cluster.redpanda.com/v1alpha2

host string

The host to match. If not set, will default to match all hosts
with the specified operation and permissionType. Note that
the asterisk is literal and matches hosts that are set to

operation ACLOperation

The ACL operation to match

permissionType ACLType

The permission type

principal string

The name of the principal, if not set will default to match
all principals with the specified operation and permissionType

accessFilter ACLAccessFilter

The access filter

resourceFilter ACLResourceFilter

The resource filter

name string

patternType PatternType

resourceType ResourceType

type ResourceType

Type specifies the type of resource an ACL is applied to. Valid values:
- topic
- group
- cluster
- transactionalId

name string

Name of resource for which given ACL rule applies. If using type cluster this must not be specified.
Can be combined with patternType field to use prefix pattern.

patternType PatternType

Describes the pattern used in the resource field. The supported types are literal
and prefixed. With literal pattern type, the resource field will be used as a definition
of a full topic name. With prefix pattern type, the resource name will be used only as
a prefix. Prefixed patterns can only be specified when using types topic, group, or
transactionalId. Default value is literal. Valid values:
- literal
- prefixed

type ACLType

Type specifies the type of ACL rule to create. Valid values are:
- allow
- deny

resource ACLResourceSpec

Indicates the resource for which given ACL rule applies.

host string

The host from which the action described in the ACL rule is allowed or denied.
If not set, it defaults to *, allowing or denying the action from any host.

operations ACLOperation array

List of operations which will be allowed or denied. Valid values are resource type dependent, but include:
- Read
- Write
- Delete
- Alter
- Describe
- IdempotentWrite
- ClusterAction
- Create
- AlterConfigs
- DescribeConfigs

enabled boolean

Specifies whether this Listener is enabled.

authenticationMethod string

Specifies the authentication method for this listener. For example, 'mtls_identity', sasl or http_basic.

appProtocol string

port integer

Specifies the container port number for this listener.

tls ListenerTLS

Configures TLS settings for the internal listener.

prefixTemplate string

Specifies the template used for generating the advertised addresses of
Services. This field accepts a string template that dynamically
constructs Service addresses based on various parameters such as Service
name and port number.
For historical backwards compatibility, this field is present on both
internal and external listeners. However, it is ignored when specified
on internal listeners.

external object (keys:string, values:ExternalListener)

Defines settings for the external listeners.

urls string array

Specifies a list of broker addresses in the format <host>:<port>

tls CommonTLS

Defines TLS configuration settings for Redpanda clusters that have TLS enabled.

sasl AdminSASL

Defines authentication configuration settings for Redpanda clusters that have authentication enabled.

username string

Specifies the username.

mechanism SASLMechanism

Specifies the SASL/SCRAM authentication mechanism.

password ValueSource

Specifies the password.

authToken ValueSource

Specifies token for token-based authentication (only used if no username/password are provided).

passwordSecretRef SecretKeyRef

Deprecated: use password instead

token SecretKeyRef

Deprecated: use authToken instead

enabled boolean

Specifies whether to enable audit logging or not

listener string

Kafka external listener name, note that it must have authenticationMethod set to sasl

partitions integer

Integer value defining the number of partitions used by a newly created audit topic

enabledEventTypes string array

Event types that should be captured by audit logs

excludedTopics string array

List of topics to exclude from auditing

excludedPrincipals string array

List of principals to exclude from auditing

clientMaxBufferSize integer

Defines the number of bytes (in bytes) allocated by the internal audit client for audit messages.

queueDrainIntervalMs integer

In ms, frequency in which per shard audit logs are batched to client for write to audit log.

queueMaxBufferSizePerShard integer

Defines the maximum amount of memory used (in bytes) by the audit buffer in each shard

replicationFactor integer

Defines the replication factor for a newly created audit log topic. This configuration applies
only to the audit log topic and may be different from the cluster or other topic configurations.
This cannot be altered for existing audit log topics. Setting this value is optional. If a value is not provided,
Redpanda will use the internal_topic_replication_factor cluster config value. Default is null

sasl SASL

Configures SASL authentication in the Helm values.

jwtSigningKey string

oidc OIDCLoginSecrets

enabled boolean

minReplicas integer

maxReplicas integer

targetCPUUtilizationPercentage integer

targetMemoryUtilizationPercentage integer

name string

Name specifies the name of the bootstrap user created for the cluster, if unspecified
defaults to "kubernetes-controller".
NOTE: for the StretchCluster kind this field is currently ignored; the bootstrap
username is fixed to "kubernetes-controller". Only secretKeyRef is honored there.

secretKeyRef SecretKeySelector

Specifies the location where the generated password will be written or a pre-existing
password will be read from. For the StretchCluster kind the referenced key is required
(there is no default key at the CRD level).

For the StretchCluster kind the referenced Secret is read and replicated by the
operator to every member cluster in the same namespace, so whoever can set this field
is trusted to name a Secret whose contents may be copied across all member clusters of
the mesh. The operator never overwrites an existing Secret of that name on a member
cluster.

mechanism string

Specifies the authentication mechanism to use for the bootstrap user. Options are SCRAM-SHA-256 and SCRAM-SHA-512.
NOTE: for the StretchCluster kind this field is currently ignored; the mechanism is
taken from sasl.mechanism.

maxUnavailable integer

Defines the maximum number of Pods that can be unavailable during a voluntary disruption.

cores Quantity

Specifies the number of CPU cores available to the application. Redpanda makes use of a thread per core model. For details, see How Redpanda Works. For this reason, Redpanda should only be given full cores. Note: You can increase cores, but decreasing cores is not currently supported. See the GitHub issue:https://github.com/redpanda-data/redpanda/issues/350. This setting is equivalent to --smp, resources.requests.cpu, and resources.limits.cpu. For production, use 4 or greater.

overprovisioned boolean

Specifies whether Redpanda assumes it has all of the provisioned CPU. This should be true unless the container has CPU affinity. Equivalent to: --idle-poll-time-us 0, --thread-affinity 0, and --poll-aio 0. If the value of full cores in resources.cpu.cores is less than 1, this setting is set to true.

issuerRef IssuerRef

Specify the name of an existing Issuer or ClusterIssuer resource to use to generate certificates. Requires cert-manager. See https://cert-manager.io/v1.1-docs.

secretRef SecretRef

Specify the name of an existing Secret resource that contains your TLS certificate.

clientSecretRef SecretRef

Specify the name of an existing Secret resource that contains your client TLS certificate.

duration Duration

Specifies the validity duration of certificates generated with issuerRef.

caEnabled boolean

Specifies whether to include the ca.crt file in the trust stores of all listeners. Set to true only for certificates that are not authenticated using public certificate authorities (CAs).

applyInternalDNSNames boolean

Specifies you wish to have Kubernetes internal dns names (IE the headless service of the redpanda StatefulSet) included in dnsNames of the certificate even, when supplying an issuer.

enabled boolean

chartName string

Specifies the name of the chart to deploy.

chartVersion string

Defines the version of the Redpanda Helm chart to deploy.

helmRepositoryName string

Defines the chart repository to use. Defaults to redpanda if not defined.

timeout Duration

Specifies the time to wait for any individual Kubernetes operation (like Jobs
for hooks) during Helm actions. Defaults to 15m0s.

upgrade RawExtension

Defines how to handle upgrades, including failures.

useFlux boolean

Setting the useFlux flag to false disables the Helm controller’s reconciliation of the Helm chart.
This ties the operator to a specific version of the Go-based Redpanda Helm chart, causing all other
ChartRef fields to be ignored.

Before disabling useFlux, ensure that your chartVersion is aligned with 5.9.21 or the corresponding
version of the Redpanda chart.

Note: When useFlux is set to false, RedpandaStatus may become inaccurate if the HelmRelease is
manually deleted.

To dynamically switch Flux controllers (HelmRelease and HelmRepository), setting useFlux to false
will suspend these resources instead of removing them.

References:
- https://fluxcd.io/flux/components/helm/helmreleases/#suspend
- https://fluxcd.io/flux/components/source/helmrepositories/#suspend

group string

Group is used to override the object group that this reference points to.
If unspecified, defaults to "cluster.redpanda.com".
A bare API group only — controllers match it by string comparison, so a
"group/version" value (e.g. "cluster.redpanda.com/v1alpha2") would
silently match nothing and the referencing object would never bind.

kind string

Kind is used to override the object kind that this reference points to.
If unspecified, defaults to "Redpanda".

name string

Name specifies the name of the cluster being referenced.

namespace string

Namespace specifies the namespace of the cluster being referenced.
If unspecified, defaults to the namespace of the referencing object.
Setting this allows referencing a cluster that resides in a different
namespace, e.g. a ShadowLink whose source and shadow Redpanda clusters
live in separate namespaces on the same Kubernetes cluster.

clusterRef ClusterRef

ClusterRef is a reference to the cluster where the object should be created.
It is used in constructing the client created to configure a cluster.
This takes precedence over StaticConfigurationSource.

staticConfiguration StaticConfigurationSource

StaticConfiguration holds connection parameters to Kafka and Admin APIs.

enabled boolean

Enabled tells any connections derived from this configuration to leverage TLS even if no
certificate configuration is specified. It only is relevant if no other field is specified
in the TLS configuration block, as, for backwards compatibility reasons, any CA/Cert/Key-specification
results in attempting to create a connection using TLS - specifying "false" in such a case does
not disable TLS from being used. Leveraging this option is to support the use-case where a
connection is served by publically issued TLS certificates that don’t require any additional certificate
specification.

caCert ValueSource

CaCert is the reference for certificate authority used to establish TLS connection to Redpanda

cert ValueSource

Cert is the reference for client public certificate to establish mTLS connection to Redpanda

key ValueSource

Key is the reference for client private certificate to establish mTLS connection to Redpanda

caCertSecretRef SecretKeyRef

Deprecated: replaced by "caCert".

certSecretRef SecretKeyRef

Deprecated: replaced by "cert".

keySecretRef SecretKeyRef

Deprecated: replaced by "key".

insecureSkipTlsVerify boolean

InsecureSkipTLSVerify can skip verifying Redpanda self-signed certificate when establish TLS connection to Redpanda

rpk RawExtension

Specifies cluster configuration properties. See Cluster Configuration Properties.

cluster RawExtension

Specifies cluster configuration properties. See Cluster Configuration Properties.

extraClusterConfiguration ClusterConfiguration

Holds values (or references to values) that should be used to configure the cluster; these
are resolved late in order to avoid embedding secrets directly into bootstrap configurations
exposed as Kubernetes configmaps.

node RawExtension

Specifies broker configuration properties. See Broker Configuration Properties.

tunable RawExtension

Specifies tunable configuration properties. See Cluster Configuration Properties.

schema_registry_client RawExtension

Specifies tunable configuration properties. See Cluster Configuration Properties.

pandaproxy_client RawExtension

Specifies tunable configuration properties. See Cluster Configuration Properties.

name string

value string

source string

unknownTags object (keys:string, values:string)

UnknownTags are tags Kafka sent that we do not know the purpose of.

enabled boolean

Specifies whether the sidecar is enabled.

extraVolumeMounts string

Specifies additional volumes to mount to the sidecar.
DEPRECATED: Use sideCars.extraVolumeMounts

resources ResourceRequirements

Specifies resource requests for the sidecar container.
DEPRECATED: Use sideCars.resources

securityContext SecurityContext

Specifies the container’s security context, including privileges and access levels of the container and its processes.
DEPRECATED: Use sideCars.securityContext

name string

Name is a key this entry corresponds to (e.g. segment.bytes).

value string

Value is the value for this config key. If the key is sensitive,
the value will be null.

readOnly boolean

ReadOnly signifies whether this is not a dynamic config option.

Note that this field is not always correct, and you may need to check
whether the Source is any dynamic enum. See franz-go#91 for more details.

isDefault boolean

IsDefault is whether this is a default config option. This has been
replaced in favor of Source.

source string

Source is where this config entry is from.

This field has a default of -1.

isSensitive boolean

IsSensitive signifies whether this is a sensitive config key, which
is either a password or an unknown type.

configSynonyms ConfigSynonyms array

ConfigSynonyms contains fallback key/value pairs for this config
entry, in order of preference. That is, if a config entry is both
dynamically configured and has a default, the top level return will be
the dynamic configuration, while its "synonym" will be the default.

configType string

ConfigType specifies the configuration data type.

documentation string

Documentation is optional documentation for the config entry.

unknownTags object (keys:string, values:string)

UnknownTags are tags Kafka sent that we do not know the purpose of.

extraVolumeMounts string

resources ResourceRequirements

additionalCLIArgs string array

enabled boolean

Specifies whether to create a ServiceMonitor that can be used by Prometheus Operator or VictoriaMetrics Operator to scrape the metrics.

labels object (keys:string, values:string)

Adds custom labels to the ServiceMonitor resource.

scrapeInterval string

Specifies how often to scrape metrics.

annotations object (keys:string, values:string)

Adds custom Annotations to the ServiceMonitor resource.

namespaceSelector NamespaceSelector

Adds custom namespaceSelector to monitoring resources

create boolean

Specifies whether to create the resource.

enabled boolean

Deprecated: this field exists for storage backwards compatibility and is
never used. Prefer Create.

apiVersion string

cluster.redpanda.com/v1alpha2

kind string

Console

kind string

Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

apiVersion string

APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

metadata ObjectMeta

Refer to the Kubernetes API documentation for fields of metadata.

spec ConsoleSpec

status ConsoleStatus

create boolean

Indicates whether the corresponding Kubernetes object (ConfigMap, Secret, or Deployment) should be created.

replicaCount integer

image Image

imagePullSecrets LocalObjectReference array

automountServiceAccountToken boolean

serviceAccount ServiceAccountConfig

commonLabels object (keys:string, values:string)

annotations object (keys:string, values:string)

podAnnotations object (keys:string, values:string)

podLabels object (keys:string, values:string)

podSecurityContext PodSecurityContext

securityContext SecurityContext

service ServiceConfig

ingress IngressConfig

gateway GatewayConfig

resources ResourceRequirements

autoscaling AutoScaling

nodeSelector object (keys:string, values:string)

tolerations Toleration array

affinity Affinity

topologySpreadConstraints TopologySpreadConstraint array

priorityClassName string

config RawExtension

extraEnv EnvVar array

extraEnvFrom EnvFromSource array

extraVolumes Volume array

extraVolumeMounts VolumeMount array

extraContainers Container array

extraContainerPorts ContainerPort array

secretMounts SecretMount array

secret SecretConfig

licenseSecretRef SecretKeySelector

livenessProbe ProbeApplyConfiguration

LivenessProbe describes a health check to be performed against a container to determine whether it is
alive.

readinessProbe ProbeApplyConfiguration

ReadinessProbe describes a health check to be performed against a container to determine whether it is
ready to receive traffic.

deployment DeploymentConfig

strategy DeploymentStrategy

warnings string array

Warnings is a slice of human readable warnings generated by the automatic
migration of a Console V2 config to a Console V3 config. If warnings are
present, they will describe which fields from the original config have
been dropped and why.
Setting this field has no effect.

monitoring MonitoringConfig

cluster ClusterSource

observedGeneration integer

The generation observed by the Console controller.

replicas integer

Total number of non-terminating Pods targeted by this Console’s Deployment.

updatedReplicas integer

Total number of non-terminating pods targeted by this Console’s Deployment that have the desired template spec.

readyReplicas integer

Total number of non-terminating pods targeted by this Console’s Deployment with a Ready Condition.

availableReplicas integer

Total number of available non-terminating pods (ready for at least minReadySeconds) targeted by this Console’s Deployment.

unavailableReplicas integer

Total number of unavailable pods targeted by this deployment. This is the total number of
pods that are still required for the deployment to have 100% available capacity. They may
either be pods that are running but not yet available or pods that still have not been created.

replicaCount integer

image Image

imagePullSecrets LocalObjectReference array

automountServiceAccountToken boolean

serviceAccount ServiceAccountConfig

commonLabels object (keys:string, values:string)

annotations object (keys:string, values:string)

podAnnotations object (keys:string, values:string)

podLabels object (keys:string, values:string)

podSecurityContext PodSecurityContext

securityContext SecurityContext

service ServiceConfig

ingress IngressConfig

gateway GatewayConfig

resources ResourceRequirements

autoscaling AutoScaling

nodeSelector object (keys:string, values:string)

tolerations Toleration array

affinity Affinity

topologySpreadConstraints TopologySpreadConstraint array

priorityClassName string

config RawExtension

extraEnv EnvVar array

extraEnvFrom EnvFromSource array

extraVolumes Volume array

extraVolumeMounts VolumeMount array

extraContainers Container array

extraContainerPorts ContainerPort array

secretMounts SecretMount array

secret SecretConfig

licenseSecretRef SecretKeySelector

livenessProbe ProbeApplyConfiguration

LivenessProbe describes a health check to be performed against a container to determine whether it is
alive.

readinessProbe ProbeApplyConfiguration

ReadinessProbe describes a health check to be performed against a container to determine whether it is
ready to receive traffic.

deployment DeploymentConfig

strategy DeploymentStrategy

warnings string array

Warnings is a slice of human readable warnings generated by the automatic
migration of a Console V2 config to a Console V3 config. If warnings are
present, they will describe which fields from the original config have
been dropped and why.
Setting this field has no effect.

monitoring MonitoringConfig

max Quantity

Specifies the maximum resources that can be allocated to a container.

min Quantity

Specifies the minimum resources required for a container.

accessKey SecretWithConfigField

secretKey SecretWithConfigField

command string array

extraArgs string array

license string

Specifies the Enterprise license key.

licenseSecretRef EnterpriseLicenseSecretRef

Defines a reference to a Secret resource that contains the Enterprise license key.

key string

Specifies the key that is contains the Enterprise license in the Secret.

name string

Specifies the name of the Secret resource to use.

addresses string array

Specifies addresses for the external listeners to advertise.Provide one entry for each broker in order of StatefulSet replicas. The number of brokers is defined in statefulset.replicas. The values can be IP addresses or DNS names. If external.domain is set, the domain is appended to these values.

annotations object (keys:string, values:string)

Adds custom annotations to the external Service.

domain string

Specifies the domain to advertise to external clients. If specified, then it will be appended to the external.addresses values as each broker’s advertised address.

enabled boolean

Specifies whether the external access is enabled.

service ExternalService

Configures the external Service resource.

sourceRanges string array

Source range for external access. Only applicable when external.type is LoadBalancer.

type string

Specifies the external Service type. Only NodePort and LoadBalancer are supported. If undefined, then advertised listeners will be configured in Redpanda, but the Helm chart will not create a Service. NodePort is recommended in cases where latency is a priority.

externalDns ExternalDNS

Defines externalDNS configurations.

prefixTemplate string

Specifies a naming prefix template for external Services.

gateway GatewayExternalConfig

Configures Gateway API TLSRoute-based external access. When enabled, ClusterIP services and TLSRoute resources are created instead of NodePort/LoadBalancer services. The Gateway itself must be managed externally.

enabled boolean

Specifies whether externalDNS annotations are added to LoadBalancer Services. If you enable externalDns, each LoadBalancer Service defined in external.type will be annotated with an external-dns hostname that matches external.addresses[i].external.domain.

enabled boolean

Specifies whether this Listener is enabled.

authenticationMethod string

Specifies the authentication method for this listener. For example, 'mtls_identity', sasl or http_basic.

appProtocol string

port integer

Specifies the container port number for this listener.

tls ListenerTLS

Configures TLS settings for the internal listener.

prefixTemplate string

Specifies the template used for generating the advertised addresses of
Services. This field accepts a string template that dynamically
constructs Service addresses based on various parameters such as Service
name and port number.
For historical backwards compatibility, this field is present on both
internal and external listeners. However, it is ignored when specified
on internal listeners.

advertisedPorts integer array

Specifies the network port that the external Service listens on.

nodePort integer

type string

Selects how this listener is exposed externally. Unset inherits the cluster-wide external.type (NodePort/LoadBalancer). Set to "tlsroute" to route this listener via Gateway API: a TLSRoute is created for it (requires external.gateway with parentRefs) and it is excluded from the NodePort/LoadBalancer Service.

host string

Host is the SNI hostname for the bootstrap TLSRoute when using Gateway API external access.

hostTemplate string

HostTemplate is a Go template for per-broker TLSRoute SNI hostnames. Supports $POD_ORDINAL and $POD_NAME variables.

name string

enabled boolean

Specifies whether to create the external Service. If set to false, the external Service type is not created. You can still set your cluster with external access but not create the supporting Service. Set this to false to manage your own Service.

enabled boolean

expectedFS string

extraVolumeMounts string

Adds extra volume mounts.

resources ResourceRequirements

Specifies the resource requirements.

enabled boolean

annotations object (keys:string, values:string)

parentRefs GatewayParentReference array

hostnames string array

path string

pathType PathMatchType

enabled boolean

Enables Gateway API TLSRoute-based external access.

parentRefs GatewayParentRefConfig array

Defines which Gateway(s) handle the TLSRoutes. At least one parent reference must be provided.

advertisedPort integer

The port advertised to clients. Defaults to 443.

group string

API group of the referent. Defaults to "gateway.networking.k8s.io".

kind string

Kind of the referent. Defaults to "Gateway".

name string

Name of the referent.

namespace string

Namespace of the referent.

sectionName string

Name of a section within the target resource.

name string

namespace string

sectionName SectionName

apiVersion string

cluster.redpanda.com/v1alpha2

kind string

Group

kind string

Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

apiVersion string

APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

metadata ObjectMeta

Refer to the Kubernetes API documentation for fields of metadata.

spec GroupSpec

Defines the desired state of the Redpanda group.

status GroupStatus

Represents the current status of the Redpanda group.

acls ACLRule array

List of ACL rules which should be applied to this group.

cluster ClusterSource

ClusterSource is a reference to the cluster where the group’s ACLs should be managed.
It is used in constructing the client created to configure a cluster.

authorization GroupAuthorizationSpec

Authorization rules defined for this group. The operator always manages ACLs
for the group principal. When omitted or empty, any existing ACLs for this
group are removed.

observedGeneration integer

Specifies the last observed generation.

conditions Condition array

Conditions holds the conditions for the Redpanda group.

enabled boolean

Specifies whether this Listener is enabled.

authenticationMethod string

Specifies the authentication method for this listener. For example, 'mtls_identity', sasl or http_basic.

appProtocol string

port integer

Specifies the container port number for this listener.

tls ListenerTLS

Configures TLS settings for the internal listener.

prefixTemplate string

Specifies the template used for generating the advertised addresses of
Services. This field accepts a string template that dynamically
constructs Service addresses based on various parameters such as Service
name and port number.
For historical backwards compatibility, this field is present on both
internal and external listeners. However, it is ignored when specified
on internal listeners.

external object (keys:string, values:ExternalListener)

Defines settings for the external listeners.

kafkaEndpoint string

Configures the listener to use for HTTP connections. For example default for the internal listener.
deprecated and not respected.

registry string

repository string

pullPolicy PullPolicy

tag string

enabled boolean

className string

annotations object (keys:string, values:string)

hosts IngressHost array

tls IngressTLS array

host string

paths IngressPath array

path string

pathType PathType

repository string

tag string

configurator Configurator

extraInitContainers string

setDataDirOwnership SetDataDirOwnership

Defines the settings related to ownership of the Redpanda data directory in environments where root access is restricted.

setTieredStorageCacheDirOwnership SetTieredStorageCacheDirOwnership

Defines the settings related to ownership of the Tiered Storage cache in environments where root access is restricted.

fsValidator FsValidator

Defines the setting for init container that not allow to start Redpanda until filesystem matches

tuning Tuning

Defines settings for the autotuner tool in Redpanda. The autotuner identifies the hardware configuration in the container and optimizes the Linux kernel to give you the best performance.

name string

Specifies the name of the resource.

kind string

Specifies the kind of resource. One of Issuer or ClusterIssuer.

group string

enabled boolean

Specifies whether this Listener is enabled.

authenticationMethod string

Specifies the authentication method for this listener. For example, 'mtls_identity', sasl or http_basic.

appProtocol string

port integer

Specifies the container port number for this listener.

tls ListenerTLS

Configures TLS settings for the internal listener.

prefixTemplate string

Specifies the template used for generating the advertised addresses of
Services. This field accepts a string template that dynamically
constructs Service addresses based on various parameters such as Service
name and port number.
For historical backwards compatibility, this field is present on both
internal and external listeners. However, it is ignored when specified
on internal listeners.

external object (keys:string, values:ExternalListener)

Defines settings for the external listeners.

brokers string array

Specifies a list of broker addresses in the format <host>:<port>

tls CommonTLS

Defines TLS configuration settings for Redpanda clusters that have TLS enabled.

sasl KafkaSASL

Defines authentication configuration settings for Redpanda clusters that have authentication enabled.

username string

Specifies the username.

password ValueSource

Specifies the password.

mechanism SASLMechanism

Specifies the SASL/SCRAM authentication mechanism.

oauth KafkaSASLOAuthBearer

gssapi KafkaSASLGSSAPI

awsMskIam KafkaSASLAWSMskIam

passwordSecretRef SecretKeyRef

Deprecated: use password instead

accessKey string

secretKey ValueSource

secretKeySecretRef SecretKeyRef

Deprecated: use secretKey instead

sessionToken ValueSource

SessionToken, if non-empty, is a session / security token to use for authentication.
See: https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html

sessionTokenSecretRef SecretKeyRef

Deprecated: use sessionToken instead

userAgent string

UserAgent is the user agent to for the client to use when connecting
to Kafka, overriding the default "franz-go/<runtime.Version()>/<hostname>".

Setting a UserAgent allows authorizing based on the aws:UserAgent
condition key; see the following link for more details:
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-useragent

authType string

keyTabPath string

kerberosConfigPath string

serviceName string

username string

password ValueSource

passwordSecretRef SecretKeyRef

Deprecated: use password instead

realm string

enableFast boolean

EnableFAST enables FAST, which is a pre-authentication framework for Kerberos.
It includes a mechanism for tunneling pre-authentication exchanges using armored KDC messages.
FAST provides increased resistance to passive password guessing attacks.

token ValueSource

tokenSecretRef SecretKeyRef

Deprecated: use token instead

saslPassword string

awsMskIamSecretKey string

tlsCa string

tlsCert string

tlsKey string

tlsPassphrase string

secret_key string

Specifies the key that is contains the Enterprise license in the Secret.

secret_name string

Specifies the name of the Secret.

enabled boolean

Specifies whether this Listener is enabled.

authenticationMethod string

Specifies the authentication method for this listener. For example, 'mtls_identity', sasl or http_basic.

appProtocol string

port integer

Specifies the container port number for this listener.

tls ListenerTLS

Configures TLS settings for the internal listener.

prefixTemplate string

Specifies the template used for generating the advertised addresses of
Services. This field accepts a string template that dynamically
constructs Service addresses based on various parameters such as Service
name and port number.
For historical backwards compatibility, this field is present on both
internal and external listeners. However, it is ignored when specified
on internal listeners.

cert string

References a specific certificate for the listener.

enabled boolean

Specifies whether TLS is enabled for the listener.

secretRef string

References a Secret resource containing TLS credentials for the listener.

Deprecated: Setting SecretRef has no affect and will be removed in
future releases.

requireClientAuth boolean

Indicates whether client authentication (mTLS) is required.

trustStore TrustStore

TrustStore allows setting the truststore_path on this listener. If
specified, this field takes precedence over [Certificate.CAEnabled].

admin Admin

Configures settings for the Admin API listeners.

http HTTP

Configures settings for the HTTP Proxy listeners.

kafka Kafka

Configures settings for the Kafka API listeners.

rpc RPC

Configures settings for the RPC API listener.

schemaRegistry SchemaRegistry

Configures settings for the Schema Registry listeners.

failureThreshold integer

Sets the number of consecutive failures required to consider a Pod as not live.

initialDelaySeconds integer

Specifies the time in seconds to wait before the first probe is initiated.

periodSeconds integer

Determines the frequency in seconds of performing the probe.

timeoutSeconds integer

successThreshold integer

logLevel string

Sets the verbosity level of logs.

usageStats UsageStats

Specifies whether to send usage statistics to Redpanda Data.

container ContainerResources

Defines resource limits for containers.

enable_memory_locking boolean

Enables memory locking. For production, set to true.

redpanda RedpandaMemory

Allows you to optionally specify the memory size for both the Redpanda process and the underlying reserved memory used by Seastar.

labels object (keys:string, values:string)

Labels specifies the Kubernetes labels to apply to a managed resource.

annotations object (keys:string, values:string)

Annotations specifies the Kubernetes annotations to apply to a managed resource.

enabled boolean

Specifies whether to create a ServiceMonitor that can be used by Prometheus Operator or VictoriaMetrics Operator to scrape the metrics.

labels object (keys:string, values:string)

Adds custom labels to the ServiceMonitor resource.

scrapeInterval string

Specifies how often to scrape metrics.

tlsConfig RawExtension

Specifies tls configuration properties.

enableHttp2 boolean

enabled boolean

scrapeInterval string

labels object (keys:string, values:string)

name string

The resource name, or ""
Note if the wildcar "" is used it must be the only character
and patternType must be literal

filterType FilterType

Valid values:
- include
- exclude

patternType PatternType

Default value is literal. Valid values:
- literal
- prefixed

name string

Name is the environment-variable name the pipeline YAML references.
Must match standard env-var characters: [A-Z_][A-Z0-9_]*.

source ValueSource

Source is the value provider. Exactly one of inline / configMapKeyRef
/ secretKeyRef / externalSecretRef must be set; the ValueSource
XValidation rules enforce this.

crossClusterMode CrossClusterMode

CrossClusterMode controls how per-pod Services route traffic to pods
on remote Kubernetes clusters. Defaults to "mesh".

clientSecret string

value string

Value is a hardcoded value to use for the given password. It should only be used for testing purposes.
In production, use ValueFrom.

valueFrom PasswordSource

ValueFrom specifies a source for a password to be fetched from when specifying or generating user credentials.
Optional when value is set: the type-level validation rule enforces
that at least one of the two is present. (This field being marked
required in the schema used to make the documented value-only form
impossible to apply — https://github.com/redpanda-data/redpanda-operator/issues/1290.)

noGenerate boolean

NoGenerate when set to true does not create kubernetes secret when ValueFrom points to none-existent secret.

secretKeyRef SecretKeySelector

SecretKeyRef specifies the secret used in reading a User password.
If the Secret exists and has a value in it, then that value is used.
If the Secret does not exist, or is empty, a password is generated and
stored based on this configuration.

enabled boolean

Enabled controls whether this per-pod Service is created. Defaults to true.

labels object (keys:string, values:string)

annotations object (keys:string, values:string)

spec ServiceSpecApplyConfiguration

annotations object (keys:string, values:string)

Adds annotations to the PersistentVolumeClaims to provide additional information or metadata that can be used by other tools or libraries.

enabled boolean

Specifies whether to enable the Helm chart to create PersistentVolumeClaims for Pods.

labels object (keys:string, values:string)

Applies labels to the PersistentVolumeClaims to facilitate identification and selection based on custom criteria.

size Quantity

Specifies the storage capacity required.

storageClass string

Specifies the StorageClass for the PersistentVolumeClaims to determine how PersistentVolumes are provisioned and managed.

nameOverwrite string

Option to change volume claim template name for tiered storage persistent volume if tiered.mountType is set to persistentVolume

apiVersion string

cluster.redpanda.com/v1alpha2

kind string

Pipeline

kind string

Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

apiVersion string

APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

metadata ObjectMeta

Refer to the Kubernetes API documentation for fields of metadata.

spec PipelineSpec

Spec defines the desired state of the Pipeline.

status PipelineStatus

Status represents the current observed state of the Pipeline.

maxUnavailable integer

MaxUnavailable defines the maximum number of pipeline pods that can be
unavailable during a voluntary disruption. Defaults to 1 if not set.

configYaml string

ConfigYAML is the user-supplied Redpanda Connect pipeline YAML.
Reference cluster-bound or sensitive values from .valueSources via
${NAME} interpolation; the operator resolves them at render time.

When .cluster is set, the operator inline-merges connection fields
(seed_brokers, tls, sasl) into any input.redpanda and
output.redpanda blocks in this YAML, derived from the resolved
cluster connection and .userRef. Users only need to write the
per-plugin fields (topic, key, consumer_group, etc.); brokers, TLS,
and SASL are filled in by the operator.

User-side keys win on conflict — set a key explicitly (for example,
seed_brokers pointing at a different cluster) and the operator’s
generated value is skipped for that key.

The merge targets the redpanda input/output plugins specifically.
Any redpanda_common blocks the user authors are passed through
unchanged — the operator does not inject connection fields into
them.

displayName string

DisplayName is a human-readable name for the pipeline.
Maps to the pipeline display name when migrating to Redpanda Cloud.

description string

Description is an optional description of what this pipeline does.
Maps to the pipeline description when migrating to Redpanda Cloud.

tags object (keys:string, values:string)

Tags are key-value pairs for organizing and filtering pipelines.
Maps to pipeline tags when migrating to Redpanda Cloud.

configFiles object (keys:string, values:string)

ConfigFiles defines additional configuration files to mount alongside
the main pipeline configuration. Each entry maps a filename to its content.
Files are mounted in the /config directory alongside connect.yaml.
The key "connect.yaml" is reserved and cannot be used.
Maps to pipeline config files when migrating to Redpanda Cloud.

replicas integer

Replicas is the number of pipeline replicas to run.

This field backs the Pipeline’s scale subresource, so kubectl scale
pipeline/<name>, HorizontalPodAutoscaler, and KEDA ScaledObjects all
read and write it through /scale. To autoscale a pipeline, point the
autoscaler at the Pipeline itself — NOT at its Deployment, whose
replica count the operator continuously resets to this field:

scaleTargetRef:
apiVersion: cluster.redpanda.com/v1alpha2
kind: Pipeline
name: <pipeline-name>

CPU and memory HPAs work out of the box: pipeline pods always carry
resource requests (operator defaults apply when .resources is unset).
To scale on the metrics Redpanda Connect itself emits (input_received,
output_sent, processor_latency_ns, …​) feed them to the autoscaler —
e.g. scrape the pods' http port at /metrics (the operator’s
monitoring PodMonitor does this) into Prometheus, then use
prometheus-adapter for HPA custom metrics or a KEDA prometheus
trigger.

When an autoscaler manages this field, omit it from applied manifests
(or have your GitOps tool ignore it) so config syncs don’t undo the
autoscaler’s writes.

image string

Image is the container image for the Redpanda Connect deployment.

serviceAccountName string

ServiceAccountName is the ServiceAccount to bind to the pipeline pod.
When unset, the namespace’s default ServiceAccount is used.

Setting this is the recommended way to scope per-pipeline cloud-IAM
trust (e.g. IRSA on EKS, Workload Identity on GKE, Pod Identity on
AKS). Annotating the namespace’s default SA works but grants every
pipeline in the namespace the same role — naming a Pipeline-specific
SA here keeps the trust boundary per-pipeline.

The operator does NOT create the ServiceAccount; provision it
(along with the appropriate cloud-IAM annotations) out-of-band.

paused boolean

Paused stops the pipeline by scaling replicas to zero when set to true.

Paused wins over .replicas, including values an autoscaler writes
through the scale subresource: while paused the Deployment stays at
zero (the pipeline reports Stopped) even if HPA/KEDA keep updating
.replicas, and unpausing resumes at the current .replicas count.

resources ResourceRequirements

Resources defines the compute resource requirements for the pipeline pods.

extraInitContainers Container array

ExtraInitContainers are additional init containers run to completion,
in order, before the pipeline’s lint and connect containers start. Use
them for setup steps the pipeline depends on — fetching certificate
material, warming a cache, or waiting on an external dependency. They run
ahead of the operator’s built-in lint init container, so anything they
write into a volume from .extraVolumes is visible to lint and to the
connect runtime (mount it into the pipeline via .extraVolumeMounts).

This is a raw container passthrough with no operator-applied policy; the
pod’s service account and security posture apply. It is distinct from a
long-lived plugin sidecar (which would be an init container with
restartPolicy: Always and is not expressed here).

Example (with the backing volume and the mount that exposes the staged
file to the pipeline containers):
spec:
extraVolumes:
- name: shared
emptyDir: {}
extraVolumeMounts:
- name: shared
mountPath: /shared
readOnly: true
extraInitContainers:
- name: fetch-certs
image: curlimages/curl:8.11.0
command: ["sh", "-c", "curl -fsSL $CERT_URL -o /shared/ca.pem"]
volumeMounts:
- name: shared
mountPath: /shared

extraVolumes Volume array

ExtraVolumes are additional volumes added to the pipeline pod, typically
backing an .extraInitContainers staging step or an .extraVolumeMounts
entry. Raw passthrough: any Kubernetes volume source is accepted. The
names "config", "cluster-tls-ca", and "cluster-tls-client" are reserved
by the operator.

extraVolumeMounts VolumeMount array

ExtraVolumeMounts are additional volume mounts applied to the built-in
lint init container and the connect container (both, so the linted view
of the filesystem matches the runtime’s). Mounts for
.extraInitContainers are declared on those containers directly.

valueSources NamedValueSource array

ValueSources is a list of named values the pipeline YAML can reference
via ${NAME} interpolation. Each value is fetched at render time from
inline / ConfigMap / Secret / ExternalSecret and projected into the
pipeline pod as an environment variable. One named pull per entry —
avoids the bag-of-Secrets env-splat pattern.

Example:
spec:
valueSources:
- name: S3_SECRET_KEY
source:
secretKeyRef:
name: s3-creds
key: secret_access_key
configYaml: |
output:
aws_s3:
bucket: my-bucket
credentials:
secret: ${S3_SECRET_KEY}