← Back to index Esc
Kind
ClusterRepository
Group
kopiur.home-operations.com
Version
v1alpha1
apiVersion: kopiur.home-operations.com/v1alpha1 kind: ClusterRepository metadata: name: example
Tip: use .spec.allowedNamespaces for path-only search
View raw schema
spec object required
A cluster-scoped kopia repository referenceable from allow-listed namespaces.
allowedNamespaces object required
Which namespaces are permitted to reference this repository.
all boolean
Allow all namespaces (must be `true`).
list []string
Explicit namespace names.
selector object
Match namespaces by label.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key string required
key is the label key that the selector applies to.
operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
backend object required
Exactly one storage backend.
azure object
Azure Blob Storage.
auth object
Access credentials (Secret ref / workload identity).
secretRef object
Secret holding the backend's static access credentials (mutually exclusive with `workloadIdentity`).
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
workloadIdentity object
Use a cloud-federated ServiceAccount instead of static keys (mutually exclusive with `secretRef`).
serviceAccountName string required
Name of the `ServiceAccount` the mover pod runs as, resolved in the Job's own namespace.
container string required
Blob container holding the kopia repository.
prefix string
Blob-name prefix within the container; empty/absent means the container root.
storageAccount string
Storage-account name (when not inferred from credentials).
b2 object
Backblaze B2.
auth object
Access credentials (application key ID/key Secret); Secret-only.
secretRef object
Secret holding the backend's access credentials, read by well-known keys.
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
bucket string required
B2 bucket holding the kopia repository.
prefix string
Object-name prefix within the bucket; empty/absent means the bucket root.
filesystem object
A local filesystem path, backed by a PVC the operator mounts into the mover.
path string required
Mount path inside the mover pod where kopia writes the repository (e.g. `/repo`).
volume object
What backs `path`: a PVC or an inline NFS export; absent for a path already on the node/image.
nfs object
An inline NFS export mounted directly (no PVC).
path string required
Exported path on the NFS server (e.g. `/export/kopia` or `/mnt/eros/Media`).
server string required
NFS server hostname or IP (e.g. `nas.lan` or `expanse.internal`).
pvc object
A `PersistentVolumeClaim` mounted read-write at the repo path.
name string required
Name of the `PersistentVolumeClaim` to mount (in the mover's namespace).
gcs object
Google Cloud Storage.
auth object
Access credentials (service-account key Secret / workload identity).
secretRef object
Secret holding the backend's static access credentials (mutually exclusive with `workloadIdentity`).
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
workloadIdentity object
Use a cloud-federated ServiceAccount instead of static keys (mutually exclusive with `secretRef`).
serviceAccountName string required
Name of the `ServiceAccount` the mover pod runs as, resolved in the Job's own namespace.
bucket string required
GCS bucket holding the kopia repository.
prefix string
Object-name prefix within the bucket; empty/absent means the bucket root.
gdrive object
Google Drive via kopia's native `gdrive` provider (service-account JSON). kopia marks this provider experimental / not maintained, and a native gdrive repository is not interchangeable with an rclone-backed Drive remote.
credentialsSecretRef object
Secret holding the Google service-account JSON used to reach the folder, read by the well-known key `KOPIA_GDRIVE_CREDENTIALS`. Absent means kopia falls back to ambient credentials (`GOOGLE_APPLICATION_CREDENTIALS` or instance metadata).
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
folderId string required
Google Drive folder ID that holds the kopia repository.
rclone object
Any rclone remote (kopia shells out to `rclone`), broadening reach to providers without a native kopia backend.
configSecretRef object
Secret holding the `rclone.conf` that defines the remote referenced by `remote_path`.
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
remotePath string required
rclone path in `remote:path` form (the remote name must exist in the supplied rclone config).
startupTimeout string
How long kopia waits for its embedded `rclone serve` to come up before failing the connect, as a Go duration (e.g. `2m`). kopia's default is `15s`; raise it for slow remotes whose repository metadata/indexes load through the rclone/WebDAV bridge and take longer than the default budget.
s3 object
Amazon S3 or any S3-compatible object store (MinIO, RustFS, Ceph RGW, …).
auth object
Access credentials (Secret ref / workload identity).
secretRef object
Secret holding the backend's static access credentials (mutually exclusive with `workloadIdentity`).
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
workloadIdentity object
Use a cloud-federated ServiceAccount instead of static keys (mutually exclusive with `secretRef`).
serviceAccountName string required
Name of the `ServiceAccount` the mover pod runs as, resolved in the Job's own namespace.
bucket string required
Bucket holding the kopia repository.
endpoint string
S3 endpoint host. Omit for AWS; set it for MinIO/RustFS/other S3-compatible stores.
prefix string
Key prefix under the bucket, letting several repositories share one bucket (e.g. `clusters/prod/`). Empty/absent means the bucket root.
region string
S3 region. Required by AWS and some compatible providers.
tls object
TLS overrides for self-signed CAs or HTTP-only endpoints.
caBundleRef object
CA bundle (PEM) used to verify the endpoint's certificate, sourced from a `ConfigMap`.
configMapName string
Name of the `ConfigMap` holding the value (e.g. a CA bundle). Resolved in the referrer's namespace for a namespaced `Repository`, and in the operator's namespace (`KOPIUR_NAMESPACE`) for a `ClusterRepository` (cluster-scoped, no namespace of its own).
key string
Which key inside the `ConfigMap` to read; defaults to `ca.crt` when unset.
disableTls boolean
Disable TLS entirely and talk plain HTTP; maps to kopia's `--disable-tls`.
insecureSkipVerify boolean
Skip TLS certificate verification (still uses TLS); maps to kopia's `--disable-tls-verification`.
sftp object
SFTP server.
auth object
Credentials (SSH private key / known-hosts) sourced from a Secret; Secret-only.
secretRef object
Secret holding the backend's access credentials, read by well-known keys.
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
host string required
SFTP server hostname or IP.
path string required
Remote path on the server that holds the kopia repository.
port integer
TCP port; defaults to 22 when absent.
format: uint16
minimum: 0
maximum: 65535
username string
SSH username to connect as.
webDav object
WebDAV endpoint.
auth object
HTTP basic-auth credentials sourced from a Secret; Secret-only.
secretRef object
Secret holding the backend's access credentials, read by well-known keys.
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
url string required
WebDAV collection URL holding the kopia repository.
bootstrap object
Tuning for the bootstrap/discovery mover Job (`<name>-discovery`) that connects/creates an object-store repository the operator cannot reach in-process (and re-runs for catalog re-scans).
failurePolicy object
Failure policy for the bootstrap Job. `activeDeadlineSeconds` caps how long a connect may run before the Job is marked failed (default 120s); raise it for a slow backend — e.g. an rclone remote whose repository metadata and indexes load through kopia's embedded `rclone serve`/WebDAV bridge, or a large repository whose cold-cache connect outgrows the default. The value is a BASE, not a ceiling: after consecutive deadline-killed attempts the operator escalates the effective deadline itself (doubling per attempt, up to 30 minutes or the configured value, whichever is larger — never below it), so a slow-but-alive backend self-heals without a spec edit. `backoffLimit` bounds retries. `podStartupDeadlineSeconds` is accepted for shape parity but is not honored by the bootstrap Job.
activeDeadlineSeconds integer
Mover `Job.spec.activeDeadlineSeconds` — wall-clock cap after which a running run is killed.
format: int64
backoffLimit integer
Mover `Job.spec.backoffLimit` — retries before a failed run is marked failed.
format: int32
podStartupDeadlineSeconds integer
Seconds a non-starting (wedged) mover pod may sit before the run is failed; default 300s.
format: int64
catalog object
Bounds materialization of `origin: discovered` `Snapshot` CRs from the kopia catalog.
adoption string
Whether a discovered snapshot whose resolved identity matches a live `SnapshotPolicy` is automatically adopted — re-attached (stamped with that policy's config label, `status.origin` flipped to `Adopted`) so GFS retention governs it and eventually prunes it, instead of it sitting in the catalog forever as an immortal `discovered` row.
enum: Adopt, Ignore
fallbackNamespace string
Where to materialize discovered `Snapshot`s with no allowed-namespace mapping (ClusterRepository only).
foreignSnapshots string
How catalog discovery treats snapshots written by ANOTHER cluster. `status.catalog.foreignSnapshotCount` counts an identity hostname carrying a different `.<cluster>` suffix ALWAYS, under either value below, plus — under `Ignore` only — a bare hostname naming no allowed namespace here. Under `Fallback`, that same disallowed bare host is NOT counted foreign: it materializes into `catalog.fallbackNamespace` exactly like a disallowed `OwnCluster` host would, so it is placed rather than dropped-and-counted (see `classify_hostname`/`decide_cluster_placement`). Meaningful only when `identityDefaults.cluster` is set: without a cluster identity there is no notion of "foreign" and the legacy hostname-names-a-namespace placement applies (validators enforce this).
enum: Ignore, Fallback
periodicRefresh boolean
Opt-in: periodically re-scan the repository to keep discovered `Snapshot` CRs current (re-list snapshots; for object-store / volume-backed repos this recycles the `<name>-discovery` mover Job every `refreshInterval`). **Off by default** — the repository still bootstraps once, re-bootstraps on a spec change, and re-probes on a backup failure, but does not re-run on a timer. Enable it if you rely on discovered snapshots reflecting changes made outside this operator.
refreshInterval string
How often to re-scan when `periodicRefresh: true` (Go-style duration; minimum `30s`, default `1h`). Inert unless `periodicRefresh` is enabled.
retain object
How many discovered `Snapshot` CRs to keep materialized (bounds etcd footprint).
maxAgeDays integer
Expire discovered `Snapshot` CRs older than this many days (minimum 1); kopia snapshots untouched.
format: int64
perIdentity integer
Keep the most-recent N discovered `Snapshot` CRs per identity; `0` disables materialization.
format: int64
concurrency object
Concurrency limits for mover Jobs against this repository (absent = unlimited).
maxConcurrentJobs integer
Ceiling on how many of this repository's mover Jobs may be in flight at once. Backup snapshots, restores, and replication runs that READ FROM this repository all draw from ONE pool — a repository's backend (and the bandwidth to it) is the shared resource, so splitting the budget per work kind would let three "safe" limits still saturate it. Restores are **always admitted** and never parked: a restore is a recovery in progress, and holding one behind a queue of routine backups is exactly backwards. An in-flight restore still COUNTS toward the pool, so it displaces backups rather than adding to them. Excluded from the pool entirely: maintenance (already single-flight per repository), verification, pin, and snapshot-delete batch Jobs. These are operator-driven housekeeping that must not be starved by a saturated backup pool. Absent or `0` means unlimited — the default, and today's behavior. No schema `default:` is emitted for this field (api-conventions §4a): absent and `0` are the SAME state (unlimited), so a materialized default would stamp `{maxConcurrentJobs: 0}` onto every stored repository — GitOps diff noise for a value that changes nothing.
format: uint32
minimum: 0
create object
What to do when the repository does not yet exist (absent means it must already exist).
ecc object
Reed-Solomon ECC parity for a freshly-created repository (creation-time only, immutable after).
algorithm string
ECC algorithm, e.g. `REED-SOLOMON-CRC32` (`--ecc`).
overheadPercent integer
Parity overhead as a percentage (`--ecc-overhead-percent`).
format: int64
enabled boolean
Create the repository if it does not exist yet — on by default. Repository create/connect is idempotent: pointing `create` at an already-initialized repository just connects to it (it never re-creates or clobbers), so the only effect of the default is that a genuinely-absent repository is bootstrapped instead of erroring. Set `false` for a strictly read-only or externally-managed repository the operator must never create.
encryption string
kopia encryption algorithm for a freshly-created repository (creation-time only).
hash string
kopia content hash algorithm for a freshly-created repository (creation-time only).
splitter string
kopia object splitter for a freshly-created repository (creation-time only).
credentialProjection object
Repository-owner gate for projecting credential Secrets into a foreign consumer namespace.
allowed boolean
When `true`, the owner permits projecting this repository's credential Secret(s) into a consumer namespace.
deletionProtection object
Mass-deletion circuit breaker for this repository's Snapshots.
threshold integer
Pending EXTERNAL destructive Snapshot deletions (deletionTimestamp set, effective deletionPolicy Delete, not operator-pruned) that trip the breaker for this repository: at or above this, those deletions are HELD (finalizers wait) until acknowledged via the `kopiur.home-operations.com/allow-mass-deletion` annotation. `0` disables the breaker. Default 10.
format: uint32
minimum: 0
encryption object required
Repository password (a Secret reference that must carry an explicit `namespace`).
passwordSecretRef object required
Repository password, always a Secret reference (never inline).
key string
Which key inside the `Secret` to read.
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
health object
Repository health thresholds (tunes the index-blob-count warning).
indexBlobWarnThreshold integer
Index-blob count above which the reconciler raises the `IndexBlobHealth` warning (`0` disables).
format: int64
probe object
Periodic backend health probe (on by default): re-connect the repository on a timer to confirm the kopia repository still exists at the backend. With the default `onFailure: Degrade` it doubles as the repository circuit breaker — see `probe.onFailure`. Disable with `probe.enabled: false`.
enabled boolean
Whether the probe runs (default `true`). `false` disables probing — and with it the circuit breaker, since the probe is its only sensor: a wiped or unreachable backend then goes unnoticed until the next backup fails.
failureThreshold integer
How many *consecutive* failing probes to require before the failure is acted on (default `3`): the loud `BackendReachable=False` condition + event fire, and — under `onFailure: Degrade` — the repository moves to `Degraded`. Debounces a single transient blip from alarming, tripping the breaker, or nudging a destructive manual recreate. Any success resets it.
format: int64
interval string
How often to re-probe the backend (Go-style duration like `30m` or `1h`; minimum `30s`, default `30m`). Inert when `enabled: false`.
onFailure string
What sustained backend-probe failure (past `failureThreshold`) does to the repository (default `Degrade`). `Degrade` moves it to `Degraded`, pausing backups and replication until a re-connect succeeds — recovery is automatic (maintenance also pauses for a confirmed-unreachable/vanished backend, but keeps running for a probe deadline kill, where index compaction is often the cure). `Alert` keeps the repository `Ready` and only raises the `BackendReachable` condition + Warning event + metric; backups keep running against the failing backend. Neither ever auto-recreates.
enum: Degrade, Alert
identityDefaults object
Identity defaults (CEL `*Expr`) applied when consumers don't override.
cluster string
This cluster's identity suffix for repositories shared across clusters (an RFC 1123 label, at most 32 characters; dots are rejected — the first `.` in a hostname is the namespace/cluster delimiter). When set, the default kopia identity hostname becomes `<namespace>.<cluster>` instead of `<namespace>`, so two clusters backing up same-named namespaces write distinct identities (and one cluster's retention prune can no longer touch the other's snapshots). Also exposed to `hostnameExpr`/ `usernameExpr` as the CEL variable `cluster`.
hostnameExpr string
CEL expression for the kopia identity hostname (e.g. `"namespace"`).
usernameExpr string
CEL expression for the kopia identity username (e.g. `"namespace + '-' + policyName"`).
maintenance object
Maintenance control; `maintenance.namespace` selects where the owned `Maintenance` CR lands.
enabled boolean
Whether the operator manages a `Maintenance` CR for this repository (default `true`).
failurePolicy object
Failure handling (backoff/deadline) for the managed `Maintenance` run.
activeDeadlineSeconds integer
Mover `Job.spec.activeDeadlineSeconds` — wall-clock cap after which a running run is killed.
format: int64
backoffLimit integer
Mover `Job.spec.backoffLimit` — retries before a failed run is marked failed.
format: int32
podStartupDeadlineSeconds integer
Seconds a non-starting (wedged) mover pod may sit before the run is failed; default 300s.
format: int64
mover object
Mover overrides for the managed `Maintenance`.
cache object
Override the repository's [`CacheDefaults`] for this recipe's movers.
capacity string
Size of the PVC backing the mover's kopia cache (e.g. `10Gi`).
contentCacheSizeMb integer
kopia content cache budget in MiB (`--content-cache-size-mb`).
format: int64
metadataCacheSizeMb integer
kopia metadata cache budget in MiB (`--metadata-cache-size-mb`).
format: int64
mode string
How a mover's kopia cache volume is provisioned.
enum: Ephemeral, Persistent
storageClassName string
StorageClass for the cache PVC; absent uses the cluster default.
inheritSecurityContextFrom object
Copy the UID/GID security context from a live workload rather than hard-coding it. Requires the workload to pin `runAsUser` (container or pod level): a UID that comes from the container image's `USER` line is invisible in the pod spec and cannot be inherited — the mover would silently run as its own image's UID instead. May be combined with `securityContext`/`podSecurityContext`, which override it field-wise and act as the fallback when no workload pod can be resolved.
pvcConsumer object
Backup sources only: auto-derive the workload from the PVC this snapshot backs up.
container string
Which container within the matched consumer pod to inherit from; absent uses the first/only.
snapshot object
Restores only: inherit the identity RECORDED on the backup itself (`Snapshot.status.recorded`, decoded from the `kopiur-meta` kopia tag) — uid/gid/fsGroup the backup mover actually ran as. Needs no live workload pod, so it works on a rebuilt cluster and with `target.populator`. Rejected at admission on SnapshotPolicy/Maintenance (backups read the live workload; maintenance has no snapshot). Write it as `snapshot: {}` (an empty sub-object) — a bare `snapshot:` is null and rejected.
workloadSelector object
Inherit from workload pod(s) matched by an explicit label selector (backup or restore).
container string
Which container within the matched pod; absent uses the first/only container.
podSelector object required
Label selector matching the workload pod(s) to read context/hooks from.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key string required
key is the label key that the selector applies to.
operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
podSecurityContext object
Pod security context for the mover (notably `fsGroup` for group-writable restore volumes). Same layering as `securityContext`: highest layer, merged field-wise, and combinable with `inheritSecurityContextFrom`.
appArmorProfile object
appArmorProfile is the AppArmor options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows.
localhostProfile string
localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is "Localhost".
type string required
type indicates which kind of AppArmor profile will be applied. Valid options are: Localhost - a profile pre-loaded on the node. RuntimeDefault - the container runtime's default profile. Unconfined - no AppArmor enforcement.
fsGroup integer
A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod: 1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw---- If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows.
format: int64
fsGroupChangePolicy string
fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. Note that this field cannot be set when spec.os.name is windows.
runAsGroup integer
The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.
format: int64
runAsNonRoot boolean
Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
runAsUser integer
The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.
format: int64
seLinuxChangePolicy string
seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod. It has no effect on nodes that do not support SELinux or to volumes does not support SELinux. Valid values are "MountOption" and "Recursive". "Recursive" means relabeling of all files on all Pod volumes by the container runtime. This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node. "MountOption" mounts all eligible Pod volumes with `-o context` mount option. This requires all Pods that share the same volume to use the same SELinux label. It is not possible to share the same volume among privileged and unprivileged Pods. Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. "MountOption" value is allowed only when SELinuxMount feature gate is enabled. If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes and "Recursive" for all other volumes. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state. Note that this field cannot be set when spec.os.name is windows.
seLinuxOptions object
The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.
level string
Level is SELinux level label that applies to the container.
role string
Role is a SELinux role label that applies to the container.
type string
Type is a SELinux type label that applies to the container.
user string
User is a SELinux user label that applies to the container.
seccompProfile object
The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows.
localhostProfile string
localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
type string required
type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
supplementalGroups []integer
A list of groups applied to the first process run in each container, in addition to the container's primary GID and fsGroup (if specified). If the SupplementalGroupsPolicy feature is enabled, the supplementalGroupsPolicy field determines whether these are in addition to or instead of any group memberships defined in the container image. If unspecified, no additional groups are added, though group memberships defined in the container image may still be used, depending on the supplementalGroupsPolicy field. Note that this field cannot be set when spec.os.name is windows.
supplementalGroupsPolicy string
Defines how supplemental groups of the first container processes are calculated. Valid values are "Merge" and "Strict". If not specified, "Merge" is used. (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled and the container runtime must implement support for this feature. Note that this field cannot be set when spec.os.name is windows.
sysctls []object
Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows.
name string required
Name of a property to set
value string required
Value of a property to set
windowsOptions object
The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
gmsaCredentialSpec string
GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field.
gmsaCredentialSpecName string
GMSACredentialSpecName is the name of the GMSA credential spec to use.
hostProcess boolean
HostProcess determines if a container should be run as a 'Host Process' container. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true.
runAsUserName string
The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
privilegedMode boolean
Opt-in, namespace-gated privileged mode; preserves UID/GID on restore.
resources object
Resource requests/limits for the mover container.
claims []object
Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers.
name string required
Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.
request string
Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.
limits object
Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
requests object
Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
securityContext object
Container security context for the mover; merged field-wise over the hardened base, `moverDefaults`, and any inherited context — this is the highest layer, so every field set here wins. Combines with `inheritSecurityContextFrom`: fields you set override the workload's, fields you omit are inherited, and this context stands in alone when inheritance cannot resolve a pod.
allowPrivilegeEscalation boolean
AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.
appArmorProfile object
appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows.
localhostProfile string
localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is "Localhost".
type string required
type indicates which kind of AppArmor profile will be applied. Valid options are: Localhost - a profile pre-loaded on the node. RuntimeDefault - the container runtime's default profile. Unconfined - no AppArmor enforcement.
capabilities object
The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows.
add []string
Added capabilities
drop []string
Removed capabilities
privileged boolean
Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows.
procMount string
procMount denotes the type of proc mount to use for the containers. The default value is Default which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows.
readOnlyRootFilesystem boolean
Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows.
runAsGroup integer
The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
format: int64
runAsNonRoot boolean
Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
runAsUser integer
The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
format: int64
seLinuxOptions object
The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
level string
Level is SELinux level label that applies to the container.
role string
Role is a SELinux role label that applies to the container.
type string
Type is a SELinux type label that applies to the container.
user string
User is a SELinux user label that applies to the container.
seccompProfile object
The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows.
localhostProfile string
localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
type string required
type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
windowsOptions object
The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
gmsaCredentialSpec string
GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field.
gmsaCredentialSpecName string
GMSACredentialSpecName is the name of the GMSA credential spec to use.
hostProcess boolean
HostProcess determines if a container should be run as a 'Host Process' container. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true.
runAsUserName string
The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
ttlSecondsAfterFinished integer
Per-recipe override of `Job.spec.ttlSecondsAfterFinished` so finished Jobs self-GC.
format: int64
namespace string
ClusterRepository only: namespace the managed `Maintenance` CR is created in (default the operator's namespace).
schedule object
Schedule override; absent uses the default quick-6h / full-daily schedule.
full object required
Cron and jitter for `kopia maintenance run --full` (content reclamation).
cron string required
The cron expression, parsed by `croner`; may contain an `H` placeholder for deterministic jitter.
jitter string
Optional deterministic jitter window as a Go-style duration string (e.g. `30m`).
timezone string
IANA timezone the cron is evaluated in (e.g. `America/Chicago`); absent uses the enclosing schedule's timezone, else the controller default (UTC).
quick object required
Cron and jitter for `kopia maintenance run` (quick, cheap index/log work).
cron string required
The cron expression, parsed by `croner`; may contain an `H` placeholder for deterministic jitter.
jitter string
Optional deterministic jitter window as a Go-style duration string (e.g. `30m`).
timezone string
IANA timezone the cron is evaluated in (e.g. `America/Chicago`); absent uses the enclosing schedule's timezone, else the controller default (UTC).
timezone string
IANA timezone both crons are evaluated in; absent means the controller default.
takeoverPolicy string
What to do when another owner already holds the lease. Defaults to `Never` (the safest: never seize a lease another owner holds).
enum: Never, PromptCondition, Force
mode string
Access mode: `ReadWrite` (default) or `ReadOnly` (serves restores only).
enum: ReadWrite, ReadOnly
moverDefaults object
Base mover configuration inherited by every mover this repository spawns.
affinity object
Pod affinity for every mover.
nodeAffinity object
Describes node affinity scheduling rules for the pod.
preferredDuringSchedulingIgnoredDuringExecution []object
The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.
preference object required
A node selector term, associated with the corresponding weight.
matchExpressions []object
A list of node selector requirements by node's labels.
key string required
The label key that the selector applies to.
operator string required
Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
values []string
An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
matchFields []object
A list of node selector requirements by node's fields.
key string required
The label key that the selector applies to.
operator string required
Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
values []string
An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
weight integer required
Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
format: int32
requiredDuringSchedulingIgnoredDuringExecution object
If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.
nodeSelectorTerms []object required
Required. A list of node selector terms. The terms are ORed.
matchExpressions []object
A list of node selector requirements by node's labels.
key string required
The label key that the selector applies to.
operator string required
Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
values []string
An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
matchFields []object
A list of node selector requirements by node's fields.
key string required
The label key that the selector applies to.
operator string required
Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
values []string
An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
podAffinity object
Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
preferredDuringSchedulingIgnoredDuringExecution []object
The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
podAffinityTerm object required
Required. A pod affinity term, associated with the corresponding weight.
labelSelector object
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key string required
key is the label key that the selector applies to.
operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
matchLabelKeys []string
MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.
mismatchLabelKeys []string
MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
namespaceSelector object
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key string required
key is the label key that the selector applies to.
operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
namespaces []string
namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
topologyKey string required
This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
weight integer required
weight associated with matching the corresponding podAffinityTerm, in the range 1-100.
format: int32
requiredDuringSchedulingIgnoredDuringExecution []object
If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
labelSelector object
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key string required
key is the label key that the selector applies to.
operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
matchLabelKeys []string
MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.
mismatchLabelKeys []string
MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
namespaceSelector object
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key string required
key is the label key that the selector applies to.
operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
namespaces []string
namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
topologyKey string required
This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
podAntiAffinity object
Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
preferredDuringSchedulingIgnoredDuringExecution []object
The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
podAffinityTerm object required
Required. A pod affinity term, associated with the corresponding weight.
labelSelector object
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key string required
key is the label key that the selector applies to.
operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
matchLabelKeys []string
MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.
mismatchLabelKeys []string
MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
namespaceSelector object
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key string required
key is the label key that the selector applies to.
operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
namespaces []string
namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
topologyKey string required
This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
weight integer required
weight associated with matching the corresponding podAffinityTerm, in the range 1-100.
format: int32
requiredDuringSchedulingIgnoredDuringExecution []object
If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
labelSelector object
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key string required
key is the label key that the selector applies to.
operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
matchLabelKeys []string
MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.
mismatchLabelKeys []string
MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
namespaceSelector object
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key string required
key is the label key that the selector applies to.
operator string required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values []string
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
namespaces []string
namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
topologyKey string required
This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
cache object
kopia cache defaults for every mover.
capacity string
Size of the PVC backing the mover's kopia cache (e.g. `10Gi`).
contentCacheSizeMb integer
kopia content cache budget in MiB (`--content-cache-size-mb`).
format: int64
metadataCacheSizeMb integer
kopia metadata cache budget in MiB (`--metadata-cache-size-mb`).
format: int64
mode string
How a mover's kopia cache volume is provisioned.
enum: Ephemeral, Persistent
storageClassName string
StorageClass for the cache PVC; absent uses the cluster default.
nodeSelector object
Pod `nodeSelector` for every mover.
podAnnotations object
Extra annotations for every mover pod. Unlike `podLabels` these are **pod-template-only** — they are not mirrored onto the `Job` object, because the common case is a sidecar-injection opt-out (`sidecar.istio.io/inject: "false"`, `linkerd.io/inject: disabled`, `vault.hashicorp.com/agent-inject: "false"`) that only means anything on the pod a mesh webhook actually sees. A mover is a short-lived batch pod; an injected sidecar that never exits keeps its Job running forever. Same reserved keys as `podLabels`, rejected at admission.
podLabels object
Extra labels for every mover POD (and the `Job` that owns it), merged UNDER kopiur's own labels — a key kopiur sets always wins, so a user-supplied value can never break the selectors the controller counts and reaps by. This is the hook for cluster machinery that keys off pod labels and that kopiur has no field of its own for: a Kueue `kueue.x-k8s.io/queue-name` to put movers under a cluster queue, a monitoring/`NetworkPolicy` selector, a service-mesh exclusion label. Keys under `kopiur.home-operations.com/` and the exact key `app.kubernetes.io/managed-by` are reserved and rejected at admission.
podSecurityContext object
Pod security-context base (notably `fsGroup`) for every mover.
appArmorProfile object
appArmorProfile is the AppArmor options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows.
localhostProfile string
localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is "Localhost".
type string required
type indicates which kind of AppArmor profile will be applied. Valid options are: Localhost - a profile pre-loaded on the node. RuntimeDefault - the container runtime's default profile. Unconfined - no AppArmor enforcement.
fsGroup integer
A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod: 1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw---- If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows.
format: int64
fsGroupChangePolicy string
fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. Note that this field cannot be set when spec.os.name is windows.
runAsGroup integer
The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.
format: int64
runAsNonRoot boolean
Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
runAsUser integer
The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.
format: int64
seLinuxChangePolicy string
seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod. It has no effect on nodes that do not support SELinux or to volumes does not support SELinux. Valid values are "MountOption" and "Recursive". "Recursive" means relabeling of all files on all Pod volumes by the container runtime. This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node. "MountOption" mounts all eligible Pod volumes with `-o context` mount option. This requires all Pods that share the same volume to use the same SELinux label. It is not possible to share the same volume among privileged and unprivileged Pods. Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. "MountOption" value is allowed only when SELinuxMount feature gate is enabled. If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes and "Recursive" for all other volumes. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state. Note that this field cannot be set when spec.os.name is windows.
seLinuxOptions object
The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.
level string
Level is SELinux level label that applies to the container.
role string
Role is a SELinux role label that applies to the container.
type string
Type is a SELinux type label that applies to the container.
user string
User is a SELinux user label that applies to the container.
seccompProfile object
The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows.
localhostProfile string
localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
type string required
type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
supplementalGroups []integer
A list of groups applied to the first process run in each container, in addition to the container's primary GID and fsGroup (if specified). If the SupplementalGroupsPolicy feature is enabled, the supplementalGroupsPolicy field determines whether these are in addition to or instead of any group memberships defined in the container image. If unspecified, no additional groups are added, though group memberships defined in the container image may still be used, depending on the supplementalGroupsPolicy field. Note that this field cannot be set when spec.os.name is windows.
supplementalGroupsPolicy string
Defines how supplemental groups of the first container processes are calculated. Valid values are "Merge" and "Strict". If not specified, "Merge" is used. (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled and the container runtime must implement support for this feature. Note that this field cannot be set when spec.os.name is windows.
sysctls []object
Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows.
name string required
Name of a property to set
value string required
Value of a property to set
windowsOptions object
The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
gmsaCredentialSpec string
GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field.
gmsaCredentialSpecName string
GMSACredentialSpecName is the name of the GMSA credential spec to use.
hostProcess boolean
HostProcess determines if a container should be run as a 'Host Process' container. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true.
runAsUserName string
The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
resources object
Resource requests/limits base for the mover container.
claims []object
Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers.
name string required
Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.
request string
Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.
limits object
Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
requests object
Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
scratch object
Defaults for the deep-verification scratch (restore-test) volume.
capacity string
Size of the ephemeral scratch PVC (e.g. `100Gi`); absent falls back to an `emptyDir`.
storageClassName string
StorageClass for the ephemeral scratch PVC; only applies when `capacity` is set.
securityContext object
Container security-context base for every mover.
allowPrivilegeEscalation boolean
AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.
appArmorProfile object
appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows.
localhostProfile string
localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is "Localhost".
type string required
type indicates which kind of AppArmor profile will be applied. Valid options are: Localhost - a profile pre-loaded on the node. RuntimeDefault - the container runtime's default profile. Unconfined - no AppArmor enforcement.
capabilities object
The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows.
add []string
Added capabilities
drop []string
Removed capabilities
privileged boolean
Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows.
procMount string
procMount denotes the type of proc mount to use for the containers. The default value is Default which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows.
readOnlyRootFilesystem boolean
Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows.
runAsGroup integer
The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
format: int64
runAsNonRoot boolean
Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
runAsUser integer
The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
format: int64
seLinuxOptions object
The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
level string
Level is SELinux level label that applies to the container.
role string
Role is a SELinux role label that applies to the container.
type string
Type is a SELinux type label that applies to the container.
user string
User is a SELinux user label that applies to the container.
seccompProfile object
The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows.
localhostProfile string
localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
type string required
type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
windowsOptions object
The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
gmsaCredentialSpec string
GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field.
gmsaCredentialSpecName string
GMSACredentialSpecName is the name of the GMSA credential spec to use.
hostProcess boolean
HostProcess determines if a container should be run as a 'Host Process' container. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true.
runAsUserName string
The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
sourceColocation object
How a mover co-locates with its RWO PVC's node; defaults to [`SourceColocationMode::Auto`].
mode string
How the mover co-locates with the node an RWO source/destination PVC is attached to.
enum: Auto, Required, Disabled
throttle object
Repository throttle limits applied by every mover after it connects.
downloadBytesPerSecond integer
Cap download throughput in bytes/sec (`--download-bytes-per-second`).
format: int64
readOpsPerSecond integer
Cap read/list ops/sec (`--read-requests-per-second`).
format: int64
uploadBytesPerSecond integer
Cap upload throughput in bytes/sec (`--upload-bytes-per-second`).
format: int64
writeOpsPerSecond integer
Cap write ops/sec (`--write-requests-per-second`).
format: int64
tolerations []object
Pod tolerations for every mover.
effect string
Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
key string
Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.
operator string
Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.
tolerationSeconds integer
TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.
format: int64
value string
Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.
ttlSecondsAfterFinished integer
`Job.spec.ttlSecondsAfterFinished` for every mover Job so finished Jobs self-GC.
format: int64
onNamespaceDelete string
What happens to this repository's snapshots when a consuming namespace is deleted.
enum: Orphan, Delete
parameters object
Mutable kopia repository parameters, re-applied on bootstrap whenever they drift.
blobRetention object
Object-lock blob retention (S3/Azure/GCS) — ransomware protection. Absent means "don't touch it"; use `disabled: true` to actively turn it off.
compliance object
`COMPLIANCE` — **nobody can shorten or remove the lock before it expires**, including the account root. An oversized period is an unfixable storage-cost commitment; there is no recovery path short of deleting the bucket after expiry.
period string required
Go-style duration; kopia's minimum is `24h` and there is no maximum. Accepts `h`/`m`/`s` (or a bare number of seconds) — **not `d`**. Note that kopia's own CLI *does* take `30d`, so a period copied from kopia's documentation is rejected here; write 30 days as `720h`. Kopiur deliberately keeps one duration grammar across every CRD field rather than matching kopia's per-flag variations.
disabled boolean
Actively disable retention (`--retention-mode=none`). Must be `true`. A `bool` rather than a unit variant because an externally-tagged unit variant serializes as the bare string `"Disabled"`, mixing string and object forms in one `oneOf` and breaking the structural schema. Same shape, and same reason, as [`crate::cluster_repository::AllowedNamespaces::All`]. This is distinct from omitting `blobRetention` entirely: absent means "leave the repository alone", so deleting the block from a manifest can never silently strip ransomware protection someone configured deliberately.
governance object
`GOVERNANCE` — locked against ordinary deletes, but a sufficiently privileged identity can still shorten or remove the lock. The safe default for most clusters.
period string required
Go-style duration; kopia's minimum is `24h` and there is no maximum. Accepts `h`/`m`/`s` (or a bare number of seconds) — **not `d`**. Note that kopia's own CLI *does* take `30d`, so a period copied from kopia's documentation is rejected here; write 30 days as `720h`. Kopiur deliberately keeps one duration grammar across every CRD field rather than matching kopia's per-flag variations.
epoch object
Epoch-manager tuning — how fast kopia closes epochs and therefore how fast index blobs get compacted.
advanceOnCount integer
Index blobs in an epoch that trigger an advance, once older than `minDuration` (kopia default `20`).
format: int64
advanceOnSizeMiB integer
Total index size in an epoch that triggers an advance, once older than `minDuration` (kopia default `10` MiB). Named `MiB`, not `MB`, with an explicit rename rather than the derived camelCase (`advanceOnSizeMb`, which reads as *megabit*). The unit is genuinely mebibytes — kopia's `--epoch-advance-on-size-mb` multiplies by 1048576, so `10` is 10485760 bytes — even though kopia's own log renders the result as "MB". That ambiguity is this field's main hazard; the API surface should not reproduce it.
format: int64
checkpointFrequency integer
Epochs between full index checkpoints (kopia default `7`).
format: int64
deleteParallelism integer
Parallelism for epoch cleanup deletions (kopia default `4`).
format: int64
minDuration string
Minimum epoch age before it may advance (kopia default `24h`). A Go-style duration (`6h`, `90m`). The advance **gate** — no blob count closes an epoch younger than this.
refreshFrequency string
How often clients re-read epoch state (kopia default `20m`). Go-style duration.
scheduleDefaults object
Scheduling defaults (`timezone`, `jitter`) inherited by consumers that don't set their own equivalent field — backup, verification, replication, and maintenance schedules; set once here instead of repeating it on every cron.
jitter string
Deterministic jitter window (Go-style duration, e.g. `10m`) applied to every consuming cron that doesn't set its own `jitter` — `SnapshotSchedule`, `Maintenance` (quick and full), `SnapshotPolicy` verification (quick and deep), and both replication kinds. Set once here instead of repeating it on every cron, so a whole repository's schedules spread their load off the top-of-the-hour thundering herd. The spread is deterministic per `(scheduleUID, slot)`, not random: the same slot always lands on the same instant, so a restart never re-rolls it. Capped at 24h by validation — jitter is a spread WITHIN a cron period, not a schedule offset.
timezone string
IANA timezone name applied to every consuming cron that doesn't set its own `timezone` (e.g. `America/New_York`). Set once here instead of repeating it on every `SnapshotPolicy.verification`, `RepositoryReplication.schedule`, and `Maintenance.schedule` cron.
seed object
Initialize this repository from an existing replica on its FIRST bootstrap (issue #380) — a disaster-recovery entry point. Armed only while the repository has never been initialized (`status.uniqueId` unset) **and** the mover's connect reports the backend uninitialized; on an already-initialized repository it is a documented no-op (`Seeded=True`, reason `AlreadyInitialized`), so it is safe to leave standing in a GitOps manifest. When armed it also replaces `spec.create`'s fallback: the repository is seeded or the bootstrap fails, never silently created empty.
allowEmptySource boolean
Accept a source that holds zero snapshots (default `false`). A mirror that answers but is empty is almost always a mis-pointed bucket/prefix, and silently seeding nothing would hand you a `Ready` repository with no history — the failure mode #380 is about. By default the bootstrap fails loudly and retries; set this when an empty source is genuinely expected (e.g. re-homing a repository whose history was deliberately pruned to nothing).
credentialProjection object
Opt-in projection of the SOURCE repository's credential Secrets into the seeding mover Job's namespace. **Migrate mode only in practice** — a blob-mode source's credentials must already be in the namespace the bootstrap Job runs in (this CR's own namespace for a `Repository`; for a `ClusterRepository` the operator's namespace, unless `encryption.passwordSecretRef.namespace` pins another, in which case the Job runs there). Requires the operator's `features.credentialProjection` install flag.
enabled boolean
Copy the repository's credential Secret(s) into the namespace of each mover Job; off by default.
failurePolicy object
Deadline/backoff for the **seeding** bootstrap Job. An absent `activeDeadlineSeconds` means **24h** here, rather than the 120s a routine connect gets — a seed copies a whole repository, once. Only applied while the seed is armed; later connects to the now-initialized repository use `spec.bootstrap.failurePolicy` as before.
activeDeadlineSeconds integer
Mover `Job.spec.activeDeadlineSeconds` — wall-clock cap after which a running run is killed.
format: int64
backoffLimit integer
Mover `Job.spec.backoffLimit` — retries before a failed run is marked failed.
format: int32
podStartupDeadlineSeconds integer
Seconds a non-starting (wedged) mover pod may sit before the run is failed; default 300s.
format: int64
from object required
Where the seed data comes from: exactly one of a bare storage backend (blob mode) or another repository CR (migrate mode).
backend object
A bare storage backend holding a byte-for-byte mirror of a kopia repository (blob mode, `kopia repository sync-to`). The mirror's format and encryption password are inherited verbatim, so this repository's `encryption.passwordSecretRef` must already hold the MIRROR's password and `spec.create`'s format knobs are refused as inert.
azure object
Azure Blob Storage.
auth object
Access credentials (Secret ref / workload identity).
secretRef object
Secret holding the backend's static access credentials (mutually exclusive with `workloadIdentity`).
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
workloadIdentity object
Use a cloud-federated ServiceAccount instead of static keys (mutually exclusive with `secretRef`).
serviceAccountName string required
Name of the `ServiceAccount` the mover pod runs as, resolved in the Job's own namespace.
container string required
Blob container holding the kopia repository.
prefix string
Blob-name prefix within the container; empty/absent means the container root.
storageAccount string
Storage-account name (when not inferred from credentials).
b2 object
Backblaze B2.
auth object
Access credentials (application key ID/key Secret); Secret-only.
secretRef object
Secret holding the backend's access credentials, read by well-known keys.
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
bucket string required
B2 bucket holding the kopia repository.
prefix string
Object-name prefix within the bucket; empty/absent means the bucket root.
filesystem object
A local filesystem path, backed by a PVC the operator mounts into the mover.
path string required
Mount path inside the mover pod where kopia writes the repository (e.g. `/repo`).
volume object
What backs `path`: a PVC or an inline NFS export; absent for a path already on the node/image.
nfs object
An inline NFS export mounted directly (no PVC).
path string required
Exported path on the NFS server (e.g. `/export/kopia` or `/mnt/eros/Media`).
server string required
NFS server hostname or IP (e.g. `nas.lan` or `expanse.internal`).
pvc object
A `PersistentVolumeClaim` mounted read-write at the repo path.
name string required
Name of the `PersistentVolumeClaim` to mount (in the mover's namespace).
gcs object
Google Cloud Storage.
auth object
Access credentials (service-account key Secret / workload identity).
secretRef object
Secret holding the backend's static access credentials (mutually exclusive with `workloadIdentity`).
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
workloadIdentity object
Use a cloud-federated ServiceAccount instead of static keys (mutually exclusive with `secretRef`).
serviceAccountName string required
Name of the `ServiceAccount` the mover pod runs as, resolved in the Job's own namespace.
bucket string required
GCS bucket holding the kopia repository.
prefix string
Object-name prefix within the bucket; empty/absent means the bucket root.
gdrive object
Google Drive via kopia's native `gdrive` provider (service-account JSON). kopia marks this provider experimental / not maintained, and a native gdrive repository is not interchangeable with an rclone-backed Drive remote.
credentialsSecretRef object
Secret holding the Google service-account JSON used to reach the folder, read by the well-known key `KOPIA_GDRIVE_CREDENTIALS`. Absent means kopia falls back to ambient credentials (`GOOGLE_APPLICATION_CREDENTIALS` or instance metadata).
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
folderId string required
Google Drive folder ID that holds the kopia repository.
rclone object
Any rclone remote (kopia shells out to `rclone`), broadening reach to providers without a native kopia backend.
configSecretRef object
Secret holding the `rclone.conf` that defines the remote referenced by `remote_path`.
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
remotePath string required
rclone path in `remote:path` form (the remote name must exist in the supplied rclone config).
startupTimeout string
How long kopia waits for its embedded `rclone serve` to come up before failing the connect, as a Go duration (e.g. `2m`). kopia's default is `15s`; raise it for slow remotes whose repository metadata/indexes load through the rclone/WebDAV bridge and take longer than the default budget.
s3 object
Amazon S3 or any S3-compatible object store (MinIO, RustFS, Ceph RGW, …).
auth object
Access credentials (Secret ref / workload identity).
secretRef object
Secret holding the backend's static access credentials (mutually exclusive with `workloadIdentity`).
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
workloadIdentity object
Use a cloud-federated ServiceAccount instead of static keys (mutually exclusive with `secretRef`).
serviceAccountName string required
Name of the `ServiceAccount` the mover pod runs as, resolved in the Job's own namespace.
bucket string required
Bucket holding the kopia repository.
endpoint string
S3 endpoint host. Omit for AWS; set it for MinIO/RustFS/other S3-compatible stores.
prefix string
Key prefix under the bucket, letting several repositories share one bucket (e.g. `clusters/prod/`). Empty/absent means the bucket root.
region string
S3 region. Required by AWS and some compatible providers.
tls object
TLS overrides for self-signed CAs or HTTP-only endpoints.
caBundleRef object
CA bundle (PEM) used to verify the endpoint's certificate, sourced from a `ConfigMap`.
configMapName string
Name of the `ConfigMap` holding the value (e.g. a CA bundle). Resolved in the referrer's namespace for a namespaced `Repository`, and in the operator's namespace (`KOPIUR_NAMESPACE`) for a `ClusterRepository` (cluster-scoped, no namespace of its own).
key string
Which key inside the `ConfigMap` to read; defaults to `ca.crt` when unset.
disableTls boolean
Disable TLS entirely and talk plain HTTP; maps to kopia's `--disable-tls`.
insecureSkipVerify boolean
Skip TLS certificate verification (still uses TLS); maps to kopia's `--disable-tls-verification`.
sftp object
SFTP server.
auth object
Credentials (SSH private key / known-hosts) sourced from a Secret; Secret-only.
secretRef object
Secret holding the backend's access credentials, read by well-known keys.
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
host string required
SFTP server hostname or IP.
path string required
Remote path on the server that holds the kopia repository.
port integer
TCP port; defaults to 22 when absent.
format: uint16
minimum: 0
maximum: 65535
username string
SSH username to connect as.
webDav object
WebDAV endpoint.
auth object
HTTP basic-auth credentials sourced from a Secret; Secret-only.
secretRef object
Secret holding the backend's access credentials, read by well-known keys.
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
url string required
WebDAV collection URL holding the kopia repository.
repository object
Another `Repository`/`ClusterRepository`, opened read-only (migrate mode, `kopia snapshot migrate`). Snapshot identities and times are preserved, so seeded history is restorable by `identity`/`fromPolicy`. A `kind: Repository` reference with no `namespace` resolves in the referrer's own namespace — and, on a cluster-scoped `ClusterRepository` (which has none), in the operator's namespace, the same rule its credential `secretRef`s follow. Set `namespace` explicitly whenever the source lives anywhere else.
kind string
Which repository CRD this points at; defaults to [`RepositoryKind::Repository`].
enum: Repository, ClusterRepository
name string required
Name of the referenced `Repository`/`ClusterRepository`.
namespace string
Cross-namespace `Repository` reference; ignored/forbidden for `ClusterRepository`.
migrate object
Tuning for the `kopia snapshot migrate` copy. **Migrate mode only** (`from.repository`); rejected at admission alongside `from.backend`.
latestOnly boolean
Copy only each source identity's most recent snapshot instead of its full history (`kopia snapshot migrate --latest`). Default `false` — a seed exists to recover history, so the full copy is the sane default; set this when you only need the latest restore point back quickly.
parallel integer
`--parallel`: snapshots migrated concurrently (kopia default `1` — sequential). Must be >= 1 when set.
format: uint32
minimum: 0
policies string
Whether the source's kopia **policies** are copied along with the snapshots. Defaults to `PolicyCopyMode::None` (an explicit `--no-policies`), not kopia's own copy-by-default: retention in a kopiur-managed repository is driven by `Snapshot` CRs, and importing the source's kopia-side policies could delete manifests behind the operator's back.
enum: none, copy, copyOverwrite
throttle object
Bandwidth/ops caps for THIS seed's copy, per side. A migrate seed opens two repositories under two kopia connections and `snapshot migrate` has no speed flags of its own, so each side is applied as `kopia repository throttle set` on that side's connection: * `source` caps the REPLICA — the repository named by `spec.seed.from.repository`, opened read-only — overriding **its** `moverDefaults.throttle`; * `destination` caps THIS repository, the one being seeded, overriding **its own** `moverDefaults.throttle`. Each side overrides field by field: a knob set here wins, a knob left unset keeps that repository's default. Absent: both sides use their repository's defaults. Applies only while the seed is armed — an ordinary connect to the now-initialized repository is capped by `moverDefaults.throttle` alone.
destination object
Caps for the DESTINATION (write) side, overriding the destination repository's `moverDefaults.throttle` field by field. Applied with `repository throttle set` on the destination connection the migrate writes through.
downloadBytesPerSecond integer
Cap download throughput in bytes/sec (`--download-bytes-per-second`).
format: int64
readOpsPerSecond integer
Cap read/list ops/sec (`--read-requests-per-second`).
format: int64
uploadBytesPerSecond integer
Cap upload throughput in bytes/sec (`--upload-bytes-per-second`).
format: int64
writeOpsPerSecond integer
Cap write ops/sec (`--write-requests-per-second`).
format: int64
source object
Caps for the SOURCE (read) side, overriding the source repository's `moverDefaults.throttle` field by field. Applied with `repository throttle set` on the migrate's read-only source connection — accepted there, so a read-only source is throttled like any other.
downloadBytesPerSecond integer
Cap download throughput in bytes/sec (`--download-bytes-per-second`).
format: int64
readOpsPerSecond integer
Cap read/list ops/sec (`--read-requests-per-second`).
format: int64
uploadBytesPerSecond integer
Cap upload throughput in bytes/sec (`--upload-bytes-per-second`).
format: int64
writeOpsPerSecond integer
Cap write ops/sec (`--write-requests-per-second`).
format: int64
sync object
Tuning for the `kopia repository sync-to` blob copy. **Blob mode only** (`from.backend`); rejected at admission alongside `from.repository`.
maxDownloadSpeedBytesPerSecond integer
`--max-download-speed`: cap read throughput from the seed source, in bytes/sec (kopia default: unlimited).
format: int64
maxUploadSpeedBytesPerSecond integer
`--max-upload-speed`: cap write throughput into this repository, in bytes/sec (kopia default: unlimited).
format: int64
parallel integer
`--parallel`: concurrent blob-copy workers (kopia default `1` — sequential). Raise it: a first-time seed of a large repository over a WAN is exactly the workload sequential copying is worst at.
format: uint32
minimum: 0
server object
Optional kopia web-UI server (the target `namespace` is required).
auth object
UI authentication mode; omitted ⇒ [`ServerAuth::Generate`] (never no-auth).
generate object
The operator mints random UI credentials into an owned `Secret`; the safe default.
username string
UI username to provision (default `kopia`).
insecure object
No UI authentication; requires an explicit `acknowledgeInsecure: true`.
acknowledgeInsecure boolean
Must be `true`; the webhook rejects insecure mode otherwise.
secretRef object
The user supplies UI credentials via a `Secret` (`name` + the two keys).
name string required
Name of the `Secret` holding the UI credentials.
passwordKey string required
Key within the secret holding the password.
usernameKey string required
Key within the secret holding the username.
namespace string required
Target namespace for the server Deployment/Service (and generated Secret).
podSecurityContext object
Pod-level security context for the server pod (notably `supplementalGroups` for NFS exports).
appArmorProfile object
appArmorProfile is the AppArmor options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows.
localhostProfile string
localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is "Localhost".
type string required
type indicates which kind of AppArmor profile will be applied. Valid options are: Localhost - a profile pre-loaded on the node. RuntimeDefault - the container runtime's default profile. Unconfined - no AppArmor enforcement.
fsGroup integer
A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod: 1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw---- If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows.
format: int64
fsGroupChangePolicy string
fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. Note that this field cannot be set when spec.os.name is windows.
runAsGroup integer
The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.
format: int64
runAsNonRoot boolean
Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
runAsUser integer
The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.
format: int64
seLinuxChangePolicy string
seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod. It has no effect on nodes that do not support SELinux or to volumes does not support SELinux. Valid values are "MountOption" and "Recursive". "Recursive" means relabeling of all files on all Pod volumes by the container runtime. This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node. "MountOption" mounts all eligible Pod volumes with `-o context` mount option. This requires all Pods that share the same volume to use the same SELinux label. It is not possible to share the same volume among privileged and unprivileged Pods. Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. "MountOption" value is allowed only when SELinuxMount feature gate is enabled. If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes and "Recursive" for all other volumes. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state. Note that this field cannot be set when spec.os.name is windows.
seLinuxOptions object
The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.
level string
Level is SELinux level label that applies to the container.
role string
Role is a SELinux role label that applies to the container.
type string
Type is a SELinux type label that applies to the container.
user string
User is a SELinux user label that applies to the container.
seccompProfile object
The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows.
localhostProfile string
localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
type string required
type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
supplementalGroups []integer
A list of groups applied to the first process run in each container, in addition to the container's primary GID and fsGroup (if specified). If the SupplementalGroupsPolicy feature is enabled, the supplementalGroupsPolicy field determines whether these are in addition to or instead of any group memberships defined in the container image. If unspecified, no additional groups are added, though group memberships defined in the container image may still be used, depending on the supplementalGroupsPolicy field. Note that this field cannot be set when spec.os.name is windows.
supplementalGroupsPolicy string
Defines how supplemental groups of the first container processes are calculated. Valid values are "Merge" and "Strict". If not specified, "Merge" is used. (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled and the container runtime must implement support for this feature. Note that this field cannot be set when spec.os.name is windows.
sysctls []object
Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows.
name string required
Name of a property to set
value string required
Value of a property to set
windowsOptions object
The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
gmsaCredentialSpec string
GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field.
gmsaCredentialSpecName string
GMSACredentialSpecName is the name of the GMSA credential spec to use.
hostProcess boolean
HostProcess determines if a container should be run as a 'Host Process' container. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true.
runAsUserName string
The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
readOnly boolean
Connect the server's repository read-only so the UI cannot mutate backups (browse + restore only).
resources object
Resource requests/limits for the server pod.
claims []object
Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers.
name string required
Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.
request string
Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.
limits object
Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
requests object
Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
securityContext object
Override the hardened default container security context.
allowPrivilegeEscalation boolean
AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.
appArmorProfile object
appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows.
localhostProfile string
localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is "Localhost".
type string required
type indicates which kind of AppArmor profile will be applied. Valid options are: Localhost - a profile pre-loaded on the node. RuntimeDefault - the container runtime's default profile. Unconfined - no AppArmor enforcement.
capabilities object
The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows.
add []string
Added capabilities
drop []string
Removed capabilities
privileged boolean
Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows.
procMount string
procMount denotes the type of proc mount to use for the containers. The default value is Default which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows.
readOnlyRootFilesystem boolean
Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows.
runAsGroup integer
The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
format: int64
runAsNonRoot boolean
Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
runAsUser integer
The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
format: int64
seLinuxOptions object
The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
level string
Level is SELinux level label that applies to the container.
role string
Role is a SELinux role label that applies to the container.
type string
Type is a SELinux type label that applies to the container.
user string
User is a SELinux user label that applies to the container.
seccompProfile object
The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows.
localhostProfile string
localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
type string required
type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
windowsOptions object
The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
gmsaCredentialSpec string
GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field.
gmsaCredentialSpecName string
GMSACredentialSpecName is the name of the GMSA credential spec to use.
hostProcess boolean
HostProcess determines if a container should be run as a 'Host Process' container. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true.
runAsUserName string
The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
service object
How the server is exposed as a Kubernetes `Service`.
annotations object
Annotations applied to the `Service` — the seam users wire their own Ingress/LoadBalancer controller onto.
port integer
Listen/Service port. Defaults to [`DEFAULT_SERVER_PORT`] when omitted.
format: uint16
minimum: 0
maximum: 65535
type string
Service type. Defaults to `ClusterIP` (routing is the user's responsibility).
enum: ClusterIP, NodePort, LoadBalancer
suspend boolean
Pause this cluster repository: skip connect/bootstrap and maintenance projection.
status object
Observed state of a `ClusterRepository`; mirrors `RepositoryStatus` plus `allowedNamespaceCount`.
allowedNamespaceCount integer
Number of namespaces currently resolved by `spec.allowedNamespaces`.
format: int64
backend string
Mirror of `spec.backend` discriminant for the print column.
catalog object
Catalog-materialization status (discovered-backup count, last refresh).
discoveredBackupCount integer
How many `Snapshot` CRs were materialized from the catalog scan.
format: int64
foreignSnapshotCount integer
Snapshots in the last complete listing classified as another cluster's (see `catalog.foreignSnapshots`); never materialized under `Ignore`. As of `catalog.lastRefreshAt` — enable `periodicRefresh` to keep it current.
format: int64
lastRefreshAt string
RFC 3339 timestamp of the last catalog refresh.
scanRequestAttemptAt string
RFC 3339 timestamp of the last bootstrap/scan attempt initiated BECAUSE OF a pending `catalog-scan-requested-at` token (i.e. the token arm was the reason the attempt fired). Used only to rate-limit token-driven attempts on a Ready-but-unreachable repository — it is never compared against the token for retirement (that's `scanRequestHonored`, by equality).
scanRequestHonored string
The RFC3339 token VALUE of the `kopiur.home-operations.com/catalog-scan-requested-at` annotation last honored by a completed catalog scan. Compared by **equality** against the live annotation to decide whether a requested on-demand scan is still pending — deliberately NOT a timestamp comparison against `lastRefreshAt` (a periodic refresh completing after the request was made would otherwise look like it honored the request even though it started before the annotation was set).
conditions []object
Standard Kubernetes conditions (e.g. `Connected`, `MaintenanceOwned`).
lastTransitionTime string required
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format: date-time
message string required
message is a human readable message indicating details about the transition. This may be an empty string.
observedGeneration integer
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
format: int64
reason string required
reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
status string required
status of the condition, one of True, False, Unknown.
type string required
type of condition in CamelCase or in foo.example.com/CamelCase.
health object
Backend health-probe state (`spec.health.probe`), when enabled.
consecutiveProbeFailures integer
Consecutive failing probes accrued; reset to zero on any success. The loud condition is raised only once this reaches the failure threshold.
format: int64
firstFailureAt string
RFC 3339 timestamp of the first failure in the current failing streak.
lastHealthyAt string
RFC 3339 timestamp of the last *successful* probe (backend reachable, repo present).
lastProbeAt string
RFC 3339 timestamp of the last completed probe (success or failure); drives the `health_probe_due` timer so the probe re-fires on cadence.
probeAttemptAt string
RFC 3339 timestamp at which the last backend health probe was *launched* (the bootstrap Job created for it), cleared when its result is finalized. This is the **launch-side** rate limit, and it is what makes the probe terminate. `lastProbeAt` is written only at *finalize*, so gating the launch on that alone recycles the bootstrap Job forever: the gate destroys every Job whose completion would have cleared it (#273). Never compared against `lastProbeAt` — see `kopiur_controller::health::probe_action`.
lastReverifyAt string
Last reverify-request token honored from a `Snapshot`'s re-probe nudge (RFC3339); the loop guard that keeps each request a one-shot.
observedGeneration integer
`metadata.generation` of the `spec` last reconciled; drives staleness detection.
format: int64
parameters object
The kopia repository parameters actually observed at the last bootstrap. Compare against `spec.parameters` to see whether a declared value landed.
blobRetention object
The blob retention the repository reports.
enabled boolean required
Whether the repository currently has blob retention in force (kopia's `IsRetentionEnabled()`: a non-empty mode AND a non-zero period).
mode string required
Observed retention mode exactly as kopia reports it (`GOVERNANCE`, `COMPLIANCE`, or empty when off).
period string required
Observed retention period, as a Go-style duration (`720h`). Empty-equivalent (`0s`) when retention is off.
epoch object
The epoch parameters the repository reports.
advanceOnCount integer required
Observed index-blob count that triggers an epoch advance.
format: int64
advanceOnSizeMiB integer required
Observed total index size (MiB) that triggers an epoch advance.
format: int64
checkpointFrequency integer required
Observed epochs between full index checkpoints.
format: int64
cleanupSafetyMargin string required
Observed cleanup safety margin, as a Go-style duration. Reported for diagnosis; not settable through `spec.parameters`.
deleteParallelism integer required
Observed epoch-cleanup delete parallelism.
format: int64
enabled boolean required
Whether kopia's epoch manager is enabled on this repository at all.
minDuration string required
Observed minimum epoch age, as a Go-style duration.
refreshFrequency string required
Observed epoch-state refresh frequency, as a Go-style duration.
phase string
Lifecycle phase of a repository. A freshly admitted CR starts in `Pending`.
enum: Pending, Initializing, Ready, Degraded, Failed
resolvedCredentialVersion string
`resourceVersion` of the password Secret observed at the last connect attempt.
seed object
What the last seed attempt did (`spec.seed`); absent on a repository that was never seeded.
mode string
Which copy mechanism a seed ran. Mirrors the `SeedSource` variant, named after the operation rather than the input so status, metrics (`kopiur_repository_seed_total{mode}`) and docs share one vocabulary.
enum: blob, migrate
seededAt string
RFC 3339 timestamp the seed completed. Set once: a repository is seeded exactly once, at its first bootstrap.
snapshotCount integer
Snapshots observed at the SOURCE when the seed ran. Zero is only ever recorded when `allowEmptySource` permitted it.
format: int64
snapshotsCopied integer
Snapshots actually copied into this repository. Migrate mode only — a blob copy moves storage, not manifests, so there is no per-snapshot copy count to report and it leaves this unset; its `snapshotCount` is the listing taken at the SOURCE before the copy, which for a byte-for-byte mirror is also what this repository ends up holding.
format: int64
source string
The source the data came from, rendered by `SeedSource::describe` — the backend discriminant (`S3`, `Filesystem`, …) for blob mode, `Kind/name` for migrate mode. Never a credential or a bucket path.
startedAt string
RFC 3339 timestamp the operator LAUNCHED a seeding bootstrap Job for this repository — the durable **seed-attempt marker**. Stamped before the Job is created, and never cleared. Its whole job is to distinguish "a seed this operator started did not finish" from "this backend was initialized by somebody else": the first must resume the copy, the second must keep the no-clobber `AlreadyInitialized` path. See `seed_resume` — the marker is the ONLY input the resume decision is allowed to take, because a resuming migrate writes into whatever repository is at the backend and then re-stamps its maintenance owner.
server object
Resolved kopia server endpoint/auth, pinned by the reconciler.
authMode string
Resolved auth mode discriminant (`Generate`/`SecretRef`/`Insecure`).
endpoint string
In-cluster endpoint, `<service>.<namespace>.svc:<port>`.
generatedSecretRef object
For `Generate` mode: the operator-owned Secret holding the UI credentials.
name string required
Name of the `Secret`.
namespace string
Namespace of the `Secret`; absent = same namespace as the referrer. A `ClusterRepository` is cluster-scoped and has no namespace of its own, so when IT reads the `Secret` (to connect, to bootstrap, or to run its repository server) an absent namespace means the operator's namespace (`KOPIUR_NAMESPACE`). A workload mover (Snapshot/Restore/Maintenance) still needs the `Secret` in its OWN namespace — `envFrom` is namespace-local — so put it there, or use `credentialProjection`, which needs this namespace set EXPLICITLY to know what to copy. Set it whenever anything other than the operator itself reads the `Secret`.
namespace string
Namespace the server objects were last applied to.
readOnly boolean
Effective read-only state of the served connection.
storageStats object
Repository size and snapshot counts from the last catalog scan.
indexBlobCount integer
Number of content-index blobs (`kopia index list`) observed at the last bootstrap.
format: int64
lastObservedAt string
RFC 3339 timestamp these stats were last observed.
snapshotCount integer
Total snapshots present in the repository (across all identities).
format: int64
totalSize string
Human-readable total on-disk size (e.g. `412Gi`).
totalSizeBytes integer
Logical bytes under management (the integer form of `total_size`): the sum, over each distinct snapshot source, of the most-recent snapshot's logical size. Exposed to backup preflight as `repository.sizeBytes`. This is repository *total size*, not backend free space (object stores don't report remaining capacity).
format: int64
uniqueId string
Kopia repository unique ID.

No matches. Try .spec.allowedNamespaces for an exact path

Copied!