# cluster.redpanda.com/v1alpha2

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [streaming-full.txt](https://docs.redpanda.com/streaming-full.txt)

---
title: cluster.redpanda.com/v1alpha2
latest-redpanda-tag: v26.2.1
latest-console-tag: v3.10.0
latest-operator-version: v26.2.1
# EOL = End-of-Life (support lifecycle status)
page-is-nearing-eol: "false"
page-is-past-eol: "false"
page-eol-date: July 28, 2027
latest-connect-version: 4.105.0
docname: k-crd
page-component-name: streaming
page-version: "26.2"
page-component-version: "26.2"
page-component-title: Streaming
page-relative-src-path: k-crd.adoc
page-edit-url: https://github.com/redpanda-data/docs/edit/main/modules/reference/pages/k-crd.adoc
description: Custom resource definitions for Redpanda resources. Use the Redpanda resources to create and manage Redpanda clusters, users and topics with the Redpanda Operator.
page-git-created-date: "2024-01-04"
page-git-modified-date: "2026-08-13"
support-status: supported
---

<!-- Source: https://docs.redpanda.com/streaming/current/reference/k-crd.md -->

Resource Types

-   [Console](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-console)

-   [Group](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-group)

-   [Pipeline](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipeline)

-   [Redpanda](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpanda)

-   [RedpandaBrokerPool](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandabrokerpool)

-   [RedpandaRole](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandarole)

-   [Schema](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schema)

-   [ShadowLink](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlink)

-   [StretchCluster](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchcluster)

-   [Topic](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-topic)

-   [User](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-user)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclaccessfilter)ACLAccessFilter

Filter an ACL based on its access

Appears in:

-   [ACLFilter](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclfilter)


| Field | Description |
| --- | --- |
| host string | The host to match. If not set, will default to match all hostswith the specified operation and permissionType. Note thatthe asterisk is literal and matches hosts that are set to |
| operation ACLOperation | The ACL operation to match |
| permissionType ACLType | The permission type |
| principal string | The name of the principal, if not set will default to matchall principals with the specified operation and permissionType |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclfilter)ACLFilter

A filter for ACLs

Appears in:

-   [ShadowLinkSecuritySettingsSyncOptions](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinksecuritysettingssyncoptions)


| Field | Description |
| --- | --- |
| accessFilter ACLAccessFilter | The access filter |
| resourceFilter ACLResourceFilter | The resource filter |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-acloperation)ACLOperation (string)

ACLOperation specifies the type of operation for an ACL.

Appears in:

-   [ACLAccessFilter](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclaccessfilter)

-   [ACLRule](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclrule)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclresourcefilter)ACLResourceFilter

Appears in:

-   [ACLFilter](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclfilter)


| Field | Description |
| --- | --- |
| name string |  |
| patternType PatternType |  |
| resourceType ResourceType |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclresourcespec)ACLResourceSpec

ACLResourceSpec indicates the resource for which given ACL rule applies.

Appears in:

-   [ACLRule](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclrule)


| Field | Description |
| --- | --- |
| type ResourceType | Type specifies the type of resource an ACL is applied to. Valid values:- topic- group- cluster- transactionalId |
| name string | Name of resource for which given ACL rule applies. If using type cluster this must not be specified.Can be combined with patternType field to use prefix pattern. |
| patternType PatternType | Describes the pattern used in the resource field. The supported types are literaland prefixed. With literal pattern type, the resource field will be used as a definitionof a full topic name. With prefix pattern type, the resource name will be used only asa prefix. Prefixed patterns can only be specified when using types topic, group, ortransactionalId. Default value is literal. Valid values:- literal- prefixed |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclrule)ACLRule

ACLRule defines an ACL rule applied to the given user.

Validations taken from [https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=75978240](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=75978240)

Appears in:

-   [GroupAuthorizationSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-groupauthorizationspec)

-   [RoleAuthorizationSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-roleauthorizationspec)

-   [UserAuthorizationSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-userauthorizationspec)


| Field | Description |
| --- | --- |
| type ACLType | Type specifies the type of ACL rule to create. Valid values are:- allow- deny |
| resource ACLResourceSpec | Indicates the resource for which given ACL rule applies. |
| host string | The host from which the action described in the ACL rule is allowed or denied.If not set, it defaults to *, allowing or denying the action from any host. |
| operations ACLOperation array | List of operations which will be allowed or denied. Valid values are resource type dependent, but include:- Read- Write- Delete- Alter- Describe- IdempotentWrite- ClusterAction- Create- AlterConfigs- DescribeConfigs |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-acltype)ACLType (string)

ACLType specifies the type, either allow or deny of an ACL rule.

Appears in:

-   [ACLAccessFilter](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclaccessfilter)

-   [ACLRule](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclrule)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-admin)Admin

Admin configures settings for the Admin API listeners.

Appears in:

-   [Listeners](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-listeners)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether this Listener is enabled. |
| authenticationMethod string | Specifies the authentication method for this listener. For example, 'mtls_identity', sasl or http_basic. |
| appProtocol string |  |
| port integer | Specifies the container port number for this listener. |
| tls ListenerTLS | Configures TLS settings for the internal listener. |
| prefixTemplate string | Specifies the template used for generating the advertised addresses ofServices. This field accepts a string template that dynamicallyconstructs Service addresses based on various parameters such as Servicename and port number.For historical backwards compatibility, this field is present on bothinternal and external listeners. However, it is ignored when specifiedon internal listeners. |
| external object (keys:string, values:ExternalListener) | Defines settings for the external listeners. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-adminapispec)AdminAPISpec

AdminAPISpec defines client configuration for connecting to Redpanda’s admin API.

Appears in:

-   [StaticConfigurationSource](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-staticconfigurationsource)


| Field | Description |
| --- | --- |
| urls string array | Specifies a list of broker addresses in the format <host>:<port> |
| tls CommonTLS | Defines TLS configuration settings for Redpanda clusters that have TLS enabled. |
| sasl AdminSASL | Defines authentication configuration settings for Redpanda clusters that have authentication enabled. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-adminsasl)AdminSASL

AdminSASL configures credentials to connect to Redpanda cluster that has authentication enabled.

Appears in:

-   [AdminAPISpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-adminapispec)


| Field | Description |
| --- | --- |
| username string | Specifies the username. |
| mechanism SASLMechanism | Specifies the SASL/SCRAM authentication mechanism. |
| password ValueSource | Specifies the password. |
| authToken ValueSource | Specifies token for token-based authentication (only used if no username/password are provided). |
| passwordSecretRef SecretKeyRef | Deprecated: use password instead |
| token SecretKeyRef | Deprecated: use authToken instead |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-auditlogging)AuditLogging

AuditLogging configures how to perform audit logging for a redpanda cluster

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether to enable audit logging or not |
| listener string | Kafka external listener name, note that it must have authenticationMethod set to sasl |
| partitions integer | Integer value defining the number of partitions used by a newly created audit topic |
| enabledEventTypes string array | Event types that should be captured by audit logs |
| excludedTopics string array | List of topics to exclude from auditing |
| excludedPrincipals string array | List of principals to exclude from auditing |
| clientMaxBufferSize integer | Defines the number of bytes (in bytes) allocated by the internal audit client for audit messages. |
| queueDrainIntervalMs integer | In ms, frequency in which per shard audit logs are batched to client for write to audit log. |
| queueMaxBufferSizePerShard integer | Defines the maximum amount of memory used (in bytes) by the audit buffer in each shard |
| replicationFactor integer | Defines the replication factor for a newly created audit log topic. This configuration appliesonly to the audit log topic and may be different from the cluster or other topic configurations.This cannot be altered for existing audit log topics. Setting this value is optional. If a value is not provided,Redpanda will use the internal_topic_replication_factor cluster config value. Default is null |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-auth)Auth

Auth configures authentication in the Helm values. See [Authentication and Authorization for Redpanda in Kubernetes](https://docs.redpanda.com/streaming/current/manage/kubernetes/security/authentication/).

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)

-   [StretchClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterspec)


| Field | Description |
| --- | --- |
| sasl SASL | Configures SASL authentication in the Helm values. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-authenticationsecrets)AuthenticationSecrets

Appears in:

-   [SecretConfig](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-secretconfig)


| Field | Description |
| --- | --- |
| jwtSigningKey string |  |
| oidc OIDCLoginSecrets |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-authorizationtype)AuthorizationType (string)

AuthorizationType specifies the type of authorization to use in creating a user.

Appears in:

-   [UserAuthorizationSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-userauthorizationspec)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-autoscaling)AutoScaling

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)

-   [ConsoleValues](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolevalues)


| Field | Description |
| --- | --- |
| enabled boolean |  |
| minReplicas integer |  |
| maxReplicas integer |  |
| targetCPUUtilizationPercentage integer |  |
| targetMemoryUtilizationPercentage integer |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-bootstrapuser)BootstrapUser

BootstrapUser configures the user used to bootstrap Redpanda when SASL is enabled.

Appears in:

-   [SASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-sasl)


> ❗ **IMPORTANT**
>
> for the StretchCluster kind the bootstrap password is consumed only when the
> cluster is first bootstrapped and cannot be rotated afterwards by editing this Secret,
> changing secretKeyRef to a different location, or removing secretKeyRef. Redpanda keeps
> the SCRAM credential it was bootstrapped with, so changing the source after bootstrap
> makes the operator and brokers authenticate with a credential the cluster never learned.
> Rotate the bootstrap user out of band (via the admin API) instead.

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-budget)Budget

Budget configures the management of disruptions affecting the Pods in the StatefulSet.

Appears in:

-   [Statefulset](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-statefulset)


| Field | Description |
| --- | --- |
| maxUnavailable integer | Defines the maximum number of Pods that can be unavailable during a voluntary disruption. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-cpu)CPU

CPU configures CPU resources for containers. See [Manage Pod Resources in Kubernetes](https://docs.redpanda.com/streaming/current/manage/kubernetes/k-manage-resources/).

Appears in:

-   [Resources](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-resources)

-   [StretchResources](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchresources)


| Field | Description |
| --- | --- |
| cores Quantity | Specifies the number of CPU cores available to the application. Redpanda makes use of a thread per core model. For details, see How Redpanda Works. For this reason, Redpanda should only be given full cores. Note: You can increase cores, but decreasing cores is not currently supported. See the GitHub issue:https://github.com/redpanda-data/redpanda/issues/350. This setting is equivalent to --smp, resources.requests.cpu, and resources.limits.cpu. For production, use 4 or greater. |
| overprovisioned boolean | Specifies whether Redpanda assumes it has all of the provisioned CPU. This should be true unless the container has CPU affinity. Equivalent to: --idle-poll-time-us 0, --thread-affinity 0, and --poll-aio 0. If the value of full cores in resources.cpu.cores is less than 1, this setting is set to true. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-certificate)Certificate

Certificate configures TLS certificates.

Appears in:

-   [TLS](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-tls)


| Field | Description |
| --- | --- |
| issuerRef IssuerRef | Specify the name of an existing Issuer or ClusterIssuer resource to use to generate certificates. Requires cert-manager. See https://cert-manager.io/v1.1-docs. |
| secretRef SecretRef | Specify the name of an existing Secret resource that contains your TLS certificate. |
| clientSecretRef SecretRef | Specify the name of an existing Secret resource that contains your client TLS certificate. |
| duration Duration | Specifies the validity duration of certificates generated with issuerRef. |
| caEnabled boolean | Specifies whether to include the ca.crt file in the trust stores of all listeners. Set to true only for certificates that are not authenticated using public certificate authorities (CAs). |
| applyInternalDNSNames boolean | Specifies you wish to have Kubernetes internal dns names (IE the headless service of the redpanda StatefulSet) included in dnsNames of the certificate even, when supplying an issuer. |
| enabled boolean |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-chartref)ChartRef

Appears in:

-   [RedpandaSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaspec)


| Field | Description |
| --- | --- |
| chartName string | Specifies the name of the chart to deploy. |
| chartVersion string | Defines the version of the Redpanda Helm chart to deploy. |
| helmRepositoryName string | Defines the chart repository to use. Defaults to redpanda if not defined. |
| timeout Duration | Specifies the time to wait for any individual Kubernetes operation (like Jobsfor hooks) during Helm actions. Defaults to 15m0s. |
| upgrade RawExtension | Defines how to handle upgrades, including failures. |
| useFlux boolean | Setting the useFlux flag to false disables the Helm controller’s reconciliation of the Helm chart.This ties the operator to a specific version of the Go-based Redpanda Helm chart, causing all otherChartRef fields to be ignored.Before disabling useFlux, ensure that your chartVersion is aligned with 5.9.21 or the correspondingversion of the Redpanda chart.Note: When useFlux is set to false, RedpandaStatus may become inaccurate if the HelmRelease ismanually deleted.To dynamically switch Flux controllers (HelmRelease and HelmRepository), setting useFlux to falsewill suspend these resources instead of removing them.References:- https://fluxcd.io/flux/components/helm/helmreleases/#suspend- https://fluxcd.io/flux/components/source/helmrepositories/#suspend |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-clusterconfiguration)ClusterConfiguration (ClusterConfiguration)

Appears in:

-   [Config](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-config)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-clusterref)ClusterRef

ClusterRef represents a reference to a cluster that is being targeted.

Appears in:

-   [ClusterSource](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-clustersource)


| Field | Description |
| --- | --- |
| group string | Group is used to override the object group that this reference points to.If unspecified, defaults to "cluster.redpanda.com".A bare API group only — controllers match it by string comparison, so a"group/version" value (e.g. "cluster.redpanda.com/v1alpha2") wouldsilently match nothing and the referencing object would never bind. |
| kind string | Kind is used to override the object kind that this reference points to.If unspecified, defaults to "Redpanda". |
| name string | Name specifies the name of the cluster being referenced. |
| namespace string | Namespace specifies the namespace of the cluster being referenced.If unspecified, defaults to the namespace of the referencing object.Setting this allows referencing a cluster that resides in a differentnamespace, e.g. a ShadowLink whose source and shadow Redpanda clusterslive in separate namespaces on the same Kubernetes cluster. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-clustersource)ClusterSource

ClusterSource defines how to connect to a particular Redpanda cluster.

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)

-   [GroupSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-groupspec)

-   [PipelineSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipelinespec)

-   [RoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-rolespec)

-   [SchemaSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaspec)

-   [ShadowLinkSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkspec)

-   [TopicSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-topicspec)

-   [UserSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-userspec)


| Field | Description |
| --- | --- |
| clusterRef ClusterRef | ClusterRef is a reference to the cluster where the object should be created.It is used in constructing the client created to configure a cluster.This takes precedence over StaticConfigurationSource. |
| staticConfiguration StaticConfigurationSource | StaticConfiguration holds connection parameters to Kafka and Admin APIs. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-commontls)CommonTLS

CommonTLS specifies TLS configuration settings for Redpanda clusters that have authentication enabled.

Appears in:

-   [AdminAPISpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-adminapispec)

-   [KafkaAPISpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkaapispec)

-   [SchemaRegistrySpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaregistryspec)

-   [ShadowLinkSchemaRegistryAPIOptions](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistryapioptions)


| Field | Description |
| --- | --- |
| enabled boolean | Enabled tells any connections derived from this configuration to leverage TLS even if nocertificate configuration is specified. It only is relevant if no other field is specifiedin the TLS configuration block, as, for backwards compatibility reasons, any CA/Cert/Key-specificationresults in attempting to create a connection using TLS - specifying "false" in such a case doesnot disable TLS from being used. Leveraging this option is to support the use-case where aconnection is served by publically issued TLS certificates that don’t require any additional certificatespecification. |
| caCert ValueSource | CaCert is the reference for certificate authority used to establish TLS connection to Redpanda |
| cert ValueSource | Cert is the reference for client public certificate to establish mTLS connection to Redpanda |
| key ValueSource | Key is the reference for client private certificate to establish mTLS connection to Redpanda |
| caCertSecretRef SecretKeyRef | Deprecated: replaced by "caCert". |
| certSecretRef SecretKeyRef | Deprecated: replaced by "cert". |
| keySecretRef SecretKeyRef | Deprecated: replaced by "key". |
| insecureSkipTlsVerify boolean | InsecureSkipTLSVerify can skip verifying Redpanda self-signed certificate when establish TLS connection to Redpanda |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-compatibilitylevel)CompatibilityLevel (string)

Appears in:

-   [SchemaSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaspec)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-config)Config

Config configures Redpanda config properties supported by Redpanda that may not work correctly in a Kubernetes cluster. Changing these values from the defaults comes with some risk. Use these properties to customize various Redpanda configurations that are not available in the `RedpandaClusterSpec`. These values have no impact on the configuration or behavior of the Kubernetes objects deployed by Helm, and therefore should not be modified for the purpose of configuring those objects. Instead, these settings get passed directly to the Redpanda binary at startup.

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)

-   [StretchClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterspec)


| Field | Description |
| --- | --- |
| rpk RawExtension | Specifies cluster configuration properties. See Cluster Configuration Properties. |
| cluster RawExtension | Specifies cluster configuration properties. See Cluster Configuration Properties. |
| extraClusterConfiguration ClusterConfiguration | Holds values (or references to values) that should be used to configure the cluster; theseare resolved late in order to avoid embedding secrets directly into bootstrap configurationsexposed as Kubernetes configmaps. |
| node RawExtension | Specifies broker configuration properties. See Broker Configuration Properties. |
| tunable RawExtension | Specifies tunable configuration properties. See Cluster Configuration Properties. |
| schema_registry_client RawExtension | Specifies tunable configuration properties. See Cluster Configuration Properties. |
| pandaproxy_client RawExtension | Specifies tunable configuration properties. See Cluster Configuration Properties. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-configsynonyms)ConfigSynonyms

ConfigSynonyms was copied from [https://github.com/twmb/franz-go/blob/01651affd204d4a3577a341e748c5d09b52587f8/pkg/kmsg/generated.go#L24569-L24578](https://github.com/twmb/franz-go/blob/01651affd204d4a3577a341e748c5d09b52587f8/pkg/kmsg/generated.go#L24569-L24578)

Appears in:

-   [Configuration](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-configuration)


| Field | Description |
| --- | --- |
| name string |  |
| value string |  |
| source string |  |
| unknownTags object (keys:string, values:string) | UnknownTags are tags Kafka sent that we do not know the purpose of. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-configwatcher)ConfigWatcher

ConfigWatcher configures a sidecar that watches for changes to the Secret in `auth.sasl.secretRef` and applies the changes to the Redpanda cluster.

Appears in:

-   [SideCars](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-sidecars)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether the sidecar is enabled. |
| extraVolumeMounts string | Specifies additional volumes to mount to the sidecar.DEPRECATED: Use sideCars.extraVolumeMounts |
| resources ResourceRequirements | Specifies resource requests for the sidecar container.DEPRECATED: Use sideCars.resources |
| securityContext SecurityContext | Specifies the container’s security context, including privileges and access levels of the container and its processes.DEPRECATED: Use sideCars.securityContext |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-configuration)Configuration

Configuration was copied from [https://github.com/twmb/franz-go/blob/01651affd204d4a3577a341e748c5d09b52587f8/pkg/kmsg/generated.go#L24593-L24634](https://github.com/twmb/franz-go/blob/01651affd204d4a3577a341e748c5d09b52587f8/pkg/kmsg/generated.go#L24593-L24634)

Appears in:

-   [TopicStatus](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-topicstatus)


| Field | Description |
| --- | --- |
| name string | Name is a key this entry corresponds to (e.g. segment.bytes). |
| value string | Value is the value for this config key. If the key is sensitive,the value will be null. |
| readOnly boolean | ReadOnly signifies whether this is not a dynamic config option.Note that this field is not always correct, and you may need to checkwhether the Source is any dynamic enum. See franz-go#91 for more details. |
| isDefault boolean | IsDefault is whether this is a default config option. This has beenreplaced in favor of Source. |
| source string | Source is where this config entry is from.This field has a default of -1. |
| isSensitive boolean | IsSensitive signifies whether this is a sensitive config key, whichis either a password or an unknown type. |
| configSynonyms ConfigSynonyms array | ConfigSynonyms contains fallback key/value pairs for this configentry, in order of preference. That is, if a config entry is bothdynamically configured and has a default, the top level return will bethe dynamic configuration, while its "synonym" will be the default. |
| configType string | ConfigType specifies the configuration data type. |
| documentation string | Documentation is optional documentation for the config entry. |
| unknownTags object (keys:string, values:string) | UnknownTags are tags Kafka sent that we do not know the purpose of. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-configurator)Configurator

Appears in:

-   [InitContainers](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-initcontainers)


| Field | Description |
| --- | --- |
| extraVolumeMounts string |  |
| resources ResourceRequirements |  |
| additionalCLIArgs string array |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-connectormonitoring)ConnectorMonitoring

ConnectorMonitoring configures monitoring resources for Connectors. See [Monitor Redpanda in Kubernetes](https://docs.redpanda.com/streaming/current/manage/kubernetes/monitoring/k-monitor-redpanda/).

Appears in:

-   [RedpandaConnectors](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaconnectors)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether to create a ServiceMonitor that can be used by Prometheus Operator or VictoriaMetrics Operator to scrape the metrics. |
| labels object (keys:string, values:string) | Adds custom labels to the ServiceMonitor resource. |
| scrapeInterval string | Specifies how often to scrape metrics. |
| annotations object (keys:string, values:string) | Adds custom Annotations to the ServiceMonitor resource. |
| namespaceSelector NamespaceSelector | Adds custom namespaceSelector to monitoring resources |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-connectorscreateobj)ConnectorsCreateObj

ConnectorsCreateObj configures Kubernetes resources for Redpanda Connectors.

Appears in:

-   [RedpandaConnectors](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaconnectors)


| Field | Description |
| --- | --- |
| create boolean | Specifies whether to create the resource. |
| enabled boolean | Deprecated: this field exists for storage backwards compatibility and isnever used. Prefer Create. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-console)Console

Console defines the CRD for Redpanda Console instances.

| Field | Description |
| --- | --- |
| apiVersion string | cluster.redpanda.com/v1alpha2 |
| kind string | Console |
| kind string | Kind is a string value representing the REST resource this object represents.Servers may infer this from the endpoint the client submits requests to.Cannot be updated.In CamelCase.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| apiVersion string | APIVersion defines the versioned schema of this representation of an object.Servers should convert recognized schemas to the latest internal value, andmay reject unrecognized values.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| metadata ObjectMeta | Refer to the Kubernetes API documentation for fields of metadata. |
| spec ConsoleSpec |  |
| status ConsoleStatus |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolecreateobj)ConsoleCreateObj

ConsoleCreateObj represents configuration options for creating Kubernetes objects such as ConfigMaps, Secrets, and Deployments.

Appears in:

-   [RedpandaConsole](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaconsole)


| Field | Description |
| --- | --- |
| create boolean | Indicates whether the corresponding Kubernetes object (ConfigMap, Secret, or Deployment) should be created. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)ConsoleSpec

Appears in:

-   [Console](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-console)


| Field | Description |
| --- | --- |
| replicaCount integer |  |
| image Image |  |
| imagePullSecrets LocalObjectReference array |  |
| automountServiceAccountToken boolean |  |
| serviceAccount ServiceAccountConfig |  |
| commonLabels object (keys:string, values:string) |  |
| annotations object (keys:string, values:string) |  |
| podAnnotations object (keys:string, values:string) |  |
| podLabels object (keys:string, values:string) |  |
| podSecurityContext PodSecurityContext |  |
| securityContext SecurityContext |  |
| service ServiceConfig |  |
| ingress IngressConfig |  |
| gateway GatewayConfig |  |
| resources ResourceRequirements |  |
| autoscaling AutoScaling |  |
| nodeSelector object (keys:string, values:string) |  |
| tolerations Toleration array |  |
| affinity Affinity |  |
| topologySpreadConstraints TopologySpreadConstraint array |  |
| priorityClassName string |  |
| config RawExtension |  |
| extraEnv EnvVar array |  |
| extraEnvFrom EnvFromSource array |  |
| extraVolumes Volume array |  |
| extraVolumeMounts VolumeMount array |  |
| extraContainers Container array |  |
| extraContainerPorts ContainerPort array |  |
| secretMounts SecretMount array |  |
| secret SecretConfig |  |
| licenseSecretRef SecretKeySelector |  |
| livenessProbe ProbeApplyConfiguration | LivenessProbe describes a health check to be performed against a container to determine whether it isalive. |
| readinessProbe ProbeApplyConfiguration | ReadinessProbe describes a health check to be performed against a container to determine whether it isready to receive traffic. |
| deployment DeploymentConfig |  |
| strategy DeploymentStrategy |  |
| warnings string array | Warnings is a slice of human readable warnings generated by the automaticmigration of a Console V2 config to a Console V3 config. If warnings arepresent, they will describe which fields from the original config havebeen dropped and why.Setting this field has no effect. |
| monitoring MonitoringConfig |  |
| cluster ClusterSource |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolestatus)ConsoleStatus

Appears in:

-   [Console](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-console)


| Field | Description |
| --- | --- |
| observedGeneration integer | The generation observed by the Console controller. |
| replicas integer | Total number of non-terminating Pods targeted by this Console’s Deployment. |
| updatedReplicas integer | Total number of non-terminating pods targeted by this Console’s Deployment that have the desired template spec. |
| readyReplicas integer | Total number of non-terminating pods targeted by this Console’s Deployment with a Ready Condition. |
| availableReplicas integer | Total number of available non-terminating pods (ready for at least minReadySeconds) targeted by this Console’s Deployment. |
| unavailableReplicas integer | Total number of unavailable pods targeted by this deployment. This is the total number ofpods that are still required for the deployment to have 100% available capacity. They mayeither be pods that are running but not yet available or pods that still have not been created. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolevalues)ConsoleValues

ConsoleValues is a CRD friendly equivalent of \[console.PartialValues\]. Any member that is optional at the top level, either by being a pointer, map, or slice, is NOT further partial-ized. This allows us to enforce validation constraints without accidentally polluting the defaults of the chart.

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)


| Field | Description |
| --- | --- |
| replicaCount integer |  |
| image Image |  |
| imagePullSecrets LocalObjectReference array |  |
| automountServiceAccountToken boolean |  |
| serviceAccount ServiceAccountConfig |  |
| commonLabels object (keys:string, values:string) |  |
| annotations object (keys:string, values:string) |  |
| podAnnotations object (keys:string, values:string) |  |
| podLabels object (keys:string, values:string) |  |
| podSecurityContext PodSecurityContext |  |
| securityContext SecurityContext |  |
| service ServiceConfig |  |
| ingress IngressConfig |  |
| gateway GatewayConfig |  |
| resources ResourceRequirements |  |
| autoscaling AutoScaling |  |
| nodeSelector object (keys:string, values:string) |  |
| tolerations Toleration array |  |
| affinity Affinity |  |
| topologySpreadConstraints TopologySpreadConstraint array |  |
| priorityClassName string |  |
| config RawExtension |  |
| extraEnv EnvVar array |  |
| extraEnvFrom EnvFromSource array |  |
| extraVolumes Volume array |  |
| extraVolumeMounts VolumeMount array |  |
| extraContainers Container array |  |
| extraContainerPorts ContainerPort array |  |
| secretMounts SecretMount array |  |
| secret SecretConfig |  |
| licenseSecretRef SecretKeySelector |  |
| livenessProbe ProbeApplyConfiguration | LivenessProbe describes a health check to be performed against a container to determine whether it isalive. |
| readinessProbe ProbeApplyConfiguration | ReadinessProbe describes a health check to be performed against a container to determine whether it isready to receive traffic. |
| deployment DeploymentConfig |  |
| strategy DeploymentStrategy |  |
| warnings string array | Warnings is a slice of human readable warnings generated by the automaticmigration of a Console V2 config to a Console V3 config. If warnings arepresent, they will describe which fields from the original config havebeen dropped and why.Setting this field has no effect. |
| monitoring MonitoringConfig |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-containerresources)ContainerResources

ContainerResources defines resource limits for containers.

Appears in:

-   [Memory](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-memory)


| Field | Description |
| --- | --- |
| max Quantity | Specifies the maximum resources that can be allocated to a container. |
| min Quantity | Specifies the minimum resources required for a container. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-credentialsecretref)CredentialSecretRef

CredentialSecretRef can be used to set cloud\_storage\_secret\_key from referenced Kubernetes Secret

Appears in:

-   [StretchTiered](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchtiered)

-   [Tiered](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-tiered)


| Field | Description |
| --- | --- |
| accessKey SecretWithConfigField |  |
| secretKey SecretWithConfigField |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-crossclustermode)CrossClusterMode (string)

CrossClusterMode defines how per-pod Services route traffic to pods on remote Kubernetes clusters.

Appears in:

-   [Networking](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-networking)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-deploymentconfig)DeploymentConfig

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)

-   [ConsoleValues](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolevalues)


| Field | Description |
| --- | --- |
| command string array |  |
| extraArgs string array |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-enterprise)Enterprise

Enterprise configures an Enterprise license key to enable Redpanda Enterprise features. Requires the post-install job to be enabled (default). See [Redpanda Licenses and Enterprise Features](https://docs.redpanda.com/streaming/current/get-started/licensing/overview/).

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)

-   [StretchClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterspec)


| Field | Description |
| --- | --- |
| license string | Specifies the Enterprise license key. |
| licenseSecretRef EnterpriseLicenseSecretRef | Defines a reference to a Secret resource that contains the Enterprise license key. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-enterpriselicensesecretref)EnterpriseLicenseSecretRef

EnterpriseLicenseSecretRef configures a reference to a Secret resource that contains the Enterprise license key.

Appears in:

-   [Enterprise](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-enterprise)


| Field | Description |
| --- | --- |
| key string | Specifies the key that is contains the Enterprise license in the Secret. |
| name string | Specifies the name of the Secret resource to use. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-external)External

External defines external connectivity settings in the Helm values.

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| addresses string array | Specifies addresses for the external listeners to advertise.Provide one entry for each broker in order of StatefulSet replicas. The number of brokers is defined in statefulset.replicas. The values can be IP addresses or DNS names. If external.domain is set, the domain is appended to these values. |
| annotations object (keys:string, values:string) | Adds custom annotations to the external Service. |
| domain string | Specifies the domain to advertise to external clients. If specified, then it will be appended to the external.addresses values as each broker’s advertised address. |
| enabled boolean | Specifies whether the external access is enabled. |
| service ExternalService | Configures the external Service resource. |
| sourceRanges string array | Source range for external access. Only applicable when external.type is LoadBalancer. |
| type string | Specifies the external Service type. Only NodePort and LoadBalancer are supported. If undefined, then advertised listeners will be configured in Redpanda, but the Helm chart will not create a Service. NodePort is recommended in cases where latency is a priority. |
| externalDns ExternalDNS | Defines externalDNS configurations. |
| prefixTemplate string | Specifies a naming prefix template for external Services. |
| gateway GatewayExternalConfig | Configures Gateway API TLSRoute-based external access. When enabled, ClusterIP services and TLSRoute resources are created instead of NodePort/LoadBalancer services. The Gateway itself must be managed externally. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-externaldns)ExternalDNS

ExternalDNS configures externalDNS.

Appears in:

-   [External](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-external)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether externalDNS annotations are added to LoadBalancer Services. If you enable externalDns, each LoadBalancer Service defined in external.type will be annotated with an external-dns hostname that matches external.addresses[i].external.domain. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-externallistener)ExternalListener

ExternalListener configures settings for the external listeners.

Appears in:

-   [Admin](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-admin)

-   [HTTP](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-http)

-   [Kafka](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafka)

-   [SchemaRegistry](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaregistry)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether this Listener is enabled. |
| authenticationMethod string | Specifies the authentication method for this listener. For example, 'mtls_identity', sasl or http_basic. |
| appProtocol string |  |
| port integer | Specifies the container port number for this listener. |
| tls ListenerTLS | Configures TLS settings for the internal listener. |
| prefixTemplate string | Specifies the template used for generating the advertised addresses ofServices. This field accepts a string template that dynamicallyconstructs Service addresses based on various parameters such as Servicename and port number.For historical backwards compatibility, this field is present on bothinternal and external listeners. However, it is ignored when specifiedon internal listeners. |
| advertisedPorts integer array | Specifies the network port that the external Service listens on. |
| nodePort integer |  |
| type string | Selects how this listener is exposed externally. Unset inherits the cluster-wide external.type (NodePort/LoadBalancer). Set to "tlsroute" to route this listener via Gateway API: a TLSRoute is created for it (requires external.gateway with parentRefs) and it is excluded from the NodePort/LoadBalancer Service. |
| host string | Host is the SNI hostname for the bootstrap TLSRoute when using Gateway API external access. |
| hostTemplate string | HostTemplate is a Go template for per-broker TLSRoute SNI hostnames. Supports $POD_ORDINAL and $POD_NAME variables. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-externalsecretkeyselector)ExternalSecretKeySelector

ExternalSecretKeySelector selects a key of an external Secret.

Appears in:

-   [ValueSource](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-valuesource)


| Field | Description |
| --- | --- |
| name string |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-externalservice)ExternalService

ExternalService allows you to enable or disable the creation of an external Service type.

Appears in:

-   [External](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-external)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether to create the external Service. If set to false, the external Service type is not created. You can still set your cluster with external access but not create the supporting Service. Set this to false to manage your own Service. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-filtertype)FilterType (string)

FilterType specifies the type, either include or exclude of a consumer group filter.

Appears in:

-   [NameFilter](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-namefilter)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-fsvalidator)FsValidator

Appears in:

-   [InitContainers](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-initcontainers)


| Field | Description |
| --- | --- |
| enabled boolean |  |
| expectedFS string |  |
| extraVolumeMounts string | Adds extra volume mounts. |
| resources ResourceRequirements | Specifies the resource requirements. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-gatewayconfig)GatewayConfig

GatewayConfig configures a Gateway API HTTPRoute for Console.

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)

-   [ConsoleValues](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolevalues)


| Field | Description |
| --- | --- |
| enabled boolean |  |
| annotations object (keys:string, values:string) |  |
| parentRefs GatewayParentReference array |  |
| hostnames string array |  |
| path string |  |
| pathType PathMatchType |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-gatewayexternalconfig)GatewayExternalConfig

GatewayExternalConfig holds configuration for Gateway API-based external access using TLSRoute resources with SNI-based routing.

Appears in:

-   [External](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-external)


| Field | Description |
| --- | --- |
| enabled boolean | Enables Gateway API TLSRoute-based external access. |
| parentRefs GatewayParentRefConfig array | Defines which Gateway(s) handle the TLSRoutes. At least one parent reference must be provided. |
| advertisedPort integer | The port advertised to clients. Defaults to 443. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-gatewayparentrefconfig)GatewayParentRefConfig

GatewayParentRefConfig identifies a Gateway (or ListenerSet) that should handle the TLSRoute traffic. Schema mirrors the upstream Gateway API ParentReference.

Appears in:

-   [GatewayExternalConfig](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-gatewayexternalconfig)


| Field | Description |
| --- | --- |
| group string | API group of the referent. Defaults to "gateway.networking.k8s.io". |
| kind string | Kind of the referent. Defaults to "Gateway". |
| name string | Name of the referent. |
| namespace string | Namespace of the referent. |
| sectionName string | Name of a section within the target resource. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-gatewayparentreference)GatewayParentReference

GatewayParentReference identifies a parent Gateway for the HTTPRoute.

Appears in:

-   [GatewayConfig](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-gatewayconfig)


| Field | Description |
| --- | --- |
| name string |  |
| namespace string |  |
| sectionName SectionName |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-group)Group

Group defines the CRD for managing ACLs for an OIDC group in Redpanda. Groups are external identities sourced from OIDC identity providers via JWT token claims. Unlike users, groups are not created in Redpanda — they exist externally. This CRD allows the operator to manage Kafka ACLs for a group principal. Group-based authorization must be enabled in Redpanda (enterprise feature).

| Field | Description |
| --- | --- |
| apiVersion string | cluster.redpanda.com/v1alpha2 |
| kind string | Group |
| kind string | Kind is a string value representing the REST resource this object represents.Servers may infer this from the endpoint the client submits requests to.Cannot be updated.In CamelCase.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| apiVersion string | APIVersion defines the versioned schema of this representation of an object.Servers should convert recognized schemas to the latest internal value, andmay reject unrecognized values.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| metadata ObjectMeta | Refer to the Kubernetes API documentation for fields of metadata. |
| spec GroupSpec | Defines the desired state of the Redpanda group. |
| status GroupStatus | Represents the current status of the Redpanda group. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-groupauthorizationspec)GroupAuthorizationSpec

GroupAuthorizationSpec defines authorization rules for this group.

Appears in:

-   [GroupSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-groupspec)


| Field | Description |
| --- | --- |
| acls ACLRule array | List of ACL rules which should be applied to this group. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-groupspec)GroupSpec

GroupSpec defines the configuration of a Redpanda group.

Appears in:

-   [Group](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-group)


| Field | Description |
| --- | --- |
| cluster ClusterSource | ClusterSource is a reference to the cluster where the group’s ACLs should be managed.It is used in constructing the client created to configure a cluster. |
| authorization GroupAuthorizationSpec | Authorization rules defined for this group. The operator always manages ACLsfor the group principal. When omitted or empty, any existing ACLs for thisgroup are removed. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-groupstatus)GroupStatus

GroupStatus defines the observed state of a Redpanda group.

Appears in:

-   [Group](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-group)


| Field | Description |
| --- | --- |
| observedGeneration integer | Specifies the last observed generation. |
| conditions Condition array | Conditions holds the conditions for the Redpanda group. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-http)HTTP

HTTP configures settings for the HTTP Proxy listeners.

Appears in:

-   [Listeners](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-listeners)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether this Listener is enabled. |
| authenticationMethod string | Specifies the authentication method for this listener. For example, 'mtls_identity', sasl or http_basic. |
| appProtocol string |  |
| port integer | Specifies the container port number for this listener. |
| tls ListenerTLS | Configures TLS settings for the internal listener. |
| prefixTemplate string | Specifies the template used for generating the advertised addresses ofServices. This field accepts a string template that dynamicallyconstructs Service addresses based on various parameters such as Servicename and port number.For historical backwards compatibility, this field is present on bothinternal and external listeners. However, it is ignored when specifiedon internal listeners. |
| external object (keys:string, values:ExternalListener) | Defines settings for the external listeners. |
| kafkaEndpoint string | Configures the listener to use for HTTP connections. For example default for the internal listener.deprecated and not respected. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-image)Image

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)

-   [ConsoleValues](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolevalues)


| Field | Description |
| --- | --- |
| registry string |  |
| repository string |  |
| pullPolicy PullPolicy |  |
| tag string |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-ingressconfig)IngressConfig

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)

-   [ConsoleValues](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolevalues)


| Field | Description |
| --- | --- |
| enabled boolean |  |
| className string |  |
| annotations object (keys:string, values:string) |  |
| hosts IngressHost array |  |
| tls IngressTLS array |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-ingresshost)IngressHost

Appears in:

-   [IngressConfig](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-ingressconfig)


| Field | Description |
| --- | --- |
| host string |  |
| paths IngressPath array |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-ingresspath)IngressPath

Appears in:

-   [IngressHost](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-ingresshost)


| Field | Description |
| --- | --- |
| path string |  |
| pathType PathType |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-initcontainerimage)InitContainerImage

InitContainerImage configures the init container image used to perform initial setup tasks before the main containers start.

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)

-   [Statefulset](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-statefulset)


| Field | Description |
| --- | --- |
| repository string |  |
| tag string |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-initcontainers)InitContainers

InitContainers configures the init container used to perform initial setup tasks before the main containers start.

Appears in:

-   [Statefulset](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-statefulset)


| Field | Description |
| --- | --- |
| configurator Configurator |  |
| extraInitContainers string |  |
| setDataDirOwnership SetDataDirOwnership | Defines the settings related to ownership of the Redpanda data directory in environments where root access is restricted. |
| setTieredStorageCacheDirOwnership SetTieredStorageCacheDirOwnership | Defines the settings related to ownership of the Tiered Storage cache in environments where root access is restricted. |
| fsValidator FsValidator | Defines the setting for init container that not allow to start Redpanda until filesystem matches |
| tuning Tuning | Defines settings for the autotuner tool in Redpanda. The autotuner identifies the hardware configuration in the container and optimizes the Linux kernel to give you the best performance. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-issuerref)IssuerRef

IssuerRef configures the Issuer or ClusterIssuer resource to use to generate certificates. Requires cert-manager. See [https://cert-manager.io/v1.1-docs](https://cert-manager.io/v1.1-docs).

Appears in:

-   [Certificate](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-certificate)


| Field | Description |
| --- | --- |
| name string | Specifies the name of the resource. |
| kind string | Specifies the kind of resource. One of Issuer or ClusterIssuer. |
| group string |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafka)Kafka

Kafka configures settings for the Kafka API listeners.

Appears in:

-   [Listeners](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-listeners)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether this Listener is enabled. |
| authenticationMethod string | Specifies the authentication method for this listener. For example, 'mtls_identity', sasl or http_basic. |
| appProtocol string |  |
| port integer | Specifies the container port number for this listener. |
| tls ListenerTLS | Configures TLS settings for the internal listener. |
| prefixTemplate string | Specifies the template used for generating the advertised addresses ofServices. This field accepts a string template that dynamicallyconstructs Service addresses based on various parameters such as Servicename and port number.For historical backwards compatibility, this field is present on bothinternal and external listeners. However, it is ignored when specifiedon internal listeners. |
| external object (keys:string, values:ExternalListener) | Defines settings for the external listeners. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkaapispec)KafkaAPISpec

KafkaAPISpec configures client configuration settings for connecting to Redpanda brokers.

Appears in:

-   [StaticConfigurationSource](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-staticconfigurationsource)

-   [TopicSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-topicspec)


| Field | Description |
| --- | --- |
| brokers string array | Specifies a list of broker addresses in the format <host>:<port> |
| tls CommonTLS | Defines TLS configuration settings for Redpanda clusters that have TLS enabled. |
| sasl KafkaSASL | Defines authentication configuration settings for Redpanda clusters that have authentication enabled. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasasl)KafkaSASL

KafkaSASL configures credentials to connect to Redpanda cluster that has authentication enabled.

Appears in:

-   [KafkaAPISpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkaapispec)


| Field | Description |
| --- | --- |
| username string | Specifies the username. |
| password ValueSource | Specifies the password. |
| mechanism SASLMechanism | Specifies the SASL/SCRAM authentication mechanism. |
| oauth KafkaSASLOAuthBearer |  |
| gssapi KafkaSASLGSSAPI |  |
| awsMskIam KafkaSASLAWSMskIam |  |
| passwordSecretRef SecretKeyRef | Deprecated: use password instead |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasaslawsmskiam)KafkaSASLAWSMskIam

KafkaSASLAWSMskIam is the config for AWS IAM SASL mechanism, see: [https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html](https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html)

Appears in:

-   [KafkaSASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasasl)


| Field | Description |
| --- | --- |
| accessKey string |  |
| secretKey ValueSource |  |
| secretKeySecretRef SecretKeyRef | Deprecated: use secretKey instead |
| sessionToken ValueSource | SessionToken, if non-empty, is a session / security token to use for authentication.See: https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html |
| sessionTokenSecretRef SecretKeyRef | Deprecated: use sessionToken instead |
| userAgent string | UserAgent is the user agent to for the client to use when connectingto Kafka, overriding the default "franz-go/<runtime.Version()>/<hostname>".Setting a UserAgent allows authorizing based on the aws:UserAgentcondition key; see the following link for more details:https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-useragent |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasaslgssapi)KafkaSASLGSSAPI

KafkaSASLGSSAPI represents the Kafka Kerberos config.

Appears in:

-   [KafkaSASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasasl)


| Field | Description |
| --- | --- |
| authType string |  |
| keyTabPath string |  |
| kerberosConfigPath string |  |
| serviceName string |  |
| username string |  |
| password ValueSource |  |
| passwordSecretRef SecretKeyRef | Deprecated: use password instead |
| realm string |  |
| enableFast boolean | EnableFAST enables FAST, which is a pre-authentication framework for Kerberos.It includes a mechanism for tunneling pre-authentication exchanges using armored KDC messages.FAST provides increased resistance to passive password guessing attacks. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasasloauthbearer)KafkaSASLOAuthBearer

KafkaSASLOAuthBearer is the config struct for the SASL OAuthBearer mechanism

Appears in:

-   [KafkaSASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasasl)


| Field | Description |
| --- | --- |
| token ValueSource |  |
| tokenSecretRef SecretKeyRef | Deprecated: use token instead |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasecrets)KafkaSecrets

Appears in:

-   [SecretConfig](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-secretconfig)


| Field | Description |
| --- | --- |
| saslPassword string |  |
| awsMskIamSecretKey string |  |
| tlsCa string |  |
| tlsCert string |  |
| tlsKey string |  |
| tlsPassphrase string |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-licensesecretref)LicenseSecretRef

LicenseSecretRef is deprecated. Use `EnterpriseLicenseSecretRef` instead.

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| secret_key string | Specifies the key that is contains the Enterprise license in the Secret. |
| secret_name string | Specifies the name of the Secret. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-listener)Listener

Appears in:

-   [Admin](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-admin)

-   [ExternalListener](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-externallistener)

-   [HTTP](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-http)

-   [Kafka](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafka)

-   [SchemaRegistry](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaregistry)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether this Listener is enabled. |
| authenticationMethod string | Specifies the authentication method for this listener. For example, 'mtls_identity', sasl or http_basic. |
| appProtocol string |  |
| port integer | Specifies the container port number for this listener. |
| tls ListenerTLS | Configures TLS settings for the internal listener. |
| prefixTemplate string | Specifies the template used for generating the advertised addresses ofServices. This field accepts a string template that dynamicallyconstructs Service addresses based on various parameters such as Servicename and port number.For historical backwards compatibility, this field is present on bothinternal and external listeners. However, it is ignored when specifiedon internal listeners. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-listenertls)ListenerTLS

ListenerTLS configures TLS configuration for each listener in the Helm values.

Appears in:

-   [Admin](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-admin)

-   [ExternalListener](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-externallistener)

-   [HTTP](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-http)

-   [Kafka](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafka)

-   [Listener](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-listener)

-   [RPC](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-rpc)

-   [SchemaRegistry](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaregistry)


| Field | Description |
| --- | --- |
| cert string | References a specific certificate for the listener. |
| enabled boolean | Specifies whether TLS is enabled for the listener. |
| secretRef string | References a Secret resource containing TLS credentials for the listener.Deprecated: Setting SecretRef has no affect and will be removed infuture releases. |
| requireClientAuth boolean | Indicates whether client authentication (mTLS) is required. |
| trustStore TrustStore | TrustStore allows setting the truststore_path on this listener. Ifspecified, this field takes precedence over [Certificate.CAEnabled]. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-listeners)Listeners

Listeners configures settings for listeners, including HTTP Proxy, Schema Registry, the Admin API and the Kafka API. See [Configure Listeners in Kubernetes](https://docs.redpanda.com/streaming/current/manage/kubernetes/networking/k-configure-listeners/).

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| admin Admin | Configures settings for the Admin API listeners. |
| http HTTP | Configures settings for the HTTP Proxy listeners. |
| kafka Kafka | Configures settings for the Kafka API listeners. |
| rpc RPC | Configures settings for the RPC API listener. |
| schemaRegistry SchemaRegistry | Configures settings for the Schema Registry listeners. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-livenessprobe)LivenessProbe

LivenessProbe configures liveness probes to monitor the health of the Pods and restart them if necessary.

Appears in:

-   [RedpandaConsole](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaconsole)

-   [Statefulset](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-statefulset)


| Field | Description |
| --- | --- |
| failureThreshold integer | Sets the number of consecutive failures required to consider a Pod as not live. |
| initialDelaySeconds integer | Specifies the time in seconds to wait before the first probe is initiated. |
| periodSeconds integer | Determines the frequency in seconds of performing the probe. |
| timeoutSeconds integer |  |
| successThreshold integer |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-logging)Logging

Logging configures logging settings in the Helm values. See [Resolve Errors in Kubernetes](https://docs.redpanda.com/streaming/current/troubleshoot/errors-solutions/k-resolve-errors/).

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| logLevel string | Sets the verbosity level of logs. |
| usageStats UsageStats | Specifies whether to send usage statistics to Redpanda Data. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-memory)Memory

Memory configures memory resources.

Appears in:

-   [Resources](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-resources)

-   [StretchResources](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchresources)


| Field | Description |
| --- | --- |
| container ContainerResources | Defines resource limits for containers. |
| enable_memory_locking boolean | Enables memory locking. For production, set to true. |
| redpanda RedpandaMemory | Allows you to optionally specify the memory size for both the Redpanda process and the underlying reserved memory used by Seastar. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-metadatatemplate)MetadataTemplate

MetadataTemplate defines additional metadata to associate with a resource.

Appears in:

-   [ResourceTemplate](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-resourcetemplate)


| Field | Description |
| --- | --- |
| labels object (keys:string, values:string) | Labels specifies the Kubernetes labels to apply to a managed resource. |
| annotations object (keys:string, values:string) | Annotations specifies the Kubernetes annotations to apply to a managed resource. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-monitoring)Monitoring

Monitoring configures monitoring resources for Redpanda. See [Monitor Redpanda in Kubernetes](https://docs.redpanda.com/streaming/current/manage/kubernetes/monitoring/k-monitor-redpanda/).

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether to create a ServiceMonitor that can be used by Prometheus Operator or VictoriaMetrics Operator to scrape the metrics. |
| labels object (keys:string, values:string) | Adds custom labels to the ServiceMonitor resource. |
| scrapeInterval string | Specifies how often to scrape metrics. |
| tlsConfig RawExtension | Specifies tls configuration properties. |
| enableHttp2 boolean |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-monitoringconfig)MonitoringConfig

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)

-   [ConsoleValues](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolevalues)

-   [RedpandaConsole](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaconsole)


| Field | Description |
| --- | --- |
| enabled boolean |  |
| scrapeInterval string |  |
| labels object (keys:string, values:string) |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-namefilter)NameFilter

A filter based on the name of a resource

Appears in:

-   [ShadowLinkConsumerOffsetSyncOptions](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkconsumeroffsetsyncoptions)

-   [ShadowLinkRoleSyncOptions](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkrolesyncoptions)

-   [ShadowLinkTopicMetadataSyncOptions](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinktopicmetadatasyncoptions)


| Field | Description |
| --- | --- |
| name string | The resource name, or ""Note if the wildcar "" is used it must be the only characterand patternType must be literal |
| filterType FilterType | Valid values:- include- exclude |
| patternType PatternType | Default value is literal. Valid values:- literal- prefixed |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-namedvaluesource)NamedValueSource

NamedValueSource binds a name to a value provider so the pipeline YAML can reference it via ${NAME} interpolation.

Appears in:

-   [PipelineSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipelinespec)


| Field | Description |
| --- | --- |
| name string | Name is the environment-variable name the pipeline YAML references.Must match standard env-var characters: [A-Z_][A-Z0-9_]*. |
| source ValueSource | Source is the value provider. Exactly one of inline / configMapKeyRef/ secretKeyRef / externalSecretRef must be set; the ValueSourceXValidation rules enforce this. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-networking)Networking

Networking configures cross-cluster networking for stretch clusters.

Appears in:

-   [StretchClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterspec)


| Field | Description |
| --- | --- |
| crossClusterMode CrossClusterMode | CrossClusterMode controls how per-pod Services route traffic to podson remote Kubernetes clusters. Defaults to "mesh". |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-oidcloginsecrets)OIDCLoginSecrets

Appears in:

-   [AuthenticationSecrets](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-authenticationsecrets)


| Field | Description |
| --- | --- |
| clientSecret string |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-password)Password

Password specifies a password for the user.

Appears in:

-   [UserAuthenticationSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-userauthenticationspec)


| Field | Description |
| --- | --- |
| value string | Value is a hardcoded value to use for the given password. It should only be used for testing purposes.In production, use ValueFrom. |
| valueFrom PasswordSource | ValueFrom specifies a source for a password to be fetched from when specifying or generating user credentials.Optional when value is set: the type-level validation rule enforcesthat at least one of the two is present. (This field being markedrequired in the schema used to make the documented value-only formimpossible to apply — https://github.com/redpanda-data/redpanda-operator/issues/1290.) |
| noGenerate boolean | NoGenerate when set to true does not create kubernetes secret when ValueFrom points to none-existent secret. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-passwordsource)PasswordSource

PasswordSource contains the source for a password.

Appears in:

-   [Password](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-password)


| Field | Description |
| --- | --- |
| secretKeyRef SecretKeySelector | SecretKeyRef specifies the secret used in reading a User password.If the Secret exists and has a value in it, then that value is used.If the Secret does not exist, or is empty, a password is generated andstored based on this configuration. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-patterntype)PatternType (string)

PatternType specifies the type of pattern applied for ACL resource matching.

Appears in:

-   [ACLResourceFilter](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclresourcefilter)

-   [ACLResourceSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclresourcespec)

-   [NameFilter](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-namefilter)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-perpodserviceoverride)PerPodServiceOverride

PerPodServiceOverride defines overrides for a per-pod Service using apply-configuration types. Only fields that are set will be merged into the generated Service.

Appears in:

-   [PerPodServices](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-perpodservices)


| Field | Description |
| --- | --- |
| enabled boolean | Enabled controls whether this per-pod Service is created. Defaults to true. |
| labels object (keys:string, values:string) |  |
| annotations object (keys:string, values:string) |  |
| spec ServiceSpecApplyConfiguration |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-persistentvolume)PersistentVolume

PersistentVolume configures configurations for a PersistentVolumeClaim to use to store the Redpanda data directory.

Appears in:

-   [Storage](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-storage)

-   [StretchStorage](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchstorage)

-   [StretchTiered](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchtiered)

-   [Tiered](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-tiered)


| Field | Description |
| --- | --- |
| annotations object (keys:string, values:string) | Adds annotations to the PersistentVolumeClaims to provide additional information or metadata that can be used by other tools or libraries. |
| enabled boolean | Specifies whether to enable the Helm chart to create PersistentVolumeClaims for Pods. |
| labels object (keys:string, values:string) | Applies labels to the PersistentVolumeClaims to facilitate identification and selection based on custom criteria. |
| size Quantity | Specifies the storage capacity required. |
| storageClass string | Specifies the StorageClass for the PersistentVolumeClaims to determine how PersistentVolumes are provisioned and managed. |
| nameOverwrite string | Option to change volume claim template name for tiered storage persistent volume if tiered.mountType is set to persistentVolume |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipeline)Pipeline

Pipeline defines a Redpanda Connect pipeline managed by the operator.

| Field | Description |
| --- | --- |
| apiVersion string | cluster.redpanda.com/v1alpha2 |
| kind string | Pipeline |
| kind string | Kind is a string value representing the REST resource this object represents.Servers may infer this from the endpoint the client submits requests to.Cannot be updated.In CamelCase.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| apiVersion string | APIVersion defines the versioned schema of this representation of an object.Servers should convert recognized schemas to the latest internal value, andmay reject unrecognized values.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| metadata ObjectMeta | Refer to the Kubernetes API documentation for fields of metadata. |
| spec PipelineSpec | Spec defines the desired state of the Pipeline. |
| status PipelineStatus | Status represents the current observed state of the Pipeline. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipelinebudget)PipelineBudget

PipelineBudget configures a PodDisruptionBudget for the pipeline.

Appears in:

-   [PipelineSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipelinespec)


| Field | Description |
| --- | --- |
| maxUnavailable integer | MaxUnavailable defines the maximum number of pipeline pods that can beunavailable during a voluntary disruption. Defaults to 1 if not set. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipelinephase)PipelinePhase (string)

PipelinePhase describes the lifecycle phase of a Pipeline.

Appears in:

-   [PipelineStatus](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipelinestatus)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipelinespec)PipelineSpec

PipelineSpec defines the desired state of a Redpanda Connect pipeline.

Appears in:

-   [Pipeline](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipeline)


| Field | Description |
| --- | --- |
| configYaml string | ConfigYAML is the user-supplied Redpanda Connect pipeline YAML.Reference cluster-bound or sensitive values from .valueSources via${NAME} interpolation; the operator resolves them at render time.When .cluster is set, the operator inline-merges connection fields(seed_brokers, tls, sasl) into any input.redpanda andoutput.redpanda blocks in this YAML, derived from the resolvedcluster connection and .userRef. Users only need to write theper-plugin fields (topic, key, consumer_group, etc.); brokers, TLS,and SASL are filled in by the operator.User-side keys win on conflict — set a key explicitly (for example,seed_brokers pointing at a different cluster) and the operator’sgenerated value is skipped for that key.The merge targets the redpanda input/output plugins specifically.Any redpanda_common blocks the user authors are passed throughunchanged — the operator does not inject connection fields intothem. |
| displayName string | DisplayName is a human-readable name for the pipeline.Maps to the pipeline display name when migrating to Redpanda Cloud. |
| description string | Description is an optional description of what this pipeline does.Maps to the pipeline description when migrating to Redpanda Cloud. |
| tags object (keys:string, values:string) | Tags are key-value pairs for organizing and filtering pipelines.Maps to pipeline tags when migrating to Redpanda Cloud. |
| configFiles object (keys:string, values:string) | ConfigFiles defines additional configuration files to mount alongsidethe main pipeline configuration. Each entry maps a filename to its content.Files are mounted in the /config directory alongside connect.yaml.The key "connect.yaml" is reserved and cannot be used.Maps to pipeline config files when migrating to Redpanda Cloud. |
| replicas integer | Replicas is the number of pipeline replicas to run.This field backs the Pipeline’s scale subresource, so kubectl scalepipeline/<name>, HorizontalPodAutoscaler, and KEDA ScaledObjects allread and write it through /scale. To autoscale a pipeline, point theautoscaler at the Pipeline itself — NOT at its Deployment, whosereplica count the operator continuously resets to this field:scaleTargetRef:apiVersion: cluster.redpanda.com/v1alpha2kind: Pipelinename: <pipeline-name>CPU and memory HPAs work out of the box: pipeline pods always carryresource requests (operator defaults apply when .resources is unset).To scale on the metrics Redpanda Connect itself emits (input_received,output_sent, processor_latency_ns, …​) feed them to the autoscaler —e.g. scrape the pods' http port at /metrics (the operator’smonitoring PodMonitor does this) into Prometheus, then useprometheus-adapter for HPA custom metrics or a KEDA prometheustrigger.When an autoscaler manages this field, omit it from applied manifests(or have your GitOps tool ignore it) so config syncs don’t undo theautoscaler’s writes. |
| image string | Image is the container image for the Redpanda Connect deployment. |
| serviceAccountName string | ServiceAccountName is the ServiceAccount to bind to the pipeline pod.When unset, the namespace’s default ServiceAccount is used.Setting this is the recommended way to scope per-pipeline cloud-IAMtrust (e.g. IRSA on EKS, Workload Identity on GKE, Pod Identity onAKS). Annotating the namespace’s default SA works but grants everypipeline in the namespace the same role — naming a Pipeline-specificSA here keeps the trust boundary per-pipeline.The operator does NOT create the ServiceAccount; provision it(along with the appropriate cloud-IAM annotations) out-of-band. |
| paused boolean | Paused stops the pipeline by scaling replicas to zero when set to true.Paused wins over .replicas, including values an autoscaler writesthrough the scale subresource: while paused the Deployment stays atzero (the pipeline reports Stopped) even if HPA/KEDA keep updating.replicas, and unpausing resumes at the current .replicas count. |
| resources ResourceRequirements | Resources defines the compute resource requirements for the pipeline pods. |
| extraInitContainers Container array | ExtraInitContainers are additional init containers run to completion,in order, before the pipeline’s lint and connect containers start. Usethem for setup steps the pipeline depends on — fetching certificatematerial, warming a cache, or waiting on an external dependency. They runahead of the operator’s built-in lint init container, so anything theywrite into a volume from .extraVolumes is visible to lint and to theconnect runtime (mount it into the pipeline via .extraVolumeMounts).This is a raw container passthrough with no operator-applied policy; thepod’s service account and security posture apply. It is distinct from along-lived plugin sidecar (which would be an init container withrestartPolicy: Always and is not expressed here).Example (with the backing volume and the mount that exposes the stagedfile to the pipeline containers):spec:extraVolumes:- name: sharedemptyDir: {}extraVolumeMounts:- name: sharedmountPath: /sharedreadOnly: trueextraInitContainers:- name: fetch-certsimage: curlimages/curl:8.11.0command: ["sh", "-c", "curl -fsSL $CERT_URL -o /shared/ca.pem"]volumeMounts:- name: sharedmountPath: /shared |
| extraVolumes Volume array | ExtraVolumes are additional volumes added to the pipeline pod, typicallybacking an .extraInitContainers staging step or an .extraVolumeMountsentry. Raw passthrough: any Kubernetes volume source is accepted. Thenames "config", "cluster-tls-ca", and "cluster-tls-client" are reservedby the operator. |
| extraVolumeMounts VolumeMount array | ExtraVolumeMounts are additional volume mounts applied to the built-inlint init container and the connect container (both, so the linted viewof the filesystem matches the runtime’s). Mounts for.extraInitContainers are declared on those containers directly. |
| valueSources NamedValueSource array | ValueSources is a list of named values the pipeline YAML can referencevia ${NAME} interpolation. Each value is fetched at render time frominline / ConfigMap / Secret / ExternalSecret and projected into thepipeline pod as an environment variable. One named pull per entry —avoids the bag-of-Secrets env-splat pattern.Example:spec:valueSources:- name: S3_SECRET_KEYsource:secretKeyRef:name: s3-credskey: secret_access_keyconfigYaml: |output:aws_s3:bucket: my-bucketcredentials:secret: ${S3_SECRET_KEY}See: Secrets |
| annotations object (keys:string, values:string) | Annotations specifies additional annotations to apply to the pipeline podtemplate. These are merged with any operator-level commonAnnotations, withper-pipeline annotations taking precedence. Useful for integrations likeDatadog autodiscovery that rely on pod annotations. |
| tolerations Toleration array | Tolerations for the pipeline pods, allowing them to be scheduled on tainted nodes. |
| nodeSelector object (keys:string, values:string) | NodeSelector constrains pipeline pods to nodes with matching labels — thesimplest way to pin a pipeline to a specific Kubernetes node pool (matchthe node pool’s label, e.g. eks.amazonaws.com/nodegroup or a customlabel). Combine with Tolerations if the node pool is tainted. |
| affinity Affinity | Affinity sets pod affinity/anti-affinity for the pipeline pods. Use it fornode-pool scheduling that NodeSelector can’t express — required-OR-of-pools(multiple acceptable node pools), preferred (soft) node-pool placement, orpod anti-affinity to spread a pipeline across nodes. It is merged with anyauto-generated zone affinity from Zones: the zone requirement is AND-edinto the node affinity so both constraints apply. |
| topologySpreadConstraints TopologySpreadConstraint array | TopologySpreadConstraints controls how pipeline pods are spread acrosstopology domains such as availability zones. When Zones is specified,a default topology spread constraint is generated automatically.Any constraints specified here are used in addition to (or instead of)the auto-generated zone constraint. |
| zones string array | Zones specifies the availability zones across which pipeline pods shouldbe spread. When set, the controller configures:- A node affinity to schedule pods only on nodes in these zones- A topology spread constraint to distribute pods evenly across zonesThe zone label used is "topology.kubernetes.io/zone". |
| budget PipelineBudget | Budget configures a PodDisruptionBudget for the pipeline Deployment,protecting pipeline pods from voluntary disruptions such as node drainsand cluster autoscaler evictions. When not set, no PDB is created. |
| cluster ClusterSource | ClusterSource declaratively binds the pipeline’s redpanda input/outputto a Redpanda cluster. Mirrors the ClusterSource pattern used by theUser/Topic CRDs:clusterRef: point at an existing Redpanda CR by name, in the samenamespace as the Pipeline (cross-namespace references are rejected —the resolved TLS/SASL Secrets must be mountable by the pipelinepod). The operator resolves the internal broker addresses + TLSmaterial automatically; the SASL identity is taken from .userRef.SECURITY: when .userRef is NOT set and the referenced cluster hasSASL enabled, the pipeline authenticates as the cluster’s bootstrapsuperuser — its credentials are projected into the pipeline pod’senvironment. Set .userRef so each pipeline runs with an ACL-scopedidentity instead.staticConfiguration: hard-code brokers, TLS, and SASL. The passwordis a ValueSource so it can come from inline / Secret / ConfigMap /ExternalSecret.When unset, the pipeline runs against whatever brokers the user wiresinline in configYaml (e.g. an external Kafka, Confluent Cloud, etc.). |
| userRef PipelineUserRef | UserRef binds the pipeline to a User CR. When set alongside.cluster.clusterRef, the operator reads the referenced User’spassword Secret + SASL mechanism and uses the User’s metadata.nameas the SASL username, emitting REDPANDA_SASL_USERNAME / _PASSWORD /_MECHANISM env vars in the pipeline pod and a sasl: block in theauto-generated redpanda config.Set this when the cluster the pipeline talks to has SASL enabled.On unauthenticated clusters (and in clusterRef-only modes thatonly need broker discovery), leave it empty.CEL restrictions:- userRef must NOT be set alongside .cluster.staticConfiguration —the static path carries its own inline SASL config.- userRef must NOT be set without .cluster.clusterRef — there’s nocluster context to authenticate against otherwise.The referenced User CR is expected to live in the same namespace asthe Pipeline and to declare ACLs scoped to the topics, schemasubjects, and consumer groups this pipeline reads/writes. Theoperator does NOT auto-create or modify the User CR — ACL scopingstays an explicit, auditable user-controlled action. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipelinestatus)PipelineStatus

PipelineStatus defines the observed state of a Pipeline.

Appears in:

-   [Pipeline](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipeline)


| Field | Description |
| --- | --- |
| observedGeneration integer | ObservedGeneration is the last observed generation of the Pipeline. |
| conditions Condition array | Conditions holds the conditions for the Pipeline. |
| phase PipelinePhase | Phase describes the current phase of the pipeline lifecycle. |
| replicas integer | Replicas is the number of pipeline pods observed on the underlyingDeployment. The scale subresource reports it as status.replicas, whichis how HPA and KEDA observe the pipeline’s current scale. |
| readyReplicas integer | ReadyReplicas is the number of ready pipeline pods. |
| selector string | Selector is the label selector for this pipeline’s pods, in stringform. The scale subresource reports it as status.selector, which ishow HPA and KEDA discover the pods backing this Pipeline whencomputing per-pod (cpu/memory/custom) metrics. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipelineuserref)PipelineUserRef

PipelineUserRef points at a User CR whose password Secret + SCRAM mechanism the pipeline will use to authenticate to Redpanda.

Appears in:

-   [PipelineSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-pipelinespec)


| Field | Description |
| --- | --- |
| name string | Name of the User CR (in the same namespace as the Pipeline). |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-podantiaffinity)PodAntiAffinity

PodAntiAffinity configures Pod anti-affinity rules to prevent Pods from being scheduled together on the same node.

Appears in:

-   [Statefulset](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-statefulset)


| Field | Description |
| --- | --- |
| topologyKey string | TopologyKey specifies the topology key used to spread Pods across different nodes or other topologies. |
| type string | Type defines the type of anti-affinity, such as soft or hard. |
| weight integer | Weight sets the weight associated with the soft anti-affinity rule. |
| custom RawExtension | Custom configures additional custom anti-affinity rules. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-podtemplate)PodTemplate

PodTemplate will pass label and annotation to Statefulset Pod template.

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)

-   [PostInstallJob](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-postinstalljob)

-   [PostUpgradeJob](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-postupgradejob)

-   [Statefulset](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-statefulset)


| Field | Description |
| --- | --- |
| labels object (keys:string, values:string) |  |
| annotations object (keys:string, values:string) |  |
| spec PodSpecApplyConfiguration |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-poolconfigurator)PoolConfigurator

Appears in:

-   [PoolInitContainers](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-poolinitcontainers)


| Field | Description |
| --- | --- |
| additionalCLIArgs string array | Chart default: [] |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-poolfsvalidator)PoolFSValidator

Appears in:

-   [PoolInitContainers](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-poolinitcontainers)


| Field | Description |
| --- | --- |
| enabled boolean | Chart default: false |
| expectedFS string | Chart default: xfs |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-poolinitcontainers)PoolInitContainers

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)


| Field | Description |
| --- | --- |
| fsValidator PoolFSValidator |  |
| setDataDirOwnership PoolSetDataDirOwnership |  |
| configurator PoolConfigurator |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-poolsetdatadirownership)PoolSetDataDirOwnership

Appears in:

-   [PoolInitContainers](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-poolinitcontainers)


| Field | Description |
| --- | --- |
| enabled boolean | Chart default: false |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-postinstalljob)PostInstallJob

PostInstallJob configures configurations for the post-install job that run after installation of the Helm chart.

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| resources ResourceRequirements | Sets resource requirements (CPU, memory) for the job to ensure proper allocation and limit resource usage. |
| annotations object (keys:string, values:string) | Adds annotations to the job to provide additional information or metadata that can be used by other tools or libraries. |
| enabled boolean | Specifies whether the job is deployed. |
| labels object (keys:string, values:string) | Applies labels to the job to facilitate identification and selection based on custom criteria. |
| affinity Affinity | Affinity constraints for scheduling Pods. For details, see theKubernetes' documentation. |
| securityContext SecurityContext | SecurityContext is deprecated. Prefer [PodTemplate.Spec.SecurityContext]or [PodTemplate.Spec.Containers[*].SecurityContext]. |
| podTemplate PodTemplate | PodTemplate is a subset of Kubernetes' PodTemplate that will be mergedinto this Job’s PodTemplate. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-postupgradejob)PostUpgradeJob

PostUpgradeJob configures configurations for the post-upgrade job that run after each upgrade of the Helm chart.

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| annotations object (keys:string, values:string) | Adds annotations to the job to provide additional information or metadata that can be used by other tools or libraries. |
| enabled boolean | Specifies whether the job is deployed. |
| labels object (keys:string, values:string) | Applies labels to the job to facilitate identification and selection based on custom criteria. |
| extraEnv EnvVar array | Adds environment variables to the job container to configure its runtime behavior. |
| extraEnvFrom EnvFromSource array | Specifies environment variables from external sources, such as ConfigMap resources, or Secret resources, to dynamically configure the job. |
| resources ResourceRequirements | Sets resource requirements (CPU, memory) for the job to ensure proper allocation and limit resource usage. |
| backoffLimit integer |  |
| affinity Affinity | Affinity constraints for scheduling Pods. For details, see theKubernetes' documentation. |
| securityContext SecurityContext | SecurityContext is deprecated. Prefer [PodTemplate.Spec.SecurityContext]or [PodTemplate.Spec.Containers[*].SecurityContext]. |
| podTemplate PodTemplate | PodTemplate is a subset of Kubernetes' PodTemplate that will be mergedinto this Job’s PodTemplate. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-probeapplyconfiguration)ProbeApplyConfiguration

ProbeApplyConfiguration is a wrapper type that allows including a partial \[corev1.Probe\] in a CRD.

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)

-   [ConsoleValues](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolevalues)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-rbac)RBAC

RBAC configures role-based access control (RBAC).

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| annotations object (keys:string, values:string) | Adds custom annotations to the RBAC resources. |
| enabled boolean | Whether RBAC is enabled. Enable for features that need extra privileges, such as rack awareness. If you use the Redpanda Operator, you must deploy it with the --set rbac.createRPKBundleCRs=true flag to give it the required ClusterRoles. |
| rpkDebugBundle boolean |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-rpc)RPC

RPC configures settings for the RPC API listeners.

Appears in:

-   [Listeners](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-listeners)


| Field | Description |
| --- | --- |
| port integer | Specifies the container port number for the internal listener. |
| tls ListenerTLS | Configures TLS settings for the internal listener. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-rpcontrollers)RPControllers

RPControllers configures additional controllers that can be deployed as sidecars in rp helm

Appears in:

-   [SideCars](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-sidecars)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether the Controllers are enabled. |
| resources ResourceRequirements | Specifies resource requests for the sidecar container.DEPRECATED: Use sideCars.resources |
| securityContext SecurityContext | Specifies the container’s security context, including privileges and access levels of the container and its processes.DEPRECATED: Use sideCars.securityContext |
| image RedpandaImage |  |
| healthProbeAddress string |  |
| metricsAddress string |  |
| pprofAddress string |  |
| run string array |  |
| createRBAC boolean |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-rackawareness)RackAwareness

RackAwareness configures rack awareness in the Helm values. See [Enable Rack Awareness in Kubernetes](https://docs.redpanda.com/streaming/current/manage/kubernetes/k-rack-awareness/).

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether rack awareness is enabled. When enabled, Kubernetes failure zones are treated as racks. Redpanda maps each rack to a failure zone and places partition replicas across them. Requires rbac.enabled set to true. |
| nodeAnnotation string | Specifies the key in Node labels or annotations to use to denote failure zones. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-readinessprobe)ReadinessProbe

ReadinessProbe configures readiness probes to determine when a Pod is ready to handle traffic.

Appears in:

-   [RedpandaConsole](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaconsole)

-   [Statefulset](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-statefulset)


| Field | Description |
| --- | --- |
| failureThreshold integer | Defines the threshold for how many times the probe can fail before the Pod is marked Unready. |
| initialDelaySeconds integer | Sets the initial delay before the readiness probe is initiated, in seconds. |
| periodSeconds integer | Configures the period, in seconds, between each readiness check. |
| timeoutSeconds integer |  |
| successThreshold integer |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpanda)Redpanda

Redpanda defines the CRD for Redpanda clusters.

| Field | Description |
| --- | --- |
| apiVersion string | cluster.redpanda.com/v1alpha2 |
| kind string | Redpanda |
| kind string | Kind is a string value representing the REST resource this object represents.Servers may infer this from the endpoint the client submits requests to.Cannot be updated.In CamelCase.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| apiVersion string | APIVersion defines the versioned schema of this representation of an object.Servers should convert recognized schemas to the latest internal value, andmay reject unrecognized values.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| metadata ObjectMeta | Refer to the Kubernetes API documentation for fields of metadata. |
| spec RedpandaSpec | Defines the desired state of the Redpanda cluster. |
| status RedpandaStatus | Represents the current status of the Redpanda cluster. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaadminapisecrets)RedpandaAdminAPISecrets

Appears in:

-   [RedpandaSecrets](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandasecrets)


| Field | Description |
| --- | --- |
| password string |  |
| tlsCa string |  |
| tlsCert string |  |
| tlsKey string |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandabrokerpool)RedpandaBrokerPool

| Field | Description |
| --- | --- |
| apiVersion string | cluster.redpanda.com/v1alpha2 |
| kind string | RedpandaBrokerPool |
| kind string | Kind is a string value representing the REST resource this object represents.Servers may infer this from the endpoint the client submits requests to.Cannot be updated.In CamelCase.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| apiVersion string | APIVersion defines the versioned schema of this representation of an object.Servers should convert recognized schemas to the latest internal value, andmay reject unrecognized values.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| metadata ObjectMeta | Refer to the Kubernetes API documentation for fields of metadata. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)RedpandaClusterSpec

RedpandaClusterSpec defines the desired state of a Redpanda cluster. These settings are the same as those defined in the Redpanda Helm chart. The values in these settings are passed to the Redpanda Helm chart through Flux. For all default values and links to more documentation, see [Kubernetes Helm Chart Specifications](https://docs.redpanda.com/streaming/current/reference/k-helm-index/).

For descriptions and default values, see [Redpanda Helm Chart Specification](https://docs.redpanda.com/streaming/current/reference/k-redpanda-helm-spec/).

Appears in:

-   [RedpandaSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaspec)


| Field | Description |
| --- | --- |
| nameOverride string | Customizes the labels app.kubernetes.io/component=<nameOverride>-statefulset and app.kubernetes.io/name=<nameOverride> on the StatefulSet Pods. The default is redpanda. |
| fullNameOverride string | Deprecated: use FullnameOverride (fullnameOverride). |
| fullnameOverride string | Customizes the name of the StatefulSet and Services. The default is redpanda. |
| clusterDomain string | Customizes the Kubernetes cluster domain. This domain is used to generate the internal domains of the StatefulSet Pods. For details, see https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#stable-network-id. The default is the cluster.local domain. |
| commonLabels object (keys:string, values:string) | Assigns custom labels to all resources generated by the Redpanda Helm chart. Specify labels as key/value pairs. |
| nodeSelector object (keys:string, values:string) | Specifies on which nodes a Pod should be scheduled. These key/value pairs ensure that Pods are scheduled onto nodes with the specified labels. |
| tolerations Toleration array | Specifies tolerations to allow Pods to be scheduled onto nodes where they otherwise wouldn’t. |
| image RedpandaImage | Defines the container image settings to use for the Redpanda cluster. |
| imagePullSecrets LocalObjectReference array | Specifies credentials for a private image repository. For details, see https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/. |
| enterprise Enterprise | Defines an Enterprise license. |
| rackAwareness RackAwareness | Defines rack awareness settings. |
| console RedpandaConsole | Defines Redpanda Console settings.Deprecated: Use the dedicated Console CRD. |
| connectors RedpandaConnectors | Defines Redpanda Connector settings.Deprecated, ignored, and unused as of v25.1.1 |
| auth Auth | Defines authentication settings for listeners. |
| tls TLS | Defines TLS settings for listeners. |
| external External | Defines external access settings. |
| logging Logging | Defines the log level settings. |
| auditLogging AuditLogging | Defines the log level settings. |
| resources Resources | Defines container resource settings. |
| service Service | Defines settings for the headless ClusterIP Service. |
| storage Storage | Defines storage settings for the Redpanda data directory and the Tiered Storage cache. |
| post_install_job PostInstallJob | Defines settings for the post-install hook, which runs after each install or upgrade. For example, this job is responsible for setting the Enterprise license, if specified. |
| post_upgrade_job PostUpgradeJob | Defines settings for the post-upgrade hook, which runs after each update. For example, this job is responsible for setting cluster configuration properties and restarting services such as Schema Registry, if required. |
| statefulset Statefulset | Defines settings for the StatefulSet that manages Redpanda brokers. |
| tuning Tuning | Defines settings for the autotuner tool in Redpanda. The autotuner identifies the hardware configuration in the container and optimizes the Linux kernel to give you the best performance. |
| listeners Listeners | Defines settings for listeners, including HTTP Proxy, Schema Registry, the Admin API and the Kafka API. |
| config Config | Defines configuration properties supported by Redpanda that may not work correctly in a Kubernetes cluster. Changing these values from the defaults comes with some risk. Use these properties to customize various Redpanda configurations that are not available in the RedpandaClusterSpec. These values have no impact on the configuration or behavior of the Kubernetes objects deployed by Helm, and therefore should not be modified for the purpose of configuring those objects. Instead, these settings get passed directly to the Redpanda binary at startup. |
| rbac RBAC | Defines Role Based Access Control (RBAC) settings. |
| serviceAccount ServiceAccount | Defines Service account settings. |
| monitoring Monitoring | Defines settings for monitoring Redpanda. |
| force boolean | Adds the --force flag in helm upgrade commands. Used for allowing a change of TLS configuration for the RPC listener.Setting force to true will result in a short period of downtime. |
| affinity Affinity | Affinity constraints for scheduling Pods, can override this forStatefulSets and Jobs. For details, see the [Kubernetesdocumentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity). |
| license_key string | Deprecated: Use enterprise.license instead. |
| license_secret_ref LicenseSecretRef | Deprecated: Use enterprise.licenseSecretRef instead. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaconnectors)RedpandaConnectors

RedpandaConnectors configures Redpanda Connectors. Redpanda Connectors is a package that includes Kafka Connect and built-in connectors, sometimes known as plugins. See [Deploy Kafka Connect in Kubernetes](https://docs.redpanda.com/streaming/current/deploy/kafka-connect/k-deploy-kafka-connect/).

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| enabled boolean |  |
| test ConnectorsCreateObj | Specifies whether to create Helm tests. |
| monitoring ConnectorMonitoring | Specifies monitoring resources |
| connectors RawExtension | Connectors specified manual configurations |
| deployment RawExtension | Connectors specified manual configurations |
| nameOverride string | Specifies a custom name for the Redpanda Console resources, overriding the default naming convention. |
| fullnameOverride string | Specifies a full custom name, which overrides the entire naming convention including release name and chart name. |
| commonLabels object (keys:string, values:string) | Assigns custom labels to all resources generated by the Connector Helm chart. Specify labels as key/value pairs. |
| tolerations Toleration array | Applies tolerations to allow Pods to be scheduled on nodes with matching taints, enabling control over where Pods can run. |
| image RedpandaImage | Defines the container image settings to use for the Redpanda cluster. |
| imagePullSecrets LocalObjectReference array | Specifies credentials for a private image repository. For details, see https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/. |
| auth RawExtension | Specifies superuser credentials |
| container RawExtension | Specifies container information |
| storage RawExtension | Specifies storage information |
| logging RawExtension | Specifies logging details |
| service RawExtension | Specifies service details |
| serviceAccount RawExtension | Specifies service account details |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaconsole)RedpandaConsole

RedpandaConsole is the union of console.PartialValues (earlier or equal to v0.7.31 Console version) and consolev3.PartialValues (after v0.7.31 Console version). Use these settings to configure the subchart. For more details on each setting, see the Helm values for the Redpanda Console chart: [https://artifacthub.io/packages/helm/redpanda-data/console?modal=values](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values)

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether the Redpanda Console subchart should be deployed. |
| replicaCount integer | Sets the number of replicas for the Redpanda Console Deployment resource. |
| nameOverride string | Specifies a custom name for the Redpanda Console resources, overriding the default naming convention. |
| fullnameOverride string | Specifies a full custom name, which overrides the entire naming convention including release name and chart name. |
| commonLabels object (keys:string, values:string) |  |
| priorityClassName string | Specifies the priority class name for the Pods that run Redpanda Console. |
| image RawExtension | Defines the container image for the Redpanda Console, including the repository, name, and tag. |
| imagePullSecrets RawExtension array | Defines Secrets used to pull the container images from a private registry. |
| serviceAccount RawExtension | Configures the ServiceAccount used by the Pods that run Redpanda Console. |
| annotations RawExtension |  |
| podAnnotations RawExtension | Adds custom annotations to the Pods that run Redpanda Console. |
| podLabels RawExtension | Adds custom labels to the Pods that run Redpanda Console. |
| podSecurityContext RawExtension |  |
| securityContext RawExtension | Sets the security context for the Pods that run Redpanda Console. |
| service RawExtension | Configures the Kubernetes Service for Redpanda Console. |
| ingress RawExtension | Configures the Kubernetes Ingress resource for Redpanda Console. |
| gateway RawExtension | Configures a Gateway API HTTPRoute for Redpanda Console. |
| resources RawExtension | Configures resource requests and limits for the Pods that run Redpanda Console. |
| autoscaling RawExtension | Configures Horizontal Pod Autoscaling (HPA) for Redpanda Console. |
| nodeSelector RawExtension | Specifies Node labels for Pod assignment. |
| tolerations RawExtension array | Specifies tolerations for scheduling Pods onto Nodes with taints. |
| affinity RawExtension | Defines affinity rules for Pod assignment. |
| topologySpreadConstraints RawExtension | Specifies topology spread constraints for Pod placement. |
| extraEnv RawExtension array | Adds extra environment variables to the Pods that run Redpanda Console. |
| extraEnvFrom RawExtension array | Allows you to add extra environment variables from external resources to the Pods that run Redpanda Console. |
| extraVolumes RawExtension array | Adds extra volumes to the Pods that run Redpanda Console. |
| extraVolumeMounts RawExtension array | Mounts additional volumes inside the containers that run Redpanda Console. |
| extraContainers RawExtension array | Adds extra containers to the Pods that run Redpanda Console. |
| initContainers RawExtension | Specifies init containers for the Pods that run Redpanda Console. |
| secretMounts RawExtension array | Mounts additional Secret resources inside the containers that run Redpanda Console. |
| configmap ConsoleCreateObj | Deprecated: this field exists for storage backwards compatibility and isnever used. Prefer ConfigMap (configmap). |
| configMap ConsoleCreateObj | Specifies whether a ConfigMap should be created for Redpanda Console. |
| secret RawExtension | Specifies whether a Secret should be created for Redpanda Console. |
| deployment RawExtension | Specifies whether a Deployment should be created for Redpanda Console. |
| config RawExtension | Configures custom settings for Redpanda Console.config is available in Console chart version after v0.7.31 semver |
| strategy RawExtension | Configures console’s Deployment’s update strategy. |
| licenseSecretRef SecretKeySelector | Defines a reference to Kubernetes Secret that points to a Redpanda Enterprise license.Please consider use Enterprise in RedpandaClusterSpec type.licenseSecretRef is available in Console chart version after v0.7.31 semver |
| automountServiceAccountToken boolean | Automount API credentials for the Service Account into the pod. |
| readinessProbe ReadinessProbe | Settings for console’s Deployment’s readiness probe. |
| livenessProbe LivenessProbe | Settings for console’s Deployment’s liveness probe. |
| monitoring MonitoringConfig |  |
| console RawExtension | Deprecated: Use config insteadconsole is available in Console chart version earlier or equal to v0.7.31 |
| enterprise RawExtension | Deprecated: Use licenseSecretRef instead.enterprise is available in Console chart version earlier or equal to v0.7.31 |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaimage)RedpandaImage

RedpandaImage configures the Redpanda container image settings in the Helm values.

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)

-   [RPControllers](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-rpcontrollers)

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)

-   [RedpandaConnectors](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaconnectors)

-   [SideCars](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-sidecars)

-   [StretchClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterspec)


| Field | Description |
| --- | --- |
| repository string | Specifies the image repository to pull from. |
| tag string | Specifies the image tag. |
| pullPolicy string | Specifies the strategy used for pulling images from the repository. For available values, see https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandalicensestatus)RedpandaLicenseStatus

Appears in:

-   [RedpandaStatus](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandastatus)

-   [StretchClusterStatus](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterstatus)


| Field | Description |
| --- | --- |
| violation boolean |  |
| inUseFeatures string array |  |
| expired boolean |  |
| type string |  |
| organization string |  |
| expiration Time |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandamemory)RedpandaMemory

RedpandaMemory allows you to optionally specify the memory size for the Redpanda process, including the Seastar subsystem. By default, this section is omitted, and memory sizes are calculated automatically based on the container’s total memory allocation. When you configure this section and manually set the memory and reserveMemory values, the automatic calculation is disabled.

If you are setting these values manually, follow these guidelines carefully. Incorrect settings can lead to performance degradation, instability, or even data loss. The total memory allocated to a container is determined as the sum of the following two areas:

-   Redpanda (including Seastar): Defined by the `--memory` parameter. Includes the memory used by the Redpanda process and the reserved memory allocated for Seastar. A minimum of 2Gi per core is required, and this value typically accounts for ~80% of the container’s total memory. For production, allocate at least 8Gi.

-   Operating system (OS): Defined by the `--reserve-memory` parameter. Represents the memory available for the operating system and other processes within the container.


Appears in:

-   [Memory](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-memory)


| Field | Description |
| --- | --- |
| memory Quantity | Memory for the Redpanda process. This must be lower than the container’s memory (resources.memory.container.min if provided, otherwise resources.memory.container.max). Equivalent to --memory. For production, use 8Gi or greater. |
| reserveMemory Quantity | Memory reserved for the OS. Any value above 1Gi will provide diminishing performance benefits. Equivalent to --reserve-memory. For production, use 1Gi. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandarole)RedpandaRole

RedpandaRole defines the CRD for a Redpanda role.

| Field | Description |
| --- | --- |
| apiVersion string | cluster.redpanda.com/v1alpha2 |
| kind string | RedpandaRole |
| kind string | Kind is a string value representing the REST resource this object represents.Servers may infer this from the endpoint the client submits requests to.Cannot be updated.In CamelCase.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| apiVersion string | APIVersion defines the versioned schema of this representation of an object.Servers should convert recognized schemas to the latest internal value, andmay reject unrecognized values.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| metadata ObjectMeta | Refer to the Kubernetes API documentation for fields of metadata. |
| spec RoleSpec | Defines the desired state of the Redpanda role. |
| status RoleStatus | Represents the current status of the Redpanda role. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandasecrets)RedpandaSecrets

Appears in:

-   [SecretConfig](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-secretconfig)


| Field | Description |
| --- | --- |
| adminApi RedpandaAdminAPISecrets |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaspec)RedpandaSpec

RedpandaSpec defines the desired state of the Redpanda cluster.

Appears in:

-   [Redpanda](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpanda)


| Field | Description |
| --- | --- |
| chartRef ChartRef | Defines chart details, including the version and repository. |
| clusterSpec RedpandaClusterSpec | Defines the Helm values to use to deploy the cluster. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandastatus)RedpandaStatus

RedpandaStatus defines the observed state of Redpanda

Appears in:

-   [Redpanda](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpanda)


| Field | Description |
| --- | --- |
| conditions Condition array | Conditions holds the conditions for the Redpanda. |
| license RedpandaLicenseStatus | LicenseStatus contains information about the current state of anyinstalled license in the Redpanda cluster. |
| configVersion string | ConfigVersion contains the configuration version written inRedpanda used for restarting broker nodes as necessary. |
| observedGeneration integer | Deprecated |
| lastHandledReconcileAt string | Deprecated |
| lastAppliedRevision string | Deprecated |
| lastAttemptedRevision string | Deprecated |
| helmRelease string | Deprecated |
| helmReleaseReady boolean | Deprecated |
| helmRepository string | Deprecated |
| helmRepositoryReady boolean | Deprecated |
| upgradeFailures integer | Deprecated |
| failures integer | Failures is the reconciliation failure count against the latest desiredstate. It is reset after a successful reconciliation.deprecated |
| installFailures integer | Deprecated |
| decommissioningNode integer | Deprecated |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-resourcetemplate)ResourceTemplate

ResourceTemplate specifies additional configuration for a resource.

Appears in:

-   [UserTemplateSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-usertemplatespec)


| Field | Description |
| --- | --- |
| metadata MetadataTemplate | Refer to the Kubernetes API documentation for fields of metadata. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-resourcetype)ResourceType (string)

ResourceType specifies the type of resource an ACL is applied to.

Appears in:

-   [ACLResourceFilter](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclresourcefilter)

-   [ACLResourceSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-aclresourcespec)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-resources)Resources

RedpandaResources encapsulates the calculation of the redpanda container’s [corev1.ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#resourcerequirements-v1-core) and parameters such as `--memory`, `--reserve-memory`, and `--smp`. This calculation supports two modes:

-   Explicit mode (recommended): Activated when `Limits` and `Requests` are set. In this mode, the CLI flags are calculated directly based on the provided `Limits` and `Requests`. This mode ensures predictable resource allocation and is recommended for production environments. If additional tuning is required, the CLI flags can be manually overridden using `statefulset.additionalRedpandaCmdFlags`.

-   Legacy mode (default): Used when `Limits` and `Requests` are not set. In this mode, the container resources and CLI flags are calculated using built-in default logic, where 80% of the container’s memory is allocated to Redpanda and the rest is reserved for system overhead. Legacy mode is intended for backward compatibility and less controlled environments.


Explicit mode offers better control and aligns with Kubernetes best practices. Legacy mode is a fallback for users who have not defined `Limits` and `Requests`.

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| limits Quantity |  |
| requests Quantity |  |
| cpu CPU | Specifies the number of CPU cores. |
| memory Memory | Specifies the amount of memory. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-roleauthorizationspec)RoleAuthorizationSpec

RoleAuthorizationSpec defines authorization rules for this role.

Appears in:

-   [RoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-rolespec)


| Field | Description |
| --- | --- |
| acls ACLRule array | List of ACL rules which should be applied to this role. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-rolespec)RoleSpec

RoleSpec defines the configuration of a Redpanda role.

Appears in:

-   [RedpandaRole](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandarole)


| Field | Description |
| --- | --- |
| cluster ClusterSource | ClusterSource is a reference to the cluster where the role should be created.It is used in constructing the client created to configure a cluster. |
| principals string array | Principals defines the list of users or groups assigned to this role.Format: Type:Name (e.g., User:john, Group:engineering). If type is omitted, defaults to User.Supported principal types are User and Group. Group principals correspond toOIDC identity provider groups and require group-based authorization to be enabled in Redpanda. |
| authorization RoleAuthorizationSpec | Authorization rules defined for this role. If specified, the operator will manage ACLs for this role.If omitted, ACLs should be managed separately using Redpanda’s ACL management. |
| internal boolean | Internal marks this role as an internal Redpanda role with "" prefix.When true, the effective role name becomes "<kubernetes-name>".When false (default), the effective role name is the Kubernetes resource name. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-rolestatus)RoleStatus

RoleStatus defines the observed state of a Redpanda role

Appears in:

-   [RedpandaRole](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandarole)


| Field | Description |
| --- | --- |
| observedGeneration integer | Specifies the last observed generation. |
| conditions Condition array | Conditions holds the conditions for the Redpanda role. |
| managedAcls boolean | ManagedACLs returns whether the role has managed ACLs that needto be cleaned up. |
| managedRole boolean | ManagedRole returns whether the role has been created in Redpanda and needsto be cleaned up. |
| managedPrincipals boolean | ManagedPrincipals returns whether the role has managed principals (membership)that are being reconciled by the operator. |
| effectiveRoleName string | EffectiveRoleName stores the last known effective role name that was successfullyreconciled. This is used to detect role renames and clean up the old role. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-sasl)SASL

SASL configures SASL authentication in the Helm values.

Appears in:

-   [Auth](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-auth)


| Field | Description |
| --- | --- |
| enabled boolean | Enables SASL authentication. If you enable SASL authentication, you must provide a Secret name in secretRef. |
| mechanism string | Specifies the default authentication mechanism to use for superusers. Options are SCRAM-SHA-256 and SCRAM-SHA-512. |
| secretRef string | If users is empty, secretRef specifies the name of the Secret that contains your superuser credentials in the format <username>:<password>:<optional-authentication-mechanism>. Otherwise, secretRef specifies the name of the Secret that the chart creates to store the credentials in users. |
| users UsersItems array | Specifies a list of superuser credentials. |
| bootstrapUser BootstrapUser | Specifies configuration about the bootstrap user. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-saslmechanism)SASLMechanism (string)

SASLMechanism specifies a SASL auth mechanism.

Appears in:

-   [AdminSASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-adminsasl)

-   [KafkaSASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasasl)

-   [SchemaRegistrySASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaregistrysasl)

-   [UserAuthenticationSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-userauthenticationspec)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schema)Schema

Schema defines the CRD for a Redpanda schema.

| Field | Description |
| --- | --- |
| apiVersion string | cluster.redpanda.com/v1alpha2 |
| kind string | Schema |
| kind string | Kind is a string value representing the REST resource this object represents.Servers may infer this from the endpoint the client submits requests to.Cannot be updated.In CamelCase.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| apiVersion string | APIVersion defines the versioned schema of this representation of an object.Servers should convert recognized schemas to the latest internal value, andmay reject unrecognized values.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| metadata ObjectMeta | Refer to the Kubernetes API documentation for fields of metadata. |
| spec SchemaSpec | Defines the desired state of the Redpanda schema. |
| status SchemaStatus | Represents the current status of the Redpanda schema. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemareference)SchemaReference

SchemaReference is a way for a one schema to reference another. The details for how referencing is done are type specific; for example, JSON objects that use the key "$ref" can refer to another schema via URL.

Appears in:

-   [SchemaSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaspec)


| Field | Description |
| --- | --- |
| name string |  |
| subject string |  |
| version integer |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaregistry)SchemaRegistry

SchemaRegistry configures settings for the Schema Registry listeners.

Appears in:

-   [Listeners](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-listeners)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether this Listener is enabled. |
| authenticationMethod string | Specifies the authentication method for this listener. For example, 'mtls_identity', sasl or http_basic. |
| appProtocol string |  |
| port integer | Specifies the container port number for this listener. |
| tls ListenerTLS | Configures TLS settings for the internal listener. |
| prefixTemplate string | Specifies the template used for generating the advertised addresses ofServices. This field accepts a string template that dynamicallyconstructs Service addresses based on various parameters such as Servicename and port number.For historical backwards compatibility, this field is present on bothinternal and external listeners. However, it is ignored when specifiedon internal listeners. |
| external object (keys:string, values:ExternalListener) | Defines settings for the external listeners. |
| kafkaEndpoint string | Configures the listener to use for HTTP connections. For example default for the internal listener.deprecated and not respected. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaregistrysasl)SchemaRegistrySASL

SchemaRegistrySASL configures credentials to connect to Redpanda cluster that has authentication enabled.

Appears in:

-   [SchemaRegistrySpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaregistryspec)


| Field | Description |
| --- | --- |
| username string | Specifies the username. |
| password ValueSource | Specifies the password. |
| authToken ValueSource |  |
| mechanism SASLMechanism | Specifies the SASL/SCRAM authentication mechanism. |
| passwordSecretRef SecretKeyRef | Deprecated: use password instead |
| token SecretKeyRef | Deprecated: use authToken instead |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaregistrysecrets)SchemaRegistrySecrets

Appears in:

-   [SecretConfig](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-secretconfig)


| Field | Description |
| --- | --- |
| bearerToken string |  |
| password string |  |
| tlsCa string |  |
| tlsCert string |  |
| tlsKey string |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaregistryspec)SchemaRegistrySpec

SchemaRegistrySpec defines client configuration for connecting to Redpanda’s admin API.

Appears in:

-   [StaticConfigurationSource](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-staticconfigurationsource)


| Field | Description |
| --- | --- |
| urls string array | Specifies a list of broker addresses in the format <host>:<port> |
| tls CommonTLS | Defines TLS configuration settings for Redpanda clusters that have TLS enabled. |
| sasl SchemaRegistrySASL | Defines authentication configuration settings for Redpanda clusters that have authentication enabled. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaspec)SchemaSpec

SchemaSpec defines the configuration of a Redpanda schema.

Appears in:

-   [Schema](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schema)


| Field | Description |
| --- | --- |
| cluster ClusterSource | ClusterSource is a reference to the cluster hosting the schema registry.It is used in constructing the client created to configure a cluster. |
| text string | Text is the actual unescaped text of a schema. |
| schemaType SchemaType | Type is the type of a schema. The default type is avro. |
| references SchemaReference array | References declares other schemas this schema references. See thedocs on SchemaReference for more details. |
| compatibilityLevel CompatibilityLevel | CompatibilityLevel sets the compatibility level for the given schema |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemastatus)SchemaStatus

SchemaStatus defines the observed state of a Redpanda schema.

Appears in:

-   [Schema](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schema)


| Field | Description |
| --- | --- |
| observedGeneration integer | Specifies the last observed generation. |
| conditions Condition array | Conditions holds the conditions for the Redpanda schema. |
| versions integer array | Versions shows the versions of a given schema |
| schemaHash string | SchemaHash is the hashed value of the schema synced to the cluster |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schematype)SchemaType (string)

SchemaType specifies the type of the given schema.

Appears in:

-   [SchemaSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaspec)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-secretconfig)SecretConfig

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)

-   [ConsoleValues](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolevalues)


| Field | Description |
| --- | --- |
| create boolean |  |
| kafka KafkaSecrets |  |
| authentication AuthenticationSecrets |  |
| license string |  |
| redpanda RedpandaSecrets |  |
| serde SerdeSecrets |  |
| schemaRegistry SchemaRegistrySecrets |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-secretkeyref)SecretKeyRef

Deprecated: SecretKeyRef contains enough information to inspect or modify the referred Secret data See [https://pkg.go.dev/k8s.io/api/core/v1#ObjectReference](https://pkg.go.dev/k8s.io/api/core/v1#ObjectReference).

Appears in:

-   [AdminSASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-adminsasl)

-   [CommonTLS](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-commontls)

-   [KafkaSASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasasl)

-   [KafkaSASLAWSMskIam](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasaslawsmskiam)

-   [KafkaSASLGSSAPI](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasaslgssapi)

-   [KafkaSASLOAuthBearer](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasasloauthbearer)

-   [SchemaRegistrySASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaregistrysasl)


| Field | Description |
| --- | --- |
| name string | Name of the referent.More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
| key string | Key in Secret data to get value from |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-secretmount)SecretMount

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)

-   [ConsoleValues](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolevalues)


| Field | Description |
| --- | --- |
| name string |  |
| secretName string |  |
| path string |  |
| subPath string |  |
| defaultMode integer |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-secretref)SecretRef

SecretRef configures the Secret resource that contains existing TLS certificates.

Appears in:

-   [Certificate](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-certificate)


| Field | Description |
| --- | --- |
| name string | Specifies the name of the Secret resource. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-secretwithconfigfield)SecretWithConfigField

Appears in:

-   [CredentialSecretRef](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-credentialsecretref)


| Field | Description |
| --- | --- |
| key string |  |
| name string |  |
| configurationKey string |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-serdesecrets)SerdeSecrets

Appears in:

-   [SecretConfig](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-secretconfig)


| Field | Description |
| --- | --- |
| protobufGitBasicAuthPassword string |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-service)Service

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| name string |  |
| internal ServiceInternal |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-serviceaccount)ServiceAccount

ServiceAccount configures Service Accounts.

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| automountServiceAccountToken boolean | Specifies whether a service account should automount API-Credentials |
| annotations object (keys:string, values:string) | Adds custom annotations to the ServiceAccount resources. |
| create boolean | Specifies whether a ServiceAccount should be created. |
| name string | Specifies the name of the ServiceAccount. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-serviceaccountconfig)ServiceAccountConfig

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)

-   [ConsoleValues](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolevalues)


| Field | Description |
| --- | --- |
| automountServiceAccountToken boolean |  |
| annotations object (keys:string, values:string) |  |
| name string |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-serviceconfig)ServiceConfig

Appears in:

-   [ConsoleSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolespec)

-   [ConsoleValues](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-consolevalues)


| Field | Description |
| --- | --- |
| type ServiceType |  |
| port integer |  |
| nodePort integer |  |
| targetPort integer |  |
| annotations object (keys:string, values:string) |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-serviceinternal)ServiceInternal

Appears in:

-   [Service](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-service)


| Field | Description |
| --- | --- |
| annotations object (keys:string, values:string) |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-setdatadirownership)SetDataDirOwnership

SetDataDirOwnership defines the settings related to ownership of the Redpanda data directory in environments where root access is restricted.

Appears in:

-   [InitContainers](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-initcontainers)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether to enable root access. Enable only in environments where root access is not allowed, such as minikube. |
| extraVolumeMounts string | Adds extra volume mounts. |
| resources ResourceRequirements | Specifies the resource requirements. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-settieredstoragecachedirownership)SetTieredStorageCacheDirOwnership

SetTieredStorageCacheDirOwnership configures the settings related to ownership of the Tiered Storage cache in environments where root access is restricted.

Appears in:

-   [InitContainers](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-initcontainers)


| Field | Description |
| --- | --- |
| extraVolumeMounts string |  |
| resources ResourceRequirements |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlink)ShadowLink

ShadowLink defines the CRD for ShadowLink cluster configuration.

| Field | Description |
| --- | --- |
| apiVersion string | cluster.redpanda.com/v1alpha2 |
| kind string | ShadowLink |
| kind string | Kind is a string value representing the REST resource this object represents.Servers may infer this from the endpoint the client submits requests to.Cannot be updated.In CamelCase.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| apiVersion string | APIVersion defines the versioned schema of this representation of an object.Servers should convert recognized schemas to the latest internal value, andmay reject unrecognized values.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| metadata ObjectMeta | Refer to the Kubernetes API documentation for fields of metadata. |
| spec ShadowLinkSpec |  |
| status ShadowLinkStatus |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkclientoptions)ShadowLinkClientOptions

ShadowLinkClientOptions configures the source-cluster Kafka fetch/connection behavior of a shadow link. These knobs primarily control replication latency vs. batching efficiency. Every field defaults server-side when left at 0, so omitting a field (or setting it to 0) preserves the Redpanda default noted in its documentation.

Appears in:

-   [ShadowLinkSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkspec)


| Field | Description |
| --- | --- |
| fetchMinBytes integer | Minimum bytes the source broker accumulates before answering a fetchrequest. Lowering this reduces replication latency at low throughput, atthe cost of more, smaller fetches. If 0, defaults to 5 MiB (5242880). |
| fetchWaitMaxMs integer | Maximum time in milliseconds the source broker waits to satisfyfetchMinBytes before answering a fetch request. Lowering this caps theworst-case replication latency when fetchMinBytes is not met. If 0,defaults to 500ms. |
| fetchMaxBytes integer | Maximum bytes returned by a single fetch request. If 0, defaults to 20 MiB (20971520). |
| fetchPartitionMaxBytes integer | Maximum bytes returned per partition in a fetch request. If 0, defaults to 5 MiB (5242880). |
| metadataMaxAgeMs integer | How often in milliseconds the client refreshes source cluster metadata. If 0, defaults to 10000ms. |
| connectionTimeoutMs integer | Connection timeout to the source cluster in milliseconds. If 0, defaults to 1000ms. |
| retryBackoffMs integer | Base backoff between connection retries in milliseconds. If 0, defaults to 100ms. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkconsumeroffsetsyncoptions)ShadowLinkConsumerOffsetSyncOptions

Options for syncing consumer offsets

Appears in:

-   [ShadowLinkSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkspec)


| Field | Description |
| --- | --- |
| interval Duration | Sync intervalIf 0 provided, defaults to 30 seconds |
| paused boolean | Allows user to pause the consumer offset sync task. If paused, thenthe task will enter the 'paused' state and not sync consumer offsets fromthe source cluster |
| groupFilters NameFilter array | The filters |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkrolesyncoptions)ShadowLinkRoleSyncOptions

Options for syncing RBAC roles

Appears in:

-   [ShadowLinkSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkspec)


| Field | Description |
| --- | --- |
| enabled boolean | Enabled controls whether RBAC role definitions and role membershipsare replicated from the source cluster. Defaults to true, whichreplicates every role (subject to roleNameFilters). Set to false toturn role replication off. |
| interval Duration | How often to sync rolesIf 0 provided, defaults to 30 seconds |
| paused boolean | Allows user to pause the role sync task. If paused, then the taskwill enter the 'paused' state and not sync roles from the sourcecluster |
| roleNameFilters NameFilter array | List of filters that select which roles are replicated. Defaults toa single include-all filter so that every role is replicated. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistryapioptions)ShadowLinkSchemaRegistryAPIOptions

Options for replicating schemas from a source schema registry over its REST API.

Appears in:

-   [ShadowLinkSchemaRegistrySyncOptions](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistrysyncoptions)


| Field | Description |
| --- | --- |
| sourceURL string | URL of the source schema registry, for examplehttps://psrc-xxxxx.us-east-1.aws.confluent.cloud |
| authentication ShadowLinkSchemaRegistryAuthentication | Authentication options used to connect to the source schemaregistry. |
| tls CommonTLS | TLS settings used to connect to the source schema registry. UnlikeKafka API connections, schema registry connection material is passedto the cluster as PEM data, so insecureSkipTlsVerify and thedeprecated secret-reference fields are not supported here. |
| tailInterval Duration | How often to poll the source registry for incremental changes.If not provided, the cluster default (10s) is used. |
| fullSyncInterval Duration | How often to run a full scan of the source registry.If not provided, the cluster default (5m) is used. |
| maxSourceRequestsPerSecond integer | Rate limit for requests against the source registry.If not provided, the cluster default (30) is used. |
| sourceFilter ShadowLinkSchemaRegistrySourceFilter | Selects which schema registry contexts and subjects are replicated.If not provided, the entire source registry is replicated. |
| destination ShadowLinkSchemaRegistryContextDestination | Destination context mapping for source schema registry data. If notprovided, source context names are preserved on the shadow cluster. |
| unsupportedSchemaFeaturePolicy UnsupportedSchemaFeaturePolicy | Policy applied when a source schema uses features that the Redpandaschema registry does not support. Defaults to fail. |
| paused boolean | Allows the user to pause the schema registry sync task. If paused,the task enters the 'paused' state, stops replicating schemas fromthe source, and the per-context client write protection on thecontexts this link owns is lifted. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistryauthentication)ShadowLinkSchemaRegistryAuthentication

Authentication options for a source schema registry.

Appears in:

-   [ShadowLinkSchemaRegistryAPIOptions](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistryapioptions)


| Field | Description |
| --- | --- |
| basic ShadowLinkSchemaRegistryBasicAuthentication | HTTP basic authentication credentials. For a Confluent SchemaRegistry these are the schema registry API key (username) and APIsecret (password). |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistrybasicauthentication)ShadowLinkSchemaRegistryBasicAuthentication

HTTP basic authentication credentials for a source schema registry.

Appears in:

-   [ShadowLinkSchemaRegistryAuthentication](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistryauthentication)


| Field | Description |
| --- | --- |
| username ValueSource | Username used for basic authentication, for example a ConfluentSchema Registry API key. May reference a Kubernetes Secret. |
| password ValueSource | Password used for basic authentication, for example a ConfluentSchema Registry API secret. May reference a Kubernetes Secret. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistrycontextdestination)ShadowLinkSchemaRegistryContextDestination

Destination context mapping for source schema registry data. It mirrors the SchemaRegistryContextDestination oneof in shadow\_link.proto: exactly one of identity or exact must be set.

Appears in:

-   [ShadowLinkSchemaRegistryAPIOptions](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistryapioptions)


| Field | Description |
| --- | --- |
| identity ShadowLinkSchemaRegistryIdentityContextMapping | Preserve source context names in the destination schema registry.Mutually exclusive with exact. |
| exact ShadowLinkSchemaRegistryContextMapping array | Map selected source contexts to explicit destination contexts. Everysource context in the effective source scope must have exactly onemapping. Mutually exclusive with identity. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistrycontextmapping)ShadowLinkSchemaRegistryContextMapping

Maps a source schema registry context to a destination context on the shadow cluster.

Appears in:

-   [ShadowLinkSchemaRegistryContextDestination](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistrycontextdestination)


| Field | Description |
| --- | --- |
| source string | The source context name. |
| destination string | The destination context name on the shadow cluster. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistryidentitycontextmapping)ShadowLinkSchemaRegistryIdentityContextMapping

Preserve source context names in the destination schema registry.

Appears in:

-   [ShadowLinkSchemaRegistryContextDestination](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistrycontextdestination)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistrysourcefilter)ShadowLinkSchemaRegistrySourceFilter

Selects which contexts and subjects are replicated from a source schema registry.

Appears in:

-   [ShadowLinkSchemaRegistryAPIOptions](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistryapioptions)


| Field | Description |
| --- | --- |
| contexts string array | Schema registry contexts to replicate, for example ".". If empty,all contexts are replicated. |
| subjects string array | Subjects to replicate within the selected contexts. If empty, allsubjects are replicated. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistrysyncoptions)ShadowLinkSchemaRegistrySyncOptions

Options for syncing schema registry settings

Appears in:

-   [ShadowLinkSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkspec)


| Field | Description |
| --- | --- |
| enabled boolean | Deprecated: use schema_registry_shadowing_mode instead. Enabled isretained for compatibility with objects created by an earlier buildof this CRD, where a boolean toggled schema replication. It ishonored only when schema_registry_shadowing_mode is unset: false mapsto disabled, and true maps to api when shadowSchemaRegistryAPI isconfigured or topic otherwise. When both are set,schema_registry_shadowing_mode takes precedence. |
| schema_registry_shadowing_mode ShadowLinkSchemaRegistrySyncOptionsMode | Mode selects how schemas are replicated from the source cluster.Defaults to topic (shadow the source Redpanda cluster’s internalschemas topic) when neither this nor the legacy enabled field is set.Set to api to replicate from the source schema registry over its RESTAPI (configured via shadowSchemaRegistryAPI), or disabled to turn schemareplication off. |
| shadowSchemaRegistryAPI ShadowLinkSchemaRegistryAPIOptions | Configuration for replicating schemas from the source cluster’sschema registry REST API (for example a Confluent Schema Registry)instead of shadowing a source Redpanda cluster’s internal schemastopic. Required when mode is api and forbidden otherwise. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistrysyncoptionsmode)ShadowLinkSchemaRegistrySyncOptionsMode (string)

ShadowLinkSchemaRegistrySyncOptionsMode selects how schemas are replicated from the source cluster. It mirrors the schema\_registry\_shadowing\_mode oneof in shadow\_link.proto so that additional modes can be introduced.

Appears in:

-   [ShadowLinkSchemaRegistrySyncOptions](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistrysyncoptions)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinksecuritysettingssyncoptions)ShadowLinkSecuritySettingsSyncOptions

Options for syncing security settings

Appears in:

-   [ShadowLinkSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkspec)


| Field | Description |
| --- | --- |
| interval Duration | Sync intervalIf 0 provided, defaults to 30 seconds |
| paused boolean | Allows user to pause the security settings sync task. If paused,then the task will enter the 'paused' state and will not sync securitysettings from the source cluster |
| aclFilters ACLFilter array | ACL filters |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkspec)ShadowLinkSpec

Appears in:

-   [ShadowLink](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlink)


| Field | Description |
| --- | --- |
| shadowCluster ClusterSource |  |
| sourceCluster ClusterSource |  |
| topicMetadataSyncOptions ShadowLinkTopicMetadataSyncOptions | Topic metadata sync options |
| consumerOffsetSyncOptions ShadowLinkConsumerOffsetSyncOptions | Consumer offset sync options |
| securitySyncOptions ShadowLinkSecuritySettingsSyncOptions | Security settings sync options |
| schemaRegistrySyncOptions ShadowLinkSchemaRegistrySyncOptions | Schema registry sync options. Schemas are replicated from the sourcecluster by default; setschemaRegistrySyncOptions.schema_registry_shadowing_mode to disabledto turn schema replication off. |
| roleSyncOptions ShadowLinkRoleSyncOptions | RBAC role sync options. Roles are replicated from the source clusterby default; set roleSyncOptions.enabled to false to turn rolereplication off. |
| clientOptions ShadowLinkClientOptions | Tuning knobs for the Kafka client the shadow cluster uses to fetch datafrom the source cluster. Connection details (bootstrap servers, TLS) arederived from sourceCluster and are not configurable here; only the mutableperformance/latency knobs are exposed. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkstate)ShadowLinkState (string)

State of the shadow link

Appears in:

-   [ShadowLinkStatus](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkstatus)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkstatus)ShadowLinkStatus

ShadowLinkStatus defines the observed state of any node pools tied to this cluster

Appears in:

-   [ShadowLink](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlink)


| Field | Description |
| --- | --- |
| state ShadowLinkState | State of the shadow link |
| taskStatuses ShadowLinkTaskStatus array | Statuses of the running tasks |
| shadowTopicStatuses ShadowTopicStatus array | Status of shadow topics |
| conditions Condition array | Conditions holds the conditions for the ShadowLink. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinktaskstatus)ShadowLinkTaskStatus

Appears in:

-   [ShadowLinkStatus](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkstatus)


| Field | Description |
| --- | --- |
| lastTransitionTime Time |  |
| name string | Name of the task |
| state TaskState | State of the task |
| reason string | Reason for task being in state |
| brokerId integer | The broker the task is running on |
| shard integer | The shard the task is running on |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinktopicmetadatasyncoptions)ShadowLinkTopicMetadataSyncOptions

Options for syncing topic metadata

Appears in:

-   [ShadowLinkSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkspec)


| Field | Description |
| --- | --- |
| interval Duration | How often to sync metadataIf 0 provided, defaults to 30 seconds |
| autoCreateShadowTopicFilters NameFilter array | List of filters that indicate which topics should be automaticallycreated as shadow topics on the shadow cluster. This only controlsautomatic creation of shadow topics and does not effect the state of themirror topic once it is created.Literal filters for consumer_offsets and redpanda.audit_log will berejected as well as prefix filters to match topics prefixed with_redpanda or redpanda.Wildcard * is permitted only for literal filters and will _not matchany topics that start with _redpanda or redpanda. If users wish toshadow topics that start with _redpanda or redpanda, they shouldprovide a literal filter for those topics. |
| syncedShadowTopicProperties string array | List of topic properties that should be synced from the source topic.The following properties will always be replicated- Partition count- max.message.bytes- cleanup.policy- timestamp.typeThe following properties are not allowed to be replicated and adding themto this list will result in an error:- redpanda.remote.readreplica- redpanda.remote.recovery- redpanda.remote.allowgaps- redpanda.virtual.cluster.id- redpanda.leaders.preference- redpanda.cloud_topic.enabledThis list is a list of properties in addition to the default propertiesthat will be synced. See excludeDefault. |
| excludeDefault boolean | If false, then the following topic properties will be synced by default:- compression.type- retention.bytes- retention.ms- delete.retention.ms- Replication Factor- min.compaction.lag.ms- max.compaction.lag.msIf this is true, then only the properties listed insynced_shadow_topic_properties will be synced. |
| startOffset TopicMetadataSyncOffset | The starting offset for new shadow topic partitions.Defaults to earliest.Only applies if the shadow partition is empty. |
| startOffsetTimestamp Time | The timestamp to start at if startOffset` is set to "timestamp".Not providing this when setting startOffset to "timestamp" isan error. |
| paused boolean | Allows user to pause the topic sync task. If paused, thenthe task will enter the 'paused' state and not sync topics or theirproperties from the source cluster |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowtopicstate)ShadowTopicState (string)

State of a shadow topic

Appears in:

-   [ShadowTopicStatus](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowtopicstatus)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowtopicstatus)ShadowTopicStatus

Status of a ShadowTopic

Appears in:

-   [ShadowLinkStatus](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkstatus)


| Field | Description |
| --- | --- |
| lastTransitionTime Time |  |
| name string | Name of the shadow topic |
| topicId string | Topic ID of the shadow topic |
| state ShadowTopicState | State of the shadow topic |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-sidecarobj)SideCarObj

SideCarObj represents a generic sidecar object. This is a placeholder for now.

Appears in:

-   [SideCars](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-sidecars)


| Field | Description |
| --- | --- |
| enabled boolean |  |
| resources ResourceRequirements | Specifies resource requests for the sidecar container.DEPRECATED: Use sideCars.resources |
| securityContext SecurityContext | Specifies the container’s security context, including privileges and access levels of the container and its processes.DEPRECATED: Use sideCars.securityContext |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-sidecars)SideCars

SideCars configures the additional sidecar containers that run alongside the main Redpanda container in the Pod.

Appears in:

-   [Statefulset](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-statefulset)


| Field | Description |
| --- | --- |
| image RedpandaImage |  |
| extraVolumeMounts string | Specifies additional volumes to mount to the sidecar. |
| resources ResourceRequirements | Specifies resource requests for the sidecar container. |
| securityContext SecurityContext | Specifies the container’s security context, including privileges and access levels of the container and its processes. |
| args string array |  |
| configWatcher ConfigWatcher | Configures the config-watcher sidecar. The config-watcher sidecar polls the Secret resource in auth.sasl.secretRef for changes and triggers a rolling upgrade to add the new superusers to the Redpanda cluster. |
| rpkStatus SideCarObj |  |
| controllers RPControllers |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-startupprobe)StartupProbe

StartupProbe configures the startup probe to determine when the Redpanda application within the Pod has started successfully.

Appears in:

-   [Statefulset](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-statefulset)


| Field | Description |
| --- | --- |
| failureThreshold integer | Determines the failure threshold to mark the application in the Pod as not started. |
| initialDelaySeconds integer | Specifies the delay in seconds before the startup probe begins. |
| periodSeconds integer | Sets the period in seconds for conducting subsequent probes. |
| timeoutSeconds integer |  |
| successThreshold integer |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-statefulset)Statefulset

Statefulset defines configurations for the StatefulSet in Helm values.

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| additionalSelectorLabels object (keys:string, values:string) |  |
| additionalRedpandaCmdFlags string array | Includes additional command flags for Redpanda at startup to customize its runtime behavior. |
| annotations object (keys:string, values:string) | Adds annotations to the StatefulSet to provide additional information or metadata.Please use PodTemplate to add additional annotation or labels for Pods managed by Statefulset. |
| podTemplate PodTemplate | PodTemplate is a subset of Kubernetes' PodTemplate that will be mergedinto this StatefulSet’s PodTemplate. |
| budget Budget | Defines the management of disruptions affecting the Pods in the StatefulSet. |
| extraVolumeMounts string | Specifies extra volume mounts for the Pods. |
| extraVolumes string | Defines additional volumes for the Pods. |
| initContainerImage InitContainerImage | Defines the init container image used to perform initial setup tasks before the main containers start. |
| initContainers InitContainers | Configures the init container used to perform initial setup tasks before the main containers start. |
| livenessProbe LivenessProbe | Defines liveness probes to monitor the health of the Pods and restart them if necessary. |
| nodeSelector object (keys:string, values:string) | Applies node selectors to schedule Pods on specific nodes based on labels. |
| podAffinity PodAffinity | Defines Pod affinity rules to influence the scheduling and placement of Pods relative to other Pods. |
| podAntiAffinity PodAntiAffinity | Defines Pod anti-affinity rules to prevent Pods from being scheduled together on the same node. |
| priorityClassName string | Defines the priority class name to assign priority levels to the Pods, influencing their scheduling order. |
| readinessProbe ReadinessProbe | Defines readiness probes to determine when a Pod is ready to handle traffic. |
| replicas integer | Specifies the number of replicas to determine the desired number of Pods (Redpanda brokers) in the StatefulSet. |
| securityContext SecurityContext | Sets a security context for the Pods to define privilege and access control settings. |
| sideCars SideCars | Defines the additional sidecar containers that run alongside the main Redpanda container in the Pod. |
| skipChown boolean | Specifies whether to skip the changing of file ownership (chown) during Pod initialization. |
| startupProbe StartupProbe | Configures the startup probe to determine when the Redpanda application within the Pod has started successfully. |
| tolerations Toleration array | Applies tolerations to allow Pods to be scheduled on nodes with matching taints, enabling control over where Pods can run. |
| topologySpreadConstraints TopologySpreadConstraints array | Defines topology spread constraints to control how Pods are spread across different topology domains. |
| updateStrategy UpdateStrategy | Defines the update strategy for the StatefulSet to manage how updates are rolled out to the Pods. |
| terminationGracePeriodSeconds integer | Specifies the termination grace period in seconds to control the time delay before forcefully terminating a Pod. |
| persistentVolumeClaimRetentionPolicy StatefulSetPersistentVolumeClaimRetentionPolicy | PersistentVolumeClaimRetentionPolicy controls the lifecycle of PersistentVolumeClaimscreated from the StatefulSet’s volume claim templates. Setting whenScaled: Deletecauses a broker’s PVC to be deleted by the StatefulSet controller when the broker isdecommissioned via scale-down; whenDeleted: Delete causes all PVCs to be deletedwhen the StatefulSet is deleted. When unset, the Kubernetes default (Retain forboth fields) applies. This value is the cluster-level default for all NodePools;individual NodePools may override it via their own persistentVolumeClaimRetentionPolicy. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-staticconfigurationsource)StaticConfigurationSource

StaticConfigurationSource configures connections to a Redpanda cluster via hard-coded connection strings and manually configured TLS and authentication parameters.

Appears in:

-   [ClusterSource](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-clustersource)


| Field | Description |
| --- | --- |
| kafka KafkaAPISpec | Kafka is the configuration information for communicating with the KafkaAPI of a Redpanda cluster where the object should be created. |
| admin AdminAPISpec | AdminAPISpec is the configuration information for communicating with the AdminAPI of a Redpanda cluster where the object should be created. |
| schemaRegistry SchemaRegistrySpec | SchemaRegistry is the configuration information for communicating with the Schema RegistryAPI of a Redpanda cluster where the object should be created. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-storage)Storage

Storage configures storage-related settings in the Helm values. See [Storage for Redpanda in Kubernetes](https://docs.redpanda.com/streaming/current/manage/kubernetes/storage/).

Appears in:

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| hostPath string | Specifies the absolute path on the worker node to store the Redpanda data directory. If unspecified, then an emptyDir volume is used. If specified but persistentVolume.enabled is true, storage.hostPath has no effect. |
| persistentVolume PersistentVolume | Configures a PersistentVolumeClaim (PVC) template to create for each Pod. This PVC is used to store the Redpanda data directory. |
| tiered Tiered | Configures storage for the Tiered Storage cache. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchapilistener)StretchAPIListener

StretchAPIListener configures an API listener (Admin, HTTP, Kafka, SchemaRegistry) for stretch clusters.

Collapsed from Admin, HTTP, Kafka, SchemaRegistry — all identical after removing deprecated KafkaEndpoint field from HTTP and SchemaRegistry (was not respected) and deprecated SecretRef from ListenerTLS (had no effect).

Appears in:

-   [StretchListeners](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchlisteners)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether this Listener is enabled. |
| authenticationMethod string | Specifies the authentication method for this listener. |
| appProtocol string |  |
| port integer | Specifies the container port number for this listener. |
| tls StretchListenerTLS | Configures TLS settings for the internal listener. |
| prefixTemplate string | Specifies the template used for generating the advertised addresses of Services. |
| external object (keys:string, values:StretchExternalListener) | Defines settings for the external listeners. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchauditlogging)StretchAuditLogging

StretchAuditLogging configures how to perform audit logging for a redpanda cluster

Appears in:

-   [StretchClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterspec)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether to enable audit logging or not |
| partitions integer | Integer value defining the number of partitions used by a newly created audit topic |
| enabledEventTypes string array | Event types that should be captured by audit logs |
| excludedTopics string array | List of topics to exclude from auditing |
| excludedPrincipals string array | List of principals to exclude from auditing |
| clientMaxBufferSize integer | Defines the number of bytes (in bytes) allocated by the internal audit client for audit messages. |
| queueDrainIntervalMs integer | In ms, frequency in which per shard audit logs are batched to client for write to audit log. |
| queueMaxBufferSizePerShard integer | Defines the maximum amount of memory used (in bytes) by the audit buffer in each shard |
| replicationFactor integer | Defines the replication factor for a newly created audit log topic. This configuration appliesonly to the audit log topic and may be different from the cluster or other topic configurations.This cannot be altered for existing audit log topics. Setting this value is optional. If a value is not provided,Redpanda will use the internal_topic_replication_factor cluster config value. Default is null |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchcluster)StretchCluster

StretchCluster defines the CRD for StretchCluster configuration.

| Field | Description |
| --- | --- |
| apiVersion string | cluster.redpanda.com/v1alpha2 |
| kind string | StretchCluster |
| kind string | Kind is a string value representing the REST resource this object represents.Servers may infer this from the endpoint the client submits requests to.Cannot be updated.In CamelCase.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| apiVersion string | APIVersion defines the versioned schema of this representation of an object.Servers should convert recognized schemas to the latest internal value, andmay reject unrecognized values.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| metadata ObjectMeta | Refer to the Kubernetes API documentation for fields of metadata. |
| spec StretchClusterSpec |  |
| status StretchClusterStatus |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterspec)StretchClusterSpec

Appears in:

-   [StretchCluster](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchcluster)


| Field | Description |
| --- | --- |
| commonLabels object (keys:string, values:string) | Assigns custom labels to all resources generated by the operator. Specify labels as key/value pairs. |
| image RedpandaImage | Defines the container image settings to use for the Redpanda cluster. |
| imagePullSecrets LocalObjectReference array | Specifies credentials for a private image repository. For details, see https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/. |
| enterprise Enterprise | Defines an Enterprise license. |
| auth Auth | Defines authentication settings for listeners. |
| logging StretchLogging | Defines the log level settings. |
| auditLogging StretchAuditLogging | Defines audit logging settings. |
| resources StretchResources | Defines container resource settings. |
| storage StretchStorage | Defines storage settings for the Redpanda data directory and the Tiered Storage cache. |
| tuning StretchTuning | Defines settings for the autotuner tool in Redpanda. |
| config Config | Defines configuration properties supported by Redpanda. |
| networking Networking | Defines cross-cluster networking settings. |
| internalServiceAnnotations object (keys:string, values:string) | InternalServiceAnnotations is applied to the headless ClusterIPService rendered for each member K8s cluster. The headless Service iscluster-wide (one per K8s cluster, not per NodePool), so itsannotations live on StretchCluster.spec rather than on individualpools. Typical use: annotations consumed by other operators orcontrollers in the same cluster (DNS controllers, service-meshsidecars, etc.) that need to attach to the headless Service. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterstatus)StretchClusterStatus

Appears in:

-   [StretchCluster](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchcluster)


| Field | Description |
| --- | --- |
| conditions Condition array | Conditions holds the conditions for the StretchCluster. |
| configVersion string | ConfigVersion contains the configuration version written inRedpanda used for restarting broker nodes as necessary. |
| license RedpandaLicenseStatus | LicenseStatus contains information about the current state of anyinstalled license in the Redpanda cluster. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchexternallistener)StretchExternalListener

StretchExternalListener configures an external listener in stretch clusters.

Forked from ExternalListener: embeds StretchListener instead of Listener.

Appears in:

-   [StretchAPIListener](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchapilistener)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether this Listener is enabled. |
| authenticationMethod string | Specifies the authentication method for this listener. |
| appProtocol string |  |
| port integer | Specifies the container port number for this listener. |
| tls StretchListenerTLS | Configures TLS settings for the internal listener. |
| prefixTemplate string | Specifies the template used for generating the advertised addresses of Services. |
| advertisedPorts integer array | Specifies the network port that the external Service listens on. |
| nodePort integer |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchlistener)StretchListener

StretchListener configures a single listener in stretch clusters.

Forked from Listener: references StretchListenerTLS instead of ListenerTLS.

Appears in:

-   [StretchAPIListener](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchapilistener)

-   [StretchExternalListener](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchexternallistener)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether this Listener is enabled. |
| authenticationMethod string | Specifies the authentication method for this listener. |
| appProtocol string |  |
| port integer | Specifies the container port number for this listener. |
| tls StretchListenerTLS | Configures TLS settings for the internal listener. |
| prefixTemplate string | Specifies the template used for generating the advertised addresses of Services. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchlistenertls)StretchListenerTLS

StretchListenerTLS configures TLS for a listener in stretch clusters.

Forked from ListenerTLS: removed deprecated SecretRef field (had no effect).

Appears in:

-   [StretchAPIListener](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchapilistener)

-   [StretchExternalListener](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchexternallistener)

-   [StretchListener](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchlistener)

-   [StretchRPC](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchrpc)


| Field | Description |
| --- | --- |
| cert string | References a specific certificate for the listener. |
| enabled boolean | Specifies whether TLS is enabled for the listener. |
| requireClientAuth boolean | Indicates whether client authentication (mTLS) is required. |
| trustStore TrustStore | TrustStore allows setting the truststore_path on this listener. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchlisteners)StretchListeners

StretchListeners configures listener settings for stretch clusters.

Forked from Listeners: uses StretchAPIListener (collapsed from Admin, HTTP, Kafka, SchemaRegistry — all identical after removing deprecated KafkaEndpoint from HTTP and SchemaRegistry) and StretchRPC.

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)


| Field | Description |
| --- | --- |
| admin StretchAPIListener | Configures settings for the Admin API listeners. |
| http StretchAPIListener | Configures settings for the HTTP Proxy listeners. |
| kafka StretchAPIListener | Configures settings for the Kafka API listeners. |
| rpc StretchRPC | Configures settings for the RPC API listener. |
| schemaRegistry StretchAPIListener | Configures settings for the Schema Registry listeners. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchlogging)StretchLogging

StretchLogging defines log level settings for stretch clusters.

Forked from Logging: uses StretchUsageStats instead of UsageStats.

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)

-   [StretchClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterspec)


| Field | Description |
| --- | --- |
| logLevel string | Specifies the log level. |
| usageStats StretchUsageStats | Defines settings for usage statistics reporting. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchrpc)StretchRPC

StretchRPC configures the RPC API listener for stretch clusters.

Forked from RPC: references StretchListenerTLS instead of ListenerTLS.

Appears in:

-   [StretchListeners](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchlisteners)


| Field | Description |
| --- | --- |
| port integer | Specifies the container port number for the internal listener. |
| tls StretchListenerTLS | Configures TLS settings for the internal listener. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchresources)StretchResources

StretchResources defines container resource settings for stretch clusters.

Forked from Resources: changed Limits/Requests from \*map\[corev1.ResourceName\]resource.Quantity (pointer-to-map) to corev1.ResourceList (standard K8s type alias) for idiomatic usage.

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)

-   [StretchClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterspec)


| Field | Description |
| --- | --- |
| cpu CPU | Specifies the number of CPU cores. |
| memory Memory | Specifies the amount of memory. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchstorage)StretchStorage

StretchStorage configures storage for stretch clusters.

Forked from Storage: uses StretchTiered instead of Tiered to pick up the cleaned-up StretchTieredConfig.

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)

-   [StretchClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterspec)


| Field | Description |
| --- | --- |
| hostPath string | Specifies the absolute path on the worker node to store the Redpanda data directory. |
| persistentVolume PersistentVolume | Configures a PersistentVolumeClaim (PVC) template to create for each Pod. |
| tiered StretchTiered | Configures storage for the Tiered Storage cache. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchtiered)StretchTiered

StretchTiered configures tiered storage for stretch clusters.

Forked from Tiered: uses StretchTieredConfig instead of TieredConfig.

Appears in:

-   [StretchStorage](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchstorage)


| Field | Description |
| --- | --- |
| mountType string | mountType: "none", "hostPath", "emptyDir", or "persistentVolume". |
| hostPath string | Specifies the absolute path on the worker node to store the Tiered Storage cache. |
| persistentVolume PersistentVolume | Configures a PersistentVolumeClaim (PVC) template for the Tiered Storage cache. |
| config StretchTieredConfig | Configures Tiered Storage properties. |
| credentialsSecretRef CredentialSecretRef | CredentialsSecretRef sets cloud_storage_secret_key and/or cloud_storage_access_key from a referenced Secret. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchtieredconfig)StretchTieredConfig

StretchTieredConfig configures Tiered Storage properties for stretch clusters.

Forked from TieredConfig: removed deprecated CloudStorageReconciliationIntervalMs (see [Cluster Configuration Properties](https://docs.redpanda.com/streaming/current/reference/properties/cluster-properties/)); replaced \*apiutil.JSONBoolean with \*bool for CloudStorageEnabled (JSONBoolean was a Helm-era hack to handle "true" vs true in values files).

Appears in:

-   [StretchTiered](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchtiered)


| Field | Description |
| --- | --- |
| cloud_storage_enabled boolean |  |
| cloud_storage_api_endpoint string |  |
| cloud_storage_api_endpoint_port integer |  |
| cloud_storage_bucket string |  |
| cloud_storage_azure_container string |  |
| cloud_storage_azure_managed_identity_id string |  |
| cloud_storage_azure_storage_account string |  |
| cloud_storage_azure_shared_key string |  |
| cloud_storage_azure_adls_endpoint string |  |
| cloud_storage_azure_adls_port integer |  |
| cloud_storage_cache_check_interval integer |  |
| cloud_storage_cache_directory string |  |
| cloud_storage_cache_size string |  |
| cloud_storage_credentials_source string |  |
| cloud_storage_disable_tls boolean |  |
| cloud_storage_enable_remote_read boolean |  |
| cloud_storage_enable_remote_write boolean |  |
| cloud_storage_initial_backoff_ms integer |  |
| cloud_storage_manifest_upload_timeout_ms integer |  |
| cloud_storage_max_connection_idle_time_ms integer |  |
| cloud_storage_max_connections integer |  |
| cloud_storage_region string |  |
| cloud_storage_segment_max_upload_interval_sec integer |  |
| cloud_storage_segment_upload_timeout_ms integer |  |
| cloud_storage_trust_file string |  |
| cloud_storage_upload_ctrl_d_coeff integer |  |
| cloud_storage_upload_ctrl_max_shares integer |  |
| cloud_storage_upload_ctrl_min_shares integer |  |
| cloud_storage_upload_ctrl_p_coeff integer |  |
| cloud_storage_upload_ctrl_update_interval_ms integer |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchtuning)StretchTuning

StretchTuning defines autotuner settings for stretch clusters.

Forked from Tuning: removed ExtraVolumeMounts and Resources fields which are init-container concerns (used by Statefulset.InitContainers.Tuning in the Helm chart) and have no meaning as cluster-level tuning configuration.

Appears in:

-   [StretchClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchclusterspec)


| Field | Description |
| --- | --- |
| ballast_file_path string | Specifies the file path for ballast file. |
| ballast_file_size string | Defines the size of the ballast file. |
| tune_aio_events boolean | Specifies whether to increase the number of allowed asynchronous IO events. |
| tune_ballast_file boolean | Specifies whether to create the ballast file. |
| tune_clocksource boolean | Specifies whether to synchronize NTP. |
| well_known_io string | Specifies the vendor, VM type, and storage device type that Redpanda runs on, in the format <vendor>:<vm>:<storage>. |
| apply_host_tuners boolean | ApplyHostTuners enables a chroot-based tuning init container thatgives rpk redpanda tune all access to the host’s /sys, /proc,NICs and block devices, so tuners like disk_irq, disk_scheduler,disk_nomerges and net actually apply. Enabling it default-enablesthose tuners plus fstrim, disk_write_cache (GCP-only) and cpu; anexplicit config.rpk.tune_*: false overrides any of the defaults.Requires tune_aio_events: true (rendering fails otherwise).Defaults to false.Security: the tuning init container runs privileged and the podmounts twelve hostPath volumes (/bin, /sbin, /usr, /lib, /lib64read-only; /sys, /proc, /etc, /dev, /var, /run writable; plus thetuner state file). The namespace needs the PSA privileged level,or on OpenShift an SCC allowing hostPath and privileged containers.Constraints: run at most one Redpanda pod per node (the defaultanti-affinity) — concurrent tuners race on kernel parameters.Disabling the flag does not revert tuning already applied to anode: sysctl/IRQ/block-device settings persist until reboot andthe fstrim systemd timer rpk installs keeps firing until removed. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchusagestats)StretchUsageStats

StretchUsageStats defines usage statistics settings for stretch clusters.

Forked from UsageStats: removed deprecated Organization field and unused ClusterID field.

Appears in:

-   [StretchLogging](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchlogging)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether usage statistics are enabled. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-tls)TLS

TLS configures TLS in the Helm values. See [TLS for Redpanda in Kubernetes](https://docs.redpanda.com/streaming/current/manage/kubernetes/security/tls/).

Appears in:

-   [EmbeddedBrokerPoolSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-embeddedbrokerpoolspec)

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| certs object (keys:string, values:Certificate) | Lists all available certificates in the cluster. You can reference a specific certificate’s name in each listener’s listeners.<listener name>.tls.cert setting. |
| enabled boolean | Enables TLS globally for all listeners. Each listener must include a certificate name in its <listener>.tls object. To allow you to enable TLS for individual listeners, certificates are always loaded, even if TLS is disabled. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-taskstate)TaskState (string)

Task states

Appears in:

-   [ShadowLinkTaskStatus](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinktaskstatus)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-tiered)Tiered

Tiered configures storage for the Tiered Storage cache. See [Tiered Storage in Kubernetes](https://docs.redpanda.com/streaming/current/manage/kubernetes/tiered-storage/).

Appears in:

-   [Storage](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-storage)


| Field | Description |
| --- | --- |
| mountType string | mountType can be one of:none: Does not mount a volume. Tiered storage will use the same volume as the one defined for the Redpanda data directory.hostPath: Uses the path specified in hostPath on the worker node that the Pod is running on.emptyDir: Mounts an empty directory every time the Pod starts.persistentVolume: Creates and mounts a PersistentVolumeClaim using the template defined in persistentVolume. |
| hostPath string | Specifies the absolute path on the worker node to store the Tiered Storage cache. |
| persistentVolume PersistentVolume | Configures a PersistentVolumeClaim (PVC) template to create for each Pod. This PVC is used to store the Tiered Storage cache. |
| config TieredConfig | Configures Tiered Storage, which requires an Enterprise license configured in enterprise.licenseKey or enterprised.licenseSecretRef. |
| credentialsSecretRef CredentialSecretRef | CredentialSecretRef can be used to set cloud_storage_secret_key and/or cloud_storage_access_key from referenced Kubernetes Secret |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-tieredconfig)TieredConfig

TieredConfig configures Tiered Storage, which requires an Enterprise license configured in `enterprise.licenseKey` or `enterprise.licenseSecretRef`.TieredConfig is a top-level field of the Helm values.

Appears in:

-   [Tiered](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-tiered)


| Field | Description |
| --- | --- |
| cloud_storage_enabled JSONBoolean | Enables Tiered Storage, if a license key is provided. See Cluster Configuration Properties. |
| cloud_storage_api_endpoint string | See Cluster Configuration Properties. |
| cloud_storage_api_endpoint_port integer | See Cluster Configuration Properties. |
| cloud_storage_bucket string | See Cluster Configuration Properties. |
| cloud_storage_azure_container string | See Cluster Configuration Properties. |
| cloud_storage_azure_managed_identity_id string | See Cluster Configuration Properties. |
| cloud_storage_azure_storage_account string | See Cluster Configuration Properties. |
| cloud_storage_azure_shared_key string | See Cluster Configuration Properties. |
| cloud_storage_azure_adls_endpoint string | See Cluster Configuration Properties. |
| cloud_storage_azure_adls_port integer | See Cluster Configuration Properties. |
| cloud_storage_cache_check_interval integer | See Cluster Configuration Properties. |
| cloud_storage_cache_directory string | See Broker Configuration Properties. |
| cloud_storage_cache_size string | See Cluster Configuration Properties. |
| cloud_storage_credentials_source string | See Cluster Configuration Properties. |
| cloud_storage_disable_tls boolean | See Cluster Configuration Properties. |
| cloud_storage_enable_remote_read boolean | See Cluster Configuration Properties. |
| cloud_storage_enable_remote_write boolean | See Cluster Configuration Properties. |
| cloud_storage_initial_backoff_ms integer | See Cluster Configuration Properties. |
| cloud_storage_manifest_upload_timeout_ms integer | See Cluster Configuration Properties. |
| cloud_storage_max_connection_idle_time_ms integer | See Cluster Configuration Properties. |
| cloud_storage_max_connections integer | See Cluster Configuration Properties. |
| cloud_storage_reconciliation_interval_ms integer | Deprecated: See Cluster Configuration Properties. |
| cloud_storage_region string | See Cluster Configuration Properties. |
| cloud_storage_segment_max_upload_interval_sec integer | See Cluster Configuration Properties. |
| cloud_storage_segment_upload_timeout_ms integer | See Cluster Configuration Properties. |
| cloud_storage_trust_file string | See Cluster Configuration Properties. |
| cloud_storage_upload_ctrl_d_coeff integer | See Cluster Configuration Properties. |
| cloud_storage_upload_ctrl_max_shares integer | See Cluster Configuration Properties. |
| cloud_storage_upload_ctrl_min_shares integer | See Cluster Configuration Properties. |
| cloud_storage_upload_ctrl_p_coeff integer | See Cluster Configuration Properties. |
| cloud_storage_upload_ctrl_update_interval_ms integer | See Cluster Configuration Properties. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-topic)Topic

Topic defines the CRD for Topic resources. See [Manage Topics with the Redpanda Operator](https://docs.redpanda.com/streaming/current/manage/kubernetes/k-manage-topics/).

| Field | Description |
| --- | --- |
| apiVersion string | cluster.redpanda.com/v1alpha2 |
| kind string | Topic |
| kind string | Kind is a string value representing the REST resource this object represents.Servers may infer this from the endpoint the client submits requests to.Cannot be updated.In CamelCase.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| apiVersion string | APIVersion defines the versioned schema of this representation of an object.Servers should convert recognized schemas to the latest internal value, andmay reject unrecognized values.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| metadata ObjectMeta | Refer to the Kubernetes API documentation for fields of metadata. |
| spec TopicSpec | Defines the desired state of the Topic resource. |
| status TopicStatus | Represents the current status of the Topic resource. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-topicmetadatasyncoffset)TopicMetadataSyncOffset (string)

Appears in:

-   [ShadowLinkTopicMetadataSyncOptions](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinktopicmetadatasyncoptions)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-topicspec)TopicSpec

TopicSpec defines the desired state of the topic. See [Manage Topics with the Redpanda Operator](https://docs.redpanda.com/streaming/current/manage/kubernetes/k-manage-topics/).

Appears in:

-   [Topic](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-topic)


| Field | Description |
| --- | --- |
| partitions integer | Specifies the number of topic shards that are distributed across the brokers in a cluster.This number cannot be decreased after topic creation.It can be increased after topic creation, but it isimportant to understand the consequences that has, especially fortopics with semantic partitioning. When absent this will default tothe Redpanda cluster configuration default_topic_partitions.See Cluster Configuration Properties andHow Redpanda Works |
| replicationFactor integer | Specifies the number of replicas the topic should have. Must be odd value.When absent this will default to the Redpanda cluster configuration default_topic_replications.See Cluster Configuration Properties. |
| overwriteTopicName string | Changes the topic name from the value of metadata.name. |
| additionalConfig object (keys:string, values:string) | Adds extra topic configurations. This is a free-form map of any configuration options that topics can have.Examples:cleanup.policy=compactredpanda.remote.write=trueredpanda.remote.read=trueredpanda.remote.recovery=trueredpanda.remote.delete=trueThe map is reconciled declaratively against the live topic configuration:A key with a string value is kept in sync on the topic: whenever thelive value differs from the desired one, the operator sets it back.A key absent from the map is not managed; if the topic carries anon-default value for it, the operator resets it to the clusterdefault. (Exceptions: cleanup.policy and redpanda.storage.modeare never reset.)A key with a null value is exempt from both: the operator neitherupdates it nor resets it to the cluster default. Use this for aconfiguration that is managed outside the operator (e.g. set viarpk or another client) and should be left untouched. |
| cluster ClusterSource | ClusterSource is a reference to the cluster where the user should be created.It is used in constructing the client created to configure a cluster. |
| kafkaApiSpec KafkaAPISpec | Defines client configuration for connecting to Redpanda brokers.Deprecated: Use cluster.staticConfiguration.kafkaApiSpec if explicit connectionconfiguration is required. Otherwise, prefer cluster.clusterRef. |
| metricsNamespace string | Overwrites the fully-qualifiedname of the metric. This should be easier to identify ifmultiple operator instances runs inside the same Kubernetes cluster.By default, it is set to redpanda-operator. |
| interval Duration | Defines when the topic controller will schedule the next reconciliation.If unset, the operator-wide default is used (the operator’s--topic-sync-interval flag, 30s by default). A per-CR value here alwaystakes precedence over the operator default.NB: the CRD no longer carries a baked-in default (previously "3s"). Pinningthe default in the operator instead of the CRD lets cluster operators tunereconcile pressure without editing every Topic. This is introduced in thev26.2 operator; on that upgrade, Topics that never set this field move fromthe old 3s cadence to the operator default. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-topicstatus)TopicStatus

TopicStatus defines the observed state of the Topic resource.

Appears in:

-   [Topic](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-topic)


| Field | Description |
| --- | --- |
| observedGeneration integer | ObservedGeneration is the last observed generation of the Topic. |
| conditions Condition array | Conditions holds the conditions for the Topic. |
| topicConfiguration Configuration array | TopicConfiguration is the last snapshot of the topic configuration during successful reconciliation. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-topologyspreadconstraints)TopologySpreadConstraints

TopologySpreadConstraints configures topology spread constraints to control how Pods are spread across different topology domains.

Appears in:

-   [Statefulset](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-statefulset)


| Field | Description |
| --- | --- |
| maxSkew integer | Defines the maximum skew between the number of Pods in any two topology domains. |
| topologyKey string | Specifies the topology key to use for spreading Pods. |
| whenUnsatisfiable string | Sets the policy for how to handle unsatisfiable constraints, such as DoNotSchedule or ScheduleAnyway. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-truststore)TrustStore

TrustStore is a mapping from a value on either a Secret or ConfigMap to the `truststore_path` field of a listener.

Appears in:

-   [ListenerTLS](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-listenertls)

-   [StretchListenerTLS](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-stretchlistenertls)


| Field | Description |
| --- | --- |
| configMapKeyRef ConfigMapKeySelector |  |
| secretKeyRef SecretKeySelector |  |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-tuning)Tuning

Tuning configures settings for the autotuner tool in Redpanda. The autotuner identifies the hardware configuration in the container and optimizes the Linux kernel to give you the best performance.

Appears in:

-   [InitContainers](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-initcontainers)

-   [RedpandaClusterSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-redpandaclusterspec)


| Field | Description |
| --- | --- |
| extraVolumeMounts string | Configures additional volume mounts for the Pod. |
| resources ResourceRequirements | Sets resource requirements such as CPU and memory limits. |
| ballast_file_path string | Specifies the file path for ballast file. A ballast file is an empty file that takes up disk space. If Redpanda runs out of disk space and becomes unavailable, you can delete the ballast file as a last resort. This clears up some space and gives you time to delete topics or records and change your retention properties. |
| ballast_file_size string | Defines the size of the ballast file. |
| tune_aio_events boolean | Specifies whether to increase the number of allowed asynchronous IO events. |
| tune_ballast_file boolean | Specifies whether to create the ballast file. |
| tune_clocksource boolean | Specifies whether to synchronize NTP. |
| well_known_io string | Specifies the vendor, VM type, and storage device type that Redpanda runs on, in the format <vendor>:<vm>:<storage>. This hints to Redpanda which configuration values it should use for the Redpanda IO scheduler. |
| apply_host_tuners boolean | ApplyHostTuners enables a chroot-based tuning init container thatgives rpk redpanda tune all access to the host’s /sys, /proc,NICs and block devices so tuners like disk_irq, disk_scheduler,disk_nomerges and net actually apply. Enabling it default-enablesthose tuners plus fstrim, disk_write_cache (GCP-only) and cpu; anexplicit config.rpk.tune_*: false overrides any of the defaults.Requires tune_aio_events: true (rendering fails otherwise).Opt-in: defaults to false. Enabling requires a privileged SCC/PSAon the namespace (the pod adds twelve hostPath mounts) and MUST becombined with one-pod-per-node anti-affinity to avoidkernel-parameter races. Disabling does not revert tuning alreadyapplied: settings persist until node reboot and the fstrim systemdtimer keeps firing until removed. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-unsupportedschemafeaturepolicy)UnsupportedSchemaFeaturePolicy (string)

UnsupportedSchemaFeaturePolicy controls what happens when a source schema uses features that the Redpanda schema registry does not support.

Appears in:

-   [ShadowLinkSchemaRegistryAPIOptions](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistryapioptions)


## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-updatestrategy)UpdateStrategy

UpdateStrategy configures the update strategy for the StatefulSet to manage how updates are rolled out to the Pods.

Appears in:

-   [Statefulset](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-statefulset)


| Field | Description |
| --- | --- |
| type string | Defines the strategy type for updating the StatefulSet, such as RollingUpdate or OnDelete. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-usagestats)UsageStats

UsageStats configures the reporting of usage statistics. Redpanda Data uses these metrics to learn how the software is used, which can guide future improvements.

Appears in:

-   [Logging](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-logging)


| Field | Description |
| --- | --- |
| enabled boolean | Specifies whether usage reporting is enabled. |
| organization string | Specifies the name of the organization using the software. This can be useful for identifying and segmenting usage data by organization, if usage reporting is enabled.Deprecated: This value is no longer respected in the redpanda helm chartand will be removed in a future version. |
| clusterId string | Specifies the ID of your Redpanda cluster. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-user)User

User defines the CRD for a Redpanda user.

| Field | Description |
| --- | --- |
| apiVersion string | cluster.redpanda.com/v1alpha2 |
| kind string | User |
| kind string | Kind is a string value representing the REST resource this object represents.Servers may infer this from the endpoint the client submits requests to.Cannot be updated.In CamelCase.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| apiVersion string | APIVersion defines the versioned schema of this representation of an object.Servers should convert recognized schemas to the latest internal value, andmay reject unrecognized values.More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| metadata ObjectMeta | Refer to the Kubernetes API documentation for fields of metadata. |
| spec UserSpec | Defines the desired state of the Redpanda user. |
| status UserStatus | Represents the current status of the Redpanda user. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-userauthenticationspec)UserAuthenticationSpec

UserAuthenticationSpec defines the authentication mechanism enabled for this Redpanda user.

Appears in:

-   [UserSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-userspec)


| Field | Description |
| --- | --- |
| type SASLMechanism | SASL mechanism to use for the user credentials. Valid values are:- scram-sha-512- scram-sha-256 |
| password Password | Password specifies where a password is read from. |
| syncCredentials boolean | SyncCredentials when set to true causes the operator to re-read thepassword from the referenced Secret on every reconciliation cycle(default: every 5 minutes) and upsert the credentials to Redpanda.This enables password rotation via external systems like the ExternalSecrets Operator (ESO) without requiring user recreation. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-userauthorizationspec)UserAuthorizationSpec

UserAuthorizationSpec defines authorization rules for this user.

Appears in:

-   [UserSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-userspec)


| Field | Description |
| --- | --- |
| type AuthorizationType | Type specifies the type of authorization to use for User ACLs. If unspecified, defaults to simple. Valid values are:- simple |
| acls ACLRule array | List of ACL rules which should be applied to this user. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-userspec)UserSpec

UserSpec defines the configuration of a Redpanda user.

Appears in:

-   [User](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-user)


| Field | Description |
| --- | --- |
| cluster ClusterSource | ClusterSource is a reference to the cluster where the user should be created.It is used in constructing the client created to configure a cluster. |
| authentication UserAuthenticationSpec | Authentication defines the authentication information for a user. If noAuthentication credentials are specified, then no user will be created.This is useful when wanting to manage ACLs for an already-existing user. |
| authorization UserAuthorizationSpec | Authorization rules defined for this user. |
| template UserTemplateSpec | Template to specify how user secrets are generated. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-userstatus)UserStatus

UserStatus defines the observed state of a Redpanda user

Appears in:

-   [User](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-user)


| Field | Description |
| --- | --- |
| observedGeneration integer | Specifies the last observed generation. |
| conditions Condition array | Conditions holds the conditions for the Redpanda user. |
| managedAcls boolean | ManagedACLs returns whether the user has managed ACLs that needto be cleaned up. |
| managedUser boolean | ManagedUser returns whether the user has a managed SCRAM user that needto be cleaned up. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-usertemplatespec)UserTemplateSpec

UserTemplateSpec defines the template metadata (labels and annotations) for any subresources, such as Secrets, created by a User object.

Appears in:

-   [UserSpec](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-userspec)


| Field | Description |
| --- | --- |
| secret ResourceTemplate | Specifies how the Secret with a user password is generated. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-usersitems)UsersItems

UsersItems configures a list of superusers in the Helm values.

Appears in:

-   [SASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-sasl)


| Field | Description |
| --- | --- |
| mechanism string | Specifies the authentication mechanism to use for superusers. Overrides the default in SASL. Options are SCRAM-SHA-256 and SCRAM-SHA-512. |
| name string | Specifies the name of the superuser. |
| password string | Specifies the superuser password. |

## [](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-valuesource)ValueSource

ValueSource represents where a value can be pulled from

Appears in:

-   [AdminSASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-adminsasl)

-   [CommonTLS](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-commontls)

-   [KafkaSASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasasl)

-   [KafkaSASLAWSMskIam](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasaslawsmskiam)

-   [KafkaSASLGSSAPI](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasaslgssapi)

-   [KafkaSASLOAuthBearer](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-kafkasasloauthbearer)

-   [NamedValueSource](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-namedvaluesource)

-   [SchemaRegistrySASL](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-schemaregistrysasl)

-   [ShadowLinkSchemaRegistryBasicAuthentication](#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-shadowlinkschemaregistrybasicauthentication)


| Field | Description |
| --- | --- |
| inline string | Inline is the raw value specified inline. |
| configMapKeyRef ConfigMapKeySelector | If the value is supplied by a kubernetes object reference, coordinates are embedded here.For target values, the string value fetched from the source will be treated asa raw string. |
| secretKeyRef SecretKeySelector | Should the value be contained in a k8s secret rather than configmap, we can referto it here. |
| externalSecretRef ExternalSecretKeySelector | If the value is supplied by an external source, coordinates are embedded here.Note: we interpret all fetched external secrets as raw string values |