API Reference

Packages

• templates.v2.stakater.com/v2alpha1

templates.v2.stakater.com/v2alpha1

Package v2alpha1 contains API Schema definitions for the templates v2alpha1 API group.

Resource Types

• Template
• TemplateInstance

Template

Template is a reusable blueprint that defines Kubernetes resources which can be instantiated multiple times across different namespaces using TemplateInstances. Templates are scoped to a provider namespace and contain go templates or Helm charts that render into one or more Kubernetes manifests when instantiated.

Namespace Scope (Provider): The Template may only reference other resources in its own namespace.

Security Implication: Anyone who can create a Template in a namespace can expose any resource that the template-operator service account is allowed to read within that namespace.

Field	Description	Default	Validation
apiVersion string	templates.v2.stakater.com/v2alpha1
kind string	Template
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec TemplateSpec
status TemplateStatus			Optional: {}

TemplateSpec

TemplateSpec defines the desired state of Template

Appears in: - Template

Field	Description	Default	Validation
gotemplate string	Exactly one of gotemplate or helm must be specified. gotemplate is rendered using Go text/template. It may emit one or more Kubernetes manifests. Sprig functions are also available https://masterminds.github.io/sprig/ If a namespace-scoped resource omits the namespace field, it will be created in the TemplateInstance's namespace (consumer namespace), NOT in the 'default' namespace or the Template's namespace. Available context (non-exhaustive): - .parameters : resolved parameter values - .instance : metadata of the TemplateInstance (name, namespace, labels) Referencing a value that does not exist (a typo, or an instance label that is not set) fails the render; the TemplateInstance reports the missing key in its Rendered condition. For optional values, look up through index, which returns an empty value instead of failing: {{ index .instance.labels "env" | default "dev" }} {{ if index .instance.labels "env" }} ... {{ end }}
helm HelmSpec	Helm renders a Helm chart instead of a raw Go template. Exactly one of gotemplate or helm must be specified.		Optional: {}
parameters TemplateParameterDefinition array	Parameters define the inputs required to render the template. Rules: - type is a hint used for validation/coercion (operator-defined).		Optional: {}
targetNamespaces TargetNamespaces	TargetNamespaces controls where this Template may be instantiated. Default behavior: If this field is omitted entirely, the Template may ONLY be instantiated in the same namespace as this Template. A namespace is eligible if it matches the explicit list OR the selector.		Optional: {}
sync SyncConfig	Sync controls drift protection for rendered resources.		Optional: {}
outputs TemplateOutput array	Outputs declare named extractions from this Template's rendered resources, surfaced on TemplateInstance.status.outputs. Each entry chooses exactly one iteration mode by field combination: - from only single-resource extraction - fromAll only iterate all rendered resources of a GVK - from + forEach iterate an array of objects inside one resource		MaxItems: 50 Optional: {}

HelmSpec

HelmSpec defines a Helm chart source and rendering configuration.

Appears in: - TemplateSpec

Field	Description	Default	Validation
chart HelmChart	Chart defines where the Helm chart is sourced from.		Required: {}
releaseName string	ReleaseName is the Helm release name used during rendering. If omitted, defaults to the TemplateInstance name at render time.		MaxLength: 53 Optional: {}
version HelmVersion	Version selects the Helm rendering engine. Defaults to "v3" if omitted: existing templates are written against Helm v3 behavior, so migrated charts render the same as before. Set "v4" to opt in to the Helm v4 engine.	v3	Enum: [v3 v4] Optional: {}
valuesTemplate string	ValuesTemplate is a Go template that renders into YAML used as Helm values. The rendered YAML is parsed and passed as Helm value overrides (merged over the chart's default values.yaml). Available context (same as gotemplate): - .parameters : resolved parameter values - .instance : metadata of the TemplateInstance (name, namespace, labels) Like gotemplate, referencing a value that does not exist fails the render; use index (with default) for optional lookups.		Optional: {}

HelmChart

HelmChart identifies a Helm chart source.

Appears in: - HelmSpec

Field	Description	Default	Validation
repository HelmRepository	Repository defines the repository location, chart name, version, and optional authentication.		Required: {}

HelmRepository

HelmRepository defines the location, chart identity, and optional authentication for a Helm chart repository or OCI registry.

Appears in: - HelmChart

Field	Description	Default	Validation
url string	URL is the repository URL. For HTTP/HTTPS repositories: https://charts.example.com For OCI registries: oci://ghcr.io/org/charts		MinLength: 1 Pattern: ^(https?\|oci):// Required: {}
name string	Name is the chart name within the repository.		MinLength: 1 Required: {}
version string	Version is the exact chart version to pull (SemVer 2, e.g. "1.2.3"). Must follow SemVer 2 (https://semver.org): MAJOR.MINOR.PATCH with optional pre-release and build metadata.		MinLength: 5 Pattern: ^v?(0\|[1-9][0-9]*)\.(0\|[1-9][0-9]*)\.(0\|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ Required: {}
auth HelmAuth	Auth provides optional authentication credentials. The referenced Secret MUST live in the same namespace as this Template. Supported credential layouts by source type: 1. HTTP(S) Helm repositories - username / password keys - token key 2. OCI registries (oci://) - username / password - token - or standard Docker config (.dockerconfigjson)		Optional: {}

HelmAuth

HelmAuth references a Secret containing repository credentials.

Appears in: - HelmRepository

Field	Description	Default	Validation
secretRef SecretRef	SecretRef references a Secret in the same namespace as the Template.		Required: {}

SecretRef

SecretRef is a reference to a Secret by name.

Appears in: - HelmAuth

Field	Description	Default	Validation
name string	Name of the Secret.		MinLength: 1 Required: {}

HelmVersion

Underlying type: string

HelmVersion specifies which Helm SDK to use for rendering.

Validation: - Enum: [v3 v4]

Appears in: - HelmSpec

Field	Description
v3
v4

TemplateParameterDefinition

TemplateParameterDefinition defines a single parameter for the template.

Appears in: - TemplateSpec

Field	Description	Default	Validation
name string	Name is the name of the parameter		MinLength: 1 Required: {}
value JSON	Value provides the parameter's literal default. It may be a scalar (string, number, bool), a list, or an object, matching the declared type.		Schemaless: {} Optional: {}
type ParameterType	Type declares the expected type for validation of both template default values and instance overrides.		Enum: [string number bool array object] Optional: {}
required boolean	Required, if true, means the TemplateInstance MUST provide a value for this parameter, regardless of whether the template has a default.		Optional: {}
exposeInStatus boolean	ExposeInStatus controls whether the resolved value appears in TemplateInstance status resolvedParameters. Defaults to false (hidden).		Optional: {}
disableOverride boolean	DisableOverride controls whether a TemplateInstance may supply its own value for this parameter. Defaults to false (allow override) when omitted.		Optional: {}

ParameterType

Underlying type: string

ParameterType declares the expected type for validation.

Validation: - Enum: [string number bool array object]

Appears in: - TemplateParameterDefinition

Field	Description
string
number
bool
array
object

TargetNamespaces

TargetNamespaces defines namespace restrictions for Template instantiation

Appears in: - TemplateSpec

Field	Description	Default	Validation
explicit AllowDeny	Explicit defines allowed (and in future, denied) consumer namespaces where this Template may be instantiated.		Optional: {}
selector LabelSelector	Selector dynamically selects namespaces via labels.		Optional: {}

SyncConfig

SyncConfig controls drift protection for rendered resources.

Appears in: - TemplateSpec

Field	Description	Default	Validation
mode SyncMode	Mode selects the drift protection strategy. - off (default): create once, then freeze — no Template, instance or valueFrom source change re-applies, and manual edits survive. - revert: the controller continuously reconciles rendered resources, reverting external drift back to the desired state. - strict: same as revert, plus an admission webhook proactively blocks unauthorized UPDATE/DELETE on rendered resources.	off	Enum: [off revert strict] Optional: {}
ignoreFields string array	IgnoreFields defines field paths that are exempt from enforcement. Changes to these fields are allowed even when sync is enabled. Field paths use dot-separated notation and are evaluated per rendered object. Array wildcards are supported via [] notation. Examples: "metadata.annotations", "spec.replicas", "spec.template.spec.containers[].env"		Optional: {}

SyncMode

Underlying type: string

SyncMode controls the level of drift protection for rendered resources.

Validation: - Enum: [off revert strict]

Appears in: - SyncConfig

Field	Description
off	SyncModeOff creates the resources once, then freezes the instance: no Template, instance or valueFrom source change re-applies, and manual edits survive. A defaultValue used at the first clean apply is kept. Flip to revert/strict to resume.
revert	SyncModeRevert enables reconciliation-based drift correction. The controller continuously reconciles rendered resources to the desired state, reverting any drift. No webhook enforcement.
strict	SyncModeStrict enables reconciliation and webhook enforcement. In addition to continuous reconciliation, an admission webhook proactively blocks unauthorized UPDATE/DELETE on rendered resources.

TemplateOutput

TemplateOutput declares a named extraction from this Template's rendered resources.

Appears in: - TemplateSpec

Field	Description	Default	Validation
name string	Name is the parent identifier for this output entry, unique across outputs[]. It is NOT surfaced in TemplateInstance status; the user-visible status keys come from each fields[].name below.		MaxLength: 63 MinLength: 1 Pattern: ^[a-zA-Z][a-zA-Z0-9]*$ Required: {}
from OutputSourceRef	From selects a single rendered resource. Required for single-resource and forEach modes; must be absent in fromAll mode.		Optional: {}
fromAll OutputSourceAll	FromAll iterates every rendered resource matching the GVK. Mutually exclusive with from and forEach.		Optional: {}
forEach string	ForEach iterates an array OF OBJECTS inside the resource named by from. JSONPath query wrapped in {...}; "{.__index}" (zero-based position) is available to keyTemplate. Required for forEach mode; absent otherwise.		MaxLength: 256 MinLength: 1 Optional: {}
keyTemplate string	KeyTemplate renders the inner status-map key (JSONPath template, {...}). Required for forEach. Optional for fromAll (runtime scope-aware default: namespaced -> "{.metadata.namespace}/{.metadata.name}", cluster-scoped -> "{.metadata.name}"). Optional for single mode (defaults to "{.metadata.name}").		MaxLength: 256 MinLength: 1 Optional: {}
fields OutputField array	Fields are the JSONPath extractions performed against each matched resource (or, for forEach, each array element).		MaxItems: 50 MinItems: 1 Required: {}

OutputSourceRef

OutputSourceRef identifies a single rendered resource (from / forEach modes).

Appears in: - TemplateOutput

Field	Description	Default	Validation
apiVersion string	APIVersion of the source resource (e.g. "v1", "apps/v1").		MaxLength: 253 Required: {}
kind string	Kind of the source resource. Kind: Secret is refused at admission because TemplateInstance status is broadly readable to anyone with get templateinstance.		MaxLength: 63 Required: {}
name string	Name is a JSONPath template ({...}) evaluated against the Template context ({"parameters": {...}, "instance": {name, namespace, labels}}). The rendered name must exist in status.renderedResources at extraction time. With sync.mode off, parameters referenced here need exposeInStatus: true — a frozen instance resolves selectors from status.resolvedParameters, never from live values.		MaxLength: 256 MinLength: 1 Required: {}
namespace string	Namespace is a JSONPath template ({...}); defaults to the TemplateInstance's namespace when omitted. Ignored for cluster-scoped kinds.		MaxLength: 253 Optional: {}

OutputSourceAll

OutputSourceAll selects all rendered resources of a GVK (fromAll mode).

Appears in: - TemplateOutput

Field	Description	Default	Validation
apiVersion string	APIVersion of the source resources (e.g. "apps/v1").		MaxLength: 253 Required: {}
kind string	Kind of the source resources. Kind: Secret is refused at admission.		MaxLength: 63 Required: {}
namespace string	Namespace is a JSONPath template ({...}) scoping the iteration; when omitted, iterates across every namespace this instance rendered into.		MaxLength: 253 Optional: {}

OutputField

OutputField is a single JSONPath extraction mapped to one outer status key.

Appears in: - TemplateOutput

Field	Description	Default	Validation
name string	Name is the OUTER key under status.outputs. Must be unique across the FLATTENED set of all outputs[].fields[].name in this Template (enforced by the Template reconciler).		MaxLength: 63 MinLength: 1 Pattern: ^[a-zA-Z][a-zA-Z0-9]*$ Required: {}
jsonPath string	JSONPath query wrapped in {...}. A scalar result is stored as-is; an array/object result is JSON-encoded (e.g. "{.foo[*].ip}" -> '["v4","v6"]').		MaxLength: 256 MinLength: 1 Required: {}

TemplateStatus

TemplateStatus defines the observed state of Template.

Appears in: - Template

Field	Description	Default	Validation
observedGeneration integer	observedGeneration is the last generation of the Template that has been processed by the controller.		Optional: {}
phase TemplatePhase	phase summarizes the overall validation state of the Template. Typical values: Valid, Invalid, Error		Enum: [Valid Invalid Error] Optional: {}
conditions Condition array	conditions describe fine-grained validation and availability states following standard Kubernetes condition conventions.		Optional: {}

TemplatePhase

Underlying type: string

TemplatePhase represents the validation state of a Template.

Validation: - Enum: [Valid Invalid Error]

Appears in: - TemplateStatus

Field	Description
Valid
Invalid
Error

TemplateInstance

TemplateInstance represents a consumer's request to instantiate a Template. It creates actual Kubernetes resources in the consumer's namespace by rendering the referenced Template with provided or overridden parameters.

Namespace Scope (Consumer): The TemplateInstance is created in a consumer namespace. Any instance-provided overrides that read from ConfigMaps, Secrets, or other resources are resolved from the namespace specified in the KeyRef or ObjectFieldRef. When a KeyRef omits the namespace, it defaults to the TemplateInstance's namespace.

Field	Description	Default	Validation
apiVersion string	templates.v2.stakater.com/v2alpha1
kind string	TemplateInstance
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec TemplateInstanceSpec
status TemplateInstanceStatus			Optional: {}

TemplateInstanceSpec

TemplateInstanceSpec defines the desired state of TemplateInstance.

Appears in: - TemplateInstance

Field	Description	Default	Validation
templateRef TemplateReference	templateRef points to the provider-scoped Template to instantiate. This is a cross-namespace reference by design
serviceAccountRef ServiceAccountRef	serviceAccountRef names the ServiceAccount, in this TemplateInstance's own namespace, whose identity is used to resolve valueFrom parameters from the cluster and to watch their source resources. The ServiceAccount needs RBAC (get, and list/watch for change detection) on every referenced resource, and list on namespaces when a parameter uses namespaceSelector. If the named ServiceAccount does not exist, the instance fails with reason ServiceAccountNotFound before any parameter is resolved — parameter defaultValue fallbacks do not apply to a missing identity. Using this field also requires the cluster to have granted the operator's own service account the 'impersonate' verb on 'serviceaccounts'; the operator does not ship with it, because granting it cluster-wide and unscoped is equivalent to cluster-admin. Without the grant the instance fails with reason ImpersonationNotPermitted, again before any resolution. When omitted, parameters resolve with the operator's own service account.		Optional: {}
parameters TemplateParameter array	Parameters override the parameters defined in the referenced Template. Validation: - A parameter override is only allowed if the corresponding Template parameter has disableOverride: false set (or omitted, since it defaults to false). - If a parameter is not overridden here, the Template's default definition is used.		Optional: {}

TemplateReference

TemplateReference defines the Template to instantiate

Appears in: - TemplateInstanceSpec

Field	Description	Default	Validation
name string	Name of the Template resource
namespace string	Namespace where the Template resource is located

ServiceAccountRef

ServiceAccountRef names a ServiceAccount in the TemplateInstance's namespace. It intentionally has no namespace field: the referenced ServiceAccount is always resolved in the TemplateInstance's own namespace, so an instance can never assume an identity from another tenant's namespace.

Appears in: - TemplateInstanceSpec

Field	Description	Default	Validation
name string	Name of the ServiceAccount.		MaxLength: 253 MinLength: 1 Required: {}

TemplateParameter

TemplateParameter defines a single parameter for TemplateInstance overrides.

Appears in: - TemplateInstanceSpec

Field	Description	Default	Validation
name string	Name is the name of the parameter		MinLength: 1 Required: {}
value string	Option 1 (literal): string|number|bool Value provides a literal parameter value (string, number, or bool).		Optional: {}
valueFrom ValueFrom	Option 2: read a value dynamically from a cluster resource. Exactly one of value or valueFrom must be set.		MaxProperties: 1 MinProperties: 1 Optional: {}
defaultValue string	DefaultValue is used when valueFrom fails. Only valid with valueFrom. With sync.mode off, a fallback at the first clean apply is final: the instance freezes with the default and does not re-read the source if it is created, or becomes readable, after the first clean apply.		Optional: {}

ValueFrom

ValueFrom specifies a dynamic source for a parameter value.

Exactly one sub-field must be set.

Validation: - MaxProperties: 1 - MinProperties: 1

Appears in: - ResolvedParameter - TemplateParameter

Field	Description	Default	Validation
secretKeyRef KeyRef	SecretKeyRef reads a key from a Secret.		Optional: {}
configMapKeyRef KeyRef	ConfigMapKeyRef reads a key from a ConfigMap.		Optional: {}
objectFieldRef ObjectFieldRef	ObjectFieldRef reads a field via JSONPath from an arbitrary resource.		Optional: {}

KeyRef

KeyRef references a specific key in a Secret or ConfigMap.

Appears in: - ValueFrom

Field	Description	Default	Validation
name string	Name of the Secret or ConfigMap.		MinLength: 1 Required: {}
key string	Key within the Secret or ConfigMap data to read.		MinLength: 1 Required: {}
namespace string	Namespace of the Secret or ConfigMap. When omitted, defaults to the TemplateInstance's namespace.		Optional: {}

ObjectFieldRef

ObjectFieldRef reads a field from an arbitrary Kubernetes resource via JSONPath.

The operator watches the target GVK for change detection. With sync.mode off that watch is released once the instance freezes after its first clean apply, and later changes to the target are ignored. When Name is set, the operator GETs that specific resource. When Name is omitted, the operator LISTs all resources of the given GVK and evaluates JSONPath over the list result. RBAC: requires get, list, and watch on the target resource.

Namespace scoping (mutually exclusive options): - Namespace set: operate in that namespace only. - NamespaceSelector set: LIST/watch across every namespace whose labels match the selector. Only valid in LIST mode (Name empty). - Both empty: for namespaced resources, operates across all namespaces; for cluster-scoped resources (Nodes, PVs, etc.), ignored.

Appears in: - ValueFrom

Field	Description	Default	Validation
apiVersion string	APIVersion of the target resource (e.g., "networking.k8s.io/v1").		MinLength: 1 Required: {}
kind string	Kind of the target resource (e.g., "Ingress").		MinLength: 1 Required: {}
name string	Name of the target resource. When omitted, the operator LISTs all resources of this GVK and evaluates JSONPath over the list result.		Optional: {}
namespace string	Namespace of the target resource. When empty, namespaced resources are listed across all namespaces; cluster-scoped resources ignore this field. Mutually exclusive with NamespaceSelector.		Optional: {}
namespaceSelector LabelSelector	NamespaceSelector matches the namespaces in which to LIST/watch the target GVK. Only meaningful in LIST mode (Name empty). The matched namespace set is kept current as namespaces are created, deleted, or relabeled. A terminating namespace is omitted, even while it still carries the labels. Mutually exclusive with Namespace. Has no effect on cluster-scoped target GVKs (operator surfaces an error at resolution time). RBAC: requires the operator's ServiceAccount to have namespaces: list, watch.		Optional: {}
jsonPath string	JSONPath expression to extract the value (without curly braces). Must start with a dot (e.g., ".metadata.name", not "{.metadata.name}"). Examples: .status.loadBalancer.ingress[0].ip, .metadata.name, .items[*].metadata.name		MinLength: 1 Required: {}

TemplateInstanceStatus

TemplateInstanceStatus defines the observed state of TemplateInstance.

Appears in: - TemplateInstance

Field	Description	Default	Validation
observedGeneration integer	observedGeneration is the .metadata.generation the controller most recently reconciled. A frozen sync-off instance advances it without applying the change; the Synced condition (reason Frozen) reports that.		Optional: {}
phase TemplateInstancePhase	phase summarizes the overall validation state of the Template.		Enum: [Ready Failed] Optional: {}
resolvedParameters ResolvedParameter array	resolvedParameters exposes the final parameter values used for rendering AFTER merging Template defaults and Instance overrides.		Optional: {}
renderedResources ResourceReference array	renderedResources list the resources created by this TemplateInstance. IMPORTANT: This list contains ONLY the minimum identifying information required to locate the rendered resources (apiVersion, kind, name, namespace). It MUST NOT be treated as a source of truth for desired or live state, and MUST NOT embed full object specs or status.		MaxItems: 500 Optional: {}
trackedGVKs string array	trackedGVKs is the set of GroupVersionKinds this TemplateInstance has rendered.		Optional: {}
matchedNamespaces string array	matchedNamespaces lists the namespaces resolved by any parameter whose objectFieldRef.namespaceSelector matched a non-empty set on the last reconcile. Populated only when at least one such parameter exists. Useful for debugging "why does my TI include / exclude this namespace?". The list is bounded — selectors matching more than 100 namespaces are truncated and the truncated set is logged.		MaxItems: 100 Optional: {}
resolvedTemplateRef ResolvedTemplateRef	resolvedTemplateRef shows the exact Template used for rendering, including its namespace and resourceVersion.		Optional: {}
conditions Condition array	conditions represent the latest available observations of the TemplateInstance's state.		Optional: {}
outputs object (keys:string, values:object)	outputs maps each Template output field name (outer key) to a map of rendered keyTemplate (inner key) -> extracted value. Populated from Template.spec.outputs against this instance's rendered resources.		Optional: {}
outputsObservedAt Time	outputsObservedAt is the time the output values (the outputs map) last changed. It advances only when a resolution produces a different map than the stored one, not on every check and not when only the OutputsResolved condition message changes while the values are unchanged. It is a last-value-change marker, not a liveness probe; condition status transitions are timestamped separately by the OutputsResolved condition's own lastTransitionTime.		Optional: {}
firstAppliedAt Time	firstAppliedAt is set once, at the first clean pass: every rendered resource applied and no orphan left to dispose. A defaultValue fallback counts as clean. With sync.mode off the instance is then frozen: no Template, instance or valueFrom source change re-applies, and manual edits survive. Flip the mode to revert/strict to resume.		Optional: {}

TemplateInstancePhase

Underlying type: string

Validation: - Enum: [Ready Failed]

Appears in: - TemplateInstanceStatus

Field	Description
Ready
Failed

ResolvedParameter

ResolvedParameter records the source and optionally the value used for a parameter after merging Template defaults and Instance overrides.

Appears in: - TemplateInstanceStatus

Field	Description	Default	Validation
name string	Name of the parameter.
value string	Value is the resolved parameter value. Only populated when the Template parameter has exposeInStatus: true.		Optional: {}
valueFrom ValueFrom	ValueFrom records the source that was used to resolve this parameter, when the value came from a dynamic source (secret, configmap, resource).		MaxProperties: 1 MinProperties: 1 Optional: {}
usedDefault boolean	UsedDefault is true when the parameter's valueFrom could not be read (source missing or access denied) and the value came from defaultValue instead. The parameters that fell back are also listed in the ParametersValid condition message.		Optional: {}
fallbackReason FallbackReason	FallbackReason categorizes why defaultValue was used. Set only when UsedDefault is true; empty means the parameter resolved from its source.		Enum: [AccessDenied SourceNotFound ResolutionFailed] Optional: {}

FallbackReason

Underlying type: string

FallbackReason labels why a parameter fell back to its defaultValue. The empty value is not one of the reasons below: it means no fallback happened and the parameter resolved from its source.

Validation: - Enum: [AccessDenied SourceNotFound ResolutionFailed]

Appears in: - ResolvedParameter

Field	Description
AccessDenied	FallbackReasonAccessDenied: the resolving identity lacks RBAC for the source — typically a missing RoleBinding.
SourceNotFound	FallbackReasonSourceNotFound: the referenced source does not exist.
ResolutionFailed	FallbackReasonResolutionFailed: any other maskable failure (e.g. a JSONPath that matched nothing, or a namespaceSelector matching zero namespaces).

ResourceReference

Appears in: - TemplateInstanceStatus

Field	Description	Default	Validation
apiVersion string	apiVersion of the resource (e.g., "v1", "apps/v1")		MinLength: 1 Required: {}
kind string	kind of the resource (e.g, "ConfigMap, "Deployment")		MinLength: 1 Required: {}
name string	name of the resource		MaxLength: 253 MinLength: 1 Required: {}
namespace string	namespace of the resource		MaxLength: 63 Optional: {}
observedGeneration integer	observedGeneration is the metadata.generation of this resource at the time it was last successfully applied by the controller.		Optional: {}
status ResourceReferenceStatus	status indicates the health of this resource. Empty means successfully applied.		Enum: [ Failed] Optional: {}

ResourceReferenceStatus

Underlying type: string

ResourceReferenceStatus indicates the health of a rendered resource.

Validation: - Enum: [ Failed]

Appears in: - ResourceReference

Field	Description
``
Failed

ResolvedTemplateRef

ResolvedTemplateRef shows the exact Template used for rendering, including its namespace and generation.

Appears in: - TemplateInstanceStatus

Field	Description	Default	Validation
name string	Name of the Template resource
namespace string	Namespace where the Template resource is located
generation integer	Generation of the Template which increments on spec changes