API Reference

Packages

deployments.plural.sh/v1alpha1

deployments.plural.sh/v1alpha1

Package v1alpha1 contains API Schema definitions for the deployments v1alpha1 API group

Resource Types

AIProviderSettings

Appears in:

AISettings

Field	Description	Validation
`proxy` HttpProxyConfiguration	Proxy configures an HTTP proxy for this provider's API calls.	Optional: {}
`model` string	Model is the LLM model name to use.	Optional: {}
`toolModel` string	ToolModel to use for tool calling, which is less frequent and often requires more advanced reasoning	Optional: {}
`embeddingModel` string	EmbeddingModel to use for generating embeddings	Optional: {}
`proxyModels` string array	ProxyModels are additional models to support within our integrated ai proxy.	Optional: {}
`baseUrl` string	BaseUrl is a custom base url to use, for reimplementations of the same API scheme (for instance Together.ai uses the OpenAI API spec)	Optional: {}
`tokenSecretRef` SecretKeySelector	TokenSecretRef is a reference to the local secret holding the token to access the configured AI provider.	Required: {}

AISettings

AISettings holds the configuration for LLM provider clients.

Appears in:

DeploymentSettingsSpec

Field	Description	Default	Validation
`enabled` boolean	Enabled defines whether to enable the AI integration or not.	false	Optional: {}
`analysisRates` AnalysisRates	Configure the pace at which AI insight analysis should run. Useful if you want to minimize impacts on inference costs.		Optional: {}
`tools` Tools	Tools holds the configuration for the tools that can be used with the AI integration.		Optional: {}
`provider` AiProvider	Provider defines which of the supported LLM providers should be used.	OPENAI	Enum: [OPENAI OPENAI_COMPATIBLE XAI ANTHROPIC OLLAMA AZURE BEDROCK VERTEX] Optional: {}
`toolProvider` AiProvider	ToolProvider to use for tool calling, in case you want to use a different LLM more optimized to those tasks		Enum: [OPENAI OPENAI_COMPATIBLE XAI ANTHROPIC OLLAMA AZURE BEDROCK VERTEX] Optional: {}
`streaming` boolean	Streaming defines whether to stream responses from LLM providers.	true	Optional: {}
`embeddingProvider` AiProvider	EmbeddingProvider to use for generating embeddings. Oftentimes foundational model providers do not have embeddings models, and it's better to simply use OpenAI.		Enum: [OPENAI OPENAI_COMPATIBLE ANTHROPIC OLLAMA AZURE BEDROCK VERTEX] Optional: {}
`logAnalysis` boolean	LogAnalysis defines whether to enable log analysis in AI insights (turn off to save on log query costs)		Optional: {}
`openAI` OpenAISettings	OpenAI holds the OpenAI provider configuration.		Optional: {}
`openAICompatible` OpenAISettings	OpenAICompatible holds the OpenAI-compatible provider configuration.		Optional: {}
`xai` OpenAISettings	XAI holds the xAI provider configuration. This is OpenAI compatible, so uses an equivalent typing.		Optional: {}
`anthropic` AIProviderSettings	Anthropic holds the Anthropic provider configuration.		Optional: {}
`ollama` OllamaSettings	Ollama holds configuration for a self-hosted Ollama deployment, more details available at https://github.com/ollama/ollama		Optional: {}
`azure` AzureOpenAISettings	Azure holds configuration for using AzureOpenAI to generate LLM insights		Optional: {}
`bedrock` BedrockSettings	Bedrock holds configuration for using AWS Bedrock to generate LLM insights		Optional: {}
`vertex` VertexSettings	Vertex holds configuration for using GCP VertexAI to generate LLM insights		Optional: {}
`nexus` NexusSettings	Nexus holds configuration for using the Nexus embeddings proxy		Optional: {}
`vectorStore` VectorStore	VectorStore holds configuration for using a vector store to store embeddings.		Optional: {}
`graph` GraphStore	Configuration for the cloud graph store, which uses similar datastores to the vector store.		Optional: {}

AWSCloudConnection

AWSCloudConnection contains AWS-specific authentication configuration. Enables cloud resource discovery and analysis across AWS resources and infrastructure.

Appears in:

CloudConnectionConfiguration

Field	Description	Validation
`accessKeyId` string
`secretAccessKey` ObjectKeyReference
`region` string	The region this connection applies to	Optional: {}
`regions` string array	A list of regions this connection can query	Optional: {}

AddonCallout

AddonCallout a callout for a specific addon in the upgrade plan

Appears in:

UpgradePlanCalloutSpec

Field	Description	Default	Validation
`addon` string	Addon the addon this callout applies to
`template` string	Template the template to use for this callout

AgentRuntimePolicy

AgentRuntimePolicy centrally defines who can create agent runs on an AgentRuntime. Bindings must be managed from the management cluster: if a target cluster could set its own bindings, cluster operators could grant themselves clone/PR access against any repository reachable by the runtime's SCM credentials.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`AgentRuntimePolicy`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` AgentRuntimePolicySpec

AgentRuntimePolicyBindings

AgentRuntimePolicyBindings defines create permissions for an AgentRuntime.

Appears in:

AgentRuntimePolicySpec

Field	Description	Default	Validation
`create` Binding array	Create bindings control who can create agent runs on this runtime.		Optional: {}

AgentRuntimePolicySpec

AgentRuntimePolicySpec defines the desired access policy for an AgentRuntime.

Appears in:

AgentRuntimePolicy

Field	Description	Validation
`runtime` string	Runtime is the name of the AgentRuntime this policy applies to. Defaults to metadata.name if not specified.	Optional: {}
`bindings` AgentRuntimePolicyBindings	Bindings define who can create agent runs on the targeted runtime.	Optional: {}
`clusterRef` ObjectReference	ClusterRef references the target Cluster where this service will be deployed. Leave it as an empty struct to use the cluster field instead.	Optional: {}
`cluster` string	Cluster is the handle of the target Cluster where this service will be deployed. Leave it empty to use the clusterRef field instead.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

AgentRuntimeRef

AgentRuntimeRef identifies an agent runtime by cluster handle and runtime name. Resolution is done similarly to Observer agent actions: cluster handle is resolved to a cluster ID, then the runtime is looked up by name and cluster ID.

Appears in:

FlowSpec

Field	Description	Default	Validation
`cluster` string	Cluster is the handle of the cluster that owns the agent runtime.		Required: {}
`runtime` string	Runtime is the name of the agent runtime within that cluster.		Required: {}

AiApprovalConfiguration

Appears in:

StackConfiguration

Field	Description	Validation
`enabled` boolean	Enabled indicates if AI approval is enabled for this stack.	Required: {}
`git` GitRef	Git references the Git repository containing the rules file.	Required: {}
`file` string	File is the name of the rules file within the Git repository.	Required: {}
`ignoreCancel` boolean	IgnoreCancel indicates if the cancellation of a stack run should be ignored by AI.	Optional: {}

AiCriteria

AiCriteria defines the configuration for AI pull request based service promotion. This can be a simpler path to construct the GitOps modifications needed to modify your services.

Appears in:

PipelineStageServicePromotionCriteria

Field	Description	Validation
`enabled` boolean	Whether AI based service promotion is enabled for this promotion.	Optional: {}
`prompt` string	The prompt to use to generate the pull request used in this promotion (liquid templating is supported).	Required: {}
`title` string	The title of the pull request used in this promotion (liquid templating is supported). If not provided, the AI will generate a title.	Optional: {}
`message` string	The message of the pull request used in this promotion (liquid templating is supported). If not provided, the AI will generate a message.	Optional: {}

AnalysisRates

Appears in:

AISettings

Field	Description	Default	Validation
`fast` string	Fast is the rate in seconds for fast analysis, eg when the prompt used has seen a material change. Example 1h		Optional: {}
`slow` string	Slow is the rate in seconds for slow analysis, eg when the prompt used has not seen a material change. Example 2h		Optional: {}

AnsibleConfiguration

Appears in:

StackConfiguration

Field	Description	Validation
`playbook` string	Playbook is the ansible playbook to run.	Optional: {}
`inventory` string	Inventory is the ansible inventory file to use. We recommend checking this into git alongside your playbook files, and referencing it with a relative path.	Optional: {}
`additionalArgs` string array	Additional args for the ansible playbook command.	Optional: {}
`privateKeyFile` string	PrivateKeyFile is the path to the private key file for SSH authentication.	Optional: {}
`configFile` string	ConfigFile is the path to the ansible config file to use.	Optional: {}
`supportsCheck` boolean	SupportsCheck indicates whether the ansible playbook supports the check flag.	Optional: {}
`deletePlaybook` string	DeletePlaybook is the playbook to run when deleting the stack.	Optional: {}

AzureCloudConnection

AzureCloudConnection contains Microsoft Azure authentication configuration. Provides credentials for discovering and querying Azure resources.

Appears in:

CloudConnectionConfiguration

Field	Description	Default	Validation
`subscriptionId` string
`tenantId` string
`clientId` string
`clientSecret` ObjectKeyReference

AzureDevopsSettings

Appears in:

ScmConnectionSpec

Field	Description	Default	Validation
`username` string	The username to use for azure devops, it should be associated with the PAT you are supplying as the tokenSecretRef
`organization` string	The organization to use for azure devops
`project` string	The project to use for azure devops

AzureOpenAISettings

Appears in:

AISettings

Field	Description	Validation
`proxy` HttpProxyConfiguration	Proxy configures an HTTP proxy for this provider's API calls.	Optional: {}
`endpoint` string	Endpoint is your Azure OpenAI endpoint, should be formatted like: https://{endpoint}/openai/deployments/{deployment-id}"	Required: {}
`apiVersion` string	The azure openai Data plane - inference api version to use, defaults to 2024-10-01-preview or the latest available	Optional: {}
`model` string	Model - the OpenAi model you wish to use. If not specified, Plural will provide a default.	Optional: {}
`toolModel` string	ToolModel to use for tool calling, which is less frequent and often requires more advanced reasoning.	Optional: {}
`embeddingModel` string	EmbeddingModel to use for generating embeddings.	Optional: {}
`deployments` object (keys:string, values:string)	Deployments is a mapping from model id to azure OpenAI deployment if those require additional configuration	Optional: {}
`proxyModels` string array	ProxyModels are additional models to support within the integrated ai proxy.	Optional: {}
`tokenSecretRef` SecretKeySelector	TokenSecretRef is a reference to the local secret holding the token to access the configured AI provider.	Required: {}

BedrockModelSettings

Appears in:

BedrockSettings

Field	Description	Default	Validation
`modelId` string	ModelID is the foundation model served by the application inference profile.		Required: {}
`inferenceProfileArn` string	InferenceProfileARN is the full ARN of the Bedrock application inference profile.		Required: {}

BedrockSettings

Appears in:

AISettings

Field	Description	Default	Validation
`proxy` HttpProxyConfiguration	Proxy configures an HTTP proxy for this provider's API calls.		Optional: {}
`modelId` string	ModelID is the primary AWS Bedrock model or inference profile identifier. Use a egional inference profile ID with three dot-separated segments (e.g. us.anthropic.claude-3-5-sonnet-20241022-v2:0, global.anthropic.claude-haiku-4-5-20251001-v1:0).		Optional: {}
`toolModelId` string	ToolModelId is the Bedrock model or inference profile for tool calling. Same ID formats as modelId.		Optional: {}
`embeddingModel` string	EmbeddingModel is the Bedrock model or inference profile for embeddings. Same ID formats as modelId.		Optional: {}
`endpoint` BedrockEndpoint	Endpoint selects the AWS Bedrock API surface. RUNTIME (the default) uses InvokeModel or Converse on bedrock-runtime; MANTLE uses the Bedrock Mantle Anthropic/OpenAI-compatible APIs.	RUNTIME	Enum: [RUNTIME MANTLE] Optional: {}
`proxyModels` string array	ProxyModels lists additional Bedrock model or inference profile IDs exposed through the Nexus OpenAI-compatible proxy beyond modelId, toolModelId, and embeddingModel. Same ID formats as modelId.		Optional: {}
`region` string	Region is the AWS region the model is hosted in		Required: {}
`tokenSecretRef` SecretKeySelector	TokenSecretRef is a reference to the local secret holding the token to access the configured AI provider.		Optional: {}
`awsAccessKeyId` string	AWS Access Key ID to use for authentication		Optional: {}
`awsSecretAccessKeyRef` SecretKeySelector	AWS Secret Access Key to use for authentication		Optional: {}
`deployments` object (keys:string, values:string)	Deployments is deprecated for most configurations: prefer regional-prefixed inference profile IDs in modelId, toolModelId, embeddingModel, or proxyModels (Nexus infers Bifrost aliases automatically). Still needed when clients use a logical model name that must resolve to a different Bedrock identifier, for application inference profile resource IDs (use the profile resource suffix, not the full ARN), or other explicit alias overrides. Maps client-facing model ID to inference profile ID. Example: {"anthropic.claude-3-5-sonnet-20241022-v2:0": "us.anthropic.claude-3-5-sonnet-20241022-v2:0"}		Optional: {}
`modelSettings` BedrockModelSettings array	ModelSettings configures per-model Bedrock options, including application inference profiles.		Optional: {}

Binding

Binding used to assign permissions to a resource for a user or a group in the system.

Appears in:

Field	Description	Validation
`id` string	ID of a binding. Deprecated. Do not use.	Optional: {}
`UserID` string		Optional: {}
`userEmail` string		Optional: {}
`groupID` string		Optional: {}
`groupName` string		Optional: {}

BindingPolicy

BindingPolicy automatically attaches a Policy to all resources that match the configured criteria. It references two Policy CRDs: policyRef (the policy to enforce) and bindPolicyRef (the selector policy that determines which resources are targeted). The controller polls at the configured interval and applies the policy to any newly matching targets.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`BindingPolicy`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` BindingPolicySpec	Spec reflects a Console API binding policy spec.	Required: {}

BindingPolicyMatches

BindingPolicyMatches defines the criteria used to select targets for a BindingPolicy.

Appears in:

BindingPolicySpec

Field	Description	Default	Validation
`workbench` WorkbenchBindingPolicyMatches	Workbench defines match criteria for workbench-type binding policies.		Optional: {}
`stack` StackBindingPolicyMatches	Stack defines match criteria for stack-type binding policies, including the evaluation stage.		Optional: {}

BindingPolicySpec

BindingPolicySpec defines the desired state of a BindingPolicy.

Appears in:

BindingPolicy

Field	Description	Validation
`type` BindingPolicyType	Type specifies the resource type this binding policy applies to. Valid values: WORKBENCH, STACK.	Required: {}
`interval` string	Interval controls how often this binding policy is evaluated. Defaults to 1h; cannot be shorter than 30m. Format: duration string e.g. "1h", "30m".	Optional: {}
`policyRef` ObjectReference	PolicyRef references the Policy CRD whose policy will be enforced on matching targets.	Required: {}
`bindPolicyRef` ObjectReference	BindPolicyRef references the Policy CRD whose policy determines which targets to bind.	Required: {}
`matches` BindingPolicyMatches	Matches defines criteria that determine when this binding policy applies.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

Bindings

Bindings used to assign read and write permissions to a resource for users and groups in the system.

Appears in:

Field	Description	Default	Validation
`read` Binding array	Read bindings.		Optional: {}
`write` Binding array	Write bindings.		Optional: {}

BindingsTemplate

Appears in:

SpecTemplate

Field	Description	Default	Validation
`read` string	Read bindings.		Optional: {}
`write` string	Write bindings.		Optional: {}

BitbucketDatacenterSettings

BitbucketDatacenterSettings holds configuration for Bitbucket Data Center / Server authentication.

Appears in:

ScmConnectionSpec

Field	Description	Default	Validation
`userSlug` string	The user slug for Bitbucket Data Center / Server

BootstrapToken

BootstrapToken is a restricted authentication token for secure cluster registration. It enables edge devices and new clusters to self-register with the Plural Console without exposing full user credentials. The token is scope-limited to cluster registration operations only and automatically assigns registered clusters to a specified project.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`BootstrapToken`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` BootstrapTokenSpec

BootstrapTokenSpec

BootstrapTokenSpec defines the desired state of BootstrapToken

Appears in:

BootstrapToken

Field	Description	Validation
`user` string	User is an optional email to attribute bootstrap token operations in audit logs.	Optional: {}
`projectRef` ObjectReference	ProjectRef is the project that all clusters registered with this token will belong to.	Required: {}
`tokenSecretRef` SecretReference	TokenSecretRef points to a secret where the generated bootstrap token will be stored. The secret is created automatically and must not already exist when the BootstrapToken is created.	Required: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

Cascade

Cascade defines the deletion behavior for resources owned by a GlobalService. It provides fine-grained control over whether resources should be deleted from the Plural Console, the target Kubernetes clusters, or both during cleanup operations.

Appears in:

Field	Description	Default	Validation
`detach` boolean	Detach specifies whether to delete owned resources in Plural Console but leave the corresponding Kubernetes objects in-place in the target clusters. This allows for graceful handoff of resource management without disrupting running workloads.		Optional: {}
`delete` boolean	Delete specifies whether to delete owned resources both in Plural Console and in the targeted Kubernetes clusters. When true, this performs a complete cleanup of all associated resources across the entire service deployment.		Optional: {}

Catalog

Catalog is an organized collection of PR Automations. It enables teams to group related automation workflows by category (like "data", "security", "devops") and provides a browsable interface for self-service capabilities. Catalogs support hierarchical permissions through RBAC bindings and can be scoped to specific projects for multi-tenant environments.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Catalog`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` CatalogSpec

CatalogBindings

CatalogBindings defines the RBAC permissions for a catalog, controlling access to PR automations. These bindings determine who can view, modify, and create PR automations within the catalog, providing fine-grained access control for self-service automation capabilities.

Appears in:

CatalogSpec

Field	Description	Validation
`create` Binding array	Create bindings control who can generate new PR automations using this catalog. Users with create permissions can trigger self-service workflows but cannot modify the catalog itself.	Optional: {}
`read` Binding array	Read bindings control who can view and browse this catalog and its PR automations. Users with read permissions can see available automations but cannot execute or modify them.	Optional: {}
`write` Binding array	Write bindings control who can modify the catalog and its PR automations. Users with write permissions can add, update, or remove PR automations within this catalog.	Optional: {}

CatalogSpec

CatalogSpec defines the desired state of Catalog

Appears in:

Catalog

Field	Description	Validation
`name` string	Name is the display name for this catalog if different from metadata.name. Defaults to metadata.name if not specified.	Optional: {}
`author` string	Author is the name of the catalog creator used for attribution and contact purposes. This field helps users identify who maintains and supports the catalog contents.	Required: {}
`icon` string	Icon is a URL to an icon image for visual identification in the catalog browser. Should be a publicly accessible image URL that displays well at small sizes.	Optional: {}
`darkIcon` string	DarkIcon is a URL to a dark mode variant of the catalog icon. Used when the UI is in dark mode to ensure proper contrast and visibility.	Optional: {}
`description` string	Description provides a detailed explanation of the catalog's purpose and contents. This helps users understand what types of automations they can find within.	Optional: {} Type: string
`category` string	Category is a short classification label for organizing catalogs in the browser. Examples include "infrastructure", "security", "monitoring", or "development".	Optional: {}
`projectRef` ObjectReference	ProjectRef links this catalog to a specific project for permission inheritance. When set, the catalog inherits the project's RBAC policies and is scoped to that project. ProjectRef owning project of the catalog, permissions will propagate down	Optional: {}
`tags` object (keys:string, values:string)	Tags provide key-value metadata for filtering and organizing catalogs. Useful for adding custom labels like environment, team, or technology stack.	Optional: {}
`bindings` CatalogBindings	Bindings define the read, write, and create permissions for this catalog. Controls who can view, modify, and use the PR automations within this catalog. Bindings contain read and write policies of this Catalog.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

CloudConnection

CloudConnection is a credential for querying a cloud provider. It will be used in agentic chats to perform generic sql-like queries against cloud configuration data.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`CloudConnection`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` CloudConnectionSpec

CloudConnectionConfiguration

CloudConnectionConfiguration contains provider-specific credential configurations. Only one provider configuration should be specified per CloudConnection instance.

Appears in:

CloudConnectionSpec

Field	Description	Default	Validation
`aws` AWSCloudConnection
`gcp` GCPCloudConnection
`azure` AzureCloudConnection
`vsphere` VsphereCloudConnection

CloudConnectionSpec

CloudConnectionSpec defines the desired state of CloudConnection

Appears in:

CloudConnection

Field	Description	Validation
`name` string	Name of this CloudConnection. If not provided CloudConnection's own name from CloudConnection.ObjectMeta will be used.	Optional: {}
`provider` CloudProvider	Provider is the name of the cloud service for the Provider. One of (CloudProvider): [gcp, aws, azure, vsphere]	Enum: [gcp aws azure vsphere] Required: {} Type: string
`configuration` CloudConnectionConfiguration	Configuration contains the cloud connection configuration.	Required: {}
`readBindings` Binding array	ReadBindings is a list of bindings that defines who can use this CloudConnection.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

CloudProvider

Underlying type: string

CloudProvider represents the supported cloud service providers.

Appears in:

CloudConnectionSpec

Field	Description
`aws`	AWS represents Amazon Web Services as a cloud provider
`azure`	Azure represents Microsoft Azure as a cloud provider
`gcp`	GCP represents Google Cloud Platform as a cloud provider
`vsphere`	Vsphere represents VMware vSphere as a cloud provider

Cluster

Cluster represents a Kubernetes cluster managed by the Plural Console for continuous deployment. Clusters serve as deployment targets for services and can be either management clusters (hosting the Plural Console and operators) or workload clusters (running application workloads). The Console tracks cluster health, versions, and coordinates service deployments across the fleet.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Cluster`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ClusterSpec

ClusterAWSCloudSettings

ClusterAWSCloudSettings contains AWS-specific configuration for cluster deployment.

Appears in:

ClusterCloudSettings

Field	Description	Default	Validation
`region` string	Region in AWS to deploy this cluster to. Determines data residency, latency characteristics, and available AWS services.		Required: {} Type: string

ClusterAzureCloudSettings

ClusterAzureCloudSettings contains Azure-specific configuration for cluster deployment.

Appears in:

ClusterCloudSettings

Field	Description	Validation
`resourceGroup` string	ResourceGroup specifies the Azure resource group name for organizing cluster resources.	Required: {} Type: string
`network` string	Network specifies the Azure virtual network name for cluster networking.	Required: {} Type: string
`subscriptionId` string	SubscriptionId is the GUID of the Azure subscription that will contain this cluster.	Required: {} Type: string
`location` string	Location specifies the Azure region where this cluster will be deployed.	Required: {} Type: string

ClusterCloudSettings

ClusterCloudSettings contains cloud provider-specific configuration for cluster infrastructure. Allows customization of networking, regions, and other cloud-specific cluster properties.

Appears in:

ClusterSpec

Field	Description	Validation
`aws` ClusterAWSCloudSettings	AWS contains Amazon Web Services specific cluster configuration.	Optional: {}
`azure` ClusterAzureCloudSettings	Azure contains Microsoft Azure specific cluster configuration.	Optional: {}
`gcp` ClusterGCPCloudSettings	GCP contains Google Cloud Platform specific cluster configuration.	Optional: {}

ClusterGCPCloudSettings

ClusterGCPCloudSettings contains Google Cloud Platform specific configuration for cluster deployment.

Appears in:

ClusterCloudSettings

Field	Description	Validation
`project` string	Project specifies the GCP project ID where this cluster will be deployed.	Required: {} Type: string
`network` string	Network specifies the GCP VPC network name for cluster networking.	Required: {} Type: string
`region` string	Region specifies the GCP region where this cluster will be deployed.	Required: {} Type: string

ClusterNodePool

ClusterNodePool defines the configuration for a group of worker nodes in the cluster.

Appears in:

ClusterSpec

Field	Description	Validation
`name` string	Name is the unique identifier for this node pool within the cluster.	Required: {} Type: string
`instanceType` string	InstanceType specifies the cloud provider instance type for nodes in this pool.	Required: {} Type: string
`minSize` integer	MinSize is the minimum number of nodes that must be running in this pool.	Minimum: 1 Required: {}
`maxSize` integer	MaxSize is the maximum number of nodes that can be running in this pool.	Minimum: 1 Required: {}
`labels` object (keys:string, values:string)	Labels are key-value pairs applied to nodes for workload scheduling and organization.	Optional: {}
`taints` Taint array	Taints are restrictions applied to nodes to control which pods can be scheduled.	Optional: {}
`cloudSettings` ClusterNodePoolCloudSettings	CloudSettings contains cloud provider-specific configuration for this node pool.	Optional: {}

ClusterNodePoolAWSCloudSettings

ClusterNodePoolAWSCloudSettings contains AWS-specific configuration for node pool deployment.

Appears in:

ClusterNodePoolCloudSettings

Field	Description	Default	Validation
`launchTemplateId` string	LaunchTemplateId specifies a custom EC2 launch template ID for node provisioning.		Optional: {} Type: string

ClusterNodePoolCloudSettings

ClusterNodePoolCloudSettings contains cloud provider-specific settings for node pools.

Appears in:

ClusterNodePool

Field	Description	Default	Validation
`aws` ClusterNodePoolAWSCloudSettings	AWS contains Amazon Web Services specific node pool configuration.		Optional: {}

ClusterRestore

ClusterRestore manages the restoration of cluster data from backup snapshots. Orchestrates the recovery process for Kubernetes resources.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`ClusterRestore`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ClusterRestoreSpec

ClusterRestoreSpec

ClusterRestoreSpec defines the desired state of ClusterRestore. It specifies the backup to restore from, including the backup ID, name, namespace, and cluster reference.

Appears in:

ClusterRestore

Field	Description	Validation
`backupID` string	BackupID is an ID of the backup to restore. If BackupID is specified, then BackupName, BackupNamespace, and BackupClusterRef are not needed.	Optional: {} Type: string
`backupName` string	BackupName is a name of the backup to restore. BackupNamespace and BackupClusterRef have to be specified as well with it. If BackupName, BackupNamespace, and BackupCluster are specified, then BackupID is not needed.	Optional: {} Type: string
`backupNamespace` string	BackupNamespace is a namespace of the backup to restore. BackupName and BackupClusterRef have to be specified as well with it. If BackupName, BackupNamespace, and BackupCluster are specified, then BackupID is not needed.	Optional: {} Type: string
`backupClusterRef` ObjectReference	BackupClusterID is an ID of a cluster where the backup to restore is located. BackupName and BackupNamespace have to be specified as well with it. If BackupName, BackupNamespace, and BackupClusterRef are specified, then BackupID is not needed.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

ClusterRestoreTrigger

ClusterRestoreTrigger triggers cluster restore operations. It provides a declarative way to initiate cluster restore processes from existing backups.

The ClusterRestoreTrigger works in conjunction with ClusterRestore resource to manage the complete backup and restore lifecycle for Kubernetes clusters in the Plural platform.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`ClusterRestoreTrigger`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ClusterRestoreTriggerSpec	Spec defines the desired state and configuration for the cluster restore trigger.

ClusterRestoreTriggerSpec

ClusterRestoreTriggerSpec defines the desired state and configuration for a ClusterRestoreTrigger. It specifies which backup should be restored and provides the necessary references to locate and access the backup data for the restore operation.

Appears in:

ClusterRestoreTrigger

Field	Description	Default	Validation
`clusterRestoreRef` ObjectReference	ClusterRestoreRef is a reference to the ClusterRestore resource that contains the backup data and configuration for the restore operation. This reference should point to a valid ClusterRestore resource that has been successfully created and contains the backup data needed for restoration.		Optional: {}

ClusterSpec

ClusterSpec defines the desired state of a Cluster. Configures cluster properties including cloud provider settings, node pools, and access controls for continuous deployment workflows across the Plural fleet management architecture.

Appears in:

Cluster

Field	Description	Validation
`handle` string	Handle is a short, unique human-readable name used to identify this cluster. Does not necessarily map to the cloud resource name. This has to be specified to adopt the existing cluster.	Optional: {} Type: string
`version` string	Version specifies the Kubernetes version to use for this cluster. Can be skipped only for BYOK (Bring Your Own Kubernetes) clusters where a version is externally managed. Deprecated. Do not use.	Optional: {} Type: string
`providerRef` ObjectReference	ProviderRef references the cloud provider to use for this cluster. Can be skipped only for BYOK clusters where infrastructure is externally provisioned. Deprecated. Do not use.	Optional: {}
`projectRef` ObjectReference	ProjectRef references the project this cluster belongs to for multi-tenancy and access control. If not provided, the cluster will be assigned to the default project. Deprecated. Do not use.	Optional: {}
`cloud` string	Cloud specifies the cloud provider to use for this cluster. Determines the infrastructure platform where the cluster will be provisioned and managed. For BYOK clusters, this field is set to "byok" and no cloud provider is required. Deprecated. Do not use.	Enum: [aws azure gcp byok] Optional: {} Type: string
`protect` boolean	Protect prevents accidental deletion of this cluster. When enabled, the cluster cannot be deleted through the Console UI or API. Deprecated. Do not use.	Optional: {}
`tags` object (keys:string, values:string)	Tags are key-value pairs used to categorize and filter clusters in fleet management. Used for organizing clusters by environment, team, or other operational criteria.	Optional: {}
`mergeTags` boolean	MergeTags, when true, merges tags specified on this resource with the existing tags on the tracked Console cluster instead of replacing them. Spec tags overlay existing tags (the CR wins on key conflicts). Tags previously applied by this CR and later removed from spec are dropped; tags that were never managed by this CR are left intact. Only applies when this Cluster is tracking an existing Console cluster (read-only mode). Defaults to false.	Optional: {}
`metadata` RawExtension	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`bindings` Bindings	Bindings contain read and write access policies for this cluster. Controls which users and groups can view or manage this cluster through RBAC.	Optional: {}
`cloudSettings` ClusterCloudSettings	CloudSettings contains cloud provider-specific configuration for this cluster. Deprecated. Do not use.	Optional: {}
`nodePools` ClusterNodePool array	NodePools defines the worker node configurations managed by this cluster. Deprecated. Do not use.	Optional: {}
`disableAI` boolean	DisableAI indicates whether to disable ai insights for this cluster.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

ClusterSpecTemplate

Appears in:

ClusterSyncSpec

Field	Description	Default	Validation
`metadata` MetadataTemplate	Refer to Kubernetes API documentation for fields of `metadata`.		Required: {}
`spec` SpecTemplate	Spec for the cluster.		Required: {}

ClusterSync

ClusterSync enables automatic synchronization of clusters from the Plural Console into Kubernetes cluster CRDs. It polls the Console clusters API endpoint and creates or updates cluster resources based on the discovered infrastructure, making it ideal for scenarios where clusters are provisioned externally (e.g., via Terraform) without direct CRD creation capability.

The resource supports optional filtering by project and tags, and uses templatable specifications that are populated with data from the discovered clusters.

Example usage:

```yaml apiVersion: deployments.plural.sh/v1alpha1 kind: ClusterSync metadata: name: my-cluster-sync namespace: default spec: projectRef: name: my-project # optional: only sync clusters from this project tags: environment: production # optional: filter clusters by tags clusterSpec: metadata: name: "{{ .cluster.name }}" # templated from discovered cluster namespace: clusters spec: handle: "{{ .cluster.handle }}" version: "{{ .cluster.version }}" cloud: "{{ .cluster.cloud }}" ````

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`ClusterSync`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ClusterSyncSpec

ClusterSyncSpec

ClusterSyncSpec defines the desired state of ClusterSync

Appears in:

ClusterSync

Field	Description	Validation
`projectRef` ObjectReference	ProjectRef references project to sync clusters from.	Optional: {}
`tags` object (keys:string, values:string)	Tags used to filter clusters.	Optional: {}
`clusterSpec` ClusterSpecTemplate	ClusterSpec contains specifications of the cluster.	Required: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

ClusterTarget

ClusterTarget defines the criteria for selecting target clusters where managed namespaces should be created. It provides flexible targeting mechanisms based on cluster metadata and properties, enabling fine-grained control over namespace distribution across a fleet of clusters.

Appears in:

ManagedNamespaceSpec

Field	Description	Default	Validation
`tags` object (keys:string, values:string)	Tags specify a set of key-value pairs used to select target clusters. Only clusters that match all specified tags will receive the managed namespace. This provides a flexible mechanism for targeting specific cluster groups, environments, or organizational boundaries.		Optional: {}
`distro` ClusterDistro	Distro specifies the Kubernetes distribution type for target cluster selection. This allows targeting namespaces to specific cluster types that may have distribution-specific requirements, networking configurations, or security policies.		Optional: {}

CommandAttributes

Appears in:

CustomStackRunSpec

Field	Description	Validation
`cmd` string	Cmd is the command to execute	Required: {}
`args` string array	Args are the arguments to pass to the command.	Optional: {}
`dir` string	Dir is the working directory for the command.	Optional: {}
`approve` boolean	Approve determines whether this command should run in the approval-gated stage.	Optional: {}

CompatibilityMatrixSummary

Appears in:

CompatibilityMatrixVersion

Field	Description	Default	Validation
`helmChanges` string array	HelmChanges the helm changes for this version		Optional: {}
`breakingChanges` string array	BreakingChanges the breaking changes for this version		Optional: {}

CompatibilityMatrixVersion

Appears in:

CustomCompatibilityMatrixSpec

Field	Description	Validation
`version` string	Version the version of the matrix
`chartVersion` string	ChartVersion the chart version of the matrix	Optional: {}
`kube` string array	Kube the kube version of the matrix	Optional: {}
`summary` CompatibilityMatrixSummary	Summary the summary for this version	Optional: {}

ComplianceReportGenerator

ComplianceReportGenerator represents a resource that generates compliance reports.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`ComplianceReportGenerator`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ComplianceReportGeneratorSpec

ComplianceReportGeneratorSpec

ComplianceReportGeneratorSpec defines the desired state of the resource.

Appears in:

ComplianceReportGenerator

Field	Description	Validation
`name` string	Name, if not provided name from object meta will be used.	Optional: {}
`format` ComplianceReportFormat	Format of the report to be generated.	Enum: [CSV JSON] Required: {}
`readBindings` Binding array	ReadBindings represent the download policy for this report.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

ComponentState

Underlying type: string

Appears in:

ServiceComponent

Field	Description
`RUNNING`

Condition

Condition defines a conditional expression.

Appears in:

PrAutomationConfiguration

Field	Description	Default	Validation
`field` string			Required: {}
`operation` Operation			Enum: [NOT GT LT EQ GTE LTE PREFIX SUFFIX] Required: {}
`value` string			Optional: {}

ConfigMapReference

ConfigMapReference identifies a ConfigMap source for a ServiceContext configuration.

Appears in:

ServiceContextSpec

Field	Description	Validation
`name` string	Name is the name of the referenced ConfigMap.	MinLength: 1
`namespace` string	Namespace is the namespace of the referenced ConfigMap. If omitted, the ServiceContext namespace is used.	Optional: {}
`scope` string	Scope places this ConfigMap's data beneath this top-level configuration key. If omitted, data is merged flat.	Optional: {}

Container

Appears in:

JobSpec

Field	Description	Validation
`name` string	Name of the container.	Optional: {} Type: string
`image` string		Required: {} Type: string
`args` string array		Optional: {}
`env` Env array		Optional: {}
`envFrom` EnvFrom array		Optional: {}
`resources` ContainerResources		Optional: {}

ContainerResources

Underlying type: struct{Requests *ContainerResourceRequests "json:"requests,omitempty""; Limits *ContainerResourceRequests "json:"limits,omitempty""}

Appears in:

CostSettings

Appears in:

DeploymentSettingsSpec

Field	Description	Default	Validation
`recommendationCushion` integer	RecommendationCushion is a percentage amount of cushion to give over the average discovered utilization to generate a scaling recommendation, should be between 1-99.		Optional: {}
`recommendationThreshold` integer	RecommendationThreshold is the minimal monthly cost for a recommendation to be covered by a controller.		Optional: {}

CreatePr

Appears in:

Tools

Field	Description	Default	Validation
`scmConnectionRef` ObjectReference	ScmConnectionRef the SCM connection to use for pr automations		Optional: {}

CustomCompatibilityMatrix

CustomCompatibilityMatrix is the Schema for the customcompatibilitymatrices API

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`CustomCompatibilityMatrix`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` CustomCompatibilityMatrixSpec

CustomCompatibilityMatrixSpec

CustomCompatibilityMatrixSpec defines the desired state of CustomCompatibilityMatrix

Appears in:

CustomCompatibilityMatrix

Field	Description	Validation
`name` string	Name of this CustomCompatibilityMatrixSpec. If not provided CustomCompatibilityMatrixSpec's own name from CustomCompatibilityMatrixSpec.ObjectMeta will be used.	Optional: {}
`icon` string	Icon the icon to use for this matrix	Optional: {}
`gitUrl` string	GitURL the git url to use for this matrix	Optional: {}
`releaseUrl` string	ReleaseURL the release url to use for this matrix	Optional: {}
`readmeUrl` string	ReadmeURL the readme url to use for this matrix	Optional: {}
`versions` CompatibilityMatrixVersion array	Versions the versions for this matrix	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

CustomRunStep

CustomRunStep defines a custom execution step within a StackDefinition template. Each step represents a discrete action that will be performed during stack execution, with control over when it runs and whether it requires manual approval.

Appears in:

StackDefinitionSpec

Field	Description	Validation
`args` string array	Args provides additional command-line arguments that should be passed to the command specified in Cmd during execution.	Required: {}
`cmd` string	Cmd specifies the executable command that should be run as part of this custom step. This can be any command available in the execution environment.	Required: {}
`requireApproval` boolean	RequireApproval determines whether this step requires manual approval before it can proceed. When true, the stack run will pause at this step until an authorized user approves its execution.	Optional: {}
`stage` StepStage	Stage controls at which phase of the stack lifecycle this step should be executed. Valid stages include PLAN, VERIFY, APPLY, INIT, and DESTROY, allowing fine-grained control over when custom logic runs in relation to the main IaC operations.	Enum: [PLAN VERIFY APPLY INIT DESTROY] Required: {}

CustomStackRun

CustomStackRun represents a custom stack run resource. It allows users to define custom commands that can be executed as part of a stack run.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`CustomStackRun`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` CustomStackRunSpec

CustomStackRunSpec

CustomStackRunSpec defines the desired state of CustomStackRun.

Appears in:

CustomStackRun

Field	Description	Validation
`name` string	Name of this CustomStackRun. If not provided CustomStackRun's own name from CustomStackRun.ObjectMeta will be used.	Optional: {}
`stackRef` LocalObjectReference	StackRef is a reference to the stack this custom run belongs to.	Optional: {}
`documentation` string	Documentation to explain what this custom run does.	Optional: {}
`commands` CommandAttributes array	Commands to execute as part of this custom run.	Optional: {}
`configuration` PrAutomationConfiguration array	Configuration self-service configuration which will be presented in UI before triggering	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

Dashboard

Dashboard represents an observability dashboard owned by a Workbench. It consists of graphs arranged on a grid, each backed by an observability tool datasource, and optional user-configurable inputs.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Dashboard`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` DashboardSpec	Spec defines the desired state of the Dashboard.	Required: {}

DashboardDatasource

DashboardDatasource defines an observability tool call used to fetch dashboard data.

Appears in:

Field	Description	Validation
`type` DashboardDatasourceType	Type is the kind of data returned by the datasource.	Enum: [LOGS METRICS TRACES LABELS] Required: {}
`tool` string	Tool is the name of the observability tool used to fetch the data.	MinLength: 1 Required: {} Type: string
`input` RawExtension	Input is passed to the observability tool.	Required: {}

DashboardGraph

DashboardGraph is a single graph placed on the dashboard grid.

Appears in:

DashboardSpec

Field	Description	Validation
`identifier` string	Identifier is a stable identifier unique within the dashboard.	MaxLength: 128 MinLength: 1 Required: {} Type: string
`title` string	Title is the graph title.	Optional: {} Type: string
`description` string	Description is an optional graph description.	Optional: {} Type: string
`type` DashboardGraphType	Type is the graph visualization type.	Enum: [TIMESERIES GAUGE LOGS MARKDOWN TABLE STAT BAR PIE HEATMAP TRACES SECTION] MaxLength: 16 Required: {} Type: string
`unit` DashboardGraphUnit	Unit of the plotted values, used to format axes and tooltips. TIME is in seconds, CPU is in cores, and PERCENT is on a 0-100 scale.	Enum: [NONE BYTES TIME CPU PERCENT] Optional: {} Type: string
`sectionId` string	SectionID is the identifier of the SECTION graph containing this graph. Sections cannot be nested.	MaxLength: 128 Optional: {} Type: string
`markdown` string	Markdown is the content for MARKDOWN graphs.	Optional: {} Type: string
`options` RawExtension	Options are visualization-specific display options. Sections may set collapsed.	Optional: {}
`layout` DashboardGraphLayout	Layout is the grid position and size of the graph.	Required: {}
`datasource` DashboardDatasource	Datasource is the tool call used to fetch external data.	Optional: {}

DashboardGraphLayout

DashboardGraphLayout defines the grid position and size of a graph.

Appears in:

DashboardGraph

Field	Description	Validation
`x` integer	X is the zero-based horizontal grid coordinate.	Minimum: 0 Required: {}
`y` integer	Y is the zero-based vertical grid coordinate.	Minimum: 0 Required: {}
`w` integer	W is the width in grid columns.	Minimum: 1 Required: {}
`h` integer	H is the height in grid rows.	Minimum: 1 Required: {}

DashboardInput

DashboardInput is a user-configurable dashboard variable.

Appears in:

DashboardSpec

Field	Description	Validation
`name` string	Name is the variable name referenced by graph datasource inputs.	MinLength: 1 Required: {} Type: string
`label` string	Label is a human-readable input label.	Optional: {} Type: string
`description` string	Description is an optional input description.	Optional: {} Type: string
`type` DashboardInputType	Type is the input control type.	Enum: [TEXT NUMBER BOOLEAN SELECT TIME_RANGE] Required: {}
`default` string	Default is the default input value.	Optional: {} Type: string
`options` string array	Options are the allowed values for select inputs.	Optional: {}
`required` boolean	Required defines whether a value is required when rendering.	Optional: {}
`datasource` DashboardDatasource	Datasource is the tool query used to populate input options, such as metric label search.	Optional: {}

DashboardSpec

DashboardSpec defines the desired state of a Dashboard.

Appears in:

Dashboard

Field	Description	Validation
`workbenchRef` LocalObjectReference	WorkbenchRef references the Workbench that owns this dashboard. The Workbench must be in the same namespace as the dashboard. It is immutable, a dashboard cannot be moved to a different workbench.	Required: {}
`name` string	Name is the dashboard name, unique within its workbench. If not set, metadata.name is used.	Optional: {} Type: string
`description` string	Description is an optional dashboard description.	Optional: {} Type: string
`graphs` DashboardGraph array	Graphs arranged on the dashboard grid. Graph identifiers must be unique within the dashboard. Graphs can be grouped by setting sectionId to the identifier of a SECTION graph. Note that overlapping graph layouts are only validated by the Console API.	MaxItems: 200 Optional: {}
`inputs` DashboardInput array	Inputs are user-configurable dashboard variables.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource.	Optional: {}

DeploymentSettings

DeploymentSettings provides global configuration settings for Continuous Deployment (CD) operations. This resource defines cluster-wide settings that control how the Plural deployment system operates, including access policies, repository configuration, monitoring integrations, and AI-powered features.

Example usage:

yaml apiVersion: deployments.plural.sh/v1alpha1 kind: DeploymentSettings metadata: name: global-deployment-settings namespace: plrl-deploy-operator spec: agentHelmValues: annotations: company.com/team: "platform" managementRepo: "https://github.com/company/infrastructure" bindings: read: - user: email: "dev-team@company.com" write: - group: name: "platform-engineers" deploymentRepositoryRef: name: "main-deployment-repo" namespace: "plrl-deploy-operator" prometheusConnection: host: "https://prometheus.company.com" user: "monitoring" passwordSecretRef: name: "prometheus-creds" key: "password" ai: enabled: true provider: OPENAI openAI: model: "gpt-4" tokenSecretRef: name: "openai-secret" key: "token" tokenExchange: enabled: true tokenUrl: "https://idp.example.com/oauth/token" clientId: "console-ai" clientSecretSecretRef: name: "openai-oauth-client" key: "clientSecret" cost: recommendationCushion: 20 recommendationThreshold: 100

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`DeploymentSettings`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` DeploymentSettingsSpec

DeploymentSettingsBindings

Appears in:

DeploymentSettingsSpec

Field	Description	Validation
`read` Binding array	Read bindings.	Optional: {}
`write` Binding array	Write bindings.	Optional: {}
`create` Binding array	Create bindings.	Optional: {}
`git` Binding array	Git bindings.	Optional: {}

DeploymentSettingsSpec

DeploymentSettingsSpec defines the desired state of DeploymentSettings

Appears in:

DeploymentSettings

Field	Description	Validation
`agentHelmValues` RawExtension	AgentHelmValues custom helm values to apply to all agents (useful for things like adding customary annotations/labels)	Optional: {}
`agentHelmValuesTemplateable` boolean	AgentHelmValuesTemplateable indicates whether to render agent helm values as a template.	Optional: {}
`agentHelmValuesTemplate` string	AgentHelmValuesTemplate is a raw string template of custom helm values to apply to all agents. Unlike AgentHelmValues it is not parsed as YAML by the operator, so it may contain template expressions that would not be valid YAML on their own (for example, unquoted Liquid tags). When set to a non-empty string, it takes precedence over AgentHelmValues, which is ignored, and AgentHelmValuesTemplateable is always treated as true.	Optional: {}
`managementRepo` string	ManagementRepo is the root repo for setting up your infrastructure with Plural. Usually this will be your `plural up repo`	Optional: {}
`stacks` StackSettings	Stacks global configuration for stack execution.	Optional: {}
`bindings` DeploymentSettingsBindings	Bindings global configuration for access control.	Optional: {}
`prometheusConnection` HTTPConnection	PrometheusConnection connection details for a prometheus instance to use	Optional: {}
`lokiConnection` HTTPConnection	LokiConnection connection details for a loki instance to use	Optional: {}
`ai` AISettings	AI settings specifies a configuration for LLM provider clients	Optional: {}
`logging` LoggingSettings	Logging settings for connections to log aggregation datastores	Optional: {}
`cost` CostSettings	Cost settings for managing Plural's cost management features	Optional: {}
`metrics` MetricsSettings	Metrics settings for OpenTelemetry metrics export	Optional: {}
`deploymentRepositoryRef` NamespacedName	DeploymentRepositoryRef is a pointer to the deployment GIT repository to use	Optional: {}
`scaffoldsRepositoryRef` NamespacedName	ScaffoldsRepositoryRef is a pointer to the Scaffolds GIT repository to use	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

DiffNormalizers

Appears in:

SyncConfigAttributes

Field	Description	Validation
`name` string
`kind` string
`namespace` string		Optional: {}
`backfill` boolean	Backfill indicates whether to backfill the given pointers with the current live value or otherwise ignore it entirely.	Optional: {}
`jsonPointers` string array	JSONPointers contains a list of JSON patches to apply to the service, which controls how drift detection works.

ElasticsearchConnection

Appears in:

LoggingSettings

Field	Description	Validation
`host` string	Host is the elasticsearch host to connect to.	Required: {}
`index` string	Index to query in elasticsearch.	Optional: {}
`user` string	User to connect with basic auth.	Optional: {}
`passwordSecretRef` SecretKeySelector	PasswordSecretRef is a reference to a secret containing the password to connect with basic auth.	Optional: {}

ElasticsearchConnectionSettings

Appears in:

Field	Description	Validation
`host` string	Host is the host of the elasticsearch cluster.	Required: {}
`index` string	Index is the index of the elasticsearch cluster.	Required: {}
`user` string	User is the user to authenticate with.	Optional: {}
`passwordSecretRef` SecretKeySelector	PasswordSecretRef is a reference to the local secret holding the password to authenticate with.	Optional: {}

FederatedCredential

FederatedCredential is a way to authenticate users from an external identity provider.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`FederatedCredential`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` FederatedCredentialSpec

FederatedCredentialSpec

FederatedCredentialSpec defines the desired state of FederatedCredential.

Appears in:

FederatedCredential

Field	Description	Validation
`issuer` string	Issuer is the URL of the identity provider that issues the tokens.	Required: {}
`aud` string	Audience is the expected aud of tokens exchanged with this credential. When unset, any audience is accepted. When set, the token aud must equal this value, or include it when aud is a list.	Optional: {}
`scopes` string array	Scopes are the scopes that the credential will request from the identity provider.	Optional: {}
`claimsLike` RawExtension	ClaimsLike is a JSON expression that matches the claims in the token. All the value strings should be a valid regular expression, which must match the entire claim value. Example: ... claimsLike: sub: "repo:myaccount/myrepo:ref:refs/heads/.*"	Optional: {}
`user` string	User is the user email address that will be authenticated by this credential.	Required: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

Flow

Flow provides an abstraction layer over complex Kubernetes deployments to simplify application management for developers. It groups related services, pipelines, and infrastructure components into a single logical unit, making it easier to understand and manage application state.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Flow`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` FlowSpec

FlowServerAssociation

Appears in:

FlowSpec

Field	Description	Default	Validation
`mcpServerRef` ObjectReference	MCPServerRef is a required reference to an MCP server resource. This establishes the connection between the flow and the server.		Required: {}

FlowSpec

FlowSpec defines the desired state of Flow

Appears in:

Flow

Field	Description	Validation
`name` string	Name of this Flow. If not provided Flow's own name from Flow.ObjectMeta will be used.	Optional: {}
`description` string	Description provides a longform description of the service managed by this flow. This field is used for documentation and UI display purposes.	Optional: {}
`icon` string	Icon specifies an optional image icon for the flow to apply branding or improve identification.	Optional: {}
`projectRef` ObjectReference	ProjectRef allows a global service to be scoped to a specific project only.	Optional: {}
`bindings` Bindings	Bindings contain read and write policies of this Flow.	Optional: {}
`repositories` string array	Repositories contains a list of git https urls of the application code repositories used in this flow.	Optional: {}
`serverAssociations` FlowServerAssociation array	ServerAssociations contains a list of MCP services you wish to associate with this flow. Can also be managed within the Plural Console UI securely.	Optional: {}
`workbenchAssociations` FlowWorkbenchAssociation array	WorkbenchAssociations contains a list of workbenches you wish to associate with this flow.	Optional: {}
`metadata` RawExtension	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`agentRuntime` AgentRuntimeRef	AgentRuntime references the agent runtime to use for this flow by cluster handle and runtime name. The controller resolves this to an agent runtime ID when syncing to the Console API.	Optional: {}
`maxPreviews` integer	MaxPreviews is the maximum number of preview environments allowed for this flow. Must be between 1 and 25. Defaults to 10 if omitted.	Maximum: 25 Minimum: 1 Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

FlowWorkbenchAssociation

Appears in:

FlowSpec

Field	Description	Default	Validation
`workbenchRef` ObjectReference	WorkbenchRef is a required reference to a Workbench resource. This establishes the connection between the flow and the workbench.		Required: {}

GCPCloudConnection

GCPCloudConnection contains Google Cloud Platform authentication configuration. Enables cloud resource discovery and analysis across GCP projects.

Appears in:

CloudConnectionConfiguration

Field	Description	Default	Validation
`serviceAccountKey` ObjectKeyReference
`projectId` string

GateSpec

GateSpec provides detailed configuration for complex gate types, particularly JOB gates.

Appears in:

PipelineGate

Field	Description	Default	Validation
`job` JobSpec	Job configuration for JOB gate types, enabling custom validation jobs such as integration tests, security scans, or other promotion checks.		Optional: {}

GeneratedSecret

GeneratedSecret handles templated secret creation and distribution. It allows you to define secret templates with variable substitution and automatically distribute the rendered secrets to multiple namespaces and destinations. This is particularly useful for sharing configuration, credentials, or certificates across multiple applications or environments while maintaining consistency and reducing manual secret management overhead.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`GeneratedSecret`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` GeneratedSecretSpec

GeneratedSecretDestination

GeneratedSecretDestination defines a target location where the generated secret should be created.

Appears in:

GeneratedSecretSpec

Field	Description	Default	Validation
`name` string	Name specifies the name of the secret to create at the destination.		Required: {}
`namespace` string	Namespace specifies the namespace where the secret should be created. If omitted, defaults to the same namespace as the GeneratedSecret resource.		Optional: {}

GeneratedSecretSpec

GeneratedSecretSpec defines the desired state of GeneratedSecret.

Appears in:

GeneratedSecret

Field	Description	Validation
`template` object (keys:string, values:string)	Template defines the secret data as key-value pairs in string form.	Optional: {}
`destinations` GeneratedSecretDestination array	Destinations describe the target name and namespace for the generated secrets.	Optional: {}
`configurationRef` SecretReference	ConfigurationRef references a Secret containing configuration data used to populate template variables.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

GitHealth

Underlying type: string

Appears in:

GitRepositoryStatus

Field	Description
`PULLABLE`
`FAILED`

GitRef

GitRef represents a reference to a Git repository.

Appears in:

Field	Description	Validation
`folder` string	Folder is the folder in the Git repository where the manifests are located.	Required: {}
`ref` string	Ref is the Git reference (branch, tag, or commit) to use.	Required: {}
`files` string array	Optional files to add to the manifests for this service	Optional: {}
`url` string	URL of the Git repository.

GitRepository

GitRepository provides Git-based source control integration for Plural's GitOps workflows. It represents a Git repository available for deployments, enabling automated fetching of manifests, IaC code, and configuration from version-controlled sources. Supports both HTTPS and SSH authentication methods with health monitoring and credential management through ScmConnections or direct secret references.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`GitRepository`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` GitRepositorySpec

GitRepositorySpec

GitRepositorySpec defines the desired state of the GitRepository resource.

Appears in:

GitRepository

Field	Description	Validation
`url` string	Url of the GitRepository, supporting both HTTPS and SSH protocols. This field is immutable once set.
`connectionRef` ObjectReference	ConnectionRef references an ScmConnection to reuse existing credentials and configuration for authenticating with GitRepository.	Optional: {}
`credentialsRef` SecretReference	CredentialsRef references a Secret containing authentication credentials for this repository. The secret should contain keys for privateKey, passphrase, username, and password as needed for the repository's authentication method.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

GlobalService

GlobalService handles the deployment and management of services across multiple clusters. It provides a centralized way to define service deployments that should be replicated across a fleet of Kubernetes clusters, with flexible targeting based on cluster properties, tags, and organizational boundaries.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`GlobalService`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` GlobalServiceSpec

GlobalServiceSpec

GlobalServiceSpec defines the desired state of a GlobalService. It enables the deployment and management of services across multiple Kubernetes clusters with flexible targeting, templating, and lifecycle management capabilities.

Appears in:

GlobalService

Field	Description	Validation
`name` string	Name of this service. If not provided, the name from GlobalService.ObjectMeta will be used.	Optional: {}
`tags` object (keys:string, values:string)	Tags specify a set of key-value pairs used to select target clusters for this global service. Only clusters that match all specified tags will be included in the deployment scope. This provides a flexible mechanism for targeting specific cluster groups or environments.	Optional: {}
`reparent` boolean	Reparent indicates whether this global service should take ownership of existing Plural services that match the targeting criteria. When true, existing services will be brought under the management of this GlobalService resource.	Optional: {}
`interval` string	Interval specifies the reconciliation interval for the global service. This controls how frequently the controller checks and updates the service deployments across target clusters. Defaults to 10 minutes if not specified.	Optional: {}
`cascade` Cascade	Cascade defines the deletion behavior for resources owned by this global service. This controls whether resources are removed from Plural Console only, target clusters only, or both during service deletion operations.	Optional: {}
`context` TemplateContext	Context provides data for dynamic template overrides of service deployment properties such as Helm chart versions, values files, or other configuration parameters. This enables environment-specific customization while maintaining a single service definition.	Optional: {}
`distro` ClusterDistro	Distro specifies the Kubernetes distribution type for target cluster selection. This allows targeting services to specific cluster types that may have distribution-specific requirements or optimizations.	Enum: [GENERIC EKS AKS GKE RKE K3S OPENSHIFT] Optional: {}
`mgmt` boolean	Mgmt indicates whether to include management clusters in the target cluster set. Management clusters typically host the Plural Console and operators, and may require special consideration for service deployments.	Optional: {}
`serviceRef` ObjectReference	ServiceRef references an existing ServiceDeployment to replicate across target clusters. This allows leveraging an existing service definition as a template for global deployment.	Optional: {}
`providerRef` ObjectReference	ProviderRef restricts deployment to clusters associated with a specific cloud provider. This enables provider-specific service deployments that may require particular cloud integrations or provider-native services. Deprecated. Do not use.	Optional: {}
`projectRef` ObjectReference	ProjectRef constrains the global service scope to clusters within a specific project. This provides project-level isolation and ensures services are only deployed to clusters belonging to the designated project.	Optional: {}
`template` ServiceTemplate	Template defines the service deployment specification to be applied across target clusters. This contains the core service definition including Helm charts, configurations, and deployment parameters that will be instantiated on each matching cluster.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}
`ignoreClusters` string array	IgnoreClusters specifies a list of cluster handles to exclude from the target cluster set.	Optional: {}

GraphStore

Appears in:

AISettings

Field	Description	Default	Validation
`enabled` boolean	Enabled controls whether the graph store is enabled or not.	false	Optional: {}
`store` VectorStore	Store is the type of the graph store to use.		Enum: [ELASTIC] Optional: {}
`elastic` ElasticsearchConnectionSettings	Elastic configuration for the graph store.		Optional: {}

Group

Group represents a group of users within the system, managed via the Console API. It includes specifications for the group's name and description.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Group`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` GroupSpec	Spec defines the desired state of the Group.

GroupSpec

GroupSpec defines the desired state of Group.

Appears in:

Group

Field	Description	Default	Validation
`name` string	Name specifies the name for this Group. If not provided, the name from the resource metadata will be used.		Optional: {}
`description` string	Description provides a detailed explanation of this Group's purpose.		Optional: {}
`global` boolean	Global indicates whether all users in the system are automatically added to this group.	false	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.		Optional: {}

HTTPConnection

Appears in:

Field	Description	Validation
`host` string	Host is the host to connect to.	Required: {}
`user` string	User to connect with basic auth.	Optional: {}
`password` string	Password to connect w/ for basic auth.	Optional: {}
`passwordSecretRef` SecretKeySelector	PasswordSecretRef is a reference to a secret containing the password to connect with basic auth.	Optional: {}

HTTPHeader

Appears in:

OpenAISettings

Field	Description	Default	Validation
`name` string	Name is the HTTP header name.		Required: {}
`value` string	Value is the HTTP header value.		Required: {}

HelmMinimal

Appears in:

Renderer

Field	Description	Validation
`values` string	Values a Helm values file to use when rendering this Helm chart.	Optional: {}
`valuesFiles` string array	ValuesFiles a list of relative paths to values files to use for Helm chart templating.	Optional: {}
`release` string	Release is a Helm release name to use when rendering this Helm chart.	Optional: {}
`ignoreHooks` boolean	IgnoreHooks indicates whether to ignore Helm hooks when rendering this Helm chart.	Optional: {}

HelmRepository

HelmRepository is a Kubernetes custom resource that represents a Helm chart repository for use with the Plural Console deployment system. It enables integration with various Helm repository providers including public repositories, private cloud-hosted repositories, and on-premises solutions with comprehensive authentication support.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`HelmRepository`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` HelmRepositorySpec	Spec defines the desired state of the HelmRepository, including the repository URL and authentication configuration. The URL is immutable once set to ensure consistency across deployments and prevent accidental repository changes.	Required: {}

HelmRepositoryAuth

HelmRepositoryAuth defines the authentication configuration for a Helm repository. It supports multiple authentication methods, but only one should be specified per repository. The authentication method used should match the Provider specified in the HelmRepositorySpec.

Appears in:

Field	Description	Validation
`proxy` HttpProxyConfiguration	Proxy configures an HTTP proxy for requests to this Helm repository or OCI registry.	Optional: {}
`basic` HelmRepositoryAuthBasic	Basic specifies username/password authentication for repositories that support HTTP Basic Auth. Commonly used with private Helm repositories, Harbor registries, and other traditional repository managers that implement standard HTTP authentication.	Optional: {}
`bearer` HelmRepositoryAuthBearer	Bearer specifies token-based authentication for repositories that support Bearer tokens. Used with modern container registries and repositories that implement OAuth2 or similar token-based authentication schemes.	Optional: {}
`aws` HelmRepositoryAuthAWS	Aws specifies AWS-specific authentication for Amazon ECR and other AWS-hosted repositories. Supports both static credentials and IAM role-based authentication for secure access to private repositories hosted in Amazon Web Services.	Optional: {}
`azure` HelmRepositoryAuthAzure	Azure specifies Azure-specific authentication for Azure Container Registry (ACR). Supports service principal authentication and managed identity for secure access to private repositories hosted in Microsoft Azure.	Optional: {}
`gcp` HelmRepositoryAuthGCP	Gcp specifies Google Cloud-specific authentication for Google Artifact Registry. Supports service account key authentication for secure access to private repositories hosted in Google Cloud Platform.	Optional: {}

HelmRepositoryAuthAWS

HelmRepositoryAuthAWS defines AWS-specific authentication for Amazon ECR and other AWS-hosted repositories. It supports both static credentials and IAM role assumption for flexible authentication in various AWS deployment scenarios.

Appears in:

HelmRepositoryAuth

Field	Description	Validation
`accessKey` string	AccessKey specifies the AWS access key ID for authentication. When using static credentials, this should be set along with the secret access key. For enhanced security, consider using IAM roles instead of static credentials.	Optional: {}
`secretAccessKeySecretRef` SecretReference	SecretAccessKeySecretRef references a Kubernetes Secret containing the AWS secret access key. The entire secret content will be used as the secret access key. This approach is deprecated in favor of SecretAccessKeySecretKeyRef for better secret management.	Optional: {}
`secretAccessKeySecretKeyRef` SecretKeySelector	SecretAccessKeySecretKeyRef references a specific key within a Kubernetes Secret containing the secret access key. This is the preferred method for storing AWS credentials as it allows multiple credential sets to be organized within a single secret.	Optional: {}
`assumeRoleArn` string	AssumeRoleArn specifies an AWS IAM role ARN to assume for repository access. This enables cross-account access and role-based authentication, providing enhanced security and flexibility in AWS environments.	Optional: {}

HelmRepositoryAuthAzure

HelmRepositoryAuthAzure defines Azure-specific authentication for Azure Container Registry (ACR). It supports service principal authentication which is the recommended approach for automated access to private Azure repositories.

Appears in:

HelmRepositoryAuth

Field	Description	Validation
`clientId` string	ClientID specifies the Azure service principal client ID. This is used in conjunction with the client secret to authenticate with Azure services.	Optional: {}
`clientSecretSecretRef` SecretReference	ClientSecretSecretRef references a Kubernetes Secret containing the Azure service principal client secret. The entire secret content will be used as the client secret. This approach is deprecated in favor of ClientSecretSecretKeyRef for better secret management.	Optional: {}
`clientSecretSecretKeyRef` SecretKeySelector	ClientSecretSecretKeyRef references a specific key within a Kubernetes Secret containing the client secret. This is the preferred method for storing Azure credentials as it allows proper secret organization and key-based access control.	Optional: {}
`tenantId` string	TenantID specifies the Azure Active Directory tenant ID. This identifies the Azure AD instance that contains the service principal and is required for proper authentication scope.	Optional: {}
`subscriptionId` string	SubscriptionID specifies the Azure subscription ID. This identifies the Azure subscription containing the resources and may be required for certain repository access scenarios.	Optional: {}

HelmRepositoryAuthBasic

HelmRepositoryAuthBasic defines username/password authentication for Helm repositories. This authentication method is widely supported by traditional repository managers and provides a simple way to secure access to private Helm charts.

Appears in:

HelmRepositoryAuth

Field	Description	Validation
`username` string	Username specifies the username for HTTP Basic authentication. This is typically a user account or service account name configured in the target repository system.	Required: {}
`passwordSecretRef` SecretReference	PasswordSecretRef references a Kubernetes Secret containing the password for Basic authentication. The entire secret content will be used as the password. This approach is deprecated in favor of PasswordSecretKeyRef for better secret management.	Optional: {}
`passwordSecretKeyRef` SecretKeySelector	PasswordSecretKeyRef references a specific key within a Kubernetes Secret that contains the password. This is the preferred method for password storage as it allows multiple credentials to be stored in a single secret with proper key-based access.	Optional: {}

HelmRepositoryAuthBearer

HelmRepositoryAuthBearer defines token-based authentication for Helm repositories. This authentication method is commonly used with modern container registries and repositories that implement OAuth2 or similar token-based authentication.

Appears in:

HelmRepositoryAuth

Field	Description	Default	Validation
`tokenSecretRef` SecretReference	TokenSecretRef references a Kubernetes Secret containing the bearer token. The entire secret content will be used as the authentication token. This approach is deprecated in favor of TokenSecretKeyRef for better secret management.		Optional: {}
`tokenSecretKeyRef` SecretKeySelector	TokenSecretKeyRef references a specific key within a Kubernetes Secret that contains the bearer token. This is the preferred method for token storage as it allows multiple tokens to be stored in a single secret with proper key-based access.		Optional: {}

HelmRepositoryAuthGCP

HelmRepositoryAuthGCP defines Google Cloud-specific authentication for Google Artifact Registry. It uses service account key-based authentication which is the standard approach for accessing private Google Cloud repositories from external systems.

Appears in:

HelmRepositoryAuth

Field	Description	Default	Validation
`applicationCredentialsSecretRef` SecretReference	ApplicationCredentialsSecretRef references a Kubernetes Secret containing the GCP service account key JSON. The entire secret content will be used as the service account credentials. This approach is deprecated in favor of ApplicationCredentialsSecretKeyRef for better secret management.		Optional: {}
`applicationCredentialsSecretKeyRef` SecretKeySelector	ApplicationCredentialsSecretKeyRef references a specific key within a Kubernetes Secret containing the service account JSON. This is the preferred method for storing GCP credentials as it allows multiple service account keys to be organized within a single secret with proper access control.		Optional: {}

HelmRepositorySpec

HelmRepositorySpec defines the desired state of a HelmRepository.

Appears in:

HelmRepository

Field	Description	Validation
`url` string	URL specifies the HTTP/HTTPS URL of the Helm repository. This field is immutable once set to prevent accidental changes that could break existing service deployments that depend on this repository. Supported formats include standard Helm repository URLs and OCI registry URLs.	Required: {}
`provider` HelmAuthProvider	Provider specifies the authentication provider type for this Helm repository. This determines which authentication method will be used when accessing the repository. Different providers support different authentication mechanisms optimized for their platforms.	Enum: [BASIC BEARER GCP AZURE AWS] Type: string
`auth` HelmRepositoryAuth	Auth contains the authentication configuration for accessing the Helm repository. The specific authentication method used depends on the Provider field. Only one authentication method should be configured per repository.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

HttpProxyConfiguration

Appears in:

Field	Description	Default	Validation
`enabled` boolean	Enabled controls whether this proxy is used. It defaults to true.	true	Optional: {}
`url` string	The url of your HTTP proxy.		Required: {}
`noproxy` string	The comma-separated list of hosts that should not be proxied, will behave equivalently to a NOPROXY env var.		Optional: {}

InfrastructureStack

InfrastructureStack provides a scalable framework to manage infrastructure as code with a K8s-friendly, API-driven approach. It declaratively defines a stack with a type, Git repository location, and target cluster for execution. On each commit to the tracked repository, a run is created which the Plural deployment operator detects and executes on the targeted cluster, enabling fine-grained permissions and network location control for IaC runs.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`InfrastructureStack`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` InfrastructureStackSpec

InfrastructureStackSpec

InfrastructureStackSpec defines the desired state of the InfrastructureStack.

Appears in:

InfrastructureStack

Field	Description	Validation
`name` string	Name of this stack. If not provided, the name from InfrastructureStack.ObjectMeta will be used.	Optional: {}
`type` StackType	Type specifies the IaC tool to use for executing the stack. One of TERRAFORM, TERRAGRUNT, PULUMI, ANSIBLE, CUSTOM.	Enum: [TERRAFORM TERRAGRUNT PULUMI ANSIBLE CUSTOM] Required: {}
`interval` string	Interval specifies the interval at which the stack will be reconciled, default is 5m	Optional: {}
`repositoryRef` ObjectReference	RepositoryRef references the GitRepository containing the IaC source code. Leave empty to use git:url instead.	Optional: {}
`clusterRef` ObjectReference	ClusterRef references the target Cluster where this stack will be executed.	Optional: {}
`cluster` string	Cluster is the handle of the target Cluster where this service will be deployed. Leave it empty to use the clusterRef field instead.	Optional: {}
`projectRef` ObjectReference	ProjectRef references a project this stack belongs to. If not provided, it will use the default project.	Optional: {}
`git` GitRef	Git contains reference within the repository where the IaC manifests are located.
`manageState` boolean	ManageState indicates whether Plural should manage the Terraform state of this stack.	Optional: {}
`workdir` string	Workdir specifies the working directory within the Git repository to execute commands in. It is useful for projects with external modules or nested folder structures.	Optional: {}
`jobSpec` JobSpec	JobSpec contains an optional configuration for the job that will apply this stack.	Optional: {}
`configuration` StackConfiguration	Configuration specifies version/image config for the IaC tool being used.	Optional: {}
`cron` StackCron	Cron configuration for automated, scheduled generation of stack runs.	Optional: {}
`approval` boolean	Approval when set to true, requires human approval before Terraform apply triggers, ensuring verification of the plan to reduce misconfiguration risk.	Optional: {}
`bindings` Bindings	Bindings contain read and write policies of this stack.	Optional: {}
`environment` StackEnvironment array	Environment variables to inject into the stack execution environment.	Optional: {}
`files` StackFile array	Files to mount from Secrets into the stack execution environment, commonly used for cloud credentials (though IRSA/Workload Identity is preferred).	Optional: {}
`detach` boolean	Detach indicates whether to detach the stack on deletion instead of destroying it. This leaves all cloud resources in place.	Optional: {}
`actor` string	Actor is a user email to use for default Plural authentication in this stack.	Optional: {}
`scmConnectionRef` ObjectReference		Optional: {}
`stackDefinitionRef` ObjectReference		Optional: {}
`observableMetrics` ObservableMetric array	ObservableMetrics is a list of metrics to poll to determine if a stack run should be canceled.	Optional: {}
`tags` object (keys:string, values:string)	Tags represent a set of key-value pairs that can be used to filter stacks.	Optional: {}
`variables` RawExtension	Variables represent a file with variables in the stack run environment. It will be automatically passed to the specific tool depending on the stack Type (except [console.StackTypeCustom]).	Optional: {}
`policyEngine` PolicyEngine	PolicyEngine is a configuration for applying policy enforcement to a stack.	Optional: {}
`agentId` string	AgentId represents agent session ID that created this stack. It is used for UI linking and otherwise ignored.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

JobSpec

JobSpec defines a Kubernetes Job to execute as part of a JOB gate, allowing inline job definition with containers, resources, and Kubernetes-native configurations.

Appears in:

Field	Description	Validation
`namespace` string	Namespace where the job will be executed.	Required: {} Type: string
`containers` Container array	Containers to run as part of the job, such as test runners or validation scripts.	Optional: {}
`labels` object (keys:string, values:string)	Labels to apply to the job for organization and selection.	Optional: {}
`annotations` object (keys:string, values:string)	Annotations to apply to the job for additional metadata.	Optional: {}
`nodeSelector` object (keys:string, values:string)	NodeSelector to apply to the job for scheduling.	Optional: {}
`tolerations` Toleration array	Tolerations to apply to the job for scheduling.	Optional: {}
`serviceAccount` string	ServiceAccount to use for the job execution.	Optional: {} Type: string
`raw` JobSpec	Raw allows defining the job using a full Kubernetes JobSpec manifest instead of the simplified container-based approach.	Optional: {}
`resources` ContainerResources	Resources specification that overrides implicit container resources when containers are not directly configured.	Optional: {}

LoggingSettings

Appears in:

DeploymentSettingsSpec

Field	Description	Default	Validation
`enabled` boolean	Enabled defines whether to enable the logging integration or not.		Optional: {}
`driver` LogDriver	Driver is the type of log aggregation solution you wish to use.	VICTORIA	Enum: [VICTORIA ELASTIC OPENSEARCH LOKI] Optional: {}
`victoria` HTTPConnection	Victoria configures a connection to VictoriaMetrics		Optional: {}
`elastic` ElasticsearchConnection	Elastic configures a connection to elasticsearch		Optional: {}
`opensearch` OpensearchConnection	Opensearch configures a connection to opensearch		Optional: {}
`loki` LokiConnection	Loki configures a connection to grafana loki		Optional: {}

LokiConnection

Appears in:

LoggingSettings

Field	Description	Validation
`host` string	Host is the host to connect to.	Required: {}
`user` string	User to connect with basic auth.	Optional: {}
`password` string	Password to connect w/ for basic auth.	Optional: {}
`passwordSecretRef` SecretKeySelector	PasswordSecretRef is a reference to a secret containing the password to connect with basic auth.	Optional: {}
`clusterLabel` string	ClusterLabel is the stream label identifying the cluster a log came from. Defaults to "cluster".	Optional: {} Pattern: `^[a-zA-Z_][a-zA-Z0-9_]*$`
`namespaceLabel` string	NamespaceLabel is the stream label identifying the namespace a log came from. Defaults to "namespace".	Optional: {} Pattern: `^[a-zA-Z_][a-zA-Z0-9_]*$`

MCPServer

MCPServer represents a Model Context Protocol server for AI tool integration within the Plural Console environment. MCP servers enable large language models to execute functions, access external APIs, and interact with various systems.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`MCPServer`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` MCPServerSpec

MCPServerAuthentication

MCPServerAuthentication defines the authentication configuration for an MCP server. It supports multiple authentication methods to integrate with various systems and security requirements, from simple JWT tokens to custom header-based authentication.

Appears in:

MCPServerSpec

Field	Description	Validation
`plural` boolean	Plural enables built-in Plural JWT authentication for this MCP server. When true, the server will receive a valid Plural JWT token in requests, allowing it to authenticate and authorize operations within the Plural ecosystem.	Optional: {}
`oauth` OAuth2TokenExchange	OAuth configures client credentials token exchange for requests to this server.	Optional: {}
`headers` object (keys:string, values:string)	Headers specify custom HTTP headers required for authentication with this MCP server. This allows integration with servers that use API keys, bearer tokens, or other header-based authentication schemes. Common examples include "Authorization", "X-API-Key", or custom authentication headers.	Optional: {}

MCPServerSpec

MCPServerSpec defines the desired state of an MCP (Model Context Protocol) server.

Appears in:

MCPServer

Field	Description	Default	Validation
`name` string	Name specifies the name for this MCP server. If not provided, the name from the resource metadata will be used. This name is used for identification and referencing in AI workflows.		Optional: {}
`protocol` McpServerProtocol	Protocol specifies the MCP transport protocol. Only STREAMABLE_HTTP is supported and it is the default when omitted. SSE is no longer supported and will fail to synchronize.	STREAMABLE_HTTP	Enum: [SSE STREAMABLE_HTTP] Optional: {}
`url` string	URL is the HTTP endpoint where the MCP server is hosted. This must be a valid HTTP or HTTPS URL that the AI system can reach to execute tool calls and interact with the server's capabilities.		Required: {}
`bindings` Bindings	Bindings define the read and write access policies for this MCP server. These control which users and groups can view, modify, or execute tools provided by this server, enabling fine-grained access control.		Optional: {}
`authentication` MCPServerAuthentication	Authentication specifies the authentication configuration for accessing this MCP server. Different authentication methods are supported including built-in Plural JWT and custom HTTP headers for integration with various authentication systems.		Optional: {}
`confirm` boolean	Confirm determines whether tool calls against this server require explicit user confirmation. When true, users must approve each tool execution before it proceeds, providing an additional safety mechanism for sensitive operations. Defaults to false.		Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.		Optional: {}

ManagedNamespace

ManagedNamespace handles the creation and management of Kubernetes namespaces across multiple clusters. It provides a centralized way to define namespace specifications that should be replicated across a fleet of Kubernetes clusters.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`ManagedNamespace`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ManagedNamespaceSpec

ManagedNamespaceSpec

ManagedNamespaceSpec defines the desired state of a ManagedNamespace. It specifies how Kubernetes namespaces should be created and managed across multiple clusters, including their metadata, targeting criteria, and associated service deployments.

Appears in:

ManagedNamespace

Field	Description	Validation
`name` string	Name specifies the name of the namespace once it's placed on a cluster. If not provided, the ManagedNamespace's own name from metadata will be used.	Optional: {}
`description` string	Description provides a short description of the purpose of this namespace. This is useful for documentation and helping teams understand the namespace's role within the broader application architecture.	Optional: {}
`cascade` Cascade	Cascade specifies the deletion behavior for resources owned by this managed namespace. This controls whether namespace deletion removes associated resources from Plural Console only, target clusters only, or both.	Optional: {}
`labels` object (keys:string, values:string)	Labels define key-value pairs to be applied to the created namespaces. These labels are applied to the actual Kubernetes namespace resources and can be used for organization, monitoring, and policy enforcement.	Optional: {}
`annotations` object (keys:string, values:string)	Annotations define key-value pairs to be applied to the created namespaces. These annotations are applied to the actual Kubernetes namespace resources and are commonly used for configuration, tooling integration, and metadata.	Optional: {}
`pullSecrets` string array	PullSecrets specifies a list of image pull secrets to attach to this namespace. These secrets will be available for pulling container images within the namespace, enabling access to private container registries across all pods in the namespace.	Optional: {}
`service` ServiceTemplate	Service defines the service deployment specification to be created within this namespace. This allows for automatic deployment of applications or infrastructure components as part of the namespace provisioning process.	Optional: {}
`target` ClusterTarget	Target specifies the targeting criteria for selecting which clusters should receive this namespace. This enables flexible namespace distribution based on tags and Kubernetes distributions.	Optional: {}
`projectRef` ObjectReference	ProjectRef constrains the managed namespace scope to clusters within a specific project. This provides project-level isolation and ensures namespaces are only created on clusters belonging to the designated project.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

MetadataTemplate

Appears in:

Field	Description	Default	Validation
`name` string	Name is a short, unique human-readable name used to identify this cluster.		Required: {}
`namespace` string	Namespace specifies an optional namespace for categorizing or scoping related resources. If empty then the ClusterSync's namespace will be used.		Optional: {}

MetricsSettings

MetricsSettings holds configuration for OpenTelemetry metrics export.

Appears in:

DeploymentSettingsSpec

Field	Description	Default	Validation
`enabled` boolean	Enabled defines whether to enable the metrics export or not.	false	Optional: {}
`endpoint` string	Endpoint is the OpenTelemetry collector endpoint to send metrics to.		Optional: {}
`crontab` string	Crontab is the cron expression for how often to export metrics. Example: "/5 * * *" for every 5 minutes.		Optional: {}

Monitor

Monitor represents an observability monitor attached to a service deployment. It periodically evaluates a log or metrics query against a threshold and fires alerts when it is crossed. Optionally, it can be attached to a workbench to start an investigation when it fires.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Monitor`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` MonitorSpec	Spec defines the desired state of the Monitor.	Required: {}

MonitorFacet

MonitorFacet is a key/value facet used to further filter log queries.

Appears in:

MonitorLogQuery

Field	Description	Default	Validation
`key` string	Key is the facet key (e.g. kubernetes namespace or pod label name).		Required: {} Type: string
`value` string	Value is the facet value to match for the given key.		Required: {} Type: string

MonitorLogAzureOptions

MonitorLogAzureOptions are Azure-specific log query options.

Appears in:

MonitorLogOptions

Field	Description	Default	Validation
`resourceId` string	ResourceID is the Azure resource ID to query logs for.		Optional: {} Type: string

MonitorLogOptions

MonitorLogOptions are provider-specific log query options.

Appears in:

MonitorLogQuery

Field	Description	Default	Validation
`azure` MonitorLogAzureOptions	Azure log query options.		Optional: {}

MonitorLogQuery

MonitorLogQuery is the log query configuration for a monitor.

Appears in:

MonitorQuery

Field	Description	Default	Validation
`tool` string	Tool is the named workbench logs tool. When omitted, the native Plural logs provider is used.		Optional: {} Type: string
`query` string	Query is the log query string passed through to the underlying log provider.		MinLength: 1 Required: {} Type: string
`bucketSize` string	BucketSize is the time bucket size (e.g. 5m) used when aggregating log results.		Pattern: `^[0-9]+[dmhs]$` Required: {} Type: string
`duration` string	Duration is the lookback duration for the log query (e.g. 1h, 10m, 30s).		Optional: {} Pattern: `^[0-9]+[dmhs]$` Type: string
`operator` MonitorOperator	Operator to use when combining multiple log queries. Defaults to OR, which is also the Console API default.	OR	Enum: [OR AND] Optional: {}
`facets` MonitorFacet array	Facets are optional key/value facets applied as additional filters on the log query.		Optional: {}
`options` MonitorLogOptions	Options are provider-specific log query options.		Optional: {}

MonitorMetricsAzureOptions

MonitorMetricsAzureOptions are Azure-specific metrics query options.

Appears in:

MonitorMetricsOptions

Field	Description	Validation
`resourceId` string	ResourceID is the Azure resource ID to query metrics for.	Optional: {} Type: string
`metricsNamespace` string	MetricsNamespace is the Azure metrics namespace.	Optional: {} Type: string
`aggregation` string	Aggregation is the Azure metrics aggregation type.	Optional: {} Type: string
`filter` string	Filter is the Azure metrics filter expression.	Optional: {} Type: string
`orderBy` string	OrderBy is the Azure metrics ordering expression.	Optional: {} Type: string
`rollUpBy` string	RollUpBy is the Azure metrics dimension to roll up by.	Optional: {} Type: string
`metricsEndpoint` string	MetricsEndpoint is the Azure metrics endpoint override.	Optional: {} Type: string

MonitorMetricsOptions

MonitorMetricsOptions are provider-specific metrics query options.

Appears in:

MonitorMetricsQuery

Field	Description	Default	Validation
`azure` MonitorMetricsAzureOptions	Azure metrics query options.		Optional: {}

MonitorMetricsQuery

MonitorMetricsQuery is the metrics query configuration for a monitor.

Appears in:

MonitorQuery

Field	Description	Validation
`tool` string	Tool is the named workbench metrics tool. When omitted, the native Plural metrics provider is used.	Optional: {} Type: string
`query` string	Query is the metrics query string passed through to the underlying metrics provider.	MinLength: 1 Required: {} Type: string
`step` string	Step is the metrics query step (e.g. 5m).	Optional: {} Pattern: `^[0-9]+[dmhs]$` Type: string
`duration` string	Duration is the lookback duration for the metrics query (e.g. 1h).	Optional: {} Pattern: `^[0-9]+[dmhs]$` Type: string
`options` MonitorMetricsOptions	Options are provider-specific metrics query options.	Optional: {}

MonitorQuery

MonitorQuery is a wrapper for the underlying query definition for a monitor. Exactly one of log or metrics should be set, matching the monitor type.

Appears in:

MonitorSpec

Field	Description	Default	Validation
`log` MonitorLogQuery	Log query used when the monitor type is LOG.		Optional: {}
`metrics` MonitorMetricsQuery	Metrics query used when the monitor type is METRICS.		Optional: {}

MonitorSpec

MonitorSpec defines the desired state of a Monitor.

Appears in:

Monitor

Field	Description	Validation
`name` string	Name is the short name used to identify this monitor in the Console API. If not set, metadata.name is used.	Optional: {} Type: string
`serviceRef` LocalObjectReference	ServiceRef references the ServiceDeployment resource this monitor is attached to. The ServiceDeployment must be in the same namespace as the monitor. Either ServiceRef or Service must be set.	Optional: {}
`service` string	Service references an existing service in the Console API this monitor is attached to, in the format "cluster-handle/service-name" (e.g. mgmt/console). Use it to attach a monitor to a service that is not managed by a ServiceDeployment resource. Either ServiceRef or Service must be set.	Optional: {} Pattern: `^[^/]+/[^/]+$` Type: string
`workbenchRef` LocalObjectReference	WorkbenchRef references the Workbench this monitor is attached to. When set, the monitor can start a workbench investigation when it fires. It is required if the query uses a named workbench tool. The Workbench must be in the same namespace as the monitor.	Optional: {}
`prompt` string	Prompt is used when the monitor starts a workbench investigation.	MaxLength: 2048 Optional: {} Type: string
`modes` WorkbenchJobModes	Modes defines mode-specific options for monitor-triggered workbench jobs.	Optional: {}
`description` string	Description is an optional free-form description of what this monitor is checking.	Optional: {} Type: string
`alertTemplate` string	AlertTemplate is an optional template used when rendering alert messages for this monitor.	Optional: {} Type: string
`severity` AlertSeverity	Severity is the severity level applied to alerts generated by this monitor.	Enum: [LOW MEDIUM HIGH CRITICAL UNDEFINED] Required: {}
`type` MonitorType	Type is the monitor data type.	Enum: [LOG METRICS] Required: {}
`evaluationCron` string	EvaluationCron is the cron schedule defining when the monitor is evaluated (e.g. /5 * * *). It must be a cron expression with 5 fields (or 6 with an optional year), separated by single spaces, or one of the @yearly, @annually, @monthly, @weekly, @daily, @midnight, @hourly, @minutely, @secondly or @reboot shortcuts. Field values are validated by the Console API.	MinLength: 1 Pattern: `^(@(?i:yearly\|annually\|monthly\|weekly\|daily\|midnight\|hourly\|minutely\|secondly\|reboot)\|[^ ]+( [^ ]+)\{4,5\})$` Required: {} Type: string
`query` MonitorQuery	Query is the underlying query configuration used to fetch data for this monitor.	Required: {}
`threshold` MonitorThreshold	Threshold is the configuration that determines when the monitor should fire.	Required: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource.	Optional: {}

MonitorThreshold

MonitorThreshold is the threshold configuration used to decide when a monitor should fire.

Appears in:

MonitorSpec

Field	Description	Default	Validation
`aggregate` MonitorAggregate	Aggregate is the aggregation function applied over the result set.		Enum: [MAX MIN AVG] Required: {}
`value` string	Value is the numeric value the aggregated metric must cross to trigger the alert. It is a string to allow decimal values (e.g. "0.95").		Pattern: `^-?[0-9]+(\.[0-9]+)?$` Required: {} Type: string

NamespaceCredentials

NamespaceCredentials enables secure multi-tenancy by overriding operator credentials at the namespace level. It connects specific namespaces with credentials from a secret reference, allowing fine-grained control over resource reconciliation permissions. This prevents GitOps from becoming implicit God-mode by ensuring operators use bounded credentials for specific namespaces, supporting the principle of least privilege in enterprise fleet management scenarios.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`NamespaceCredentials`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` NamespaceCredentialsSpec		Required: {}

NamespaceCredentialsSpec

NamespaceCredentialsSpec defines the desired state of the NamespaceCredentials resource.

Appears in:

NamespaceCredentials

Field	Description	Validation
`namespaces` string array	Namespaces specifies the list of Kubernetes namespaces that will use the credentials from SecretRef during resource reconciliation, enabling namespace-level credential isolation.	Required: {}
`secretRef` SecretReference	SecretRef references a Secret containing the credentials that operators will use when reconciling resources within the specified namespaces, overriding default operator credentials.	Required: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

NamespacedName

NamespacedName is the same as types.NamespacedName with the addition of kubebuilder/json annotations for better schema support.

Appears in:

Field	Description	Default	Validation
`name` string	Name is a resource name.		Required: {}
`namespace` string	Namespace is a resource namespace.		Required: {}

NexusSettings

NexusSettings holds configuration for using the Nexus proxy

Appears in:

AISettings

Field	Description	Validation
`url` string	URL is the URL of the Nexus proxy	Required: {}
`model` string	Model to use for completions	Optional: {}
`toolModel` string	ToolModel to use for tool calling	Optional: {}
`embeddingModel` string	EmbeddingModel to use for generating embeddings	Optional: {}
`tokenSecretRef` SecretKeySelector	TokenSecretRef is a reference to the local secret holding the access token for the Nexus proxy	Optional: {}

NotificationRouter

NotificationRouter routes events from Plural Console to notification destinations. It filters events based on type, resource associations, and regex patterns, then forwards matching events to configured sinks like Slack, Teams, or in-app notifications. Common use cases include routing service deployment events, pipeline failures, cluster alerts, and security events to appropriate teams or channels.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`NotificationRouter`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` NotificationRouterSpec	Spec defines the desired state of the NotificationRouter, including event subscriptions, filtering criteria, and destination sink configurations.

NotificationRouterSpec

NotificationRouterSpec defines the desired state of NotificationRouter. It specifies which events to subscribe to, how to filter them, and where to route the resulting notifications.

Appears in:

NotificationRouter

Field	Description	Validation
`name` string	Name specifies the name for this notification router. If not provided, the name from the resource metadata will be used.	Optional: {}
`events` string array	Events define the list of event types this router should subscribe to. Use "*" to subscribe to all events, or specify specific event names to filter for particular types of notifications. Event names are: alert.fired, alert.resolved, service.update, stack.run, stack.pending, pipeline.update, pr.close, service.insight, cluster.insight, stack.insight, cluster.insight, service.insight, stack.insight, alert.insight	Optional: {}
`filters` RouterFilters array	Filters define criteria for selectively routing events. These filters control which events trigger notifications, allowing teams to focus on relevant events. Multiple filters can be combined.	Optional: {}
`sinks` ObjectReference array	Sinks specify the notification destinations where filtered events should be delivered. Each sink represents a configured notification channel such as Slack webhooks, Microsoft Teams channels, or in-app notification systems. Events matching the router's criteria will be formatted and sent to all configured sinks. It is a reference to the NotificationSink resource.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

NotificationSink

NotificationSink defines notification delivery destinations for events routed by NotificationRouter. It represents the actual channels where notifications are sent, such as Slack webhooks, Microsoft Teams channels, or in-app notifications. NotificationSinks are referenced by NotificationRouter resources to determine where filtered events should be delivered.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`NotificationSink`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` NotificationSinkSpec	Spec defines the desired state of the NotificationSink, including the sink type, destination configuration, and delivery settings.

NotificationSinkSpec

NotificationSinkSpec defines the desired state of NotificationSink. It specifies the type of notification channel, destination configuration, and delivery preferences for events routed to this sink.

Appears in:

NotificationSink

Field	Description	Validation
`name` string	Name specifies the name for this notification sink. If not provided, the name from the resource metadata will be used. // +kubebuilder:validation:Optional
`type` SinkType	Type specifies the channel type of this sink. Determines which configuration section will be used and how notifications are delivered. SLACK and TEAMS require webhook URLs, while PLURAL delivers in-app notifications.	Enum: [SLACK TEAMS PLURAL] Required: {}
`configuration` SinkConfiguration	Configuration contains the type-specific settings for this notification sink. Only one configuration section should be populated based on the Type field. Each type has different requirements for delivery setup and authentication.	Optional: {}
`bindings` Binding array	Bindings define the users and groups who can receive notifications through this sink. This is only applicable for PLURAL type sinks that deliver in-app notifications. For external sinks like Slack or Teams, notifications are sent to the configured webhook.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

OAuth2TokenExchange

OAuth2TokenExchange configures OAuth2 client credentials token endpoint exchange.

Appears in:

Field	Description	Default	Validation
`enabled` boolean	Enabled turns token exchange on for obtaining access tokens via the configured token endpoint.		Optional: {}
`type` OauthTokenExchangeType	Type selects client secret or signed JWT client assertion authentication.	CLIENT_SECRET	Enum: [CLIENT_SECRET CLIENT_ASSERTION] Optional: {}
`tokenUrl` string	TokenURL is the OAuth2 token endpoint URL.		Optional: {}
`clientId` string	ClientID is the OAuth2 client identifier.		Optional: {}
`clientSecretSecretRef` SecretKeySelector	ClientSecretSecretRef is a reference to a Kubernetes secret key holding the OAuth2 client secret.		Optional: {}
`privateKeySecretRef` SecretKeySelector	PrivateKeySecretRef references a PEM-encoded RSA private key used to sign client assertions.		Optional: {}
`keyId` string	KeyID is added to the signed JWT header as kid when configured.		Optional: {}
`audience` string	Audience overrides the JWT aud claim. It defaults to tokenUrl.		Optional: {}
`resource` string	Resource is the OAuth resource parameter requested from the token endpoint.		Optional: {}
`scopes` string array	Scopes are sent as a space-separated OAuth scope parameter.		Optional: {}

OIDCProvider

OIDCProvider configures OpenID Connect (OIDC) authentication for external applications and services. It enables third-party applications to authenticate users through the Plural Console using the standard OIDC protocol. This is useful for integrating external tools, dashboards, or custom applications with Plural's authentication system while maintaining centralized user management and access control. Common use cases include connecting monitoring dashboards, CI/CD tools, or custom applications that need to authenticate users against the Plural Console's user directory.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`OIDCProvider`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` OIDCProviderSpec	Spec defines the desired state of the OIDCProvider, including authentication settings, redirect URIs, and credential management for OIDC client configuration.

OIDCProviderSpec

OIDCProviderSpec defines the desired state of OIDCProvider. It specifies the OIDC client configuration including redirect URIs, authentication methods, and credential storage for enabling third-party applications to authenticate with Plural Console.

Appears in:

OIDCProvider

Field	Description	Validation
`name` string	Name specifies the name for this OIDC provider. If not provided, the name from the resource metadata will be used.	Optional: {}
`description` string	Description provides a human-readable description of this OIDC provider. This helps administrators understand the purpose and intended use of this OIDC client, such as which application or service it's configured for.	Optional: {}
`redirectUris` string array	RedirectUris specifies the list of allowed redirect URIs for this OIDC client. These URIs define where the authorization server can redirect users after authentication. Each URI must be an exact match to be considered valid during the OIDC flow. Common patterns include application callback URLs or localhost URLs for development.	Optional: {}
`credentialsSecretRef` LocalObjectReference	CredentialsSecretRef references a Kubernetes Secret that will contain the generated OIDC client credentials. Once the OIDCProvider is successfully created in the Console API, this secret will be populated with the client ID and client secret needed for OIDC authentication flows. The secret will contain two keys: 'clientId' and 'clientSecret'.	Required: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

ObjectKeyReference

ObjectKeyReference is a reference to an object in a specific namespace. It is used to reference objects like secrets, configmaps, etc.

Appears in:

Field	Description	Validation
`name` string	Name is unique within a namespace to reference a resource.	Required: {}
`namespace` string	Namespace defines the space within which the resource name must be unique.	Required: {}
`key` string	Key is the key of the object to use.	Required: {}

ObjectReferenceTemplate

Appears in:

SpecTemplate

Field	Description	Default	Validation
`name` string	Name is a short, unique human-readable name used to identify this cluster.		Required: {}
`namespace` string	Namespace specifies an optional namespace for categorizing or scoping related resources. If empty then the ClusterSync's namespace will be used.		Optional: {}

ObservabilityProvider

ObservabilityProvider configures external monitoring and observability platforms for use with Plural Console. It enables integration with services like Datadog and New Relic to provide enhanced monitoring capabilities for infrastructure stacks and service deployments. The provider can be used by InfrastructureStack resources to monitor metrics and determine if operations should be cancelled based on system health indicators. Common use cases include monitoring deployment health or tracking infrastructure performance metrics.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`ObservabilityProvider`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ObservabilityProviderSpec	Spec defines the desired state of the ObservabilityProvider, including the provider type and authentication credentials needed to connect to the external monitoring service.	Required: {}

ObservabilityProviderCredentials

ObservabilityProviderCredentials defines the authentication credentials for different observability providers. Only one provider's credentials should be specified, matching the Type field in the ObservabilityProviderSpec. Each provider has different authentication requirements and API key formats.

Appears in:

ObservabilityProviderSpec

Field	Description	Default	Validation
`datadog` SecretReference	Datadog specifies a reference to a Kubernetes Secret containing Datadog API credentials. The referenced secret must contain two keys: - 'apiKey': Your Datadog API key for authentication - 'appKey': Your Datadog application key for extended API access These keys are obtained from your Datadog account's API settings.		Optional: {}
`newrelic` SecretReference	Newrelic specifies a reference to a Kubernetes Secret containing New Relic API credentials. The referenced secret must contain one key: - 'apiKey': Your New Relic API key for authentication and data access This key is obtained from your New Relic account's API settings.		Optional: {}

ObservabilityProviderSpec

ObservabilityProviderSpec defines the desired state of ObservabilityProvider. It specifies the type of monitoring service and the credentials needed to authenticate and establish connections with external observability platforms.

Appears in:

ObservabilityProvider

Field	Description	Validation
`name` string	Name specifies the name for this observability provider. If not provided, the name from the resource metadata will be used.	Optional: {}
`type` ObservabilityProviderType	Type specifies the observability platform this provider connects to. Currently supported providers include Datadog for comprehensive monitoring and alerting, and New Relic for application performance monitoring and infrastructure insights.	Enum: [DATADOG NEWRELIC] Required: {}
`credentials` ObservabilityProviderCredentials	Credentials contains the authentication information needed to connect to the observability provider. The specific credential format depends on the provider type. Each provider requires different API keys and authentication methods as specified in their respective credential specifications.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

ObservableMetric

Appears in:

InfrastructureStackSpec

Field	Description	Default	Validation
`identifier` string			Required: {}
`observabilityProviderRef` ObjectReference			Required: {}

Observer

Observer monitors external data sources and triggers automated actions when changes are detected. It polls various targets like Helm repositories, OCI registries, Git repositories, or Kubernetes add-ons on a scheduled basis and executes predefined actions when new versions or updates are discovered. Common use cases include automatically creating pull requests when new chart versions are available or triggering pipeline deployments when container images are updated.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Observer`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ObserverSpec	Spec defines the desired state of the Observer, including the polling schedule, target configuration, and actions to execute when changes are detected.

ObserverAction

ObserverAction defines an automated response to execute when the observer detects changes. Actions can create pull requests or trigger pipelines.

Appears in:

ObserverSpec

Field	Description	Default	Validation
`type` ObserverActionType	Type specifies the kind of action to perform when changes are detected. PIPELINE actions trigger pipeline context updates, while PR actions create pull requests using PR automation templates with the discovered values.		Enum: [PIPELINE PR AGENT] Required: {} Type: string
`configuration` ObserverConfiguration	Configuration contains the specific settings for this action type. The structure depends on the Type field - PR actions use PR configuration, while PIPELINE actions use pipeline configuration.		Required: {}

ObserverAddOn

ObserverAddOn defines configuration for monitoring Kubernetes add-on versions. This allows observing when new versions of Kubernetes add-ons are available, enabling automated updates while ensuring compatibility with specific Kubernetes versions.

Appears in:

ObserverTarget

Field	Description	Validation
`name` string	Name specifies the add-on to monitor for new versions. This should match the add-on name as known to the monitoring system.	Required: {}
`kubernetesVersion` string	KubernetesVersion specifies the Kubernetes version for compatibility checking. The observer will only consider add-on versions that are compatible with this Kubernetes version. This helps ensure that suggested updates will work with your cluster.	Optional: {}
`kubernetesVersions` string array	KubernetesVersions specifies multiple Kubernetes versions for compatibility checking. Useful when managing clusters with different Kubernetes versions or during upgrade periods. The observer will only suggest add-on versions compatible with all specified versions.	Optional: {}

ObserverAgentAction

Appears in:

ObserverConfiguration

Field	Description	Validation
`runtime` string	Runtime specifies the runtime to use for the agent run.	Required: {}
`prompt` string	Prompt specifies the prompt to give the agent to explain how to handle the observed value.	Required: {}
`repository` string	Repository specifies the repository to use for the agent run.	Required: {}
`cluster` string	Cluster references the cluster handle associated with the agent runtime, used to uniquely identify the runtime if needed.

ObserverConfiguration

ObserverConfiguration contains type-specific configuration for observer actions. Only one configuration section should be populated based on the action type. This allows for different action types to have their own specialized settings.

Appears in:

ObserverAction

Field	Description	Validation
`pr` ObserverPrAction	Pr contains configuration for pull request actions. Used when the action type is PR to automatically create pull requests when new versions are detected by the observer.	Optional: {}
`pipeline` ObserverPipelineAction	Pipeline contains configuration for pipeline actions. Used when the action type is PIPELINE to trigger pipeline context updates when new versions are detected by the observer.	Optional: {}
`agent` ObserverAgentAction	Agent contains configuration for agent actions. Used when the action type is AGENT to execute coding agent runs when new versions are detected by the observer.	Optional: {}

ObserverGit

ObserverGit defines configuration for monitoring Git repository tags. This allows observing when new tags are created in a Git repository, typically used for monitoring application releases or infrastructure updates.

Appears in:

ObserverTarget

Field	Description	Validation
`gitRepositoryRef` ObjectReference	GitRepositoryRef references the Git repository resource to monitor. The repository must be configured in Plural Console with appropriate access credentials.	Required: {}
`type` ObserverGitTargetType	Type specifies what Git resources to monitor within the repository. Currently only TAGS is supported, which monitors for new Git tags.	Enum: [TAGS] Required: {} Type: string
`filter` ObserverGitFilter	Filter specifies a regex to filter the git repository tags for the observed value.	Optional: {}

ObserverGitFilter

Appears in:

ObserverGit

Field	Description	Default	Validation
`regex` string	Regex specifies a regex to filter the git repository tags for the observed value. Useful if you want to filter out tags within a larger monorepo or across multiple channels, eg: prod-1.2.3 vs. dev-1.2.3		Optional: {}

ObserverHelm

ObserverHelm defines configuration for monitoring Helm chart repositories. This allows observing when new chart versions are published to Helm repositories, enabling automated updates when application or infrastructure charts are updated.

Appears in:

ObserverTarget

Field	Description	Validation
`url` string	URL specifies the Helm repository URL to monitor. This should be a valid Helm repository URL that contains the chart index. The URL is immutable once set to ensure consistent monitoring.	Required: {}
`chart` string	Chart specifies the name of the chart within the repository to monitor. The observer will check for new versions of this specific chart.	Required: {}
`provider` HelmAuthProvider	Provider specifies the authentication provider type for the Helm repository. Different providers support different authentication mechanisms optimized for their platforms.	Enum: [BASIC BEARER GCP AZURE AWS] Optional: {} Type: string
`auth` HelmRepositoryAuth	Auth contains authentication credentials for accessing the Helm repository. Required for private repositories, the format depends on the Provider type.	Optional: {}

ObserverOci

ObserverOci defines configuration for monitoring OCI (container) registries. This allows observing when new container images or OCI artifacts are published, enabling automated updates when application images or infrastructure artifacts are updated.

Appears in:

ObserverTarget

Field	Description	Validation
`url` string	URL specifies the OCI registry URL to monitor. This should include the full path to the specific repository or artifact. The URL is immutable once set to ensure consistent monitoring.	Required: {}
`provider` HelmAuthProvider	Provider specifies the authentication provider type for the OCI registry. Different providers support different authentication mechanisms optimized for their platforms.	Enum: [BASIC BEARER GCP AZURE AWS] Optional: {} Type: string
`auth` HelmRepositoryAuth	Auth contains authentication credentials for accessing the OCI registry. Required for private registries, the format depends on the Provider type.	Optional: {}

ObserverPipelineAction

ObserverPipelineAction defines configuration for triggering pipeline context updates. When the observer detects new versions, it can update pipeline contexts to trigger deployments or other pipeline-driven workflows with the new values.

Appears in:

ObserverConfiguration

Field	Description	Default	Validation
`pipelineRef` ObjectReference	PipelineRef references the pipeline to update when changes are detected. The pipeline will receive a new context with the observed value, potentially triggering deployment workflows or other pipeline stages.		Required: {}
`context` RawExtension	Context is a templated context that becomes the pipeline context. Use $value to interpolate the observed value into the context data. This context is applied to the pipeline to trigger appropriate actions.		Optional: {}

ObserverPrAction

ObserverPrAction defines configuration for automatically creating pull requests. When the observer detects new versions, it can generate pull requests using PR automation templates with the discovered values interpolated into the context.

Appears in:

ObserverConfiguration

Field	Description	Validation
`prAutomationRef` ObjectReference	PrAutomationRef references the PR automation template to use for generating pull requests. The automation template defines the repository, branch pattern, and file modifications to apply when creating the pull request.	Optional: {}
`ai` ObserverPrAiAction	Ai contains configuration for AI assistance in this PR automation.	Optional: {}
`repository` string	Repository overrides the repository slug for the referenced PR automation. Use this when you want to target a different repository than the one configured in the PR automation template.	Optional: {}
`branchTemplate` string	BranchTemplate provides a template for generating branch names. Use $value to inject the observed value into the branch name. Example: "update-chart-to-$value" becomes "update-chart-to-1.2.3".	Optional: {}
`context` RawExtension	Context is a templated context that becomes the input for the PR automation. Use $value to interpolate the observed value into the context data. This context is passed to the PR automation for template rendering and file modifications.	Optional: {}
`actor` string	Actor specifies the actor to use for the created branch. Should be a user email in Plural.	Optional: {}

ObserverPrAiAction

Appears in:

ObserverPrAction

Field	Description	Default	Validation
`enabled` boolean	Whether AI assistance is enabled for this automation.		Optional: {}
`prompt` string	The prompt to use to guide the AI code change for this PR.		Required: {}

ObserverRenovate

ObserverRenovate defines Renovate regex versioning options for observer target ordering.

Appears in:

ObserverTarget

Field	Description	Default	Validation
`ignoreUnstable` boolean	IgnoreUnstable skips prerelease values captured by the target format regex.		Optional: {}

ObserverSpec

ObserverSpec defines the desired state of Observer. It specifies what external source to monitor, when to poll it, and what actions to take when changes are detected, enabling automated workflows based on external updates.

Appears in:

Observer

Field	Description	Validation
`name` string	Name specifies the name for this observer. If not provided, the name from the resource metadata will be used. This name is used for identification and logging purposes.	Optional: {}
`crontab` string	Crontab defines the polling schedule using standard cron syntax. This determines how frequently the observer checks the target for updates. Examples: "0 /6 * " (every 6 hours), "/15 * * * *" (every 15 minutes).	Required: {}
`initial` string	Initial sets the baseline value for this observer to prevent duplicate actions on startup. When specified, the observer will only trigger actions for values that are newer than this initial value. This prevents unnecessary actions when the observer is first created or restarted.	Optional: {}
`target` ObserverTarget	Target specifies the external source to monitor for changes. This defines what type of resource to poll (Helm chart, OCI image, Git tags, etc.) and the specific configuration needed to access that resource.	Required: {}
`actions` ObserverAction array	Actions define the automated responses to execute when new values are detected. Each action specifies what should happen when the observer discovers an update, such as creating pull requests or triggering pipeline deployments.	Optional: {}
`projectRef` ObjectReference	ProjectRef references the project this observer belongs to. If not provided, the observer will use the default project. This helps organize observers and control access permissions.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

ObserverTarget

ObserverTarget defines the external source to monitor for changes. It specifies what type of resource to poll and how to interpret the results, supporting various sources like Helm repositories, OCI registries, and Git repositories.

Appears in:

ObserverSpec

Field	Description	Validation
`type` ObserverTargetType	Type specifies the kind of external source to monitor. Each type has different configuration requirements and polling mechanisms. Supported types include Helm charts, OCI images, Git tags, and Kubernetes add-ons.	Enum: [OCI HELM GIT ADDON EKS_ADDON] Required: {} Type: string
`format` string	Format is a regex pattern with a capture group for extracting version information. Useful when version strings are embedded in larger release names or tags. The first capture group is used as the version value. Example: "app-v([0-9]+.[0-9]+.[0-9]+)" extracts "1.2.3" from "app-v1.2.3".	Optional: {}
`order` ObserverTargetOrder	Order determines how discovered versions are sorted and which one is selected. SEMVER sorts by semantic version rules, LATEST uses chronological ordering, and RENOVATE uses regex capture groups with Renovate-style version comparison.	Enum: [SEMVER LATEST RENOVATE] Required: {} Type: string
`renovate` ObserverRenovate	Renovate contains options for RENOVATE target ordering. Used when Order is RENOVATE to control prerelease filtering and related behavior.	Optional: {}
`helm` ObserverHelm	Helm contains configuration for monitoring Helm chart repositories. Used when Type is HELM to specify the repository URL, chart name, and authentication.	Optional: {}
`oci` ObserverOci	OCI contains configuration for monitoring OCI (container) registries. Used when Type is OCI to specify the registry URL and authentication credentials.	Optional: {}
`git` ObserverGit	Git contains configuration for monitoring Git repository tags. Used when Type is GIT to specify which Git repository to monitor for new tags.	Optional: {}
`addon` ObserverAddOn	AddOn contains configuration for monitoring Plural add-on versions. Used when Type is ADDON to specify which Kubernetes add-on to monitor for updates.	Optional: {}
`eksAddon` ObserverAddOn	EksAddOn contains configuration for monitoring AWS EKS add-on versions. Used when Type is EKS_ADDON to specify which EKS add-on to monitor for updates.	Optional: {}

OllamaSettings

OllamaSettings for configuring a self-hosted Ollama LLM, more details at https://github.com/ollama/ollama

Appears in:

AISettings

Field	Description	Validation
`proxy` HttpProxyConfiguration	Proxy configures an HTTP proxy for this provider's API calls.	Optional: {}
`url` string	URL is the url this model is queryable on	Required: {}
`model` string	Model is the Ollama model to use when querying the /chat api	Required: {}
`toolModel` string	ToolModel to use for tool calling, which is less frequent and often requires more advanced reasoning	Optional: {}
`tokenSecretRef` SecretKeySelector	AuthorizationSecretRef is a reference to the local secret holding the contents of a HTTP Authorization header to send to your ollama api in case authorization is required (eg for an instance hosted on a public network)	Optional: {}

OpenAISettings

Appears in:

AISettings

Field	Description	Validation
`proxy` HttpProxyConfiguration	Proxy configures an HTTP proxy for this provider's API calls.	Optional: {}
`model` string	Model is the LLM model name to use.	Optional: {}
`toolModel` string	ToolModel to use for tool calling, which is less frequent and often requires more advanced reasoning	Optional: {}
`embeddingModel` string	EmbeddingModel to use for generating embeddings	Optional: {}
`proxyModels` string array	ProxyModels are additional models to support within our integrated ai proxy.	Optional: {}
`baseUrl` string	BaseUrl is a custom base url to use, for reimplementations of the same API scheme (for instance Together.ai uses the OpenAI API spec). Should be similar to https://api.openai.com/v1	Optional: {}
`tokenExchange` OAuth2TokenExchange	TokenExchange configures OAuth2 client credentials against a token endpoint to obtain access tokens for OpenAI-compatible APIs.	Optional: {}
`headers` HTTPHeader array	Headers are custom HTTP headers to include in OpenAI-compatible API requests.	Optional: {}
`method` OpenAiMethod	Method to use for openai api calls (defaults to auto, but can be used to restrict to only responses or chart completions apis, useful for configuring against common AI proxies)	Enum: [CHAT RESPONSES AUTO] Optional: {}
`tokenSecretRef` SecretKeySelector	TokenSecretRef is a reference to the local secret holding the token to access the configured AI provider.	Required: {}

OpensearchConnection

Appears in:

LoggingSettings

Field	Description	Validation
`host` string	Host is the opensearch host to connect to.	Required: {}
`index` string	Index to query in opensearch.	Optional: {}
`awsAccessKeyId` string	AWS Access Key ID to use, can also use IRSA to acquire credentials.	Optional: {}
`awsSecretAccessKeySecretRef` SecretKeySelector	AWS Secret Access Key to use, can also use IRSA to acquire credentials.	Optional: {}
`awsRegion` string	AWS Region to use.	Optional: {}
`usePodIdentity` boolean	UsePodIdentity enables Workload Identity for AWS authentication instead of static credentials. When enabled, the controller will use the default AWS credential chain which supports EKS Pod Identity or instance metadata credentials.	Optional: {}

OpensearchConnectionSettings

Appears in:

VectorStore

Field	Description	Validation
`host` string	Host is the host of the opensearch cluster.	Required: {}
`index` string	Index is the index of the opensearch cluster.	Required: {}
`awsAccessKeyId` string	AWSAccessKeyID is the AWS Access Key ID to use, can also use IRSA to acquire credentials.	Optional: {}
`awsSecretAccessKeyRef` SecretKeySelector	AWSSecretAccessKeyRef is a reference to the local secret holding the AWS Secret Access Key to use, can also use IRSA to acquire credentials.	Optional: {}
`awsRegion` string	AwsRegion is the AWS region to use, defaults to us-east-1	Optional: {}

Persona

Persona defines role-based UI configurations for different types of users in Plural Console. It allows customizing the user interface based on user roles such as platform engineers, developers, security teams, or management. Each persona controls which features and sections of the Console are visible and accessible to users assigned to it. This enables organizations to provide tailored experiences that match different user responsibilities and reduce interface complexity for specific roles. Common use cases include hiding infrastructure details from developers or providing simplified dashboards for management oversight.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Persona`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` PersonaSpec	Spec defines the desired state of the Persona, including role configuration, UI customizations, and group bindings for role-based access control.

PersonaAI

PersonaAI defines access controls for AI-powered features within the Console. These settings determine which AI capabilities are available to users assigned to this persona.

Appears in:

PersonaConfiguration

Field	Description	Default	Validation
`pr` boolean	PR enables AI-powered pull request generation and management features. When enabled, users can use AI assistance to create pull requests, generate code changes, and automate various development workflows through AI-powered tools.		Optional: {}

PersonaConfiguration

PersonaConfiguration defines the complete UI customization settings for a persona. These settings control which features, sections, and capabilities are visible and accessible to users assigned to this persona, enabling role-specific experiences.

Appears in:

PersonaSpec

Field	Description	Validation
`all` boolean	All enables the complete UI interface for this persona when set to true. This overrides individual feature settings and provides full access to all Console features. Useful for administrative personas that need unrestricted access to all functionality.	Optional: {}
`home` PersonaHome	Home configures the homepage layout and content for this persona. Different personas can have customized homepages that highlight the most relevant information and workflows for their specific role and responsibilities.	Optional: {}
`deployments` PersonaDeployment	Deployments controls access to deployment-related features and sections. This includes clusters, services, pipelines, and other deployment management tools. Useful for controlling which teams can view or manage different aspects of deployments.	Optional: {}
`flows` PersonaFlows	Flows controls access to flow-related features and sections. This includes workbenches, pipelines, and preview environments grouped under flows.	Optional: {}
`sidebar` PersonaSidebar	Sidebar configures which navigation items and sections are visible in the main sidebar. This allows personas to have streamlined navigation focused on their primary workflows while hiding irrelevant or restricted functionality.	Optional: {}
`services` PersonaServices	Services controls access to service-specific features and configuration options. This includes service configuration, secrets management, and other service-level operations.	Optional: {}
`settings` PersonaSettings	Settings controls which tabs are visible within the Console settings page. Tabs are visible by default and can be hidden by explicitly setting them to false.	Optional: {}
`ai` PersonaAI	AI configures access to AI-powered features and capabilities within the Console. This includes AI-assisted operations, automated suggestions, and other intelligent features.	Optional: {}

PersonaDeployment

PersonaDeployment defines access controls for deployment-related features and views. These settings determine which deployment management capabilities are visible and accessible to users assigned to this persona.

Appears in:

PersonaConfiguration

Field	Description	Validation
`clusters` boolean	Clusters enables access to cluster management features when set to true. This includes viewing cluster status, managing cluster resources, and performing cluster-level operations. Typically enabled for platform and infrastructure teams.	Optional: {}
`deployments` boolean	Deployments enables access to deployment management features when set to true. This includes viewing and managing application deployments, deployment history, and deployment-related operations across the platform.	Optional: {}
`repositories` boolean	Repositories enables access to Git repository management features when set to true. This includes configuring source repositories, managing Git credentials, and other repository-related operations for deployments.	Optional: {}
`services` boolean	Services enables access to service management features when set to true. This includes viewing service status, managing service configurations, and performing service-level operations and troubleshooting.	Optional: {}
`pipelines` boolean	Pipelines enables access to CI/CD pipeline features when set to true. This includes viewing pipeline status, managing pipeline configurations, and triggering pipeline executions for automated deployments.	Optional: {}
`providers` boolean	Providers enables access to cloud provider management features when set to true. This includes managing cloud provider credentials, configuring provider settings, and other provider-related operations for infrastructure management.	Optional: {}
`addOns` boolean	AddOns enables access to Kubernetes add-on management features when set to true. This includes installing, configuring, and managing cluster add-ons.	Optional: {}

PersonaFlows

PersonaFlows defines access controls for flow-related features and views. These settings determine which flow management capabilities are visible and accessible to users assigned to this persona.

Appears in:

PersonaConfiguration

Field	Description	Validation
`permissions` boolean	Permissions enables the permissions action in the flow header when set to true. This allows personas to manage flow permissions from the flow detail page.	Optional: {}
`startWorkbenchJob` boolean	StartWorkbenchJob enables the "Start workbench job" action in the flow header when set to true. This allows personas to launch workbench jobs directly from the flow detail page.	Optional: {}
`workbenches` boolean	Workbenches enables access to flow workbench features when set to true. This includes viewing and using workbenches associated with flows.	Optional: {}
`pipelines` boolean	Pipelines enables access to flow pipeline features when set to true. This includes viewing and managing pipelines associated with flows.	Optional: {}
`previews` boolean	Previews enables access to flow preview environment features when set to true. This includes viewing and managing preview environments associated with flows.	Optional: {}

PersonaHome

PersonaHome defines homepage customization settings for different persona roles. The homepage can be configured to emphasize different aspects of the system based on the user's primary responsibilities and information needs.

Appears in:

PersonaConfiguration

Field	Description	Default	Validation
`manager` boolean	Manager enables management-focused homepage content when set to true. This typically includes high-level dashboards, cost summaries, compliance status, and other information relevant to engineering managers and leadership roles.		Optional: {}
`security` boolean	Security enables security-focused homepage content when set to true. This includes security alerts, compliance reports, vulnerability summaries, and other security-related metrics and dashboards.		Optional: {}

PersonaServices

PersonaServices defines access controls for service-related features and operations. These settings control which service management capabilities are available to users assigned to this persona, enabling role-based access to sensitive operations.

Appears in:

PersonaConfiguration

Field	Description	Default	Validation
`secrets` boolean	Secrets enables access to service secrets management when set to true. This includes viewing, creating, and modifying secrets associated with services. Typically restricted to platform engineers and senior developers who need to manage service authentication and configuration secrets.		Optional: {}
`configuration` boolean	Configuration enables access to service configuration management when set to true. This includes modifying service deployment settings, environment variables, and other configuration parameters that affect service behavior.		Optional: {}

PersonaSettings

PersonaSettings defines the visibility of tabs on the Console settings page.

Appears in:

PersonaConfiguration

Field	Description	Default	Validation
`userManagement` boolean			Optional: {}
`global` boolean			Optional: {}
`ai` boolean			Optional: {}
`webhooks` boolean			Optional: {}
`chatbots` boolean			Optional: {}
`cloudConnections` boolean			Optional: {}
`projects` boolean			Optional: {}
`notifications` boolean			Optional: {}
`audits` boolean			Optional: {}
`accessTokens` boolean			Optional: {}

PersonaSidebar

PersonaSidebar defines which navigation items and sections are visible in the main Console sidebar. These settings allow personas to have customized navigation focused on their primary workflows while hiding irrelevant or restricted functionality from the user interface.

Appears in:

PersonaConfiguration

Field	Description	Validation
`cd` boolean	CD enables access to the Plural Continuous Deployment tab when set to true. This is the entry point for clusters, services, pipelines, and other deployment management views. Use the Deployments configuration to control the individual views within it.	Optional: {}
`audits` boolean	Audits enables access to audit logs and compliance reporting features when set to true. This includes viewing system audit trails, user activity logs, and compliance reports. Typically enabled for security teams and compliance officers.	Optional: {}
`kubernetes` boolean	Kubernetes enables access to direct Kubernetes management features when set to true. This includes raw Kubernetes resource management, kubectl-like operations, and low-level cluster administration tasks.	Optional: {}
`pullRequests` boolean	PullRequests enables access to pull request management features when set to true. This includes viewing and managing pull requests and Git-based deployment automation features.	Optional: {}
`flows` boolean	Flows enables access to the flows navigation item when set to true. This includes viewing and managing flow resources from the main sidebar.	Optional: {}
`workbenches` boolean	Workbenches enables access to the workbenches navigation item when set to true. This includes viewing and managing workbenches from the main sidebar.	Optional: {}
`settings` boolean	Settings enables access to system configuration and administrative settings when set to true. This includes user management, system configuration, integration settings, and other administrative functions. Typically restricted to administrators.	Optional: {}
`backups` boolean	Backups enables access to backup and restore management features when set to true. This includes configuring backup policies, managing backup storage, and performing restore operations for disaster recovery.	Optional: {}
`stacks` boolean	Stacks enables access to Infrastructure as Code (IaC) stack management when set to true. This includes managing Terraform stacks and other IaC automation tools for infrastructure provisioning and management.	Optional: {}
`security` boolean	Security enables access to security management features when set to true. This includes security scanning results, vulnerability management, policy enforcement, and other security-related tools and dashboards.	Optional: {}
`cost` boolean	Cost enables access to cost management and optimization features when set to true. This includes cost tracking or resource optimization recommendations.	Optional: {}
`ai` boolean	AI enables access to the Plural AI tab when set to true. This includes AI insights, chat threads, and other AI-driven investigation tools. Use the AI configuration to control individual AI capabilities within it.	Optional: {}

PersonaSpec

PersonaSpec defines the desired state of Persona. It specifies the role-based configuration, UI customizations, and access controls that define how the Console interface appears and behaves for users assigned to this persona.

Appears in:

Persona

Field	Description	Validation
`name` string	Name specifies the name for this persona. If not provided, the name from the resource metadata will be used.	Optional: {}
`description` string	Description provides a detailed explanation of this persona's purpose and intended users. This helps administrators understand which teams or roles should be assigned to this persona and what kind of experience it provides. Examples might describe responsibilities like "Platform engineers managing infrastructure" or "Developers deploying applications".	Optional: {}
`role` PersonaRole	Role defines the primary responsibility area for users assigned to this persona. This controls the default homepage layout and highlights relevant features. Different roles provide different perspectives on the same underlying data, optimized for specific workflows and responsibilities.	Optional: {}
`configuration` PersonaConfiguration	Configuration contains detailed UI customization settings for this persona. These settings are additive across multiple personas assigned to a user, allowing for flexible permission combinations while maintaining role-based defaults.	Optional: {}
`bindings` Binding array	Bindings define which users and groups are assigned to this persona. Users can be assigned to multiple personas, with permissions being additive. This enables flexible role combinations while maintaining clear base configurations.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

Pipeline

Pipeline automates Service Deployments across environments by promoting git-based changes through defined stages. It models multi-stage deployment pipelines with support for approval and job gates, offering safe, customizable delivery flows. Integrates with continuous deployment systems by enabling declarative configuration of deployment flows, including gating, promotions, and service progression.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Pipeline`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` PipelineSpec

PipelineContext

PipelineContext provides a variable context mechanism for pipelines. It stores a context map that gets passed to the pipeline to enable advanced automation workflows.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`PipelineContext`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` PipelineContextSpec

PipelineContextSpec

PipelineContextSpec defines the desired state of the PipelineContext.

Appears in:

PipelineContext

Field	Description	Validation
`pipelineRef` ObjectReference	PipelineRef references the Pipeline this context will be applied to.	Optional: {}
`context` RawExtension	Context is a templated context map that will be passed to the pipeline. This context can contain variables, configuration data, and other information needed.
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

PipelineEdge

PipelineEdge defines the flow of execution between stages, controlling promotion paths and enabling attachment of gates for additional validation and approval.

Appears in:

PipelineSpec

Field	Description	Validation
`fromId` string	FromID is stage ID the edge is from, can also be specified by name.	Optional: {} Type: string
`toId` string	ToID is stage ID the edge is to, can also be specified by name.	Optional: {} Type: string
`from` string	From is the name of the pipeline stage this edge emits from.	Optional: {} Type: string
`to` string	To is the name of the pipeline stage this edge points to.	Optional: {} Type: string
`gates` PipelineGate array	Gates are any optional promotion gates you wish to configure.	Optional: {}

PipelineGate

PipelineGate serves as a checkpoint between pipeline stages, enforcing promotion policies. Three gate types are supported: APPROVAL (human sign-off), WINDOW (time-based constraints), and JOB (custom validation jobs like tests or security scans).

Appears in:

PipelineEdge

Field	Description	Validation
`name` string	Name of this gate.	Required: {} Type: string
`type` GateType	Type of gate. One of: - APPROVAL (requires human approval) - WINDOW (time-based constraints), - JOB (runs custom validation before allowing promotion). - SENTINEL (runs a Plural Sentinel before allowing promotion).	Enum: [APPROVAL WINDOW JOB SENTINEL] Required: {}
`clusterRef` ObjectReference	ClusterRef specifies the target cluster where this gate will execute.	Optional: {}
`cluster` string	Cluster is the handle of the target Cluster where this service will be deployed. Leave it empty to use the clusterRef field instead.	Optional: {}
`sentinelRef` ObjectReference	SentinelRef specifies the sentinel to execute for the SENTINEL gate.	Optional: {}
`spec` GateSpec	Spec contains detailed configuration for complex gate types like JOB gates.	Optional: {}

PipelineSpec

PipelineSpec defines the desired state of the Pipeline.

Appears in:

Pipeline

Field	Description	Validation
`stages` PipelineStage array	Stages represent discrete steps in the deployment pipeline, such as environments (dev, staging, prod) or specific deployment phases that services progress through.
`edges` PipelineEdge array	Edges define the dependencies and flow between stages, controlling the execution order and promotion path through the pipeline.
`flowRef` ObjectReference	FlowRef provides contextual linkage to a broader application Flow this pipeline belongs within.	Optional: {}
`projectRef` ObjectReference	ProjectRef references the project this pipeline belongs to. If not provided, it will use the default project.	Optional: {}
`bindings` Bindings	Bindings contain read and write policies controlling access to this pipeline.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

PipelineStage

PipelineStage represents a logical unit within the pipeline, typically corresponding to environments (e.g., dev, staging, prod) or specific deployment phases.

Appears in:

PipelineSpec

Field	Description	Default	Validation
`name` string	Name of this stage.		Required: {} Type: string
`services` PipelineStageService array	Services deployed in this stage, including optional promotion criteria that dictate when and how services advance to subsequent stages.

PipelineStageService

PipelineStageService defines a service within a pipeline stage and its promotion rules. This enables conditional promotions, a critical part of automating production deployments safely.

Appears in:

PipelineStage

Field	Description	Default	Validation
`serviceRef` ObjectReference	ServiceRef references the ServiceDeployment being deployed at this stage.
`criteria` PipelineStageServicePromotionCriteria	Criteria defines optional promotion rules that control when and how this service is allowed to advance to the next stage.		Optional: {}

PipelineStageServicePromotionCriteria

PipelineStageServicePromotionCriteria defines actions to perform when promoting this service to the next stage, including source references and secrets to copy.

Appears in:

PipelineStageService

Field	Description	Validation
`serviceRef` ObjectReference	ServiceRef pointing to a source ServiceDeployment to promote from.	Optional: {}
`prAutomationRef` ObjectReference	PrAutomationRef pointing to a source PrAutomation to promote from.	Optional: {}
`repository` string	The repository slug the PrAutomation will use. E.g., pluralsh/console if PR is done against https://github.com/pluralsh/console.	Optional: {}
`ai` AiCriteria	AI configuration for this promotion.	Optional: {}
`connectionRef` ObjectReference	SCM connection to use for ai pr based service promotion.	Optional: {}
`secrets` string array	Secrets to copy over in a promotion.	Optional: {}

PluralSinkConfiguration

PluralSinkConfiguration defines settings for in-app notifications within Plural Console. These notifications appear in the Console interface and can be configured for priority and immediate email delivery based on urgency requirements.

Appears in:

SinkConfiguration

Field	Description	Default	Validation
`priority` NotificationPriority	Priority determines the importance level of notifications delivered through this sink. Higher priority notifications may be displayed more prominently in the Console UI and can influence notification filtering and display behavior.		Enum: [LOW MEDIUM HIGH] Optional: {}
`urgent` boolean	Urgent controls whether notifications should be immediately delivered via email. When true, notifications sent to this sink will trigger immediate SMTP delivery in addition to appearing in the Console UI, useful for critical alerts.		Optional: {}

Policy

Policy defines a reusable OPA policy that can be attached to resources via BindingPolicy. Policies contain the actual policy source text (Rego) along with metadata describing what type of resources they apply to (workbench, stack, or binding).

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Policy`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` PolicySpec	Spec reflects a Console API policy spec.	Required: {}

PolicyEngine

PolicyEngine defines configuration for applying policy enforcement to a stack.

Appears in:

InfrastructureStackSpec

Field	Description	Validation
`type` PolicyEngineType	Type of the policy engine to use with this stack. At the moment only TRIVY is supported.	Enum: [TRIVY] Required: {}
`customPolicies` boolean	CustomPolicies enables loading custom policies from the configured repository.	Optional: {}
`maxSeverity` VulnSeverity	MaxSeverity is the maximum allowed severity without failing the stack run. One of UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL, NONE.	Enum: [UNKNOWN LOW MEDIUM HIGH CRITICAL NONE] Optional: {}
`repositoryRef` ObjectReference	RepositoryRef references a GitRepository for policy configuration. Leave unset when policies live in the stack repository, or use git.url instead of this ref.	Optional: {}
`git` GitRef	Git is the ref and folder (within the policy repository or stack repository) for policy files. If git.url is set, it resolves the repository in Console (same as the stack-level git field); ref and folder are still used for the API.	Optional: {}

PolicySpec

PolicySpec defines the desired state of a Policy.

Appears in:

Policy

Field	Description	Validation
`name` string	Name is the unique policy name in the Console API. Defaults to metadata.name if not specified.	Optional: {}
`description` string	Description provides a human-readable explanation of this policy's purpose.	Optional: {}
`type` PolicyType	Type specifies what kind of resource this policy applies to. Valid values: WORKBENCH, STACK, BINDING.	Optional: {}
`policy` string	Policy contains the actual policy source text (e.g. Rego for OPA policies).	Optional: {}
`projectRef` ObjectReference	ProjectRef links this policy to a specific project. When set, the policy is scoped to that project.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

PrAutomation

PrAutomation provides a self-service mechanism for generating pull requests against IaC repositories. It enables teams to create standardized, templated PRs for common operations like cluster upgrades, service deployments, and configuration changes. Each automation defines the files to modify, the changes to make (via regex replacement, YAML overlays, or file creation), and provides a UI wizard for users to configure parameters before generating the PR.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`PrAutomation`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` PrAutomationSpec	Spec defines the desired state of the PrAutomation, including the operations to perform, target repository, and user interface configuration.	Required: {}

PrAutomationAIConfiguration

Appears in:

PrAutomationSpec

Field	Description	Default	Validation
`enabled` boolean	Enabled controls whether AI assistance is enabled for this PR automation.		Optional: {}
`prompt` string	Prompt is a custom prompt to guide AI-generated updates for this automation. Templating is supported.		Required: {}

PrAutomationBindings

PrAutomationBindings defines access control for PR automation resources.

Appears in:

PrAutomationSpec

Field	Description	Default	Validation
`create` Binding array	Create bindings.		Optional: {}
`write` Binding array	Write bindings.		Optional: {}

PrAutomationConfiguration

PrAutomationConfiguration defines a single input field in the self-service UI form.

Appears in:

Field	Description	Validation
`name` string	Name is the identifier for this configuration field, used as a template variable and as the form field name in the UI.	Required: {}
`type` ConfigurationType	Type specifies the input type for this field, determining how it's rendered in the UI and what validation is applied.	Enum: [STRING INT BOOL JSON PASSWORD ENUM CLUSTER PROJECT GROUP USER FLOW] Required: {}
`condition` Condition	Condition defines when this field should be displayed based on the values of other fields, enabling dynamic forms that adapt to user input.	Optional: {}
`default` string	Default provides a default value for this field.	Optional: {}
`documentation` string	Documentation provides help text or description for this field to guide users in providing the correct input.	Optional: {}
`longform` string	Longform provides extended documentation or detailed explanation for complex configuration fields.	Optional: {}
`displayName` string	DisplayName provides a human-readable label for this field in the UI. If not provided, the Name field is used as the display label.	Optional: {}
`optional` boolean	Optional indicates whether this field is required (false) or optional (true) for PR generation. Required fields must be filled by the user.	Optional: {}
`page` integer	Page specifies the page to use for the pr configuration in the Plural web configuration wizard	Optional: {}
`placeholder` string	Placeholder text to show in the input field to guide users on the expected format or content.	Optional: {}
`validation` PrAutomationConfigurationValidation	Validation defines additional validation rules to apply to user input before allowing PR generation.	Optional: {}
`values` string array	Values provides the list of allowed values for ENUM type fields, creating a dropdown selection in the UI.	Optional: {}

PrAutomationConfigurationValidation

PrAutomationConfigurationValidation defines validation rules for configuration field inputs.

Appears in:

PrAutomationConfiguration

Field	Description	Validation
`regex` string	A regex to match string-valued configuration items	Optional: {}
`json` boolean	Whether the string value is supposed to be json-encoded	Optional: {}
`uniqBy` PrAutomationUniqBy	How to determine uniquenss for this field	Optional: {}

PrAutomationConfirmation

PrAutomationConfirmation defines additional verification steps before PR generation.

Appears in:

PrAutomationSpec

Field	Description	Default	Validation
`text` string	Text in Markdown to explain this PR.		Optional: {}
`checklist` PrConfirmationChecklist array	Checklist to present to confirm each prerequisite is satisfied.		Optional: {}

PrAutomationCreateConfiguration

PrAutomationCreateConfiguration defines how to generate new files from templates during PR creation.

Appears in:

PrAutomationSpec

Field	Description	Default	Validation
`git` GitRef	Git location to source external files from.		Optional: {}
`templates` PrAutomationTemplate array	Template files to use to generate file content		Optional: {}

PrAutomationDeleteConfiguration

PrAutomationDeleteConfiguration specifies files and folders to delete as part of the PR operation.

Appears in:

PrAutomationSpec

Field	Description	Default	Validation
`files` string array	Individual files to delete.		Optional: {}
`folders` string array	Entire folders to delete.		Optional: {}

PrAutomationHelmVendorConfiguration

Appears in:

PrAutomationVendorConfiguration

Field	Description	Validation
`url` string	The url of the helm repository to use	Required: {}
`chart` string	The name of the chart to use	Required: {}
`version` string	The version of the chart to use	Required: {}
`destination` string	The directory destination to place the chart in	Required: {}

PrAutomationLuaConfiguration

Appears in:

PrAutomationSpec

Field	Description	Validation
`external` boolean	Whether the lua script is sourced from an external git repo bound to this automation	Optional: {}
`script` string	File of a flat script to use	Optional: {}
`folder` string	Folder with lua library code and scripts to use	Optional: {}

PrAutomationSecretConfiguration

Appears in:

PrAutomationSpec

Field	Description	Default	Validation
`cluster` string	The cluster handle that will hold this secret
`namespace` string	The k8s namespace to place the secret in
`name` string	The name of the secret
`entries` PrAutomationSecretEntry array	The entries of the secret

PrAutomationSecretEntry

Appears in:

PrAutomationSecretConfiguration

Field	Description	Validation
`name` string	The name of the secret entry
`documentation` string	The documentation of the secret entry
`autogenerate` boolean	Whether to autogenerate the secret entry	Optional: {}

PrAutomationSpec

PrAutomationSpec defines the desired state of the PrAutomation.

Appears in:

PrAutomation

Field	Description	Validation
`role` PrRole		Enum: [CLUSTER SERVICE PIPELINE UPDATE UPGRADE COST] Optional: {}
`addon` string	Addon links this automation to a specific add-on name.	Optional: {}
`branch` string	Branch specifies the base branch this PR will be created from. If not provided, defaults to the repository's main branch (usually 'main' or 'master').	Optional: {}
`icon` string	Icon provides a URL to an icon image to visually represent this automation in the user interface and catalogs.	Optional: {}
`darkIcon` string	DarkIcon provides a URL to a dark-mode variant of the icon for improved visibility in dark-themed user interfaces.	Optional: {}
`documentation` string	Documentation provides detailed explanation of what this automation does, when to use it, and any prerequisites or considerations.	Optional: {}
`identifier` string	Identifier specifies the target repository in the format "organization/repository-name" for GitHub, or equivalent formats for other SCM providers.	Optional: {}
`message` string	Message defines the commit message template that will be used in the generated PR. Can include templated variables from user input. If you're using an AI pr automation, the ai can provide this for you.	Optional: {}
`name` string	Name specifies the display name for this automation in the Console API. If not provided, defaults to the Kubernetes resource name.	Optional: {}
`title` string	Title defines the template for the pull request title. Can include variables that will be replaced with user-provided configuration values. If you're using an AI pr automation, the ai can provide this for you.	Optional: {}
`patch` boolean	Patch determines whether to generate a patch for this PR instead of creating a full pull request.	Optional: {}
`branchPrefix` string	BranchPrefix specifies a prefix to use for the branch name, will be appended with a random string for deduplication.	Optional: {}
`clusterRef` ObjectReference	ClusterRef references a specific cluster that this PR operates on.	Optional: {}
`cluster` string	Cluster is the handle of the target Cluster where this service will be deployed. Leave it empty to use the clusterRef field instead.	Optional: {}
`scmConnectionRef` ObjectReference	ScmConnectionRef references the SCM connection to use for authentication when creating pull requests.	Required: {}
`repositoryRef` ObjectReference	RepositoryRef references a Git repository resource this automation uses.	Optional: {}
`git` GitRef	Git location to source external files from. If `creates.git` is also specified, the results will be merged.	Optional: {}
`serviceRef` ObjectReference	ServiceRef references a specific service that this PR automation acts upon.	Optional: {}
`projectRef` ObjectReference	ProjectRef references the project this automation belongs to, enabling project-scoped organization and access control.	Optional: {}
`catalogRef` ObjectReference	CatalogRef references the catalog this automation belongs to for organizational purposes and discoverability in the service catalog.	Optional: {}
`bindings` PrAutomationBindings	Bindings containing read and write policies of PR automation.	Optional: {}
`configuration` PrAutomationConfiguration array	Configuration defines the self-service UI form fields that users fill out to customize the generated PR. Each field can be templated into the PR content.	Optional: {}
`secrets` PrAutomationSecretConfiguration	Configuration for setting a secret as part of this pr. This will usually be used by k8s manifests defined and is securely handled by our api with RBAC validation.	Optional: {}
`confirmation` PrAutomationConfirmation	Confirmation specifies additional verification steps or information to present to users before they can generate the PR, ensuring prerequisites are met.	Optional: {}
`creates` PrAutomationCreateConfiguration	Creates defines specifications for generating new files from templates, allowing the automation to add new configuration files to the repository.	Optional: {}
`updates` PrAutomationUpdateConfiguration	Updates specifies how to modify existing files using regex replacements or YAML overlays, enabling precise changes to infrastructure code.	Optional: {}
`deletes` PrAutomationDeleteConfiguration	Deletes specifies files and folders to remove from the repository as part of the PR, useful for cleanup or migration scenarios.	Optional: {}
`ai` PrAutomationAIConfiguration	AI configuration controls whether AI assistance is enabled for this automation and allows specifying a custom prompt to guide AI-generated updates.	Optional: {}
`lua` PrAutomationLuaConfiguration	Lua specification to source lua scripts to preprocess the PR automation.	Optional: {}
`vendor` PrAutomationVendorConfiguration	Software vendoring logic to perform in this PR	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}
`proxy` HttpProxyConfiguration	Configures usage of an HTTP proxy for all requests involving this PR automation, usually needed for the vendoring to external repositories.	Optional: {}
`labels` string array	Labels to apply to all created PRs from this pr automation	Optional: {}

PrAutomationTemplate

PrAutomationTemplate defines a single file template for creating new files in the target repository.

Appears in:

PrAutomationCreateConfiguration

Field	Description	Validation
`destination` string	The destination to write the file to	Required: {}
`external` boolean	Whether it is being sourced from an external git repository	Required: {}
`source` string	The source file to use for templating	Optional: {}
`context` RawExtension	Additional context overrides to apply to this template, will be merged into the user-provided configuration options	Optional: {}
`condition` string	Condition string that will be evaluated to determine if source files should be copied or not.	Optional: {}

PrAutomationTrigger

PrAutomationTrigger initiates the execution of a PR automation with specific parameters. This resource enables automated, event-driven, or scheduled generation of pull requests by providing configuration context and branch information to an existing PrAutomation.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`PrAutomationTrigger`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` PrAutomationTriggerSpec	Spec defines the desired state of the PrAutomationTrigger, including the target automation, branch name, and configuration context.

PrAutomationTriggerSpec

PrAutomationTriggerSpec defines the desired state of PrAutomationTrigger. A trigger executes a specific PR automation with custom configuration and branch settings, enabling programmatic and event-driven generation of pull requests for infrastructure changes.

Appears in:

PrAutomationTrigger

Field	Description	Validation
`prAutomationRef` ObjectReference	PrAutomationRef points to the source PrAutomation resource that defines the templates, operations, and target repository for the generated PR.	Optional: {}
`branch` string	Branch specifies the name of the branch that should be created for this PR against the PrAutomation's configured base branch. This allows multiple triggers to operate on the same automation without conflicts.	Required: {}
`context` RawExtension	Context provides the configuration values that will be used to template the PR content, file modifications, and metadata. This should match the configuration schema defined in the referenced PrAutomation.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

PrAutomationUniqBy

Appears in:

PrAutomationConfigurationValidation

Field	Description	Default	Validation
`scope` ValidationUniqScope			Enum: [PROJECT CLUSTER] Required: {}

PrAutomationUpdateConfiguration

PrAutomationUpdateConfiguration defines how to modify existing files in the target repository.

Appears in:

PrAutomationSpec

Field	Description	Validation
`files` string array	Files to update.	Optional: {}
`matchStrategy` MatchStrategy	MatchStrategy, see enum for behavior.	Optional: {}
`regexReplacements` RegexReplacement array	Full regex + replacement structs in case there is different behavior per regex	Optional: {}
`yamlOverlays` YamlOverlay array	Replacement via overlaying a yaml structure on an existing yaml file	Optional: {}
`regexes` string array	Regexes to apply on each file.	Optional: {}
`replaceTemplate` string	ReplaceTemplate is a template to use when replacing a regex.	Optional: {}
`yq` string	Yq (unused so far)	Optional: {}

PrAutomationVendorConfiguration

Appears in:

PrAutomationSpec

Field	Description	Default	Validation
`helm` PrAutomationHelmVendorConfiguration	Specification for vendoring a helm chart		Optional: {}

PrConfirmationChecklist

PrConfirmationChecklist represents a checkbox to render to confirm a PR prerequisite is satisfied.

Appears in:

PrAutomationConfirmation

Field	Description	Default	Validation
`label` string	The label of this checkbox

PrGovernance

PrGovernance defines governance rules and policies for pull request management within Plural Console. It enforces organizational policies, approval workflows, and compliance requirements for pull requests created through PR automations.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`PrGovernance`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` PrGovernanceSpec	Spec defines the desired state of the PrGovernance, including governance rules, webhook configurations, and SCM integration settings for pull request management.

PrGovernanceConfiguration

PrGovernanceConfiguration defines the configuration settings for PR governance enforcement. It specifies the mechanisms and integrations used to implement governance policies for pull requests managed through Plural Console automations.

Appears in:

PrGovernanceSpec

Field	Description	Default	Validation
`webhook` PrGovernanceWebhook	Webhook defines webhook integration settings for governance enforcement. This enables the governance controller to receive notifications about pull request events and respond with appropriate policy enforcement actions such as requiring additional approvals, running compliance checks, or blocking merges.		Optional: {}
`serviceNow` PrGovernanceServiceNow	ServiceNow defines ServiceNow change request integration for PR governance. When set, PRs will require a ServiceNow change request to be opened and approved before merge. The password is read from the referenced Secret.		Optional: {}

PrGovernanceServiceNow

PrGovernanceServiceNow defines ServiceNow integration for PR governance. PRs governed by this configuration will create and manage ServiceNow change requests.

Appears in:

PrGovernanceConfiguration

Field	Description	Validation
`url` string	Url is the ServiceNow instance URL (e.g. https://instance.service-now.com).	Required: {}
`changeModel` string	ChangeModel is the change request model/type (e.g. "Standard"). If empty, "Standard" is used. We currently support the built-in ILI4 models, such as Standard, Normal, and Emergency.	Optional: {}
`username` string	Username is the ServiceNow API username for authentication.	Required: {}
`passwordSecretKeyRef` SecretKeySelector	PasswordSecretKeyRef references a key in a Secret containing the ServiceNow API password. For namespaced PrGovernance the secret is read from the same namespace; for cluster-scoped PrGovernance set SecretNamespace to the namespace where the secret lives.	Required: {}
`secretNamespace` string	SecretNamespace is the namespace of the secret referenced by PasswordSecretKeyRef.	Optional: {}
`attributes` RawExtension	Attributes is optional JSON passed as additional attributes when creating change requests. Not all change attributes need to be provided, we will auto-fill basics like description, implementation plan, backout plan, test plan, etc using AI if not provided.	Optional: {}

PrGovernanceSpec

PrGovernanceSpec defines the desired state of PrGovernance. It specifies governance rules, approval workflows, and integration settings for managing pull requests created through Plural Console automations.

Appears in:

PrGovernance

Field	Description	Validation
`type` PrGovernanceType	Type specifies the type of PR governance controller to use.	Enum: [WEBHOOK SERVICE_NOW] Required: {}
`name` string	Name specifies the name for this PR governance controller. If not provided, the name from the resource metadata will be used.	Optional: {}
`connectionRef` ObjectReference	ConnectionRef references an ScmConnection to reuse its credentials for this governance controller's authentication.	Required: {}
`configuration` PrGovernanceConfiguration	Configuration contains the specific governance settings and rules to enforce on pull requests. This includes webhook configurations, approval requirements, and other policy enforcement mechanisms that control how pull requests are managed and processed.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

PrGovernanceWebhook

PrGovernanceWebhook defines webhook configuration for external governance system integration. This enables the PR governance controller to integrate with external approval systems, compliance platforms, or custom governance workflows that need to be notified about or control pull request lifecycle events.

Appears in:

PrGovernanceConfiguration

Field	Description	Default	Validation
`url` string	Url specifies the HTTP endpoint where governance webhook notifications should be sent. This URL will receive webhook payloads containing pull request information and governance context, allowing external systems to implement custom approval workflows, compliance checks, or other governance processes. The endpoint should be accessible and configured to handle the webhook payload format expected by the governance system.		Required: {}

PreviewEnvironmentTemplate

PreviewEnvironmentTemplate automates the creation of temporary preview environments for pull requests. It defines how to clone and customize existing services when pull requests are opened, enabling developers to test changes in isolated environments before merging. This is particularly useful for feature branches, bug fixes, or any changes that need validation in a running environment. Common use cases include creating preview environments for web applications, API services, or microservices where visual or functional testing is needed before code review approval.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`PreviewEnvironmentTemplate`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` PreviewEnvironmentTemplateSpec	Spec defines the desired state of the PreviewEnvironmentTemplate, including the reference service to clone, customization template, and integration settings for pull request workflows.

PreviewEnvironmentTemplateSpec

PreviewEnvironmentTemplateSpec defines the desired state of PreviewEnvironmentTemplate. It specifies how to create preview environments by cloning an existing service with customizations, enabling automated testing environments for pull requests and feature development.

Appears in:

PreviewEnvironmentTemplate

Field	Description	Validation
`name` string	Name specifies the name for this preview environment template. If not provided, the name from the resource metadata will be used.	Optional: {}
`commentTemplate` string	CommentTemplate provides a liquid template for generating custom PR comments. This template can include dynamic information about the preview environment such as URLs, deployment status, or custom instructions for reviewers. Variables from the service template and environment can be interpolated into the comment.	Optional: {}
`previewTtl` string	PreviewTTL specifies how long preview environments created from this template should live, as a Kubernetes duration (e.g. 1d, 12h, 30m). If omitted, the Console default is used.	Optional: {}
`scmConnectionRef` ObjectReference	ScmConnectionRef references the source control management connection to use for PR operations. This connection is used to post comments on pull requests with preview environment information and to trigger environment creation based on PR events.	Optional: {}
`referenceServiceRef` ObjectReference	ReferenceServiceRef specifies the existing service deployment to use as a template. This service will be cloned and customized according to the Template configuration to create preview environments. The referenced service should be a stable, working deployment that represents the base configuration for preview environments.	Required: {}
`flowRef` ObjectReference	FlowRef references the flow that owns and manages this preview environment template. The flow defines the overall workflow and permissions for creating and managing preview environments based on this template.	Required: {}
`template` ServiceTemplate	Template defines the service configuration overrides and customizations to apply when cloning the reference service for preview environments. This includes namespace changes, configuration overrides, and any other modifications needed to create isolated preview environments.	Required: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

Project

Project provides organizational segmentation and multi-tenancy capabilities within Plural Console. It serves as a unit of an organization to control permissions for sets of resources, enabling enterprise-grade fleet management while maintaining security boundaries. Projects allow resource owners to manage their domain without accessing resources outside their scope, supporting principles of least privilege and preventing credential sprawl across the entire fleet.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Project`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ProjectSpec	Spec reflects a Console API project spec.	Required: {}

ProjectSpec

ProjectSpec defines the desired state of a Project.

Appears in:

Project

Field	Description	Validation
`name` string	Name of the project.	Required: {} Type: string
`description` string	Description provides a human-readable explanation of this project's purpose and the resources it manages within the organizational hierarchy.	Optional: {} Type: string
`disableInsights` boolean	DisableInsights indicates whether to disable AI insights and vector storage for this project.	Optional: {}
`bindings` Bindings	Bindings contain read and write policies that control access to all resources within this project, enabling fine-grained permission management and multi-tenancy.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

PulumiConfiguration

Appears in:

Field	Description	Validation
`parallel` integer	Parallel is the number of resource operations to run concurrently, equivalent to the --parallel flag in pulumi preview, up, and destroy.	Optional: {}
`refresh` boolean	Refresh is whether to refresh the state of the stack, equivalent to the --refresh flag in pulumi preview, up, and destroy.	Optional: {}
`approveEmpty` boolean	ApproveEmpty is whether to auto-approve a plan if there are no changes, preventing a stack from being blocked.	Optional: {}
`stack` string	Stack is the pulumi stack name to operate on, equivalent to the --stack flag in pulumi preview, up, and destroy.	Optional: {}
`backendUrl` string	BackendUrl is an opaque URL passed to pulumi login for the state backend. When omitted, Pulumi Cloud is used. It supports self-hosted Pulumi Cloud, S3, GCS, Azure Blob, and other Pulumi-supported login URLs.	Optional: {}

Reconciliation

Reconciliation parameters for a specific resource.

Appears in:

Field	Description	Default	Validation
`driftDetection` boolean	DriftDetection enables drift detection for this resource. It is destined to detect changes made to the related resources that are not referenced with owner ref. Use with Interval to set how often drift detection runs.	true	Optional: {}
`interval` string	Interval for the drift detection mechanism. It is subject to jitter to avoid the thundering herd problem, it is calculated as a random value between 50% and 150% of the given duration.	30m	Optional: {} Type: string

RegexReplacement

RegexReplacement defines a specific find-and-replace operation using regular expressions.

Appears in:

PrAutomationUpdateConfiguration

Field	Description	Validation
`regex` string	Regex to match a substring on.	Required: {}
`file` string	File this replacement will work on.	Required: {}
`replacement` string	Replacement to be substituted for the match in the regex.	Required: {}
`templated` boolean	Templated indicates whether you want to apply templating to the regex before compiling.	Optional: {}

Renderer

Appears in:

Field	Description	Validation
`path` string	Path is the path to the renderer works under.	Required: {}
`type` RendererType	Type is the type of renderer to use.	Enum: [AUTO RAW HELM KUSTOMIZE] Required: {}
`helm` HelmMinimal	Helm is the Helm configuration to use for this renderer, use if `path` points to a helm chart and you want to override the default helm configuration.	Optional: {}

RouterFilters

RouterFilters defines filtering criteria for routing events to notification destinations. Filters can be based on regex patterns, resource associations, or combinations thereof.

Appears in:

NotificationRouterSpec

Field	Description	Validation
`regex` string	Regex specifies a regular expression pattern for filtering events based on content. This can be used to filter events by URLs, resource names, error messages, or any other textual content within the event data. Use standard regex syntax.	Optional: {}
`serviceRef` ObjectReference	ServiceRef filters events to only those associated with a specific service deployment.	Optional: {}
`clusterRef` ObjectReference	ClusterRef filters events to only those associated with a specific cluster.	Optional: {}
`cluster` string	Cluster is the handle of the target Cluster where this service will be deployed. Leave it empty to use the clusterRef field instead.	Optional: {}
`pipelineRef` ObjectReference	PipelineRef filters events to only those associated with a specific pipeline.	Optional: {}

ScmConnection

ScmConnection is a container for credentials to a scm provider. You can also reference a SCM connection created in the Plural UI via the provider + name, leaving all other fields blank.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`ScmConnection`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ScmConnectionSpec		Required: {}

ScmConnectionSpec

Appears in:

ScmConnection

Field	Description	Validation
`name` string	Name is a human-readable name of the ScmConnection.	Required: {}
`type` ScmType	Type is the name of the scm service for the ScmConnection. One of (ScmType): [GITHUB, GITLAB, AZURE_DEVOPS, BITBUCKET, BITBUCKET_DATACENTER]	Enum: [GITHUB GITLAB BITBUCKET AZURE_DEVOPS BITBUCKET_DATACENTER] Required: {} Type: string
`tokenSecretRef` SecretReference	A secret containing this access token you will use, stored in the `token` data field.	Optional: {}
`username` string	Username ...	Optional: {}
`baseUrl` string	BaseUrl is a base URL for Git clones for self-hosted versions.	Optional: {}
`apiUrl` string	APIUrl is a base URL for HTTP apis for shel-hosted versions if different from BaseUrl.	Optional: {}
`github` ScmGithubConnection	Settings for configuring Github App authentication	Optional: {}
`azure` AzureDevopsSettings	Settings for configuring Azure DevOps authentication	Optional: {}
`bitbucketDatacenter` BitbucketDatacenterSettings	Settings for configuring Bitbucket Data Center / Server authentication	Optional: {}
`proxy` HttpProxyConfiguration	Configures usage of an HTTP proxy for all requests involving this SCM connection.	Optional: {}
`default` boolean		Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

ScmGithubConnection

Appears in:

ScmConnectionSpec

Field	Description	Validation
`appId` string	The Github App ID to use for authentication (can be found on the Github Apps settings page)
`installationId` string	The installation ID of your install of the Github App (found on the Github Apps section of your github repo/organization, located in the url path)
`privateKeyRef` SecretKeySelector		Optional: {}

Sentinel

Sentinel is the Schema for the sentinels API

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Sentinel`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` SentinelSpec

SentinelCheck

Appears in:

SentinelSpec

Field	Description	Validation
`type` SentinelCheckType	Type the type of check to run.	Enum: [LOG KUBERNETES INTEGRATION_TEST]
`name` string	Name the name of the check.
`ruleFile` string	RuleFile the rule file to use for this check.
`configuration` SentinelCheckConfiguration	Configuration the configuration to use for this check.

SentinelCheckConfiguration

Appears in:

SentinelCheck

Field	Description	Default	Validation
`log` SentinelCheckLogConfiguration	the log configuration to use for this check
`kubernetes` SentinelCheckKubernetesConfiguration	the kubernetes configuration to use for this check
`integrationTest` SentinelCheckIntegrationTestConfiguration	the integration test configuration to use for this check

SentinelCheckGotestsumConfiguration

Appears in:

SentinelCheckIntegrationTestConfiguration

Field	Description	Default	Validation
`p` string	the value of the p flag for gotestsum		Optional: {}
`parallel` string	the value of the parallel flag for gotestsum		Optional: {}

SentinelCheckIntegrationTestCase

Appears in:

SentinelCheckIntegrationTestConfiguration

Field	Description	Validation
`type` SentinelIntegrationTestCaseType	Type the type of test case to run	Enum: [COREDNS LOADBALANCER RAW PVC]
`name` string	Name the name of the test case
`coredns` SentinelCheckIntegrationTestCaseCoredns	Coredns the coredns configuration to use for this test case	Optional: {}
`loadbalancer` SentinelCheckIntegrationTestCaseLoadbalancer	Loadbalancer the load balancer configuration to use for this test case	Optional: {}
`pvc` SentinelCheckIntegrationTestCasePVC	PVC the pvc configuration to use for this test case	Optional: {}
`raw` SentinelCheckIntegrationTestCaseRaw	Raw the raw configuration to use for this test case	Optional: {}

SentinelCheckIntegrationTestCaseCoredns

Underlying type: struct{DialFqdns []string "json:"dialFqdns,omitempty""; Delay *string "json:"delay,omitempty""; Retries *int64 "json:"retries,omitempty""}

Appears in:

SentinelCheckIntegrationTestCase

SentinelCheckIntegrationTestCaseLoadbalancer

Underlying type: struct{Namespace string "json:"namespace""; NamePrefix string "json:"namePrefix""; Annotations map[string]string "json:"annotations,omitempty""; Labels map[string]string "json:"labels,omitempty""; DNSProbe *SentinelCheckIntegrationTestCaseDNSProbe "json:"dnsProbe,omitempty""}

Appears in:

SentinelCheckIntegrationTestCase

SentinelCheckIntegrationTestCasePVC

Underlying type: struct{NamePrefix string "json:"namePrefix""; Size string "json:"size""; StorageClass string "json:"storageClass""}

Appears in:

SentinelCheckIntegrationTestCase

SentinelCheckIntegrationTestCaseRaw

Underlying type: struct{Yaml k8s.io/apimachinery/pkg/runtime.RawExtension "json:"yaml""; ExpectedResult *github.com/pluralsh/console/go/client.SentinelRawResult "json:"expectedResult,omitempty""}

Appears in:

SentinelCheckIntegrationTestCase

SentinelCheckIntegrationTestConfiguration

Appears in:

SentinelCheckConfiguration

Field	Description	Validation
`format` SentinelRunJobFormat	the test output format of the job	Enum: [PLAINTEXT JUNIT] Required: {}
`jobSpec` JobSpec	The job to run for this check. We expect there to at least be one container named `default` that includes the sentinel go test code. It's also recommended to not allow retries on the job.	Optional: {}
`gotestsum` SentinelCheckGotestsumConfiguration	the configuration for the gotestsum test runner for this check	Optional: {}
`distro` ClusterDistro	the distro to run the check on	Enum: [GENERIC EKS AKS GKE RKE K3S OPENSHIFT] Optional: {}
`tags` object (keys:string, values:string)	the cluster tags to select where to run this job	Optional: {}
`rerunFailures` boolean	RerunFailures when true, failed tests will be rerun (e.g. to reduce flakiness). Defaults to false.	Optional: {}
`rerunFailuresCount` integer	RerunFailuresCount is the number of times to rerun failed tests when RerunFailures is true. Defaults to 2.	Optional: {}
`postrunScript` string	PostrunScript is a script to run after the integration test job completes.	Optional: {}
`repositoryRef` ObjectReference	RepositoryRef references a Git repository to use for this integration test.	Optional: {}
`git` GitRef	The git location to use for this integration test.	Optional: {}
`default` SentinelCheckIntegrationTestDefault	Default configures default test cases and global behavior (e.g. namespace labels and annotations for created resources).	Optional: {}
`cases` SentinelCheckIntegrationTestCase array	A list of custom test cases to run for this check. These can provide yaml-configurable targeted cases of things like coredns, load balancers, pvcs, etc.	Optional: {}

SentinelCheckIntegrationTestDefault

SentinelCheckIntegrationTestDefault configures default integration test behavior: built-in test cases and labels/annotations applied to created namespaces and deployments.

Appears in:

SentinelCheckIntegrationTestConfiguration

Field	Description	Validation
`ignore` boolean	Ignore disables default integration test cases, useful if you'd prefer to just use custom test cases exclusively.	Optional: {}
`namespaceLabels` object (keys:string, values:string)	NamespaceLabels labels to apply to created namespaces (test cases run in temporary namespaces to ensure cleanup is seamless).	Optional: {}
`namespaceAnnotations` object (keys:string, values:string)	NamespaceAnnotations annotations to apply to created namespaces (test cases run in temporary namespaces to ensure cleanup is seamless).	Optional: {}
`registry` string	Registry container image registry for test deployments. Image names an tags will still be preserved	Optional: {}
`resourceAnnotations` object (keys:string, values:string)	ResourceAnnotations annotations to apply to test resources within a namespace (this is useful if you need to sidestep policy enforcement for test resources).	Optional: {}
`resourceLabels` object (keys:string, values:string)	ResourceLabels labels to apply to test resources within a namespace (this is useful if you need to sidestep policy enforcement for test resources).	Optional: {}

SentinelCheckKubernetesConfiguration

Appears in:

SentinelCheckConfiguration

Field	Description	Validation
`group` string	Group to use when fetching this resource.
`version` string	Version the api version to use when fetching this resource.
`kind` string	Kind the kind to use when fetching this resource.
`name` string	Name to use when fetching this resource.
`namespace` string	Namespace to use when fetching this resource
`clusterRef` ObjectReference	ClusterRef the cluster to run the query against	Required: {}

SentinelCheckLogConfiguration

Appears in:

SentinelCheckConfiguration

Field	Description	Default	Validation
`namespaces` string array	Namespaces the namespaces to run the query against.
`query` string	Query a search query this will run against the logs.
`clusterRef` ObjectReference	ClusterRef the cluster to run the query against.
`duration` string	Duration of the log analysis run.
`facets` object (keys:string, values:string)	Facets the log facets to run the query against.

SentinelRunOverrides

SentinelRunOverrides defines ad-hoc overrides applied when triggering a sentinel run.

Appears in:

SentinelTriggerSpec

Field	Description	Default	Validation
`tags` object (keys:string, values:string)	Tags are merged into integration test checks for this run.		Optional: {}

SentinelSpec

SentinelSpec defines the desired state of Sentinel

Appears in:

Sentinel

Field	Description	Validation
`name` string	Name of this Sentinel. If not provided, the name from Sentinel.ObjectMeta will be used.	Optional: {}
`description` string	Description provides a human-readable explanation of what this Sentinel.
`crontab` string	Crontab defines a schedule at which sentinels will automatically run. Can be left empty to run manually or via the API. Examples: "0 /6 * " (every 6 hours), "/15 * * * *" (every 15 minutes).	Optional: {}
`repositoryRef` ObjectReference	RepositoryRef references a Git repository.	Optional: {}
`projectRef` ObjectReference	ProjectRef references the project this object belongs to, enabling project-scoped organization and access control.	Optional: {}
`git` GitRef	The git location to use for this sentinel.
`checks` SentinelCheck array
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

SentinelTrigger

SentinelTrigger is the Schema for the sentinel triggers API

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`SentinelTrigger`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` SentinelTriggerSpec

SentinelTriggerSpec

SentinelTriggerSpec defines the desired state of SentinelTrigger

Appears in:

SentinelTrigger

Field	Description	Default	Validation
`sentinelRef` ObjectReference	SentinelRef is a reference to the Sentinel resource.		Required: {}
`overrides` SentinelRunOverrides	Overrides are applied when triggering the sentinel run.		Optional: {}

ServiceAccount

ServiceAccount provides a programmatic identity for automated processes and tools to interact with the Plural Console API. Unlike user accounts, service accounts are designed for non-human authentication and can be scoped to specific APIs and resources for secure, limited access. This enables to authenticate and perform operations within defined permissions boundaries.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`ServiceAccount`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ServiceAccountSpec	Spec defines the desired state of the ServiceAccount, including email identity and scope restrictions for API access control.	Required: {}

ServiceAccountScope

ServiceAccountScope defines access restrictions for a service account, allowing fine-grained control over which Console APIs and resources can be accessed. This enables implementing least-privilege principles for automated systems.

Appears in:

ServiceAccountSpec

Field	Description	Validation
`api` string	API specifies a single Console API endpoint name that this service account should be scoped to, such as 'service.write' or 'cluster.read'.	Optional: {}
`apis` string array	Apis is a list of Console API endpoint names that this service account should be scoped to.	Optional: {}
`identifier` string	Identifier specifies a resource ID in the Console API that this service account should be scoped to. Leave blank or use '*' to scope to all resources within the specified API endpoints.	Optional: {}
`ids` string array	Ids is a list of Console API resource IDs that this service account should be scoped to.	Optional: {}

ServiceAccountSpec

ServiceAccountSpec defines the desired state of the ServiceAccount.

Appears in:

ServiceAccount

Field	Description	Validation
`email` string	Email address that will be bound to this service account for identification and authentication purposes. This email serves as the unique identifier for the service account within the Console API.	Required: {} Type: string
`allowedScopes` string array	AllowedScopes define the Console API endpoints that can be granted to access tokens created for this service account. An empty list imposes no restriction.	Optional: {}
`scopes` ServiceAccountScope array	Scopes define the access boundaries for this service account, controlling which Console APIs and resources it can interact with. Each scope can restrict access to specific API endpoints and resource identifiers, enabling fine-grained permission control for automated processes.	Optional: {}
`tokenExpiry` string	TokenExpiry is the TTL of the access token, e.g. 1h, 1d, 1w	Optional: {}
`tokenSecretRef` SecretReference	TokenSecretRef references a Kubernetes secret that should contain the authentication token for this service account. This enables secure storage and management of credentials within the cluster.	Optional: {}
`assumeBindings` Binding array	AssumeBindings define which users and groups can assume this service account.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

ServiceComponent

Appears in:

ServiceStatus

Field	Description	Validation
`id` string
`name` string	Name is the name of the Kubernetes resource, e.g. "test-deployment" or "test-job".
`group` string	Group is a Kubernetes resource group, e.g. "apps" or "batch".	Optional: {}
`version` string	Version is the Kubernetes resource version, e.g. "v1" or "v1beta1".	Optional: {}
`kind` string	Kind is the Kubernetes resource kind, e.g. "Deployment" or "Job".
`namespace` string	Namespace is the Kubernetes namespace where this component is deployed.	Optional: {}
`state` ComponentState	State specifies the component state. One of RUNNING, PENDING, FAILED.	Enum: [RUNNING PENDING FAILED] Optional: {}
`synced` boolean	Synced indicates whether this component is in sync with the desired state.

ServiceContext

ServiceContext provides a reusable bundle of configuration. It enables sharing configuration data across multiple services. This is particularly useful for passing outputs from infrastructure-as-code tools to Kubernetes services.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`ServiceContext`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ServiceContextSpec

ServiceContextSpec

ServiceContextSpec defines the desired state of the ServiceContext.

Appears in:

ServiceContext

Field	Description	Validation
`name` string	Name of this service context. If not provided, the name from ServiceContext.ObjectMeta will be used.	Optional: {}
`configuration` RawExtension	Configuration is a reusable configuration context that can include any JSON-compatible configuration data that needs to be shared across multiple services.
`configMapRef` ObjectReference	ConfigMapRef references a ConfigMap containing configuration data to merge into the Configuration. The keys and values from the ConfigMap will be merged into the Configuration JSON. ConfigMapRef and ConfigMapRefs are mutually exclusive.	Optional: {}
`configMapRefs` ConfigMapReference array	ConfigMapRefs references ConfigMaps containing configuration data to merge into the Configuration. Sources are processed in order and later sources overwrite earlier values at the same top-level key. A scoped source is placed under its scope key while an unscoped source merges its keys at the top level.	Optional: {}
`secretRef` SecretReference	SecretRef references a Secret containing configuration data to merge into the Configuration. The keys and values from the Secret will be merged into the Configuration JSON.	Optional: {}
`projectRef` ObjectReference	ProjectRef references the project this service context belongs to. If not provided, it will use the default project.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

ServiceDependency

Appears in:

Field	Description	Default	Validation
`name` string	The name of a service on the same cluster this service depends on

ServiceDeployment

ServiceDeployment provides a GitOps-driven approach to deploy and manage Kubernetes applications from Git repositories. It represents a reference to a service deployed from a Git repo into a Cluster, enabling complete GitOps workflows with full auditability and automated synchronization. The operator manages the deployment lifecycle by fetching manifests from Git repositories and applying them to target clusters with support for Helm, Kustomize, and raw YAML.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`ServiceDeployment`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ServiceSpec		Required: {}

ServiceError

Appears in:

ServiceStatus

Field	Description	Default	Validation
`source` string
`message` string

ServiceHelm

Appears in:

Field	Description	Validation
`url` string		Optional: {}
`valuesFrom` SecretReference	ValuesFrom is a reference to a Kubernetes Secret containing Helm values. It will consider any key with YAML data as a values file and merge them iteratively. This allows you to store Helm values in a secret and reference them here.	Optional: {}
`valuesConfigMapRef` ConfigMapKeySelector		Optional: {}
`release` string	Release contains the name of the Helm release to use when applying this service.	Optional: {}
`repositoryRef` ObjectReference	RepositoryRef contains a reference to a GitRepository to source the Helm chart from. This is useful for using a multi-source configuration for values files.	Optional: {}
`values` RawExtension	Values contains arbitrary YAML values to overlay.	Optional: {}
`valuesFiles` string array	ValuesFiles contains individual values files to overlay.	Optional: {}
`chart` string	Chart is the name of the Helm chart to use.	Optional: {}
`version` string	Version of the Helm chart to use.	Optional: {}
`repository` NamespacedName	Repository is a pointer to the FluxCD Helm repository to use.	Optional: {}
`git` GitRef	Git contains a reference to a Git folder and ref where the Helm chart is located.	Optional: {}
`ignoreHooks` boolean	IgnoreHooks indicates whether to completely ignore Helm hooks when actualizing this service.	Optional: {}
`ignoreCrds` boolean	IgnoreCrds indicates whether to not include the CRDs in the /crds folder of the chart. It is useful if you want to avoid installing CRDs that are already present in the cluster.	Optional: {}
`luaScript` string	LuaScript to use to generate Helm configuration. This can ultimately return a lua table with keys "values" and "valuesFiles" to supply overlays for either dynamically based on git state or other metadata. The script can call warn(message) to report non-fatal service warnings, which mark the service as stale.	Optional: {}
`luaFile` string	LuaFile to use to generate Helm configuration. This can ultimately return a Lua table with keys "values" and "valuesFiles" to supply overlays for either dynamically based on Git state or other metadata. The script can call warn(message) to report non-fatal service warnings, which mark the service as stale.	Optional: {}
`luaFolder` string	a folder of lua files to include in the final script used	Optional: {}
`pythonScript` string	PythonScript to use to generate Helm configuration. This can ultimately return a dict with keys "values" and "valuesFiles" to supply overlays for either dynamically based on git state or other metadata. The script can call warn(message) to report non-fatal service warnings, which mark the service as stale.	Optional: {}
`pythonFile` string	PythonFile to use to generate Helm configuration. This can ultimately return a dict with keys "values" and "valuesFiles" to supply overlays for either dynamically based on Git state or other metadata. The script can call warn(message) to report non-fatal service warnings, which mark the service as stale.	Optional: {}
`pythonFolder` string	a folder of python files to include in the final script used	Optional: {}
`kustomizePostrender` string	KustomizePostrender is a folder containing a kustomization to apply to the result of rendering this service's manifests.	Optional: {}

ServiceImport

Appears in:

ServiceSpec

Field	Description	Default	Validation
`stackRef` ObjectReference	StackRef is a reference to an InfrastructureStack resource that provides outputs to import.		Required: {}

ServiceKustomize

Appears in:

Field	Description	Validation
`path` string	The folder your base kustomization file lives within relative to your main git folder path. It can be a subdirectory.
`enableHelm` boolean	EnableHelm indicates whether to enable Helm for this Kustomize deployment. Used for inflating Helm charts.	Optional: {}
`envsubst` boolean	Envsubst indicates whether to apply envsubst replacements to the manifests, using the services attached configuration as the variables.	Optional: {}

ServiceSpec

ServiceSpec defines the desired state of a ServiceDeployment.

Appears in:

ServiceDeployment

Field	Description	Validation
`name` string	Name of this service. If not provided, the name from ServiceDeployment.ObjectMeta will be used.	Optional: {}
`namespace` string	Namespace where this service will be deployed. If not provided, deploys to the ServiceDeployment namespace.	Optional: {}
`docsPath` string	DocsPath specifies the path to documentation within the Git repository.	Optional: {}
`version` string	Version specifies the semantic version of this ServiceDeployment.	Optional: {}
`protect` boolean	Protect when true, prevents deletion of this service to avoid accidental removal.	Optional: {}
`kustomize` ServiceKustomize	Kustomize configuration for applying Kustomize transformations to manifests.	Optional: {}
`git` GitRef	Git reference within the repository where the service manifests are located.	Optional: {}
`helm` ServiceHelm	Helm configuration for deploying Helm charts, including values and repository settings.	Optional: {}
`syncConfig` SyncConfigAttributes	SyncConfig contains advanced configuration for how manifests are synchronized to the cluster.	Optional: {}
`repositoryRef` ObjectReference	RepositoryRef references the GitRepository CRD containing the service source code.	Optional: {}
`clusterRef` ObjectReference	ClusterRef references the target Cluster where this service will be deployed. Leave it as an empty struct to use the cluster field instead.	Optional: {}
`cluster` string	Cluster is the handle of the target Cluster where this service will be deployed. Leave it empty to use the clusterRef field instead.	Optional: {}
`configurationRef` SecretReference	ConfigurationRef is a secret reference containing service configuration for templating.	Optional: {}
`flowRef` ObjectReference	FlowRef provides contextual linkage to a broader application Flow this service belongs within.	Optional: {}
`configuration` object (keys:string, values:string)	Configuration contains non-secret key-value pairs for lightweight templating of manifests.	Optional: {}
`bindings` Bindings	Bindings contain read and write policies controlling access to this service.	Optional: {}
`dependencies` ServiceDependency array	Dependencies specify services that must be healthy before this service can be deployed.	Optional: {}
`contexts` string array	Contexts reference ServiceContext names to inject additional configuration.	Optional: {}
`templated` boolean	Templated enables Liquid templating for raw YAML files, defaults to true.	Optional: {}
`imports` ServiceImport array	Imports enable importing outputs from InfrastructureStack resources for use in templating.	Optional: {}
`detach` boolean	Detach when true, detaches the service on deletion instead of destroying it.	Optional: {}
`sources` Source array	Sources specify additional Git repositories to source manifests from for multi-source deployments.	Optional: {}
`renderers` Renderer array	Renderers define how to process and render manifests using different engines (Helm, Kustomize, etc.).	Optional: {}
`agentId` string	AgentId represents agent session ID that created this service. It is used for UI linking and otherwise ignored.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

ServiceTemplate

ServiceTemplate defines the configuration for a service to be deployed within a managed namespace. This enables automatic application deployment as part of the namespace provisioning process.

Appears in:

Field	Description	Validation
`name` string	Name specifies the name for the service deployment. For managed namespaces, this is optional and can be auto-generated if not explicitly provided.	Optional: {}
`namespace` string	Namespace specifies the namespace for the service deployment. For managed namespaces, this is typically auto-populated with the managed namespace name if not explicitly provided.	Optional: {}
`templated` boolean	Templated indicates whether to apply liquid templating to raw YAML files. When enabled, allows for dynamic configuration injection and environment-specific customization of service manifests.	Optional: {}
`repositoryRef` ObjectReference	RepositoryRef references a GitRepository resource containing the service manifests. This provides the source location for Kubernetes YAML files, Helm charts, or other deployment artifacts needed for the service.	Optional: {}
`protect` boolean	Protect indicates whether to protect this service from deletion. Protected services are not automatically deleted during namespace cleanup or cluster deletion operations, providing safety for critical workloads.	Optional: {}
`contexts` string array	Contexts specifies a list of context names to add to this service. Contexts provide reusable configuration bundles that can be shared across multiple services for consistent environment setup.	Optional: {}
`git` GitRef	Git defines Git-specific settings for sourcing service manifests. This includes repository references, branch/tag specifications, and subdirectory paths within the Git repository.	Optional: {}
`helm` ServiceHelm	Helm defines Helm-specific settings for deploying Helm charts as part of this service. This includes chart specifications, values files, repository references, and Helm-specific deployment options.	Optional: {}
`kustomize` ServiceKustomize	Kustomize defines Kustomize-specific settings for manifest customization. This enables sophisticated YAML manipulation and configuration overlay capabilities for complex deployment scenarios.	Optional: {}
`syncConfig` SyncConfigAttributes	SyncConfig defines advanced synchronization settings for the service deployment. This includes options for namespace management, drift detection configuration, and deployment behavior customization.	Optional: {}
`dependencies` ServiceDependency array	Dependencies specify services that must be healthy before this service can be deployed.	Optional: {}
`configurationRef` SecretReference	ConfigurationRef references a Kubernetes Secret containing service-specific configuration. This secret should contain key-value pairs that will be made available to the service for runtime configuration and secrets management.	Optional: {}
`configuration` object (keys:string, values:string)	Configuration provides a set of non-secret service-specific configuration values. These key-value pairs are useful for templating and can be referenced in manifest templates for environment-specific customization.	Optional: {}
`sources` Source array	Sources specify additional Git repositories or locations to source manifests from. This enables multi-repository deployments and complex source composition for sophisticated application architectures.	Optional: {}
`renderers` Renderer array	Renderers specify how manifests should be processed and rendered. This includes options for Helm chart rendering, Kustomize processing, and other manifest transformation workflows.	Optional: {}

SinkConfiguration

SinkConfiguration contains type-specific configuration for different notification channels. Only one configuration section should be populated based on the sink type. Each configuration type has different requirements and delivery mechanisms.

Appears in:

NotificationSinkSpec

Field	Description	Validation
`slack` SinkURL	Slack configuration for delivering notifications to Slack channels via webhook URLs. Requires a valid Slack incoming webhook URL configured in your Slack workspace.	Optional: {}
`teams` SinkURL	Teams configuration for delivering notifications to Microsoft Teams channels. Requires a valid Teams incoming webhook URL configured in your Teams workspace.	Optional: {}
`plural` PluralSinkConfiguration	Plural configuration for delivering in-app notifications within the Plural Console. These notifications appear in the Console UI and can optionally trigger email delivery.	Optional: {}

SinkURL

SinkURL defines the webhook URL configuration for external notification services. Used by both Slack and Teams sink types to specify the destination webhook endpoint.

Appears in:

SinkConfiguration

Field	Description	Default	Validation
`url` string	URL is the webhook endpoint where notifications will be delivered. This should be a valid HTTP/HTTPS URL provided by your Slack or Teams workspace when configuring incoming webhooks for the target channel.		Required: {}

Source

Appears in:

Field	Description	Validation
`path` string	Path the subdirectory this source will live in the final tarball	Optional: {}
`repositoryRef` ObjectReference	RepositoryRef the reference of the Git repository to source from.	Optional: {}
`git` GitRef	Git contains a location in a Git repository to use.	Optional: {}

SpecTemplate

Appears in:

ClusterSpecTemplate

Field	Description	Validation
`handle` string	Handle is a short, unique human-readable name used to identify this cluster. Does not necessarily map to the cloud resource name. This has to be specified in order to adopt existing cluster.	Optional: {} Type: string
`version` string	Version of Kubernetes to use for this cluster. Can be skipped only for BYOK.	Optional: {} Type: string
`providerRef` ObjectReferenceTemplate	ProviderRef references provider to use for this cluster. Can be skipped only for BYOK.	Optional: {}
`projectRef` ObjectReferenceTemplate	ProjectRef references project this cluster belongs to. If not provided, it will use the default project.	Optional: {}
`cloud` string	Cloud provider to use for this cluster.	Optional: {} Type: string
`protect` string	Protect cluster from being deleted.	Optional: {}
`tags` string	Tags used to filter clusters.	Optional: {}
`metadata` string	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`bindings` BindingsTemplate	Bindings contain read and write policies of this cluster	Optional: {}
`nodePools` string	NodePools contains specs of node pools managed by this cluster.	Optional: {}

StackBindingPolicyMatches

StackBindingPolicyMatches defines the stack policy evaluation stage attached by a BindingPolicy.

Appears in:

BindingPolicyMatches

Field	Description	Default	Validation
`type` StackPolicyType	Type is the stack policy evaluation stage. Valid values: APPROVAL, RUN. APPROVAL evaluates after the plan. RUN evaluates before a run is created.		Optional: {}

StackConfiguration

Appears in:

Field	Description	Validation
`image` string	Image contains the optional Docker image to use for the IaC tool. If not provided, the default image for the tool will be used.	Optional: {}
`version` string	Version of the IaC tool to use.	Optional: {}
`tag` string	Tag of the IaC tool Docker image to use.	Optional: {}
`hooks` StackHook array	Hooks to run at various stages of the stack run.	Optional: {}
`terraform` TerraformConfiguration	Terraform configuration for this stack.	Optional: {}
`terragrunt` TerragruntConfiguration	Terragrunt configuration for this stack.	Optional: {}
`pulumi` PulumiConfiguration	Pulumi configuration for this stack.	Optional: {}
`ansible` AnsibleConfiguration	Ansible configuration for this stack.	Optional: {}
`aiApproval` AiApprovalConfiguration	AiApproval configuration for this stack to be auto-approved by AI according to rules sourced from Git.	Optional: {}

StackCron

Appears in:

InfrastructureStackSpec

Field	Description	Validation
`crontab` string	The crontab on which to spawn stack runs.
`autoApprove` boolean	Whether to automatically approve cron-spawned runs.	Optional: {}
`overrides` StackOverrides	Overrides for the cron triggered stack run configuration.	Optional: {}
`trackRef` boolean	Whether to track the stack's ref exactly on cron runs versus the last detected commit. This can theoretically cause drift between code if referenced via symlinks.	Optional: {}

StackDefinition

StackDefinition provides reusable templates for Infrastructure Stack configurations and execution steps. It allows you to define standardized stack configurations, custom execution steps, and runtime environments that can be referenced by multiple Infrastructure Stacks. This enables consistent deployment patterns and reduces duplication when managing similar infrastructure components across different environments.

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`StackDefinition`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` StackDefinitionSpec

StackDefinitionSpec

StackDefinitionSpec defines the desired state of the StackDefinition.

Appears in:

StackDefinition

Field	Description	Validation
`name` string	Name of this StackDefinition. If not provided, the name from StackDefinition.ObjectMeta will be used.	Optional: {}
`description` string	Description provides a human-readable explanation of what this StackDefinition template is intended for and how it should be used.	Optional: {}
`steps` CustomRunStep array	Steps defines a list of custom run steps that will be executed as part of any stack run using this definition. Each step specifies a command, arguments, execution stage, and approval requirements.	Optional: {}
`deleteSteps` CustomRunStep array	DeleteSteps defines a list of custom run steps that will be executed when deleting/destroying a stack using this definition. Each step specifies a command, arguments, execution stage, and approval requirements.	Optional: {}
`configuration` StackConfiguration	Configuration allows customization of the stack execution environment, including Docker image settings, version specifications, and execution hooks.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

StackEnvironment

Appears in:

InfrastructureStackSpec

Field	Description	Validation
`name` string	Name of the environment variable to set.	Required: {}
`value` string	Value of the environment variable to set.	Optional: {}
`secretKeyRef` SecretKeySelector	SecretKeyRef references a key in a Secret to set the environment variable value.	Optional: {}
`configMapRef` ConfigMapKeySelector	ConfigMapRef references a key in a ConfigMap to set the environment variable value.	Optional: {}

StackFile

StackFile represents a file to mount from secrets into the stack execution environment.

Appears in:

InfrastructureStackSpec

Field	Description	Default	Validation
`mountPath` string	MountPath is the path where the file will be mounted in the stack execution environment.
`secretRef` LocalObjectReference	SecretRef is a reference to the secret containing the file.

StackHook

Appears in:

StackConfiguration

Field	Description	Validation
`cmd` string	Cmd is the command to execute.	Required: {}
`args` string array	Args contain optional arguments to pass to the command.	Optional: {}
`afterStage` StepStage		Enum: [INIT PLAN VERIFY APPLY DESTROY] Required: {}

StackOverrides

Appears in:

StackCron

Field	Description	Validation
`terraform` TerraformConfiguration	Terraform is the terraform configuration for this stack	Optional: {}
`terragrunt` TerragruntConfiguration	Terragrunt is the terragrunt configuration for this stack	Optional: {}
`pulumi` PulumiConfiguration	Pulumi is the pulumi configuration for this stack	Optional: {}

StackSettings

Appears in:

DeploymentSettingsSpec

Field	Description	Default	Validation
`jobSpec` JobSpec	JobSpec optional k8s job configuration for the job that will apply this stack.		Optional: {}
`connectionRef` ObjectReference	ConnectionRef reference to ScmConnection.		Optional: {}

Status

Appears in:

Field	Description	Default	Validation
`id` string	ID of the resource in the Console API.		Optional: {} Type: string
`sha` string	SHA of last applied configuration.		Optional: {} Type: string
`readonly` boolean	ReadOnly indicates whether the resource is read-only.	false
`conditions` Condition array	Represents the observations of a PrAutomation's current state.

SyncConfigAttributes

Appears in:

Field	Description	Validation
`createNamespace` boolean	Whether to auto-create the namespace for this service (specifying labels and annotations will also add those to the created namespace)	Optional: {}
`deleteNamespace` boolean	Whether to delete the namespace for this service upon deletion	Optional: {}
`enforceNamespace` boolean	Whether to enforce all created resources are placed in the service namespace	Optional: {}
`requireOwnership` boolean	Whether to require all resources are owned by this service and fail if they are owned by another. Default is true.	Optional: {}
`labels` object (keys:string, values:string)		Optional: {}
`annotations` object (keys:string, values:string)		Optional: {}
`diffNormalizers` DiffNormalizers array	DiffNormalizers a list of diff normalizers to apply to the service which controls how drift detection works.	Optional: {}

Taint

Taint represents a Kubernetes taint.

Appears in:

ClusterNodePool

Field	Description	Validation
`effect` TaintEffect	Effect specifies the effect for the taint.	Enum: [NoSchedule NoExecute PreferNoSchedule]
`key` string	Key is the key of the taint.
`value` string	Value is the value of the taint.

TaintEffect

Underlying type: string

TaintEffect is the effect for a Kubernetes taint.

Appears in:

Taint

TemplateContext

TemplateContext provides metadata and configuration data for templating service deployments. It enables dynamic customization of service properties based on cluster-specific or environment-specific requirements during the deployment process.

Appears in:

GlobalServiceSpec

Field	Description	Default	Validation
`raw` RawExtension	Raw contains arbitrary YAML data that can be used as context for templating service deployment properties. This data is made available to template engines for dynamic substitution of values, configurations, or other deployment parameters.		Optional: {}

TerraformConfiguration

Appears in:

Field	Description	Validation
`parallelism` integer	Parallelism is the number of concurrent operations to run, equivalent to the -parallelism flag in Terraform.	Optional: {}
`refresh` boolean	Refresh is whether to refresh the state of the stack, equivalent to the -refresh flag in Terraform.	Optional: {}
`approveEmpty` boolean	ApproveEmpty is whether to auto-approve a plan if there are no changes, preventing a stack from being blocked.	Optional: {}
`tofu` boolean	Tofu is whether to use OpenTofu instead of Terraform for this stack.	Optional: {}
`tofuRegistry` boolean	TofuRegistry is whether to use the OpenTofu registry for provider and module sources.	Optional: {}

TerragruntConfiguration

Appears in:

Field	Description	Validation
`parallelism` integer	Parallelism is the number of concurrent operations to run, equivalent to the -parallelism flag passed through to the underlying Terraform/OpenTofu invocation.	Optional: {}
`refresh` boolean	Refresh is whether to refresh the state of the stack, equivalent to the -refresh flag passed through to the underlying Terraform/OpenTofu invocation.	Optional: {}
`approveEmpty` boolean	ApproveEmpty is whether to auto-approve a plan if there are no changes, preventing a stack from being blocked.	Optional: {}

Tools

Appears in:

AISettings

Field	Description	Default	Validation
`createPr` CreatePr	CreatePr holds the configuration for the pr automation tool.		Optional: {}

UpgradePlanCallout

UpgradePlanCallout is the Schema for the upgradeplancallouts API

Field	Description	Default	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`UpgradePlanCallout`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` UpgradePlanCalloutSpec

UpgradePlanCalloutSpec

UpgradePlanCalloutSpec defines the desired state of UpgradePlanCallout

Appears in:

UpgradePlanCallout

Field	Description	Validation
`name` string	Name of this UpgradePlanCallout. If not provided UpgradePlanCallout's own name from UpgradePlanCallout.ObjectMeta will be used.	Optional: {}
`callouts` AddonCallout array	Callouts the callouts for this instance
`context` RawExtension	Context is an untyped object containing the context for this callout	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource. Controls drift detection and reconciliation intervals.	Optional: {}

VectorStore

Appears in:

AISettings

Field	Description	Default	Validation
`enabled` boolean	Enabled controls whether the vector store is enabled or not..	false	Optional: {}
`vectorStore` VectorStore	VectorStore is the type of the vector store to use.		Enum: [ELASTIC OPENSEARCH POSTGRES] Optional: {}
`elastic` ElasticsearchConnectionSettings	Elastic configuration for the vector store.		Optional: {}
`opensearch` OpensearchConnectionSettings	Opensearch configuration for the vector store.		Optional: {}

VertexSettings

Appears in:

AISettings

Field	Description	Validation
`proxy` HttpProxyConfiguration	Proxy configures an HTTP proxy for this provider's API calls.	Optional: {}
`model` string	Model is the Vertex AI model to use. This should be a model listed currently on models.dev, for instance here: https://models.dev/?search=google-vertex	Optional: {}
`toolModel` string	ToolModel to use for tool calling, which is less frequent and often requires more advanced reasoning. This should be a model listed currently on models.dev, for instance here: https://models.dev/?search=google-vertex	Optional: {}
`embeddingModel` string	EmbeddingModel to use for generating embeddings. This should be a model listed currently on models.dev, for instance here: https://models.dev/?search=google-vertex. Default is gemini-embedding-001.	Optional: {}
`proxyModels` string array	ProxyModels are additional models to support within the integrated ai proxy.	Optional: {}
`project` string	Project is the GCP project you'll be using	Required: {}
`location` string	Location is the GCP region Vertex is queried from	Required: {}
`endpoint` string	Endpoint is a custom endpoint for self-deployed models	Optional: {}
`serviceAccountJsonSecretRef` SecretKeySelector	ServiceAccountJsonSecretRef is a Service Account json file stored w/in a kubernetes secret to use for authentication to GCP	Optional: {}

VsphereCloudConnection

VsphereCloudConnection contains VMware vSphere authentication configuration. Provides credentials for discovering and querying vSphere resources.

Appears in:

CloudConnectionConfiguration

Field	Description	Validation
`server` string	The vCenter SDK endpoint, for example https://vcenter.example.com/sdk
`user` string	The vCenter user
`password` ObjectKeyReference	The vCenter password
`allowUnverifiedSsl` boolean	Whether to allow unverified vCenter TLS certificates	Optional: {}

Workbench

Workbench represents an AI workbench in Plural Console. It defines the system prompt, configuration, skills, and tools available for agent runs, and can reference a project, Git repository, and agent runtime.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`Workbench`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` WorkbenchSpec	Spec defines the desired state of the Workbench.	Required: {}

WorkbenchBindingPolicyMatches

WorkbenchBindingPolicyMatches defines regex-based selection criteria for workbench targets.

Appears in:

BindingPolicyMatches

Field	Description	Default	Validation
`regexes` string array	Regexes is a list of regular expressions that select workbench inputs for this policy.		Optional: {}

WorkbenchCodingConfig

WorkbenchCodingConfig defines coding agent settings.

Appears in:

WorkbenchConfiguration

Field	Description	Default	Validation
`mode` AgentRunMode	Mode is the agent run mode (e.g. analyze, write).		Enum: [ANALYZE WRITE] Optional: {}
`repositories` string array	Repositories are allowed repository identifiers.		Optional: {}

WorkbenchConfiguration

WorkbenchConfiguration defines workbench capabilities.

Appears in:

WorkbenchSpec

Field	Description	Validation
`coding` WorkbenchCodingConfig	Coding configures coding agent capabilities (mode, repositories).	Optional: {}
`infrastructure` WorkbenchInfrastructureConfig	Infrastructure configures infrastructure capabilities (services, stacks, Kubernetes).	Optional: {}
`observability` WorkbenchObservabilityConfig	Observability configures observability capabilities (logs, metrics).	Optional: {}

WorkbenchCron

WorkbenchCron represents a scheduled cron trigger for a Workbench. It runs a prompt on the associated workbench at the configured cron schedule.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`WorkbenchCron`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` WorkbenchCronSpec	Spec defines the desired state of the WorkbenchCron.	Required: {}

WorkbenchCronSpec

WorkbenchCronSpec defines the desired state of a WorkbenchCron.

Appears in:

WorkbenchCron

Field	Description	Validation
`workbenchRef` ObjectReference	WorkbenchRef references the Workbench this cron belongs to.	Required: {}
`crontab` string	Crontab is the cron expression defining the schedule (e.g. /5 * * *).	MinLength: 1 Required: {} Type: string
`prompt` string	Prompt is the prompt to run when the cron triggers.	Optional: {} Type: string
`reconciliation` Reconciliation	Reconciliation settings for this resource.	Optional: {}

WorkbenchInfrastructureConfig

WorkbenchInfrastructureConfig defines infrastructure capabilities.

Appears in:

WorkbenchConfiguration

Field	Description	Validation
`selfService` boolean	SelfService enables the self-service subagent for catalog and PR automation workflows.	Optional: {}
`services` boolean	Services enables the services capability.	Optional: {}
`stacks` boolean	Stacks enables the stacks capability.	Optional: {}
`kubernetes` boolean	Kubernetes enables the Kubernetes capability.	Optional: {}

WorkbenchJobBudget

WorkbenchJobBudget defines budget limits for a workbench job.

Appears in:

WorkbenchJobModes

Field	Description	Default	Validation
`cost` string	Cost is the maximum cost budget for the job. It is a string to allow decimal values (e.g. "12.5").		Optional: {} Pattern: `^[0-9]+(\.[0-9]+)?$` Type: string
`tokens` integer	Tokens is the maximum token budget for the job.		Minimum: 0 Optional: {}

WorkbenchJobCodingModes

WorkbenchJobCodingModes defines coding mode options for a workbench job.

Appears in:

WorkbenchJobModes

Field	Description	Validation
`babysit` boolean	Babysit enables babysit mode for coding agent runs.	Optional: {}
`approval` boolean	Approval requires approval before coding agent runs continue.	Optional: {}
`review` boolean	Review enables pull request review mode for coding agent runs.	Optional: {}

WorkbenchJobKubernetesModes

WorkbenchJobKubernetesModes defines kubernetes action options for a workbench job.

Appears in:

WorkbenchJobModes

Field	Description	Validation
`update` boolean	Update enables kubernetes update actions.	Optional: {}
`delete` boolean	Delete enables kubernetes delete actions.	Optional: {}
`exec` boolean	Exec enables kubernetes exec actions.	Optional: {}
`drain` boolean	Drain enables kubernetes node drain actions.	Optional: {}
`excludeNamespaces` string array	ExcludeNamespaces are namespaces the agent can never act in.	Optional: {}
`requireNamespaces` string array	RequireNamespaces, if set, are the only namespaces the agent is allowed to act in.	Optional: {}

WorkbenchJobModel

WorkbenchJobModel defines the AI model override for a workbench job.

Appears in:

WorkbenchJobModes

Field	Description	Default	Validation
`provider` AiProvider	Provider is the AI provider for the job.		Enum: [OPENAI ANTHROPIC OLLAMA AZURE BEDROCK VERTEX OPENAI_COMPATIBLE XAI] Required: {}
`model` string	Model is the model name for the job.		MinLength: 1 Required: {} Type: string

WorkbenchJobModes

WorkbenchJobModes defines mode-specific options for workbench jobs.

Appears in:

MonitorSpec

Field	Description	Validation
`plan` boolean	Plan enables planning mode for the job.	Optional: {}
`verification` boolean	Verification enables verification mode for the job.	Optional: {}
`model` WorkbenchJobModel	Model overrides the AI model used for the job.	Optional: {}
`coding` WorkbenchJobCodingModes	Coding defines coding mode options for the job.	Optional: {}
`budget` WorkbenchJobBudget	Budget defines budget limits for the job.	Optional: {}
`kubernetes` WorkbenchJobKubernetesModes	Kubernetes defines kubernetes action options for the job.	Optional: {}

WorkbenchObservabilityConfig

WorkbenchObservabilityConfig configures observability capabilities.

Appears in:

WorkbenchConfiguration

Field	Description	Default	Validation
`logs` boolean	Logs enables the logs capability.		Optional: {}
`metrics` boolean	Metrics enables the metrics capability.		Optional: {}

WorkbenchPrompt

WorkbenchPrompt represents a saved prompt for a Workbench.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`WorkbenchPrompt`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` WorkbenchPromptSpec	Spec defines the desired state of the WorkbenchPrompt.	Required: {}

WorkbenchPromptSpec

WorkbenchPromptSpec defines the desired state of a WorkbenchPrompt.

Appears in:

WorkbenchPrompt

Field	Description	Validation
`workbenchRef` ObjectReference	WorkbenchRef references the Workbench this prompt belongs to.	Required: {}
`title` string	Title is the display title for the saved prompt.	Optional: {} Type: string
`category` string	Category is the grouping category for the saved prompt.	Optional: {} Type: string
`prompt` string	Prompt is the saved prompt text.	MinLength: 1 Required: {} Type: string
`reconciliation` Reconciliation	Reconciliation settings for this resource.	Optional: {}

WorkbenchSkills

WorkbenchSkills defines skills configuration for a workbench.

Appears in:

WorkbenchSpec

Field	Description	Default	Validation
`ref` WorkbenchSkillsRef	Ref is the git reference for skills (ref, folder, files).		Optional: {}
`files` string array	Files to include.		Optional: {}

WorkbenchSkillsRef

WorkbenchSkillsRef is a git reference for skills.

Appears in:

WorkbenchSkills

Field	Description	Validation
`ref` string	Ref is the Git reference (branch, tag, or commit) understandable by `git checkout <ref>`.	MinLength: 1 Required: {} Type: string
`folder` string	Folder in the repository.	MinLength: 1 Required: {} Type: string
`files` string array	Files to include.	Optional: {}

WorkbenchSpec

WorkbenchSpec defines the desired state of a Workbench.

Appears in:

Workbench

Field	Description	Validation
`name` string	Name of the workbench. If not set, metadata.name is used.	Optional: {} Type: string
`description` string	Description provides a human-readable explanation of the workbench's purpose.	Optional: {} Type: string
`systemPrompt` string	SystemPrompt is the system prompt used for agent runs in this workbench.	Optional: {} Type: string
`projectRef` ObjectReference	ProjectRef references the project this workbench belongs to.	Optional: {}
`repositoryRef` ObjectReference	RepositoryRef references the Git repository used for this workbench.	Optional: {}
`agentRuntime` string	AgentRuntime reference in the "<cluster-handle>/<runtime-name>" format.	Optional: {} Type: string
`configuration` WorkbenchConfiguration	Configuration defines workbench capabilities (coding and infrastructure).	Optional: {}
`skills` WorkbenchSkills	Skills define skills configuration (git ref and/or files) for the workbench.	Optional: {}
`bindings` Bindings	Bindings define read and write access policies for this workbench.	Optional: {}
`toolRefs` ObjectReference array	ToolRefs references WorkbenchTool resources to associate with this workbench.	Optional: {}
`reconciliation` Reconciliation	Reconciliation settings for this resource.	Optional: {}

WorkbenchTool

WorkbenchTool is the Schema for the workbenchtools API.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`WorkbenchTool`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` WorkbenchToolSpec		Required: {}

WorkbenchToolAtlassianConfig

WorkbenchToolAtlassianConfig defines an atlassian/jira connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`serviceAccountSecretRef` SecretKeySelector	Reference to a secret key containing the encrypted service account JSON (alternative to api_token + email).	Optional: {}
`apiTokenSecretRef` SecretKeySelector	Reference to a secret key containing the atlassian API token (required if not using service_account).	Optional: {}
`email` string	Atlassian account email (required if not using service_account).	Optional: {}

WorkbenchToolAzureConfig

WorkbenchToolAzureConfig defines an azure monitor connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`subscriptionId` string	Azure subscription id.	Required: {}
`tenantId` string	Azure tenant id.	Required: {}
`clientId` string	Azure client id.	Required: {}
`clientSecretSecretRef` SecretKeySelector	Reference to a secret key containing the azure client secret.	Required: {}
`prometheusUrl` string	Optional azure managed prometheus url if you wish to use it for metrics.	Optional: {}

WorkbenchToolAzureDevopsConfig

WorkbenchToolAzureDevopsConfig defines an azure devops connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Default	Validation
`url` string	Optional REST API root (defaults to https://dev.azure.com).		Optional: {}
`tokenSecretRef` SecretKeySelector	Reference to a secret key containing the Azure DevOps personal access token.		Optional: {}

WorkbenchToolAzureFunctionConfig

WorkbenchToolAzureFunctionConfig defines an Azure Function / Cloud Function configuration.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`identifier` string	Cloud Function identifier.	Required: {}
`description` string	Description of the function exposed to the agent.	Required: {}
`inputSchema` RawExtension	JSON schema for the tool input.	Optional: {}

WorkbenchToolBitbucketConfig

WorkbenchToolBitbucketConfig defines a bitbucket cloud connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Default	Validation
`url` string	Optional Bitbucket Cloud API base URL.		Optional: {}
`tokenSecretRef` SecretKeySelector	Reference to a secret key containing the Bitbucket app password or access token.		Optional: {}

WorkbenchToolBitbucketDatacenterConfig

WorkbenchToolBitbucketDatacenterConfig defines a bitbucket data center connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Default	Validation
`url` string	Bitbucket Data Center REST API base URL.		Required: {}
`tokenSecretRef` SecretKeySelector	Reference to a secret key containing the HTTP access token or personal access token.		Optional: {}

WorkbenchToolCloudRunConfig

WorkbenchToolCloudRunConfig defines a Google Cloud Run service configuration.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`identifier` string	Cloud Run service identifier.	Required: {}
`description` string	Description of the function exposed to the agent.	Required: {}
`inputSchema` RawExtension	JSON schema for the tool input.	Optional: {}

WorkbenchToolCloudwatchConfig

WorkbenchToolCloudwatchConfig defines a cloudwatch connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`region` string	AWS region (e.g. us-east-1).	Required: {}
`logGroupNames` string array	Optional default log groups for CloudWatch Logs Insights.	Optional: {}
`accessKeyIdSecretRef` SecretKeySelector	Reference to a secret key containing the optional static AWS access key id.	Optional: {}
`secretAccessKeySecretRef` SecretKeySelector	Reference to a secret key containing the optional static AWS secret access key.	Optional: {}
`roleArn` string	Optional IAM role ARN to assume.	Optional: {}
`externalId` string	Optional external id for assume role.	Optional: {}
`roleSessionName` string	Optional role session name for assume role.	Optional: {}

WorkbenchToolConfiguration

WorkbenchToolConfiguration defines tool-specific connection configuration.

Appears in:

WorkbenchToolSpec

Field	Description	Validation
`http` WorkbenchToolHTTPConfig	Http tool configuration.	Optional: {}
`elastic` WorkbenchToolElasticConfig	Elasticsearch connection (logs).	Optional: {}
`opensearch` WorkbenchToolOpensearchConfig	AWS OpenSearch connection (logs).	Optional: {}
`prometheus` WorkbenchToolPrometheusConfig	Prometheus connection (metrics).	Optional: {}
`loki` WorkbenchToolLokiConfig	Loki connection (logs).	Optional: {}
`victoriaLogs` WorkbenchToolVictoriaLogsConfig	VictoriaLogs connection (logs).	Optional: {}
`tempo` WorkbenchToolTempoConfig	Tempo connection (traces).	Optional: {}
`jaeger` WorkbenchToolJaegerConfig	Jaeger connection (traces).	Optional: {}
`splunk` WorkbenchToolSplunkConfig	Splunk connection (logs).	Optional: {}
`datadog` WorkbenchToolDatadogConfig	Datadog connection (metrics, logs).	Optional: {}
`dynatrace` WorkbenchToolDynatraceConfig	Dynatrace connection (metrics, logs, traces).	Optional: {}
`cloudwatch` WorkbenchToolCloudwatchConfig	Cloudwatch connection (metrics, logs).	Optional: {}
`azure` WorkbenchToolAzureConfig	Azure monitor connection (metrics).	Optional: {}
`sentry` WorkbenchToolSentryConfig	Sentry connection (error tracking).	Optional: {}
`linear` WorkbenchToolLinearConfig	Linear connection (ticketing).	Optional: {}
`slack` WorkbenchToolSlackConfig	Slack connection (integration).	Optional: {}
`pagerduty` WorkbenchToolPagerdutyConfig	PagerDuty connection (integration).	Optional: {}
`teams` WorkbenchToolTeamsConfig	Microsoft Teams / Graph connection (integration).	Optional: {}
`atlassian` WorkbenchToolAtlassianConfig	Atlassian/jira connection (ticketing).	Optional: {}
`jiraDatacenter` WorkbenchToolJiraDatacenterConfig	Jira Data Center connection (ticketing).	Optional: {}
`serviceNow` WorkbenchToolServiceNowConfig	ServiceNow connection (ticketing).	Optional: {}
`exa` WorkbenchToolExaConfig	Exa connection (search).	Optional: {}
`github` WorkbenchToolGithubConfig	GitHub connection (integration).	Optional: {}
`gitlab` WorkbenchToolGitlabConfig	GitLab connection (scm).	Optional: {}
`bitbucket` WorkbenchToolBitbucketConfig	Bitbucket Cloud connection (scm).	Optional: {}
`bitbucketDatacenter` WorkbenchToolBitbucketDatacenterConfig	Bitbucket Data Center connection (scm).	Optional: {}
`azureDevops` WorkbenchToolAzureDevopsConfig	Azure DevOps connection (scm).	Optional: {}
`lambda` WorkbenchToolLambdaConfig	AWS Lambda function configuration.	Optional: {}
`cloudRun` WorkbenchToolCloudRunConfig	Google Cloud Run service configuration.	Optional: {}
`azureFunction` WorkbenchToolAzureFunctionConfig	Azure Function / Cloud Function configuration.	Optional: {}
`docker` WorkbenchToolDockerConfig	Docker/OCI registry connection.	Optional: {}

WorkbenchToolDatadogConfig

WorkbenchToolDatadogConfig defines a datadog connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`site` string	Datadog site (e.g. datadoghq.com).	Optional: {}
`apiKeySecretRef` SecretKeySelector	Reference to a secret key containing the datadog API key.	Optional: {}
`appKeySecretRef` SecretKeySelector	Reference to a secret key containing the datadog application key.	Optional: {}

WorkbenchToolDockerConfig

WorkbenchToolDockerConfig defines a docker/OCI registry connection. Auth secrets are resolved by the reconciler via HelmRepositoryAuth helpers.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`url` string	Registry host or base URL (defaults to registry-1.docker.io).	Optional: {}
`provider` HelmAuthProvider	Registry authentication provider: BASIC, BEARER, AWS, AZURE, or GCP.	Enum: [BASIC BEARER GCP AZURE AWS] Optional: {}
`auth` HelmRepositoryAuth	Registry authentication credentials and optional proxy.	Optional: {}

WorkbenchToolDynatraceConfig

WorkbenchToolDynatraceConfig defines a dynatrace connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Default	Validation
`url` string	Dynatrace base URL.		Required: {}
`platformTokenSecretRef` SecretKeySelector	Reference to a secret key containing the dynatrace platform token.		Required: {}

WorkbenchToolElasticConfig

WorkbenchToolElasticConfig defines an elasticsearch connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`url` string	Elasticsearch base URL.	Required: {}
`username` string	Basic auth username.	Required: {}
`passwordSecretRef` SecretKeySelector	Reference to a secret key containing the basic auth password.	Optional: {}
`index` string	Elasticsearch index.	Required: {}

WorkbenchToolExaConfig

WorkbenchToolExaConfig defines an exa connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Default	Validation
`apiKeySecretRef` SecretKeySelector	Reference to a secret key containing the exa API key.		Optional: {}

WorkbenchToolGithubConfig

WorkbenchToolGithubConfig defines a github connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`url` string	Optional GitHub REST API base URL (defaults to https://api.github.com/; set for GitHub Enterprise Server).	Optional: {}
`accessTokenSecretRef` SecretKeySelector	Reference to a secret key containing an optional GitHub personal access token or fine-grained token.	Optional: {}
`toolset` string	Optional native tool subset: issues, pull_requests, repos, security, default/all, or omit for all tools.	Optional: {}
`appId` string	GitHub App ID (use with installationId and privateKey instead of accessToken).	Optional: {}
`installationId` string	GitHub App installation ID for this organization or account.	Optional: {}
`privateKeySecretRef` SecretKeySelector	Reference to a secret key containing the PEM private key for the GitHub App.	Optional: {}

WorkbenchToolGitlabConfig

WorkbenchToolGitlabConfig defines a gitlab connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Default	Validation
`url` string	Optional GitLab API base URL (defaults to https://gitlab.com when omitted).		Optional: {}
`tokenSecretRef` SecretKeySelector	Reference to a secret key containing the GitLab personal access token or project/group token.		Optional: {}

WorkbenchToolHTTPConfig

WorkbenchToolHTTPConfig defines the HTTP tool configuration.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`url` string	The request URL.	Format: uri Required: {} Type: string
`method` WorkbenchToolHTTPMethod	The HTTP method.	Enum: [GET POST PUT DELETE PATCH] Required: {}
`function` boolean	When true, exposes this HTTP tool as a workbench action; execution may require approval when tool approval is enabled.	Optional: {}
`headers` WorkbenchToolHTTPHeader array	Request headers.	Optional: {}
`body` string	Request body.	Optional: {} Type: string
`inputSchema` RawExtension	JSON schema for the tool input.	Required: {}

WorkbenchToolHTTPHeader

WorkbenchToolHTTPHeader represents a single HTTP header.

Appears in:

WorkbenchToolHTTPConfig

Field	Description	Default	Validation
`name` string			Optional: {} Type: string
`value` string			Optional: {} Type: string

WorkbenchToolJaegerConfig

WorkbenchToolJaegerConfig defines a jaeger connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`url` string	Jaeger base URL.	Required: {}
`tokenSecretRef` SecretKeySelector	Reference to a secret key containing the bearer token.	Optional: {}
`username` string	Basic auth username.	Optional: {}
`passwordSecretRef` SecretKeySelector	Reference to a secret key containing the basic auth password.	Optional: {}

WorkbenchToolJiraDatacenterConfig

WorkbenchToolJiraDatacenterConfig defines a Jira Data Center connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Default	Validation
`url` string	Jira Data Center base URL.		Required: {}
`apiTokenSecretRef` SecretKeySelector	APITokenSecretRef references a personal access token when OAuth is not used.		Optional: {}

WorkbenchToolLambdaConfig

WorkbenchToolLambdaConfig defines an AWS Lambda function configuration.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`lambdaArn` string	AWS Lambda function ARN.	Required: {}
`description` string	Description of the function exposed to the agent.	Required: {}
`inputSchema` RawExtension	JSON schema for the tool input.	Optional: {}

WorkbenchToolLinearConfig

WorkbenchToolLinearConfig defines a linear connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Default	Validation
`accessTokenSecretRef` SecretKeySelector	Reference to a secret key containing the linear API access token.		Optional: {}

WorkbenchToolLokiConfig

WorkbenchToolLokiConfig defines a loki connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`url` string	Loki base URL.	Required: {}
`tokenSecretRef` SecretKeySelector	Reference to a secret key containing the bearer token or api key.	Optional: {}
`username` string	Basic auth username.	Optional: {}
`passwordSecretRef` SecretKeySelector	Reference to a secret key containing the basic auth password.	Optional: {}
`tenantId` string	Optional tenant id.	Optional: {}

WorkbenchToolOpensearchConfig

WorkbenchToolOpensearchConfig defines an AWS OpenSearch connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`host` string	AWS OpenSearch endpoint.	Required: {}
`index` string	OpenSearch index.	Required: {}
`awsAccessKeyIdSecretRef` SecretKeySelector	Reference to a secret key containing the AWS access key id for SigV4 authentication.	Optional: {}
`awsSecretAccessKeySecretRef` SecretKeySelector	Reference to a secret key containing the AWS secret access key for SigV4 authentication.	Optional: {}
`awsRegion` string	AWS region for SigV4 authentication.	Optional: {}
`assumeRoleArn` string	Optional IAM role ARN to assume before signing OpenSearch requests.	Optional: {}
`usePodIdentity` boolean	Whether to use pod identity (IRSA/Workload Identity) for AWS authentication instead of static credentials.	Optional: {}

WorkbenchToolPagerdutyConfig

WorkbenchToolPagerdutyConfig defines a pagerduty connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Default	Validation
`apiTokenSecretRef` SecretKeySelector	Reference to a secret key containing the pagerduty REST API key.		Optional: {}

WorkbenchToolPrometheusConfig

WorkbenchToolPrometheusConfig defines a prometheus connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`url` string	Prometheus base URL.	Required: {}
`tokenSecretRef` SecretKeySelector	Reference to a secret key containing the bearer token or api key.	Optional: {}
`username` string	Basic auth username.	Optional: {}
`passwordSecretRef` SecretKeySelector	Reference to a secret key containing the basic auth password.	Optional: {}
`tenantId` string	Optional tenant id (e.g. for Mimir).	Optional: {}
`awsSigv4` boolean	Whether to sign requests with AWS SigV4.	Optional: {}
`awsAccessKeyIdSecretRef` SecretKeySelector	Reference to a secret key containing the AWS access key id for SigV4 authentication.	Optional: {}
`awsSecretAccessKeySecretRef` SecretKeySelector	Reference to a secret key containing the AWS secret access key for SigV4 authentication.	Optional: {}
`awsRegion` string	AWS region for SigV4 authentication.	Optional: {}

WorkbenchToolSentryConfig

WorkbenchToolSentryConfig defines a sentry connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Default	Validation
`url` string	Optional Sentry API host (defaults to https://sentry.io; set for self-hosted).		Optional: {}
`accessTokenSecretRef` SecretKeySelector	Reference to a secret key containing the Sentry user auth token or internal integration token.		Optional: {}

WorkbenchToolServiceNowConfig

WorkbenchToolServiceNowConfig defines a ServiceNow connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`url` string	ServiceNow instance URL, for example https://example.service-now.com.	Required: {}
`username` string	Username for basic auth when OAuth is not used.	Optional: {}
`passwordSecretRef` SecretKeySelector	PasswordSecretRef references the basic auth password when OAuth is not used.	Optional: {}

WorkbenchToolSlackConfig

WorkbenchToolSlackConfig defines a slack connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Default	Validation
`botTokenSecretRef` SecretKeySelector	Reference to a secret key containing the slack bot user OAuth token (xoxb-...).		Optional: {}

WorkbenchToolSpec

WorkbenchToolSpec defines the desired state of a WorkbenchTool.

Appears in:

WorkbenchTool

Field	Description	Validation
`name` string	The name of the tool (a-z, 0-9, underscores). If not set, metadata.name is used.	Optional: {} Pattern: `^[a-z0-9_]+$` Type: string
`tool` WorkbenchToolType	The type of tool.	Enum: [HTTP ELASTIC DATADOG PROMETHEUS LOKI TEMPO SENTRY MCP LINEAR ATLASSIAN SPLUNK DYNATRACE CLOUDWATCH AZURE CLOUD JAEGER EXA GITHUB SLACK TEAMS GITLAB BITBUCKET BITBUCKET_DATACENTER AZURE_DEVOPS PAGERDUTY OPENSEARCH LAMBDA CLOUD_RUN AZURE_FUNCTION DOCKER VICTORIA_LOGS JIRA JIRA_DATACENTER SERVICE_NOW] Required: {}
`categories` WorkbenchToolCategory array	Categories for the tool.	Optional: {}
`approval` boolean	Whether this tool requires approval before execution.	Optional: {}
`projectRef` ObjectReference	The project for this tool.	Optional: {}
`mcpServerRef` ObjectReference	The mcp server for this tool.	Optional: {}
`cloudConnectionRef` ObjectReference	The cloud connection for this tool (e.g. infrastructure cloud tools).	Optional: {}
`scmConnectionRef` ObjectReference	The SCM connection for this tool (e.g. shared Git provider credentials).	Optional: {}
`bindings` Bindings	Bindings define the read and write access policies for this tool.	Optional: {}
`configuration` WorkbenchToolConfiguration	Tool configuration (e.g. HTTP).	Optional: {}
`oauth` OAuth2TokenExchange	OAuth configures client credentials token exchange for this tool.	Optional: {}
`reconciliation` Reconciliation		Optional: {}

WorkbenchToolSplunkConfig

WorkbenchToolSplunkConfig defines a splunk connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Default	Validation
`url` string	Splunk base URL.		Required: {}
`tokenSecretRef` SecretKeySelector	Reference to a secret key containing the authentication token.		Optional: {}
`tokenType` SplunkTokenType	Authorization realm used for token authentication.	BEARER	Enum: [BEARER SPLUNK] Optional: {}
`username` string	Basic auth username.		Optional: {}
`passwordSecretRef` SecretKeySelector	Reference to a secret key containing the basic auth password.		Optional: {}

WorkbenchToolTeamsConfig

WorkbenchToolTeamsConfig defines a microsoft teams / graph connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`clientId` string	Microsoft Entra application (client) id.	Required: {}
`clientSecretSecretRef` SecretKeySelector	Reference to a secret key containing the microsoft entra client secret.	Required: {}
`tenantId` string	Microsoft Entra tenant (directory) id.	Required: {}

WorkbenchToolTempoConfig

WorkbenchToolTempoConfig defines a tempo connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`url` string	Tempo base URL.	Required: {}
`tokenSecretRef` SecretKeySelector	Reference to a secret key containing the bearer token or api key.	Optional: {}
`username` string	Basic auth username.	Optional: {}
`passwordSecretRef` SecretKeySelector	Reference to a secret key containing the basic auth password.	Optional: {}
`tenantId` string	Optional tenant id.	Optional: {}

WorkbenchToolVictoriaLogsConfig

WorkbenchToolVictoriaLogsConfig defines a VictoriaLogs connection.

Appears in:

WorkbenchToolConfiguration

Field	Description	Validation
`url` string	VictoriaLogs base URL.	Required: {}
`tokenSecretRef` SecretKeySelector	Reference to a secret key containing the bearer token or api key.	Optional: {}
`username` string	Basic auth username.	Optional: {}
`passwordSecretRef` SecretKeySelector	Reference to a secret key containing the basic auth password.	Optional: {}
`accountId` string	Optional AccountID tenant header.	Optional: {}
`projectId` string	Optional ProjectID tenant header.	Optional: {}

WorkbenchWebhook

WorkbenchWebhook represents a webhook trigger for a Workbench. When an incoming webhook payload matches the configured criteria, a prompt is run on the workbench.

Field	Description	Validation
`apiVersion` string	`deployments.plural.sh/v1alpha1`
`kind` string	`WorkbenchWebhook`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` WorkbenchWebhookSpec	Spec defines the desired state of the WorkbenchWebhook.	Required: {}

WorkbenchWebhookMatchesSpec

WorkbenchWebhookMatchesSpec defines criteria to match incoming webhook payloads.

Appears in:

WorkbenchWebhookSpec

Field	Description	Validation
`regex` string	Regex is a regex pattern to match in the webhook body.	Optional: {} Type: string
`substring` string	Substring is a substring to match in the webhook body.	Optional: {} Type: string
`caseInsensitive` boolean	CaseInsensitive enables case-insensitive matching.	Optional: {}

WorkbenchWebhookSpec

WorkbenchWebhookSpec defines the desired state of a WorkbenchWebhook.

Appears in:

WorkbenchWebhook

Field	Description	Validation
`workbenchRef` ObjectReference	WorkbenchRef references the Workbench this webhook trigger belongs to.	Required: {}
`name` string	Name is the unique name for this webhook trigger on the workbench. If not set, metadata.name is used.	Optional: {} Type: string
`webhookName` string	WebhookName is the name of an observability webhook in the Console API that receives events. Either WebhookName or IssueWebhookName must be set.	Optional: {} Type: string
`issueWebhookName` string	IssueWebhookName is the name of an issue webhook in the Console API that receives events. Either WebhookName or IssueWebhookName must be set.	Optional: {} Type: string
`matches` WorkbenchWebhookMatchesSpec	Matches defines criteria to match incoming webhook payloads.	Optional: {}
`prompt` string	Prompt is the prompt to run when the webhook matches.	Optional: {} Type: string
`reconciliation` Reconciliation	Reconciliation settings for this resource.	Optional: {}

YamlOverlay

YamlOverlay defines a YAML merge operation to modify existing YAML files.

Appears in:

PrAutomationUpdateConfiguration

Field	Description	Validation
`file` string	File to execute the overlay on.	Required: {}
`yaml` string	Yaml (possibly templated) to use as the overlayed YAML blob written to the file.	Required: {}
`templated` boolean	Templated indicates whether you want to apply templating to the YAML blob before overlaying.	Optional: {}
`listMerge` ListMerge	ListMerge defines how you want list merge to be performed, defaults to OVERWRITE.	Enum: [OVERWRITE APPEND] Optional: {}