	Optional: {}
`apiKeySecretRef` SecretKeySelector	ApiKeySecretRef references a Secret containing the Exa API key.	Optional: {}
`proxyUrl` string	ProxyURL is an HTTP proxy URL used for Exa API requests.	Optional: {}

FlowControl

Appears in:

ClusterDrainSpec

Field	Description	Default	Validation
`percentage` integer
`maxConcurrency` integer

GateSpec

GateSpec defines the detailed gate specifications

Appears in:

PipelineGateSpec

Field	Description	Default	Validation
`job` JobSpec	resuse JobSpec type from the kubernetes api

GateState

Underlying type: GateState

GateState represents the state of a gate, reused from console client

Validation:

Enum: [PENDING OPEN CLOSED RUNNING]

Appears in:

PipelineGateStatus

GateType

Underlying type: GateType

GateType represents the type of a gate, reused from console client

Validation:

Enum: [APPROVAL WINDOW JOB]

Appears in:

PipelineGateSpec

GeminiConfig

GeminiConfig contains configuration for the Gemini CLI runtime.

Appears in:

AgentRuntimeConfig

Field	Description	Validation
`apiKeySecretRef` SecretKeySelector	APIKeySecretRef references a Secret containing the Gemini API key. Optional when aiProxy is enabled; authentication uses the Console deploy token instead.	Optional: {}
`model` string	Model is the name of the model to use. NOTE: gemini flash lite models and are not fit for the write (agent) mode, and should only be used for analysis.	Optional: {}
`timeout` Duration	Timeout bounds a single gemini run invocation.	Optional: {}
`inactivityTimeout` Duration	InactivityTimeout is the timeout for inactivity during a gemini run.	Optional: {}
`endpoint` string		Optional: {}

GeminiConfigRaw

GeminiConfigRaw contains configuration for the Gemini CLI runtime.

NOTE: Do not embed this struct directly, use GeminiConfig instead. This is only used to read original GeminiConfig secret data and be able to inject it into the pod as env vars.

Appears in:

AgentRuntimeConfigRaw

Field	Description	Validation
`apiKey` string	APIKey is the raw Gemini API key to use.
`model` string	Model is the name of the model to use.
`timeout` Duration	Timeout bounds a single gemini run invocation.	Optional: {}
`inactivityTimeout` Duration	InactivityTimeout is the timeout for inactivity during gemini run.	Optional: {}
`endpoint` string		Optional: {}

GitSpec

Appears in:

AgentRuntimeSpec

Field	Description	Default	Validation
`proxy` string
`signingKeyRef` SecretKeySelector

HelmConfiguration

Appears in:

Field	Description	Validation
`chartName` string	ChartName is a helm chart name.
`repoUrl` string	RepoUrl is a url that points to this helm chart.	Optional: {} Type: string
`values` RawExtension	Values allows defining arbitrary YAML values to pass to the helm as values.yaml file. Use only one of: - Values - ValuesSecretRef - ValuesConfigMapRef	Optional: {}
`valuesSecretRef` SecretKeySelector	ValuesSecretRef fetches helm values from a secret in this cluster. Use only one of: - Values - ValuesSecretRef - ValuesConfigMapRef	Optional: {}
`valuesConfigMapRef` ConfigMapKeySelector	ValuesConfigMapRef fetches helm values from a config map in this cluster. Use only one of: - Values - ValuesSecretRef - ValuesConfigMapRef	Optional: {}

HelmSpec

Appears in:

VirtualClusterSpec

Field	Description	Default	Validation
`agent` AgentHelmConfiguration	Agent allows configuring agent specific helm chart options.		Optional: {}
`vcluster` VClusterHelmConfiguration	VCluster allows configuring vcluster specific helm chart options.		Optional: {}

ImageWarmer

ImageWarmer is the Schema for the imagewarmers API.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`ImageWarmer`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ImageWarmerSpec

ImageWarmerSpec

ImageWarmerSpec defines an image that should periodically be pulled onto every selected node.

Appears in:

ImageWarmer

Field	Description	Validation
`cron` string	Cron is a standard five-field cron expression controlling how often the image is refreshed.	MinLength: 1 Required: {}
`image` string	Image is the OCI image to warm.	MinLength: 1 Required: {}
`template` PodTemplateSpec	Template optionally overrides the secure default warmer pod template.	Optional: {}
`selector` LabelSelector	Selector restricts warming to nodes matching this label selector.	Optional: {}

IngressReplica

IngressReplica is the Schema for the console ingress replica

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`IngressReplica`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` IngressReplicaSpec	Spec of the IngressReplica	Required: {}

IngressReplicaSpec

Appears in:

IngressReplica

Field	Description	Default	Validation
`ingressRef` ObjectReference			Required: {}
`ingressClassName` string			Optional: {}
`tls` IngressTLS array			Optional: {}
`hostMappings` object (keys:string, values:string)			Required: {}

KubecostExtractor

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`KubecostExtractor`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` KubecostExtractorSpec

KubecostExtractorSpec

Appears in:

KubecostExtractor

Field	Description	Default	Validation
`provider` CostProvider	Provider selects which cost backend to query. Defaults to Kubecost.	Kubecost	Enum: [Kubecost OpenCost] Optional: {}
`interval` string		1h	Optional: {}
`kubecostServiceRef` ObjectReference	KubecostServiceRef points at the cost analyzer Service. When omitted, defaults are chosen from provider: kubecost-cost-analyzer/kubecost or opencost/opencost.		Optional: {}
`kubecostPort` integer			Optional: {}
`recommendationThreshold` string	RecommendationThreshold float value for example: `1.2 or 0.001`
`recommendationsSettings` RecommendationsSettings			Optional: {}

MCPServer

MCPServer is a remote MCP server exposed to agent runtimes.

Appears in:

AgentRuntimeSpec

Field	Description	Validation
`name` string	Name is the MCP server identifier used by the coding agent.	MinLength: 1 Required: {}
`url` string	URL is the remote streamable HTTP MCP endpoint.	MinLength: 1 Required: {}
`allowedTools` string array	AllowedTools is an optional allowlist of tool names from this server. When omitted or empty, all tools advertised by the server are exposed.	Optional: {}
`headers` MCPServerHeader array	Headers are HTTP headers sent with requests to this MCP server. Each header must set exactly one of value or valueFrom.	Optional: {}

MCPServerHeader

MCPServerHeader is an HTTP header for a remote MCP server.

Appears in:

MCPServer

Field	Description	Validation
`name` string	Name is the HTTP header name.	MinLength: 1 Required: {}
`value` string	Value is a literal header value.	Optional: {}
`valueFrom` EnvVarSource	ValueFrom sources the header value the same way as a pod env var.	Optional: {}

MetricsAggregate

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`MetricsAggregate`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.

MiseSpec

MiseSpec is an inline mise.toml used for unattended bootstrap. See https://mise.jdx.dev/bootstrap.html

Appears in:

AgentRuntimeSpec

Field	Description	Default	Validation
`config` string	Config is the contents of a mise.toml.		Optional: {}

OpenCodeConfig

OpenCodeConfig contains configuration for the OpenCode CLI runtime.

Appears in:

AgentRuntimeConfig

Field	Description	Validation
`openaiCompatible` OpenCodeOpenAICompatibleConfig	OpenAICompatible configures a custom OpenAI-compatible provider block in opencode.json. When set (and aiProxy is false), provider and endpoint on this struct are ignored in favor of the nested openaiCompatible fields.	Optional: {}
`provider` string	Provider is the OpenCode provider id from https://models.dev (for example openai, anthropic, amazon-bedrock, google-vertex, google). Optional. When the parent AgentRuntime has spec.aiProxy enabled, the harness ignores this field and autowires provider "plural", routing requests through the Console AI proxy at /ext/ai/v1 using the deploy token, which the in-pod mcpserver sidecar adds. Set spec.config.opencode.model to a bare model id; the harness prefixes it for proxy routing based on runtime type (for example gpt-5.4 -> openai/gpt-5.4). When aiProxy is false, this selects the native OpenCode provider block; credentials come from tokenSecretRef or the provider's usual environment variables. Defaults to plural when omitted. Use exact models.dev slugs (for example amazon-bedrock, google-vertex, google).	MaxLength: 128 Optional: {}
`endpoint` string	Endpoint optionally overrides the provider baseURL in opencode.json. When omitted, the harness omits baseURL so OpenCode uses the models.dev default for the provider.	Optional: {}
`model` string	Model is the LLM model to use.	Optional: {}
`method` OpenAiMethod	Method configures which OpenAI API OpenCode should use. CHAT selects @ai-sdk/openai-compatible and forces /chat/completions. RESPONSES selects @ai-sdk/openai and forces /responses. AUTO preserves the provider default.	Enum: [CHAT RESPONSES AUTO] Optional: {}
`tokenSecretRef` SecretKeySelector	TokenSecretRef references a Secret containing the API token for OpenCode. Optional when aiProxy is enabled; authentication uses the Console deploy token instead.	Optional: {}
`extraArgs` string array	ExtraArgs args for advanced or experimental CLI flags. Deprecated: It is being ignored by the agent harness.
`timeout` Duration	Timeout bounds a single opencode run invocation.	Optional: {}

OpenCodeConfigRaw

OpenCodeConfigRaw contains configuration for the OpenCode CLI runtime.

NOTE: Do not embed this struct directly, use OpenCodeConfig instead. This is only used to read original OpenCodeConfig secret data and be able to inject it into the pod as env vars.

Appears in:

AgentRuntimeConfigRaw

Field	Description	Validation
`openaiCompatible` boolean	OpenAICompatible is true when spec.config.opencode.openaiCompatible was set on the AgentRuntime.
`provider` string	Provider is the OpenCode provider id from https://models.dev.
`endpoint` string	Endpoint API endpoint for the OpenCode service.
`model` string	Model is the LLM model to use.
`method` OpenAiMethod	Method configures which OpenAI API OpenCode should use.
`token` string	Token is the raw API token for OpenCode.
`timeout` Duration	Timeout bounds a single opencode run invocation.	Optional: {}

OpenCodeOpenAICompatibleConfig

OpenCodeOpenAICompatibleConfig configures a custom OpenAI-compatible API provider in opencode.json. Use this for endpoints that are not listed on https://models.dev (for example LiteLLM, vLLM, or a private gateway).

When set and the parent AgentRuntime has spec.aiProxy false, spec.config.opencode.provider and spec.config.opencode.endpoint are ignored in favor of this block.

Appears in:

OpenCodeConfig

Field	Description	Validation
`endpoint` string	Endpoint is the OpenAI-compatible API base URL (for example https://litellm.example/v1).	MinLength: 1 Required: {}
`model` string	Model is the model id exposed by that endpoint.	Optional: {}
`tokenSecretRef` SecretKeySelector	TokenSecretRef references a Secret containing the API key for the endpoint.	Optional: {}

PiConfig

PiConfig configures the Pi coding-agent CLI runtime.

Appears in:

AgentRuntimeConfig

Field	Description	Validation
`apiKeySecretRef` SecretKeySelector	APIKeySecretRef references an API key. Optional with aiProxy enabled.	Optional: {}
`provider` string	Provider is Pi's provider id. Defaults to openai.	Optional: {}
`model` string	Model is the model id to use.	Optional: {}
`method` OpenAiMethod	Method configures which OpenAI API Pi should use. CHAT selects openai-completions and forces /chat/completions. RESPONSES selects openai-responses and forces /responses. AUTO preserves the current openai-responses default.	Enum: [CHAT RESPONSES AUTO] Optional: {}
`endpoint` string	Endpoint overrides the OpenAI-compatible provider base URL.	Optional: {}
`timeout` Duration	Timeout bounds a single Pi invocation.	Optional: {}

PiConfigRaw

PiConfigRaw contains resolved credentials and configuration for Pi.

Appears in:

AgentRuntimeConfigRaw

Field	Description	Default	Validation
`apiKey` string
`provider` string
`model` string
`method` OpenAiMethod
`endpoint` string
`timeout` Duration

PipelineGate

PipelineGate represents a gate blocking promotion along a release pipeline

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`PipelineGate`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` PipelineGateSpec

PipelineGateSpec

PipelineGateSpec defines the detailed gate specifications

Appears in:

PipelineGate

Field	Description	Default	Validation
`id` string
`name` string
`type` GateType			Enum: [APPROVAL WINDOW JOB]
`gateSpec` GateSpec

PluralCAPICluster

PluralCAPICluster is the Schema for the CAPI cluster configuration

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`PluralCAPICluster`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` CapiConfigurationClusterSpec	Spec of the CAPI cluster configuration	Required: {}

Progress

Appears in:

ClusterDrainStatus

Field	Description	Default	Validation
`wave` integer
`percentage` integer
`count` integer
`failures` ObjectReference array
`cursor` ObjectReference

ProviderCredentials

Appears in:

UpgradeInsightsSpec

Field	Description	Default	Validation
`aws` AWSProviderCredentials	AWS defines attributes required to auth with AWS API.		Optional: {}

RecommendationsSettings

Appears in:

KubecostExtractorSpec

Field	Description	Default	Validation
`excludeNamespaces` string array
`requireAnnotations` object (keys:string, values:string)

RepositoryImagePrewarm

RepositoryImagePrewarm configures periodic repository image warming.

Appears in:

AgentRuntimeSpec

Field	Description	Validation
`cron` string	Cron is a standard five-field cron expression controlling how often the repository image is refreshed.	MinLength: 1 Required: {}
`template` PodTemplateSpec	Template optionally overrides the secure default warmer pod template.	Optional: {}
`selector` LabelSelector	Selector restricts warming to nodes matching this label selector.	Optional: {}

SentinelRunJob

SentinelRunJob is the Schema for the sentinel run job

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`SentinelRunJob`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` SentinelRunJobSpec

SentinelRunJobSpec

Appears in:

SentinelRunJob

Field	Description	Default	Validation
`runId` string	RunID from Console API

StackRunJob

StackRunJob is the Schema for the stack run job

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`StackRunJob`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` StackRunJobSpec

StackRunJobSpec

Appears in:

StackRunJob

Field	Description	Default	Validation
`runId` string	RunID from Console API

Status

Appears in:

Field	Description	Validation
`id` string	ID of the resource in the Console API.	Optional: {} Type: string
`sha` string	SHA of last applied configuration.	Optional: {} Type: string
`conditions` Condition array	Represents the observations of a PrAutomation's current state.

UpgradeInsights

UpgradeInsights is the Schema for the UpgradeInsights API

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`UpgradeInsights`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` UpgradeInsightsSpec

UpgradeInsightsSpec

Appears in:

UpgradeInsights

Field	Description	Default	Validation
`distro` ClusterDistro	Distro defines which provider API should be used to fetch latest upgrade insights. If not provided, we get the distro from the Plural API cluster tied to this operator deploy token.		Enum: [EKS] Optional: {}
`clusterName` string	ClusterName is your cloud provider cluster identifier (usually name) that is used to fetch latest upgrade insights information from the cloud provider API. If not provided, we get the cluster name from the Plural API cluster tied to this operator deploy token and assume that it is the same as the cluster name in your cloud provider.		Optional: {}
`interval` string	Interval defines how often should the upgrade insights information be fetched.	10m	Optional: {}
`credentials` ProviderCredentials	Credentials allow overriding default provider credentials bound to the operator.		Optional: {}

VClusterHelmConfiguration

Appears in:

HelmSpec

Field	Description	Validation
`chartName` string	ChartName is a helm chart name.
`repoUrl` string	RepoUrl is a url that points to this helm chart.	Optional: {} Type: string
`values` RawExtension	Values allows defining arbitrary YAML values to pass to the helm as values.yaml file. Use only one of: - Values - ValuesSecretRef - ValuesConfigMapRef	Optional: {}
`valuesSecretRef` SecretKeySelector	ValuesSecretRef fetches helm values from a secret in this cluster. Use only one of: - Values - ValuesSecretRef - ValuesConfigMapRef	Optional: {}
`valuesConfigMapRef` ConfigMapKeySelector	ValuesConfigMapRef fetches helm values from a config map in this cluster. Use only one of: - Values - ValuesSecretRef - ValuesConfigMapRef	Optional: {}

VirtualCluster

VirtualCluster is the Schema for the virtual cluster API

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`VirtualCluster`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` VirtualClusterSpec	Spec ...	Required: {}

VirtualClusterSpec

Appears in:

VirtualCluster

Field	Description	Validation
`kubeconfigRef` LocalObjectReference	KubeconfigRef is a reference to the secret created by the vcluster helm chart. It contains kubeconfig with information on how to access created virtual cluster.	Required: {}
`credentialsRef` SecretKeySelector	CredentialsRef is a reference to the secret pointing to the key that holds Console API access token. It allows to communicate with the standard Console API.	Required: {}
`cluster` ClusterSpec	Cluster is a simplified representation of the Console API cluster object. See [ClusterSpec] for more information.	Optional: {}
`external` boolean	External marks this virtual cluster as external one, meaning that the vcluster deployment will not be automatically created. User has to pre-provision vcluster and provide a valid KubeconfigRef pointing to an existing vcluster installation.	Optional: {}
`helm` HelmSpec	Helm allows configuring helm chart options of both agent and vcluster. It is then deployed by the [VirtualCluster] CRD controller.	Optional: {}

WorkbenchMCPCategory

Underlying type: string

WorkbenchMCPCategory is a workbench tool category accepted by the Console MCP endpoint.

Validation:

Enum: [metrics logs integration ticketing traces error_tracking infrastructure search scm chat function coding verification observability]

Appears in:

WorkbenchMCPConfig

Field	Description
`metrics`
`logs`
`integration`
`ticketing`
`traces`
`error_tracking`
`infrastructure`
`search`
`scm`
`chat`
`function`
`coding`
`verification`
`observability`

WorkbenchMCPConfig

Appears in:

AgentRuntimeSpec

Field	Description	Default	Validation
`enabled` boolean	Enabled controls whether workbench tools are available to coding agents.	false
`categories` WorkbenchMCPCategory array	Categories limits the exposed workbench tools. When omitted, the default set is metrics, logs, traces, ticketing, search, scm, and infrastructure.		Enum: [metrics logs integration ticketing traces error_tracking infrastructure search scm chat function coding verification observability] Optional: {}