API Reference

Tenant Operator

Packages

• tenantoperator.stakater.com/v1alpha1
• tenantoperator.stakater.com/v1beta1
• tenantoperator.stakater.com/v1beta3

tenantoperator.stakater.com/v1alpha1

Package v1alpha1 contains API Schema definitions for the tenantoperator v1alpha1 API group

Resource Types

• Extensions
• IntegrationConfig

AppProjectConfig

AppProject contains details about argocd AppProjects

Appears in: - ArgoCDConfig

Field	Description	Default	Validation
sourceRepos string array	SourceRepos contains list of repository URLs which can be used for deployment
namespaceResourceBlacklist GroupKind array	NamespaceResourceBlacklist contains list of blacklisted namespace level resources
clusterResourceWhitelist GroupKind array	ClusterResourceWhitelist contains list of whitelisted cluster level resources

ArgoCD

Appears in: - IntegrationConfigSpec

Field	Description	Default	Validation
namespace Namespace	Namespace should contain the name of the namespace in which to deploy ArgoCD AppProjects		Required: {}
namespaceResourceBlacklist GroupKind array	NamespaceResourceBlacklist contains list of blacklisted namespace level resources
clusterResourceWhitelist GroupKind array	ClusterResourceWhitelist contains list of whitelisted cluster level resources

ArgoCDConfig

ArgoCDConfig contains details about source repositories and AppProjects

Appears in: - ExtensionsSpec

Field	Description	Default	Validation
appProject AppProjectConfig	AppProject contains details about argocd AppProjects
onDeletePurgeAppProject boolean	OnDeletePurgeAppProject is used to enable or disable the AppProject purge feature		Optional: {}

ArgoCDConfigStatus

ArgoCDStatus defines the observed state of the ArgoCD extension

Appears in: - ExtensionsStatus

Field	Description	Default	Validation
appProjectState boolean
argoNamespace string
conditions Condition array

Endpoint

Endpoint is used to connect to an application

Appears in: - ManagedApp

Field	Description	Default	Validation
url string
secretReference SecretReference

Extensions

Extensions is the Schema for the extensions API

Field	Description	Default	Validation
apiVersion string	tenantoperator.stakater.com/v1alpha1
kind string	Extensions
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ExtensionsSpec
status ExtensionsStatus

ExtensionsSpec

ExtensionsSpec defines the desired state of Extensions

Appears in: - Extensions

Field	Description	Default	Validation
tenantName string	TenantName is the name of the tenant to which the extension belongs		Required: {}
argoCD ArgoCDConfig	ArgoCDConfig defines ArgoCD configurations for the tenant

ExtensionsStatus

ExtensionsStatus defines the observed state of Extensions

Appears in: - Extensions

Field	Description	Default	Validation
argocd ArgoCDConfigStatus

Ingress

Appears in: - IngressConfig

Field	Description	Default	Validation
host string	Host specifies the hostname for the ingress
tlsSecretName string	TLSSecretName is the name of the secret containing the TLS certificate		Optional: {}

IngressConfig

Appears in: - Provision

Field	Description	Default	Validation
keycloak Ingress
console Ingress
gateway Ingress
ingressClassName string	ingressClassName is the ingress class name		Optional: {}

IntegrationConfig

IntegrationConfig is the Schema for the integrationConfigs API

Field	Description	Default	Validation
apiVersion string	tenantoperator.stakater.com/v1alpha1
kind string	IntegrationConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec IntegrationConfigSpec
status IntegrationConfigStatus

IntegrationConfigSpec

IntegrationConfigSpec defines the desired state of IntegrationConfig

Appears in: - IntegrationConfig

Field	Description	Default	Validation
openshift OpenshiftConfig	Openshift is the config containing labels and annotations
tenantRoles TenantRoles	TenantRoles sets the default Owner/Editor/Viewer and/or custom roles for each tenant	{ default:map[editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]]] }
nexus ManagedNexus	Nexus is the config for managed Nexus.
rhsso ManagedRHSSO	Nexus is the config for managed RHSSO.
vault ManagedVault	Nexus is the config for managed Vault.
argocd ArgoCD	ArgoCD contains details about argocd Applications and AppProjects
provision Provision	Provision is used to enable/disable the provision feature such as mto-console and showback	{ console:true showback:true }

IntegrationConfigStatus

IntegrationConfigStatus defines the observed state of IntegrationConfig

Appears in: - IntegrationConfig

Field	Description	Default	Validation
roleBindingsToDelete object (keys:string, values:string array)	RoleBindingsToDelete contains all of the rolebindings that have been whenever the roles cache config map gets updated

ManagedApp

ManagedApp is the config for a managed application.

Appears in: - ManagedNexus - ManagedRHSSO

Field	Description	Default	Validation
enabled boolean		false
endpoint Endpoint
sso SSO

ManagedNexus

ManagedNexus is the config for Nexus.

Appears in: - IntegrationConfigSpec

Field	Description	Default	Validation
ManagedApp ManagedApp

ManagedRHSSO

ManagedRHSSO is the config for RedHat Single Sign-On.

Appears in: - IntegrationConfigSpec

Field	Description	Default	Validation
ManagedApp ManagedApp
realm string

ManagedVault

ManagedVault is the config for Vault.

Appears in: - IntegrationConfigSpec

Field	Description	Default	Validation
enabled boolean		false
address string
accessorPath string
roleName string
sso VaultSSO

MatchNamespaceLabel

Appears in: - TenantRoles

Field	Description	Default	Validation
labelSelector LabelSelector	LabelSelector is the label selector that will be used to find namespaces to apply roles to
UserRoles UserRoles	Custom roles applied to the namespaces selected by the label selector		Required: {}

Metadata

Appears in: - OpenshiftConfig

Field	Description	Default	Validation
labels object (keys:string, values:string)
annotations object (keys:string, values:string)

NamespaceAccessPolicy

NamespaceAccessPolicy contains access and deny policies for namespaces

Appears in: - OpenshiftConfig

Field	Description	Default	Validation
deny Policy

OpenshiftConfig

OpenshiftConfig is the config containing labels and annotations

Appears in: - IntegrationConfigSpec

Field	Description	Default	Validation
project Metadata	Project contains labels and annotations applied to the namespace
group Metadata	Group contains labels and annotations applied to the group
sandbox Metadata	Sandbox contains labels and annotations applied to the sandbox
privilegedNamespaces string array	PrivilegedNamespaces contains list of privileged namespaces regex
privilegedServiceAccounts string array	PrivilegedServiceAccounts contains list of privileged serviceAccounts regex
namespaceAccessPolicy NamespaceAccessPolicy	NamespaceAccessPolicy contains groups/users which are denied access over managed namespaces
clusterAdminGroups string array	ClusterAdminGroups contains groups which are admins of tenants

Policy

Policy contains policies relating to privilegedNamespaces

Appears in: - NamespaceAccessPolicy

Field	Description	Default	Validation
privilegedNamespaces PrivilegedNamespaces

PolicyMembers

Appears in: - PrivilegedNamespaces

Field	Description	Default	Validation
users string array
groups string array

PrivilegedNamespaces

PrivilegedNamespaces contains groups/users

Appears in: - Policy

Field	Description	Default	Validation
users string array
groups string array

Provision

Appears in: - IntegrationConfigSpec

Field	Description	Default	Validation
console boolean	Console is used to enable/disable the mto-console	true	Optional: {}
showback boolean	Showback is used to enable/disable the showback feature	true	Optional: {}
ingress IngressConfig	the following are used to configure the ingress for the provisioned services
trustedRootCert string	TrustedRootCert is the name of the secret containing the trusted root CA certificate This certificate is used for SSL/TLS communication with other services		Optional: {}

SSO

SSO contains details for single sign on

Appears in: - ManagedApp

Field	Description	Default	Validation
clientName string
accessorID string

SecretReference

SecretReference contains details of a secret

Appears in: - Endpoint

Field	Description	Default	Validation
name string
namespace string

TenantRoles

TenantRoles is used to configure custom RBAC rules for tenants

Appears in: - IntegrationConfigSpec

Field	Description	Default	Validation
default UserRoles	DefaultRoles contains the default roles that will be applied to each tenant. Required field.	{ editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]] }
custom MatchNamespaceLabel array	CustomRoles is an optional Label selector method to apply roles to specific namespaces. These roles will override the existing Default Roles

UserRoles

UserRoles is the list of roles applied to owners/editors/viewers

Appears in: - MatchNamespaceLabel - TenantRoles

VaultSSO

Appears in: - ManagedVault

Field	Description	Default	Validation
clientName string

tenantoperator.stakater.com/v1beta1

Package v1beta1 contains API Schema definitions for the tenantoperator v1beta1 API group

Resource Types

• IntegrationConfig
• Quota

AccessControl

AccessControl defines the access control settings for IntegrationConfig

Appears in: - IntegrationConfigSpec

Field	Description	Default	Validation
rbac RBAC		{ tenantRoles:map[default:map[editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]]]] }
namespaceAccessPolicy NamespaceAccessPolicy
privileged Privileged

ArgoCDIntegration

ArgoCD defines the ArgoCD integration settings

Appears in: - Integrations

Field	Description	Default	Validation
clusterResourceWhitelist GroupKind array	ClusterResourceWhitelist contains list of whitelisted cluster level resources
namespaceResourceBlacklist GroupKind array	NamespaceResourceWhitelist contains list of whitelisted namespace level resources
namespace Namespace	Namespace should contain the name of the namespace in which to deploy ArgoCD AppProjects		Required: {}

Components

Components defines the components settings for IntegrationConfig

Appears in: - IntegrationConfigSpec

Field	Description	Default	Validation
console boolean		false
showback boolean		false
showbackOpts ShowbackOpts	ShowbackOpts is used to configure the showback for the Component ShowbackOpts is deprecated and will be removed in a future release. See docs.stakater.com/mto/latest for more details on the replacement for showback configuration.
ingress IngressConfig	the following are used to configure the ingress for the Component's services
prometheus PrometheusComponentConfig	Defines configuration for prometheus component		Optional: {}
opencost OpenCostComponentConfig	Defines configuration for opencost component		Optional: {}
postgres PostgresComponentConfig	Defines configuration for postgres component		Optional: {}
dex DexComponentConfig	Defines configuration for dex component		Optional: {}
finopsOperator FinOpsOperator	Defines configuration for finops operator component		Optional: {}
dexConfigOperator DexConfigOperatorConfig	Defines configuration for dex config operator component		Optional: {}

Custom

Appears in: - ShowbackOpts

Field	Description	Default	Validation
CPU string
spotCPU string
RAM string
spotRAM string
GPU string
storage string
zoneNetworkEgress string
regionNetworkEgress string
internetNetworkEgress string
provider string
description string
projectId string
awsSpotDataBucket string
awsSpotDataRegion string
awsSpotDataPrefix string
spotLabel string
spotLabelValue string

Deny

Deny defines the deny settings for namespace access policy

Appears in: - NamespaceAccessPolicy

Field	Description	Default	Validation
privilegedNamespaces PrivilegedNamespaces

DependencyMode

Underlying type: string

DependencyMode describes how a dependency is provided

Validation: - Enum: [Managed External]

Appears in: - DexComponentConfig - OpenCostComponentConfig - PostgresComponentConfig - PrometheusComponentConfig

Field	Description
Managed	DependencyModeManaged indicates the operator should provision and manage the dependency
External	DependencyModeExternal indicates the dependency is supplied by the user

DexComponentConfig

Appears in: - Components

Field	Description	Default	Validation
mode DependencyMode		Managed	Enum: [Managed External]
values RawExtension	Values allows customization of the Prometheus Helm chart values when mode is Managed
external DexExternalConfig	External defines information required when using an externally managed Dex deployment

DexConfigOperatorConfig

Appears in: - Components

Field	Description	Default	Validation
values RawExtension	Values allows customization of the Prometheus Helm chart values

DexExternalConfig

Appears in: - DexComponentConfig

Field	Description	Default	Validation
issuer string	Issuer is the URL of the Dex issuer, used for OIDC discovery

ExternalServerConfig

ExternalServerConfig stores references to an external Prometheus deployment

Appears in: - OpenCostComponentConfig - PrometheusComponentConfig

Field	Description	Default	Validation
serverURL string	ServerURL is the base URL that the operator should use for query API access

FinOpsOperator

FinOpsOperator defines the configuration for FinOps Operator components See https://docs.stakater.com/finops-operator/latest for more details

Appears in: - Components

Field	Description	Default	Validation
values RawExtension	Values allows customization of the FinOps Operator Helm chart values when mode is Managed		Optional: {}

Ingress

Appears in: - IngressConfig

Field	Description	Default	Validation
host string	Host specifies the hostname for the ingress (legacy per-component mode).
tlsSecretName string	TLSSecretName is the name of the secret containing the TLS certificate.		Optional: {}
path string	Path is the path prefix under the shared host in consolidated mode. Defaults: Console "/", Gateway "/gateway", Dex "/dex", FinOps "/finops".		Optional: {}

IngressConfig

Appears in: - Components

Field	Description	Default	Validation
host string	Host, when set, enables consolidated mode: all components are served under this single shared hostname via distinct path prefixes. When empty, the per-component Console/Gateway/Dex/FinOpsGateway hosts are used (legacy).		Optional: {}
tlsSecretName string	TLSSecretName is the TLS secret for the shared host (consolidated mode).		Optional: {}
console Ingress
gateway Ingress
dex Ingress
finopsGateway Ingress
ingressClassName string	ingressClassName is the ingress class name		Optional: {}

IntegrationConfig

IntegrationConfig is the Schema for the integrationconfigs API

Field	Description	Default	Validation
apiVersion string	tenantoperator.stakater.com/v1beta1
kind string	IntegrationConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec IntegrationConfigSpec
status IntegrationConfigStatus

IntegrationConfigSpec

IntegrationConfigSpec defines the desired state of IntegrationConfig

Appears in: - IntegrationConfig

Field	Description	Default	Validation
accessControl AccessControl		{ rbac:map[tenantRoles:map[default:map[editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]]]]] }
components Components
metadata Metadata	Refer to Kubernetes API documentation for fields of metadata.
integrations Integrations
tenantPolicies TenantPolicies

IntegrationConfigStatus

IntegrationConfigStatus defines the observed state of IntegrationConfig

Appears in: - IntegrationConfig

Field	Description	Default	Validation
roleBindingsToDelete object (keys:string, values:string array)
conditions Condition array	Status conditions

Integrations

Integrations defines the integration settings for IntegrationConfig

Appears in: - IntegrationConfigSpec

Field	Description	Default	Validation
argocd ArgoCDIntegration
vault VaultIntegration

MatchNamespaceLabel

Appears in: - TenantRoles

Field	Description	Default	Validation
labelSelector LabelSelector	LabelSelector is the label selector that will be used to find namespaces to apply roles to
UserRoles UserRoles	Custom roles applied to the namespaces selected by the label selector

Metadata

Metadata defines the metadata settings for IntegrationConfig

Appears in: - IntegrationConfigSpec

Field	Description	Default	Validation
groups MetadataType	Groups contains labels and annotations applied to the groups
namespaces MetadataType	Namespaces contains labels and annotations applied to the namespaces
sandboxes MetadataType	Sandboxes contains labels and annotations applied to the sandbox

MetadataType

Appears in: - Metadata

Field	Description	Default	Validation
labels object (keys:string, values:string)
annotations object (keys:string, values:string)

NamespaceAccessPolicy

NamespaceAccessPolicy defines the namespace access policy settings

Appears in: - AccessControl

Field	Description	Default	Validation
deny Deny

OpenCostComponentConfig

OpenCostComponentConfig describes how OpenCost is configured for showback features

Appears in: - Components

Field	Description	Default	Validation
mode DependencyMode		Managed	Enum: [Managed External]
values RawExtension	Values allows customization of the OpenCost Helm chart values when mode is Managed
external ExternalServerConfig	External defines information required when using an externally managed OpenCost deployment

PolicyRule

PolicyRule defines the policy rule

Appears in: - VaultPolicy

Field	Description	Default	Validation
path string	Path is the path to the resource
capabilities string array	Capabilities is the list of capabilities

PostgresComponentConfig

PostgresComponentConfig describes how Postgres is configured for application persistence

Appears in: - Components

Field	Description	Default	Validation
mode DependencyMode		Managed	Enum: [Managed External]
values RawExtension	Values allows customization of the Postgres Helm chart values when mode is Managed
external PostgresExternalConfig	External defines information required when using an externally managed Postgres instance

PostgresExternalConfig

PostgresExternalConfig stores references to an external Postgres instance

Appears in: - PostgresComponentConfig

Field	Description	Default	Validation
secretRef SecretRef	SecretRef references a secret containing a DSN or discrete connection details

Privileged

Privileged defines the privileged settings for IntegrationConfig

Appears in: - AccessControl

Field	Description	Default	Validation
namespaces string array
serviceAccounts string array
users string array
groups string array

PrivilegedNamespaces

PrivilegedNamespaces defines the list of privileged namespaces and associated users/groups

Appears in: - Deny

Field	Description	Default	Validation
users string array
groups string array

PrometheusComponentConfig

PrometheusComponentConfig describes how Prometheus is configured for tenant operations

Appears in: - Components

Field	Description	Default	Validation
mode DependencyMode		Managed	Enum: [Managed External]
values RawExtension	Values allows customization of the Prometheus Helm chart values when mode is Managed
external ExternalServerConfig	External defines information required when using an externally managed Prometheus

Quota

Quota is the Schema for the quotas API

Field	Description	Default	Validation
apiVersion string	tenantoperator.stakater.com/v1beta1
kind string	Quota
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec QuotaSpec
status QuotaStatus

QuotaSpec

Appears in: - Quota

Field	Description	Default	Validation
resourcequota ResourceQuotaSpec	ResourceQuota defines the allocated ResourceQuota for the tenant
limitrange LimitRangeSpec	LimitRange defines the allocated LimitRange for the namespace inside tenant		Optional: {}

QuotaStatus

QuotaStatus defines the observed state of Quota

Appears in: - Quota

Field	Description	Default	Validation
TenantQuotaStatus TenantQuotaStatus
conditions Condition array	Status conditions for quota

RBAC

RBAC defines the RBAC settings for IntegrationConfig

Appears in: - AccessControl

Field	Description	Default	Validation
tenantRoles TenantRoles	TenantRoles sets the default Owner/Editor/Viewer and/or custom roles for each tenant	{ default:map[editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]]] }

SecretRef

SecretReference defines the reference to a secret

Appears in: - PostgresExternalConfig - ShowbackOpts - VaultAccessInfo

Field	Description	Default	Validation
name string
namespace string

ShowbackOpts

Appears in: - Components

Field	Description	Default	Validation
custom Custom	Custom is used to define custom pricing for opencost. If not provided, the default pricing will be used. Custom field is deprecated and will be removed in a future release. Please use the spec.components.finopsOperator.priceBook field instead to configure custom pricing for OpenCost.		Optional: {}
cloudPricingSecretRef SecretRef	CloudPricingSecretRef is the reference to the secret containing the opeconst config for AWS/Azure. This field is deprecated and will be removed in a future release. Please use the spec.components.opencost.cloudIntegrationSecret field instead to configure the cloud integration for OpenCost.		Optional: {}
retentionPeriod string	RetentionPeriod defines the retention period of prometheus server This field is deprecated and will be removed in a future release. Please use the spec.components.prometheus.values.server.retention field instead to configure the retention period for Prometheus.	7d

TenantPolicies

Appears in: - IntegrationConfigSpec

Field	Description	Default	Validation
network TenantPoliciesNetwork

TenantPoliciesNetwork

Appears in: - TenantPolicies

Field	Description	Default	Validation
disableIntraTenantNetworking boolean
disableNodePortServices boolean
disableHostPorts boolean

TenantQuotaStatus

Appears in: - QuotaStatus

Field	Description	Default	Validation
tenants object (keys:string, values:TenantResourceStatus)

TenantResourceStatus

Appears in: - TenantQuotaStatus

Field	Description	Default	Validation
status ResourceQuotaStatus

TenantRoles

Appears in: - RBAC

Field	Description	Default	Validation
default UserRoles	DefaultRoles contains the default roles that will be applied to each tenant. Required field.	{ editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]] }
custom MatchNamespaceLabel array	CustomRoles is an optional Label selector method to apply roles to specific namespaces. These roles will override the existing Default Roles

UserRoles

Appears in: - MatchNamespaceLabel - TenantRoles

VaultAccessInfo

VaultAccessInfo defines the access information for Vault

Appears in: - VaultIntegration

Field	Description	Default	Validation
accessorPath string
address string
roleName string
secretRef SecretRef

VaultConfig

VaultConfig defines the Vault configuration

Appears in: - VaultIntegration

Field	Description	Default	Validation
ssoClient string
commonSecretsPath string	CommonSecretsPath defines a secrets path in Vault which is shared by all tenants		Optional: {}

VaultIntegration

Vault defines the Vault integration settings

Appears in: - Integrations

Field	Description	Default	Validation
enabled boolean		false
authMethod string	AuthMethod defines the authentication method for Vault, Possible values are: "kubernetes", "token"	kubernetes	Enum: [kubernetes token]
accessInfo VaultAccessInfo	AccessInfo defines the access information for Vault
config VaultConfig	Config defines the Vault configuration
policies VaultPolicy array	Policies defines custom Vault policies		Optional: {}

VaultPolicy

VaultPolicy defines the Vault policy details

Appears in: - VaultIntegration

Field	Description	Default	Validation
name string	Name is the name of the policy
rules PolicyRule array	Rules is the policy rules
tenantRoles string array	TenantRoles is the list of tenant roles to apply the policy to

tenantoperator.stakater.com/v1beta3

Package v1beta3 contains API Schema definitions for the tenantoperator v1beta3 API group

Resource Types

• Tenant

AccessControl

Appears in: - TenantSpec

Field	Description	Default	Validation
owners Members	owners represents the list of owners
editors Members	editors represents the list of editors
viewers Members	viewers represents the list of viewers

HostValidationConfig

Appears in: - TenantSpec

Field	Description	Default	Validation
denyWildcards boolean	DenyWildcards indicates whether wildcard host names are allowed or not If true, wildcard host names are not allowed If false, wildcard host names are allowed	false	Optional: {} Type: boolean
allowedRegex string	AllowedRegex is a regular expression that defines the allowed host names If specified, host names must match this regex to be allowed		Optional: {} Type: string
allowed string array	Allowed is a list of allowed host names If specified, host names must be in this list to be allowed		Optional: {} Type: array

IngressClassEntry

Appears in: - IngressClassStatus

Field	Description	Default	Validation
name string

IngressClassStatus

Appears in: - TenantStatus

Field	Description	Default	Validation
available IngressClassEntry array

Metadata

Appears in: - Namespaces

Field	Description	Default	Validation
common Metadata	commonmetadata applies given labels and annotations
sandbox Metadata	sandboxmetadata applies given labels and annotation across sandbox namespaces
specific MetadataOnNamespaces array	specificmetadata applies given labels and annotation across specific namespaces

Namespaces

Appears in: - TenantSpec

Field	Description	Default	Validation
sandboxes Sandboxes	sandboxes is used to enable or disable the sandbox feature
withoutTenantPrefix Namespace array	WithoutTenantPrefix will create new namespaces mentioned in it
withTenantPrefix Namespace array	WithTenantPrefix will create new namespaces mentioned in it and add a prefix of the tenant name to them
onDeletePurgeNamespaces boolean	ondeletepurgenamespaces is used to enable or disable the namespace purge feature	false
metadata Metadata	Refer to Kubernetes API documentation for fields of metadata.

NamespacesStatus

Appears in: - TenantStatus

Field	Description	Default	Validation
commonStatus Metadata	CommonStatus stores the previous state of labels and annotation applied across all tenant namespaces, if mentioned in spec
sandboxStatus Metadata	SandboxStatus stores the previous state of labels and annotation applied across all sandbox namespaces, if mentioned in spec
specificStatus MetadataOnNamespaces array	SpecificStatus stores the previous state of labels and annotations applied across specific tenant namespaces, if mentioned in spec

PodPriorityClassEntry

Appears in: - PodPriorityClassStatus

Field	Description	Default	Validation
name string

PodPriorityClassStatus

Appears in: - TenantStatus

Field	Description	Default	Validation
available PodPriorityClassEntry array

QuotaEntry

Appears in: - QuotaStatus

Field	Description	Default	Validation
name string

QuotaStatus

Appears in: - TenantStatus

Field	Description	Default	Validation
available QuotaEntry array

Sandboxes

Appears in: - Namespaces

Field	Description	Default	Validation
enabled boolean	enabled is used to enable or disable the sandbox feature
private boolean	private is used to enable or disable the private sandbox feature

StorageClassEntry

Appears in: - StorageStatus

Field	Description	Default	Validation
name string

StorageStatus

Appears in: - TenantStatus

Field	Description	Default	Validation
available StorageClassEntry array

Tenant

Tenant is the Schema for the tenants API

Field	Description	Default	Validation
apiVersion string	tenantoperator.stakater.com/v1beta3
kind string	Tenant
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec TenantSpec
status TenantStatus

TenantSpec

TenantSpec defines the desired state of Tenant

Appears in: - Tenant

Field	Description	Default	Validation
quota string	Quota field is used to link relevant Tenant Operator Quota CR		Required: {}
accessControl AccessControl	AccessControl defines the list of admins, editors and viewers
namespaces Namespaces	namespaces defines namespaces and their metadata
desc string	Desc can contains description about the tenant
hostValidationConfig HostValidationConfig	HostValidationConfig defines the allowed ingress and route host names for the tenant		Optional: {}

TenantStatus

TenantStatus defines the observed state of Tenant

Appears in: - Tenant

Field	Description	Default	Validation
namespaces NamespacesStatus	namespacesStatus stores the previous state of namespaces, if mentioned in spec
sandboxState boolean	SandboxState stores the previous state of sandbox field, if mentioned in spec
deployedSandboxes object (keys:string, values:string)	DeployedSandboxes has the map for created sandbox environments so they can be synced with spec
deployedNamespaces string array	DeployedNamespaces has the string for created namespaces so they can be synced with spec
storageClasses StorageStatus	StorageClasses is the status for currently available StorageClasses for the tenant
ingressClasses IngressClassStatus	IngressClasses is the status for currently available IngressClasses for the tenant
podPriorityClasses PodPriorityClassStatus	PodPriorityClasses is the status for currently available PodPriorityClasses for the tenant
quota QuotaStatus	Quota is the status for the tenant's Quota
conditions Condition array	Status conditions for tenant

Template Operator

Packages

• templates.stakater.com/v1alpha1

templates.stakater.com/v1alpha1

Package v1alpha1 contains API Schema definitions for the templates.stakater.com v1alpha1 API group

Resource Types

• ClusterTemplateInstance
• Template
• TemplateInstance

ClusterTemplateInstance

ClusterTemplateInstance is the Schema for the clustertemplateinstances API

Field	Description	Default	Validation
apiVersion string	templates.stakater.com/v1alpha1
kind string	ClusterTemplateInstance
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ClusterTemplateInstanceSpec
status ClusterTemplateInstanceStatus

ClusterTemplateInstanceSpec

ClusterTemplateInstanceSpec defines the desired state of ClusterTemplateInstance

Appears in: - ClusterTemplateInstance

Field	Description	Default	Validation
template string	Template is used to tell what to deploy in matched namespaces
selector LabelSelector	Selector is used to filter namespaces where template needs to be deployed
sync boolean	Sync is used to keep deployed instance and template in sync
parameters TemplateInstanceParameter array	Parameters hold the values of the defined parameters in the template		Optional: {}

TemplateInstanceParameter

Appears in: - ClusterTemplateInstanceSpec - TemplateInstanceSpec

Field	Description	Default	Validation
name string	Name is the name of the parameter to set
value string	Value is the value of the parameter to set

ClusterTemplateInstanceStatus

ClusterTemplateInstanceStatus defines the observed state of ClusterTemplateInstance

Appears in: - ClusterTemplateInstance

Field	Description	Default	Validation
conditions Condition array	Status conditions		Optional: {}
deployedNamespaces object (keys:string, values:DeployedNamespaceState)	DeployedNamespaces is a list of namespaces where template has been deployed along with its state.		Optional: {}
mappedSecrets object (keys:string, values:map[string]MappedResourcesState)	MappedSecrets is a list of secrets which have been mapped along with its state.		Optional: {}
mappedConfigmaps object (keys:string, values:map[string]MappedResourcesState)	MappedConfigmaps is a list of configmaps which have been mapped along with its state.		Optional: {}
templateManifestsHash string	TemplateManifestsHash is used to ignore false-positive template.manifests update events		Optional: {}
templateResourceMappingHash string	TemplateResourceMappingHash is used to ignore false-positive template.resourceMappings update events		Optional: {}
namespaceCount integer	NamespaceCount tells the number of namespaces CTI matches		Optional: {}

Template

Template is the Schema for the templates API

Field	Description	Default	Validation
apiVersion string	templates.stakater.com/v1alpha1
kind string	Template
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
resources TemplateResources			Optional: {}
spec TemplateSpec
status TemplateStatus			Optional: {}
parameters TemplateParameter array	Parameters can be used to replace certain parts of the template. A parameter is referenced by this format: ${NAME}, to parse the value as an expression write ${{NAME}} instead. Besides the parameters defined here, the following predefined parameters can be used: - ${NAMESPACE}: the namespace where the template instance was created - ${TENANT}: the tenant name of the tenant that owns the namespace (if any)		Optional: {}

TemplateResources

TemplateResources defines a templates resources

Appears in: - Template

Field	Description	Default	Validation
manifests EmbeddedResource array	manifest represents kubernetes resources that will be deployed into the target namespace		Optional: {}
helm HelmConfiguration	helm defines the configuration for a helm deployment		Optional: {}
resourceMappings ResourceMapping	ResourceMappings defines the secrets/configmaps which will be mapped into the target namespaces		Optional: {}
gotemplate string	gotemplate is a Go template with Sprig functions support which will be rendered to generate Kubernetes resources.		Optional: {}

EmbeddedResource

EmbeddedResource holds a kubernetes resource

Appears in: - TemplateResources

HelmConfiguration

HelmConfiguration holds the helm configuration

Appears in: - TemplateResources

Field	Description	Default	Validation
releaseName string	The helm release name. If omitted the template name will be used		Optional: {}
setValues HelmSetValue array	Values in the form of name=value that will be passed to the helm command during helm template		Optional: {}
values string	The additional helm values to use. Expected block string		Optional: {}
chart HelmChart	Tells us where to find the helm chart to deploy

HelmSetValue

HelmSetValue defines a name=value pair that will be passed to helm template

Appears in: - HelmConfiguration

Field	Description	Default	Validation
name string	The path of the value to set
value string	The value to set
forceString boolean	ForceString specifies if the parameter --set or --set-string should be used		Optional: {}

HelmChart

HelmChart holds the information needed to find a chart to deploy

Appears in: - HelmConfiguration

Field	Description	Default	Validation
repository HelmChartRepository	Load helm chart from a repository		Optional: {}

HelmChartRepository

HelmChartRepository defines a helm repository where TO can load a chart from

Appears in: - HelmChart

Field	Description	Default	Validation
name string	Name of the chart to deploy
version string	Version is the version of the chart to deploy		Optional: {}
repoUrl string	The repo url to use		Optional: {}
username HelmSecretRef	The username to use for the selected repository		Optional: {}
password HelmSecretRef	The password to use for the selected repository		Optional: {}

HelmSecretRef

HelmSecretRef holds a secret reference to a secret

Appears in: - HelmChartRepository

Field	Description	Default	Validation
key string
name string
namespace string			Optional: {}

ResourceMapping

Appears in: - TemplateResources

Field	Description	Default	Validation
secrets Resource array	Secrets consist of secrets which will be mapped to matching namespaces		Optional: {}
configMaps Resource array	ConfigMaps consist of configMaps which will be mapped to matching namespaces		Optional: {}

Resource

Appears in: - ResourceMapping

Field	Description	Default	Validation
name string	Name is the name of the resource		Required: {}
namespace string	Namespace is the namespace where the resource lives		Required: {}

TemplateSpec

Appears in: - Template

TemplateStatus

Appears in: - Template

TemplateParameter

Appears in: - Template

Field	Description	Default	Validation
name string	Name is the name of the parameter
value string	Value is the default value of the parameter		Optional: {}
required boolean	If required is true, the template instance must define this parameter, otherwise the deployment will fail.		Optional: {}
validation string	Validation takes a regular expression as value to verify the provided value does match expected values.		Optional: {}

TemplateInstance

TemplateInstance is the Schema for the templatesinstance API

Field	Description	Default	Validation
apiVersion string	templates.stakater.com/v1alpha1
kind string	TemplateInstance
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec TemplateInstanceSpec
status TemplateInstanceStatus			Optional: {}

TemplateInstanceSpec

TemplateInstanceSpec holds the expected cluster status of the template instance

Appears in: - TemplateInstance

Field	Description	Default	Validation
template string	The template to instantiate. This is an immutable field
sync boolean	If true the template instance will keep the deployed resources in sync with the template.		Optional: {}
parameters TemplateInstanceParameter array	Parameters hold the values of the defined parameters in the template		Optional: {}

TemplateInstanceStatus

TemplateInstanceStatus describes the current status of the template instance in the cluster

Appears in: - TemplateInstance

Field	Description	Default	Validation
status InstanceDeploymentStatus	Status holds the template instances status
message string	A human readable message indicating details about why the namespace is in this condition.		Optional: {}
reason string	A brief CamelCase message indicating details about why the namespace is in this state.		Optional: {}
templateHash string	TemplateHash is used to ignore false-positive template update events		Optional: {}
templateManifests string	TemplateManifests are the manifests that were rendered before		Optional: {}
mappedSecrets object (keys:string, values:MappedResourcesState)	MappedSecrets is a list of secrets which have been mapped along with its state.		Optional: {}
mappedConfigmaps object (keys:string, values:MappedResourcesState)	MappedConfigmaps is a list of configmaps which have been mapped along with its state.		Optional: {}
observedAt Time	LastAppliedAt indicates when the template was last applied		Optional: {}

InstanceDeploymentStatus

Underlying type: string

InstanceDeploymentStatus describes the status of template instance deployment as {"Deployed", "Failed", ""}

Appears in: - DeployedNamespaceState - MappedResourcesState - TemplateInstanceStatus

Field	Description
Deployed	InstanceDeploymentStatusDeployed describes a succeeded instance deployment
Failed	InstanceDeploymentStatusFailed describes a failed instance deployment
``	InstanceDeploymentStatusPending describes a not yet deployed instance

DeployedNamespaceState

Appears in: - ClusterTemplateInstanceStatus

Field	Description	Default	Validation
templateManifests string	TemplateManifests are the manifests that were rendered before		Optional: {}
status InstanceDeploymentStatus

MappedResourcesState

Appears in: - ClusterTemplateInstanceStatus - TemplateInstanceStatus

Field	Description	Default	Validation
reason string	Reason of resource mapping if failed		Optional: {}
status InstanceDeploymentStatus

FinOps

Packages

• finops.stakater.com/v1alpha1

finops.stakater.com/v1alpha1

Package v1alpha1 contains API Schema definitions for the finops v1alpha1 API group.

Resource Types

• CostJob
• FinOpsProvider
• Offering
• PriceBook
• Subscription

AWSOptions

AWSOptions defines AWS-specific options.

Appears in: - FinOpsProviderSpec

Field	Description	Default	Validation
cloudIntegrationSecret string	CloudIntegrationSecret is the Azure Subscription ID.		Optional: {}
pricingModelSource string	PricingModelSource indicates how the pricing model is provided to OpenCost. e.g., "Pricebook" if derived from PriceBook CRs.		Optional: {}

AzureOptions

AzureOptions defines Azure-specific options.

Appears in: - FinOpsProviderSpec

Field	Description	Default	Validation
cloudIntegrationSecret string	CloudIntegrationSecret is the Azure Subscription ID.		Optional: {}
pricingModelSource string	PricingModelSource indicates how the pricing model is provided to OpenCost. e.g., "Pricebook" if derived from PriceBook CRs.		Optional: {}

Compatibility

Compatibility defines compatibility requirements for subscriptions bound to this offering

Appears in: - OfferingSpec

Field	Description	Default	Validation
requiredOfferings ObjectReference array	RequiredOfferings lists offerings that must be covered by an active subscription in the same family (the connected tree sharing a root ancestor) for a subscription to this offering to activate. Coverage spans the whole family EXCEPT the subscription's own subtree: ancestors, siblings, uncles, and cousins all count; the subscription's own children and descendants do not. A root subscription's subtree is the entire family, so a requirement-bearing root can never be covered.		Optional: {}

CostBucket

Appears in: - SubscriptionStatus

Field	Description	Default	Validation
granularity string	Granularity is the time granularity of this bucket (e.g., hour, day, month).		Enum: [hour day month]
start Time	Start is the start time of the bucket (inclusive).
endExclusive Time	EndExclusive is the end time of the bucket (exclusive).
current integer	Current is the current accumulated spend for the period in micro-currency units.		Optional: {}
projected integer	Projected is the projected spend for the full period cycle in micro-currency units.		Optional: {}
breakdown CostMetric array	Breakdown contains the cost breakdown by component.		Optional: {}

CostJob

CostJob is the Schema for the costjobs API.

Field	Description	Default	Validation
apiVersion string	finops.stakater.com/v1alpha1
kind string	CostJob
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec CostJobSpec
status CostJobStatus

CostJobSpec

CostJobSpec defines the desired state of CostJob.

Appears in: - CostJob

Field	Description	Default	Validation
type CostJobType	Type of the cost collection job, e.g., "ResourceCostCollection"	ResourceCostCollection	Enum: [ResourceCostCollection SubscriptionChargeCollection] Optional: {}
databaseInitTimeout Duration	DatabaseInitTimeout is the timeout for database initialization	2m	Optional: {}
kubernetesOperationTimeout Duration	KubernetesOperationTimeout is the timeout for Kubernetes API operations	1m	Optional: {}
openCostFetchTimeout Duration	OpenCostFetchTimeout is the timeout for fetching data from OpenCost	2m	Optional: {}
databaseInsertTimeout Duration	DatabaseInsertTimeout is the timeout for database insert operations	3m	Optional: {}
databaseViewsRefreshTimeout Duration	DatabaseViewsRefreshTimeout is retained for API compatibility and has no effect. The cost ingestion job no longer refreshes any database view: the mv_provider_allocations_summary materialized view it used to rebuild on every run had no readers and was dropped in migration 14. Deprecated: no-op. Setting this value changes nothing.		Optional: {}
statusUpdateTimeout Duration	StatusUpdateTimeout is the timeout for status update operations	1m	Optional: {}
httpClientTimeout Duration	HTTPClientTimeout is the timeout for HTTP client requests	90s	Optional: {}
interval Duration		24h
resources ResourceRequirements	Resources overrides compute resources for the generated CronJob's loader container. Setting this replaces the whole block, so a partial value does not inherit the template defaults for the keys it omits. Unset means the operator defaults apply.		Optional: {}

CostJobStatus

CostJobStatus defines the observed state of CostJob

Appears in: - CostJob

Field	Description	Default	Validation
lastExecutionTime Time	Last execution time
lastSuccessfulExecutionTime Time	Last successful execution time
lastExecutionStatus string	Status of the last execution		Enum: [Success Failed Error Pending]
executionHistory ExecutionRecord array	History of the last 10 executions

CostJobType

Underlying type: string

Validation: - Enum: [ResourceCostCollection SubscriptionChargeCollection]

Appears in: - CostJobSpec

Field	Description
ResourceCostCollection
SubscriptionChargeCollection

CostMetric

Appears in: - CostBucket

Field	Description	Default	Validation
name MeterName	Name is the name of the cost metric (e.g., "cpuHour", "pvGbHour").		Enum: [subscription cpuHour gpuHour ramGbHour pvGbHour networkGb] Required: {}
current integer	Current is the current accumulated value in micro-currency units.		Optional: {}
projected integer	Projected is the projected value in micro-currency units.		Optional: {}

ExecutionRecord

ExecutionRecord represents a single execution attempt

Appears in: - CostJobStatus

Field	Description	Default	Validation
executionTime Time	The time when this execution started
status string	Status of the execution (Success, Failed, Error)		Enum: [Success Failed Error]
duration string	Duration of the execution
error string	Error message if the execution failed

FinOpsProvider

FinOpsProvider is the Schema for the finopsproviders API.

Field	Description	Default	Validation
apiVersion string	finops.stakater.com/v1alpha1
kind string	FinOpsProvider
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec FinOpsProviderSpec
status FinOpsProviderStatus

FinOpsProviderSpec

ProviderOptions holds provider-specific configuration options. Exactly one of AWS, GCP, Azure, or OnPrem must be set. These validations operate on the Go field names (AWS, GCP, Azure, OnPrem). Se https://opencost.io/docs/configuration/ for possible options todo: +kubebuilder:validation:XValidation:rule="has(self.Aws) || has(self.Gcp) || has(self.Azure) || has(self.OnPrem)", message="At least one provider option (awsoptions, gcpoptions, azureoptions, onpremoptions) must be set" todo: +kubebuilder:validation:XValidation:rule="(has(self.Aws) ? 1 : 0) + (has(self.Gcp) ? 1 : 0) + (has(self.Azure) ? 1 : 0) + (has(self.OnPrem) ? 1 : 0) == 1", message="Exactly one provider option (awsoptions, gcpoptions, azureoptions, onpremoptions) must be set"

Appears in: - FinOpsProvider

Field	Description	Default	Validation
awsoptions AWSOptions	AWS specific options.		Optional: {}
gcpoptions GCPOptions	GCP specific options.		Optional: {}
azureoptions AzureOptions	Azure specific options.		Optional: {}
onpremoptions OnPremOptions	OnPrem specific options.		Optional: {}

FinOpsProviderStatus

FinOpsProviderStatus defines the observed state of FinOpsProvider.

Appears in: - FinOpsProvider

Field	Description	Default	Validation
observedGeneration integer	ObservedGeneration reflects the generation of the most recently observed spec.		Optional: {}
conditions Condition array	Conditions represent the latest available observations of the FinOpsProvider's state.		Optional: {}
lastSyncTime Time	LastSyncTime is the timestamp of the last successful sync of OpenCost configuration.		Optional: {}

GCPOptions

GCPOptions defines GCP-specific options.

Appears in: - FinOpsProviderSpec

Field	Description	Default	Validation
cloudIntegrationSecret string	CloudIntegrationSecret is the Azure Subscription ID.		Optional: {}
pricingModelSource string	PricingModelSource indicates how the pricing model is provided to OpenCost. e.g., "Pricebook" if derived from PriceBook CRs.		Optional: {}

Lifecycle

Lifecycle defines lifecycle behavior for subscriptions

Appears in: - OfferingSpec

Field	Description	Default	Validation
onParentDeactivate ParentDeactivateAction	OnParentDeactivate toggles whether subscriptions to this offering should be deactivated when their parent subscription is deactivated - Deactivate: this subscription also deactivates. - Orphan: this subscription stays active independently, while retaining the parent reference for traceability.	Deactivate	Enum: [Deactivate Orphan]
allowOverride boolean	AllowOverride allows the subscription to override the lifecycle settings		Optional: {}

Margins

Margins defines pricing adjustments. AbsoluteMicros and FactorMilli are mutually exclusive — pick one mode per meter. Both must be non-negative: a negative margin would drive the per-unit price (and thus the usage charge) below zero, which usage meters don't support. Express a discount with a factorMilli below 1000 (e.g. 980 = 0.98x), not a negative absoluteMicros.

Appears in: - Meter

Field	Description	Default	Validation
absoluteMicros integer	AbsoluteMicros is an additive margin in micro-currency units (10^-6 of the currency) 1,000,000 micros = 1.00 currency unit Example: 0.02 cents = 0.0002 currency units = 200 micros		Optional: {}
factorMilli integer	FactorMilli is a multiplicative factor in milli-units 1000 = 1.000x, 1020 = 1.020x (adds 2%), 980 = 0.980x (discount 2%)		Optional: {}

Meter

Meter defines pricing adjustments for a specific meter

Appears in: - Pricing

Field	Description	Default	Validation
name MeterName	Name is the name of the meter along with unit (e.g., "cpuHour", "ramGbHour").		Enum: [subscription cpuHour gpuHour ramGbHour pvGbHour networkGb] Required: {}
margins Margins	Margins adjusts the price derived from raw usage for this meter. You can specify either: - absoluteMicros: an additive margin in micro-currency units (10^-6 of the currency), or - factorMilli: a multiplicative factor in milli-units (1000 = 1.000x, 1020 = 1.020x).		Optional: {}

MeterName

Underlying type: string

MeterName defines the name of a usage meter for pricing adjustments

Validation: - Enum: [subscription cpuHour gpuHour ramGbHour pvGbHour networkGb]

Appears in: - CostMetric - Meter - ResolvedMeter

Field	Description
subscription
cpuHour
gpuHour
ramGbHour
pvGbHour
networkGb	MeterNetworkGB bills total data transferred (transfer + receive) per GiB. No time dimension — the rate is per-GB, not per-GB-hour — hence no "Hour".

ObjectReference

Appears in: - Compatibility - SubscriptionParent - SubscriptionSpec

Field	Description	Default	Validation
name string			Required: {}
namespace string	Namespace of the referenced object. Must be set explicitly — references are never resolved against the referrer's namespace, so the same reference always means the same object no matter where it is authored. MinLength guards against an empty string, which +required alone would accept.		MinLength: 1 Required: {}

Offering

Offering describes a cost driving entity It owns the rules for how the base cost for that entity is collected and calculated

Field	Description	Default	Validation
apiVersion string	finops.stakater.com/v1alpha1
kind string	Offering
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec OfferingSpec
status OfferingStatus

OfferingSpec

OfferingSpec defines the desired state of Offering.

Appears in: - Offering

Field	Description	Default	Validation
pricing Pricing	Pricing specifies how the price for this offering is calculated		Required: {}
compatibility Compatibility	Compatibility can be used for ensuring that any subscription created for this offering has the required offerings in its parents or siblings		Optional: {}
lifecycle Lifecycle	Lifecycle defines how subscriptions to this offering behave during certain lifecycle events		Optional: {}

OfferingStatus

OfferingStatus defines the observed state of Offering.

Appears in: - Offering

Field	Description	Default	Validation
resolvedPricing ResolvedPricing	ResolvedPricing contains the effective pricing derived from the offering spec		Optional: {}
conditions Condition array	Conditions represent the latest available observations of the Offering's state		Optional: {}
ready ConditionStatus	Ready indicates whether the offering is ready to be subscribed to (i.e., all required offerings are present and no circular dependencies detected)

OnPremOptions

OnPremOptions defines On-Premise specific options.

Appears in: - FinOpsProviderSpec

Field	Description	Default	Validation
pricingModelSource string	PricingModelSource indicates how the pricing model is provided to OpenCost. e.g., "Pricebook" if derived from PriceBook CRs.		Optional: {}

ParentDeactivateAction

Underlying type: string

ParentDeactivateAction defines the behavior when a parent subscription is deactivated.

Validation: - Enum: [Deactivate Orphan]

Appears in: - Lifecycle - SubscriptionLifecycle

Field	Description
Deactivate
Orphan

PriceBook

PriceBook is the Schema for the pricebooks API

Field	Description	Default	Validation
apiVersion string	finops.stakater.com/v1alpha1
kind string	PriceBook
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec PriceBookSpec
status PriceBookStatus

PriceBookSpec

PriceBookSpec defines the desired state of PriceBook

Appears in: - PriceBook

Field	Description	Default	Validation
currency string	The base currency for financial reporting and calculations (e.g., EUR, USD).		Pattern: ^[A-Z]\{3\}$ Required: {}
valuationMode string	The mode of valuation - either 'currency' for direct monetary rates or 'percent' for weighted scoring.		Enum: [currency percent] Required: {}
rates PriceRates	Rates used for valuation in 'currency' mode. Defines cost per unit of resource. Required if valuationMode is 'currency'.		Optional: {}

PriceBookStatus

PriceBookStatus defines the observed state of PriceBook

Appears in: - PriceBook

Field	Description	Default	Validation
active boolean	Active indicates whether this PriceBook instance is currently designated as the active one used for pricing calculations. This field is managed by the operator.		Optional: {}
ready ConditionStatus	Ready indicates whether this PriceBook's rates are valid and it is usable for pricing resolution. Managed by the operator.		Optional: {}
observedGeneration integer	ObservedGeneration reflects the generation of the most recently observed spec.		Optional: {}
conditions Condition array	Conditions represent the latest available observations of the PriceBook's state.		Optional: {}
activePricing object (keys:string, values:string)	ActivePricing mirrors the OpenCost custom-pricing document (default.json) this PriceBook has applied to OpenCost. Populated only on the active, ready PriceBook (the one driving OpenCost); nil on every other PriceBook. Managed by the operator.		Optional: {}

PriceRates

PriceRates defines the cost rates for different resources. Each rate is a non-negative decimal string (e.g. "0.031"); empty means "unset". The pattern ^([0-9]+(\.[0-9]+)?)?$ rejects malformed values at admission while allowing empty.

Appears in: - PriceBookSpec

Field	Description	Default	Validation
cpuHour string	Cost per vCPU-hour (e.g., 0.031).		Pattern: ^([0-9]+(\.[0-9]+)?)?$ Optional: {}
spotCPUHour string	Cost per vCPU-hour (e.g., 0.031).		Pattern: ^([0-9]+(\.[0-9]+)?)?$ Optional: {}
ramGbHour string	Cost per GB-hour of RAM (e.g., 0.004).		Pattern: ^([0-9]+(\.[0-9]+)?)?$ Optional: {}
spotRAMGbHour string	Cost per GB-hour of spotRAM (e.g., 0.004).		Pattern: ^([0-9]+(\.[0-9]+)?)?$ Optional: {}
pvGbHour string	Cost per GB-hour of Persistent Volume (e.g., 0.00012).		Pattern: ^([0-9]+(\.[0-9]+)?)?$ Optional: {}
gpuHour string	Cost per GPU-hour (e.g., 1.8).		Pattern: ^([0-9]+(\.[0-9]+)?)?$ Optional: {}
networkGiB string	Cost per GiB of network data transferred (e.g., 0.09).		Pattern: ^([0-9]+(\.[0-9]+)?)?$ Optional: {}

Pricing

Pricing defines pricing rules for the offering

Appears in: - OfferingSpec

Field	Description	Default	Validation
resourcePricing Meter array	ResourcePricing defines per-meter pricing adjustments applied to raw usage. Each meter can optionally define: - includedUsage: an amount of usage included for free per subscription (same unit as the meter) - margins: either an absolute add-on (in micro-currency) or a multiplicative factor (in milli-units)		Optional: {}
subscriptionFee SubscriptionFee	SubscriptionFee defines the recurring fee charged for the subscription being active, independent of resource usage		Optional: {}

ResolvedIncludedUsage

ResolvedIncludedUsage contains the resolved included usage with its unit of measurement

Appears in: - ResolvedMeter

Field	Description	Default	Validation
value integer	Value is the amount of free usage included per subscription
unit string	Unit is the unit of measurement (e.g., "GbHour", "CoreHour")

ResolvedMeter

ResolvedMeter contains the effective per-unit price for a specific meter

Appears in: - ResolvedPricing

Field	Description	Default	Validation
name MeterName	Name is the meter name (e.g., "cpuHour", "ramGbHour")		Enum: [subscription cpuHour gpuHour ramGbHour pvGbHour networkGb] Required: {}
unitPriceMicros integer	UnitPriceMicros is the effective per-unit price in micro-currency units (10^-6)
includedUsage ResolvedIncludedUsage	IncludedUsage is the free usage included per subscription for this meter		Optional: {}

ResolvedPricing

ResolvedPricing contains the effective pricing that consumers see. It is derived from the offering spec and stamped on status during reconciliation.

Appears in: - OfferingStatus

Field	Description	Default	Validation
resolvedAt Time	ResolvedAt is the timestamp when pricing was last resolved
meters ResolvedMeter array	Meters contains per-meter resolved unit prices after margins are applied. Empty when no resource pricing is configured.
subscriptionFee SubscriptionFee	SubscriptionFee contains the resolved subscription fee, if configured		Optional: {}

Subscription

Subscription is the Schema for the subscriptions API.

Field	Description	Default	Validation
apiVersion string	finops.stakater.com/v1alpha1
kind string	Subscription
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec SubscriptionSpec
status SubscriptionStatus

SubscriptionFee

SubscriptionFee defines the recurring fee charged for the subscription being active, independent of resource usage.

Billing model: - The fee accrues over time in discrete "ticks" of length period. - Each tick contributes priceMicros to the total. - Ticks are aligned according to tickAlignment.

Tick alignment: - ActivatedAt: ticks start at status.activatedAt (tick boundaries are: activatedAt + N*period). Best for per-subscription billing cycles (common for add-ons). - HourBoundary / DayBoundary / MonthBoundary: ticks align to wall-clock boundaries. Best for synchronized billing windows across subscriptions (common for reporting).

Charging rule (deterministic per time window): For a time bucket [start, endExclusive), the subscription fee charged in that bucket is:

ticks(t) = number of full tick boundaries strictly before time t
feeInBucket = priceMicros * (ticks(endExclusive) - ticks(start))

This ensures exports are idempotent: the same [start, endExclusive) always yields the same fee.

Minimum commitment (minPeriods): - minPeriods defines the minimum number of periods to bill once the subscription becomes active. - If the subscription deactivates before minPeriods have elapsed, the remaining periods are billed as an adjustment at deactivation time, so the total billed periods is at least minPeriods.

All monetary values are expressed in micro-currency units (10^-6 of the currency).

Appears in: - Pricing - ResolvedPricing

Field	Description	Default	Validation
period string	Period is the tick interval. Its interpretation depends on tickAlignment: - ActivatedAt: a Go duration string (e.g., "1h", "30m", "24h"). - HourBoundary: an integer number of hours (e.g., "1", "2"). - DayBoundary: an integer number of days (e.g., "1", "7"). - MonthBoundary: an integer number of months (e.g., "1", "3", "12").
tickAlignment TickAlignment	TickAlignment defines where tick boundaries occur. ActivatedAt: ticks start at status.activatedAt (tick boundaries are: activatedAt + N*period). Best for per-subscription billing cycles (common for add-ons). HourBoundary / DayBoundary / MonthBoundary: ticks align to wall-clock boundaries. Best for synchronized billing windows across subscriptions (common for reporting). For boundary-aligned modes, the first tick after activation covers a partial period and is prorated: charge = priceMicros * actualDuration / periodDuration. For MonthBoundary, the period duration denominator is a fixed 365.25/12 days (30.4375 days).		Enum: [ActivatedAt HourBoundary DayBoundary MonthBoundary]
minPeriods integer	MinPeriods is the minimum number of full tick periods before deletion is allowed. The collection job keeps the subscription finalizer until at least minPeriods ticks have elapsed since activation. The subscription continues accruing charges normally until the finalizer is removed.		Minimum: 1 Optional: {}
priceMicros integer	PriceMicros is the price per tick, in micro-currency units		Minimum: 1 Required: {}

SubscriptionLifecycle

Appears in: - SubscriptionSpec

Field	Description	Default	Validation
onParentDeactivate ParentDeactivateAction	OnParentDeactivate controls what happens when the parent subscription deactivates: - Deactivate: this subscription also deactivates. - Orphan: this subscription stays active independently, while retaining the parent reference for traceability. Orphan only detaches the parent lifecycle link; compatibility requirements are still enforced. An orphan whose required offering was covered only by the now-deactivated parent (and by no active sibling) is still deactivated, because keeping it active would violate the requirement.	Deactivate	Enum: [Deactivate Orphan]
targetRef TargetReference	TargetRef ties the lifecycle of the subscription to a target resource. The subscription will not activate until the target status is Ready. When the target is deleted, the subscription will be deactivated.		Optional: {}

SubscriptionParent

Appears in: - SubscriptionSpec

Field	Description	Default	Validation
subscriptionRef ObjectReference	SubscriptionRef is a reference to the parent subscription.		Required: {}

SubscriptionSpec

SubscriptionSpec defines the desired state of Subscription. A Subscription creates a binding to an Offering, starting the clock and instantiating the offering. Effectively it starts consuming the cost-driving entity from a billing perspective.

offeringRef and parent are immutable: both determine what the subscription is billed for and which subscriptions provide its compatibility coverage, and a subscription's activation is a billing epoch that cannot be re-pointed.

Appears in: - Subscription

Field	Description	Default	Validation
offeringRef ObjectReference	OfferingRef is the reference to the Offering which is being subscribed to.		Required: {}
parent SubscriptionParent	Parent is an optional reference to a parent subscription for traceability. For example, a storage subscription attached to a VM would reference the VM subscription.		Optional: {}
usageSources UsageSource array	UsageSources defines from where the data for the resource usage of this subscription comes.		Optional: {}
lifecycle SubscriptionLifecycle	Lifecycle allows overriding lifecycle behavior if the Offering permits it. If both parent and targetRef are set: - activation requires BOTH (parent active AND target Ready) - deactivation happens if EITHER stops applying, except parent deactivation is ignored when onParentDeactivate=Orphan Note: onParentDeactivate=Orphan only governs the parent lifecycle link. It does not exempt the subscription from its offering's compatibility requirements: if the deactivating parent was the only active provider of a required offering, the subscription is still deactivated for the coverage gap.		Optional: {}

SubscriptionStatus

SubscriptionStatus defines the observed state of Subscription. Non-active subscriptions are ignored by scrape jobs. A subscription becomes active when: - parent.SubscriptionRef is set and the parent is active, and/or - targetRef is set and the target is Ready. Unset references are ignored. If neither reference is set, the subscription activates after spec validation.

Appears in: - Subscription

Field	Description	Default	Validation
ready ConditionStatus	Ready indicates whether the subscription is active and ready.
activatedAt Time	ActivatedAt is the time when the subscription became active.		Optional: {}
deactivatedAt Time	DeactivatedAt is the time when the subscription was deactivated.		Optional: {}
compatibilityRoot string	CompatibilityRoot is the metadata.uid of this subscription's root ancestor, resolved once by the controller. It identifies the connected family used for compatibility coverage.		Optional: {}
costs CostBucket array	Costs contains rolling cost summaries for the current hour, day, and month. When populated, contains exactly 3 entries — one per granularity. // +optional
conditions Condition array	Conditions represent the latest available observations of the Subscription's state.		Optional: {}

TargetReference

Appears in: - SubscriptionLifecycle

Field	Description	Default	Validation
apiVersion string	APIVersion is the API version of the target resource.
kind string	Kind is the kind of the target resource.
namespace string	Namespace is the namespace of the target resource.		Optional: {}
name string	Name is the name of the target resource.

TickAlignment

Underlying type: string

TickAlignment defines where tick boundaries occur for subscription fee billing.

Validation: - Enum: [ActivatedAt HourBoundary DayBoundary MonthBoundary]

Appears in: - SubscriptionFee

Field	Description
ActivatedAt	ActivatedAt: ticks start at status.activatedAt (tick boundaries are: activatedAt + N*period). Best for per-subscription billing cycles (common for add-ons).
HourBoundary	HourBoundary ticks align to wall-clock hour boundaries (e.g., 1:00, 2:00, etc.).
DayBoundary	DayBoundary ticks align to wall-clock day boundaries (e.g., 1 calender day).
MonthBoundary	MonthBoundary ticks align to wall-clock month boundaries (e.g., 1st of each month).

UsageSource

Appears in: - SubscriptionSpec

Field	Description	Default	Validation
resourceType string	ResourceType is the type of resource to track (e.g., Deployment, StatefulSet, Pod).		Enum: [Deployment StatefulSet Pod DaemonSet Job CronJob ReplicaSet]
name string	Name is the name of the specific resource instance.		Optional: {}
namespace string	Namespace is the namespace of the resource.		Optional: {}

Hibernation Operator

Packages

• hibernation.stakater.com/v1beta1

hibernation.stakater.com/v1beta1

Resource Types

• ClusterResourceSupervisor
• ResourceSupervisor

ClusterResourceSupervisor

ClusterResourceSupervisor is the Schema for the resourcesupervisors API

Field	Description	Default	Validation
apiVersion string	hibernation.stakater.com/v1beta1
kind string	ClusterResourceSupervisor
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ClusterResourceSupervisorSpec
status ClusterResourceSupervisorStatus

ClusterResourceSupervisorSpec

ClusterResourceSupervisorSpec defines the desired state of ClusterResourceSupervisor

Appears in: - ClusterResourceSupervisor

Field	Description	Default	Validation
schedule Hibernation			Required: {}
namespaces Namespaces	Namespaces is a list of namespaces to which the schedule will be applied		Optional: {}
argocd ArgoCDHibernation	ArgoCD contains details about ArgoCD to which the schedule will be applied

ClusterResourceSupervisorStatus

ClusterResourceSupervisorStatus defines the observed state of ClusterResourceSupervisor

Appears in: - ClusterResourceSupervisor

Field	Description	Default	Validation
nextReconcileTime Time	NextReconcileTime contains the next time at which the namespace resources will sleep or wake up
currentStatus Status	CurrentStatus shows the state the tenant's resources		Enum: [sleeping running error]
sleepingNamespaces SleepingNamespace array	SleepingResources contains the previous states for each of the deployments currently scaled down
watchedNamespaces string array	WatchedNamespaces contains the list of namespaces that are being watched by the ClusterResourceSupervisor
ignoreNamespaces string array	IgnoreNamespaces contains the list of namespaces that are being ignored by the ClusterResourceSupervisor

ResourceSupervisor

ResourceSupervisor is the Schema for the resourcesupervisors API

Field	Description	Default	Validation
apiVersion string	hibernation.stakater.com/v1beta1
kind string	ResourceSupervisor
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ResourceSupervisorSpec
status ResourceSupervisorStatus

ResourceSupervisorSpec

ResourceSupervisorSpec defines the desired state of ResourceSupervisor API

Appears in: - ResourceSupervisor

Field	Description	Default	Validation
schedule Hibernation			Required: {}

ResourceSupervisorStatus

ResourceSupervisorStatus defines the observed state of ResourceSupervisor

Appears in: - ResourceSupervisor

Field	Description	Default	Validation
nextReconcileTime Time	NextReconcileTime contains the next time at which the namespace resources will sleep or wake up
currentStatus Status	CurrentStatus shows the state the tenant's resources		Enum: [sleeping running error]

Status

Underlying type: string

Validation: - Enum: [sleeping running error]

Appears in: - ClusterResourceSupervisorStatus - ResourceSupervisorStatus