Generated

This page is generated from api/v1alpha1 by make crd-ref-docs (crd-ref-docs) and checked for drift by make docs. Do not edit it. Condition types and reasons are on Conditions and reasons.

API Reference

Packages

• pgtoolbox.fyannk.dev/v1alpha1

pgtoolbox.fyannk.dev/v1alpha1

The kinds of the operator, PgAdmin, EvidenceAgent and PgAccessRequest. Field descriptions are the Go doc comments of api/v1alpha1; the Validation column lists the kubebuilder markers, and the cross-field CEL rules are collected at the end of the page.

Resource Types

• EvidenceAgent
• EvidenceAgentList
• PgAccessRequest
• PgAccessRequestList
• PgAdmin
• PgAdminAccess
• PgAdminAccessList
• PgAdminList
• PgToolBoxConsole
• PgToolBoxConsoleList

AccessCapability

Underlying type: string

AccessCapability is what is requested: one of the two ClusterRoles of the console. viewer includes pod logs; operator includes the console's operations and opening pgAdmin.

Validation:

• Enum: [viewer operator]

Appears in:

• PgAccessRequestSpec

Field	Description
viewer	AccessCapabilityViewer binds the pgtoolbox-console-viewer ClusterRole.
operator	AccessCapabilityOperator binds the pgtoolbox-console-operator ClusterRole.

AccessGrantScope

Underlying type: string

AccessGrantScope is how far an approved request reaches.

Validation:

• Enum: [Namespace]

Appears in:

• PgAccessRequestStatus

Field	Description
Namespace

AccessSubject

AccessSubject is who the access is for.

Appears in:

• PgAccessRequestSpec

Field	Description	Default	Validation
kind AccessSubjectKind	The subject's kind.		Enum: [User Group ServiceAccount]
name string	The subject's name as the API server sees it: a username (with its OIDC prefix, if the API server adds one), a group, or a ServiceAccount name in this namespace.		MaxLength: 512 MinLength: 1 Pattern: ^[^\x00-\x1f\x7f]+$

AccessSubjectKind

Underlying type: string

AccessSubjectKind is the kind of the subject access is requested for.

Validation:

• Enum: [User Group ServiceAccount]

Appears in:

• AccessSubject

Field	Description
User	AccessSubjectUser is a user as the API server names them (the username a token review returns, with any OIDC prefix).
Group	AccessSubjectGroup is a group as the API server names it.
ServiceAccount	AccessSubjectServiceAccount is a ServiceAccount of the request's own namespace (same-namespace references only).

ClaimValues

Underlying type: string array

ClaimValues are the accepted values of one claim; any one matches.

Validation:

• MaxItems: 16
• MinItems: 1
• items:MaxLength: 256
• items:Pattern: ^[^'"\\\r\n]+$

Appears in:

• PgAdminOAuth2Spec

Endpoint

Underlying type: string

Endpoint names which Service of a Cluster a server connects through: rw (the primary), ro (the replicas), r (any instance) or pooler:<Pooler name> (a CNPG Pooler of that Cluster; its Service name must be among the Cluster's spec.certificates.serverAltDNSNames for verify-full to succeed).

Validation:

• MaxLength: 70
• Pattern: ^(rw|ro|r|pooler:[a-z0-9]([-a-z0-9]*[a-z0-9])?)$

Appears in:

• PgAdminSpec

Field	Description
rw
ro
r

EvidenceAgent

EvidenceAgent deploys a read-only evidence agent for the backup repository of one CloudNativePG Cluster in its namespace. Whoever may get an EvidenceAgent may read the evidence it serves.

Appears in:

• EvidenceAgentList

Field	Description	Default	Validation
apiVersion string	pgtoolbox.fyannk.dev/v1alpha1
kind string	EvidenceAgent
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec EvidenceAgentSpec
status EvidenceAgentStatus			Optional: {}

EvidenceAgentCertificateIssuer

Underlying type: string

EvidenceAgentCertificateIssuer selects who signs the agent's serving certificate.

Validation:

• Enum: [Operator OpenShiftServiceCA]

Appears in:

• EvidenceAgentTLSSpec

Field	Description
Operator	CertificateIssuerOperator means the operator keeps a CA per EvidenceAgent (a Secret the agent Pod never mounts) and signs a renewable serving certificate with it.
OpenShiftServiceCA	CertificateIssuerOpenShiftServiceCA means the OpenShift service CA issues the certificate through the Service annotation and injects its CA bundle into a ConfigMap the operator creates.

EvidenceAgentList

EvidenceAgentList contains a list of EvidenceAgent.

Field	Description	Default	Validation
apiVersion string	pgtoolbox.fyannk.dev/v1alpha1
kind string	EvidenceAgentList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items EvidenceAgent array

EvidenceAgentPgBackRestSpec

EvidenceAgentPgBackRestSpec selects the pgBackRest repository the agent reads. The stanza, the bucket or container, the path, the credentials and the cipher pass come from the plugin's Stanza or Archive; every Secret they name, and endpointCA, must be listed in spec.allowedSecrets.

Appears in:

• EvidenceAgentSpec

Field	Description	Default	Validation
repository integer	The pgBackRest repository number (repo<n>) to read. Dalibo numbers the Stanza's S3 repositories first, then its Azure ones; Opera numbers the Archive's repositories in order. 1 is where both plugins send a backup that names no repository.	1	Maximum: 256 Minimum: 1 Optional: {}
endpointCA SecretKeyReference	A CA bundle (a key of a Secret in this namespace) the agent trusts for the repository endpoint, beside the system roots. It wins over the Archive's endpointCA. TLS is always verified: Dalibo's verifyTLS and Opera's disableVerifyTLS are not followed.		Optional: {}
endpoint string	Pins the repository's endpoint: a host[:port] (a DNS name, an IPv4 address or a bracketed IPv6 address) that the host the agent sends its requests and credentials to must match, or the Cluster is refused (UnsupportedObjectStore). That host is the S3 endpoint the plugin's object names, or the Azure account's Blob host (<account>.blob.core.windows.net host-style, the endpoint path-style). Without a port, the scheme's default port. Whoever may edit the Stanza or the Archive chooses where the credentials go; the pin keeps that choice with this object's author. It is also the opt-in that lets an Azure storage key or SAS token go to a host outside the Azure Blob domains (Azurite).		MaxLength: 261 Pattern: ^(\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9]([-A-Za-z0-9]*[A-Za-z0-9])?([.][A-Za-z0-9]([-A-Za-z0-9]*[A-Za-z0-9])?)*)(:[0-9]\{1,5\})?$ Optional: {}

EvidenceAgentPgBackRestStatus

EvidenceAgentPgBackRestStatus is the pgBackRest repository an agent resolved: the plugin and its object as soon as the Cluster names them, the rest once the object was read.

Appears in:

• EvidenceAgentStatus

Field	Description	Default	Validation
plugin string	The plugin: pgbackrest.dalibo.com or pgbackrest.cnpg.opera.com.		MaxLength: 253
kind string	The plugin's object in this namespace: a Stanza (Dalibo) or an Archive (Opera).		Enum: [Stanza Archive]
objectName string			MaxLength: 253
stanza string	The stanza the backups are read under.		MaxLength: 256 Optional: {}
archiveStanza string	The stanza the WAL is read under, when it differs from stanza (Opera's configuration.stanza): a restore must name it.		MaxLength: 256 Optional: {}
repository integer	The repository number read (repo<n>).		Optional: {}

EvidenceAgentSpec

EvidenceAgentSpec declares one evidence agent: a read-only reader of the backup repository of one CloudNativePG Cluster in this namespace, serving evidence/v1alpha1 to the console over in-cluster HTTPS.

Appears in:

• EvidenceAgent

Field	Description	Default	Validation
clusterRef LocalObjectReference	The CloudNativePG Cluster, in this namespace, whose backups the agent reads. Its barman-cloud plugin stanza names the ObjectStore and the server name unless the fields below override them.
objectStoreRef LocalObjectReference	The barman-cloud ObjectStore (barmancloud.cnpg.io/v1), in this namespace, to read. Defaults to the Cluster's barmanObjectName plugin parameter. The agent uses the same credentials the plugin uses; they never leave this namespace.		Optional: {}
allowedSecrets string array	The Secrets, in this namespace, the agent may read: whoever may edit the Cluster or the ObjectStore chooses which Secrets the backup configuration names, and the agent reads only those also listed here. A configuration naming another is refused by name (ConfigurationValid=False, UnsupportedObjectStore). Empty is the deprecated behaviour, kept for an ObjectStore of the barman-cloud plugin only: every Secret that ObjectStore names; the Cluster's own spec.backup.barmanObjectStore is then refused.		MaxItems: 16 items:MaxLength: 253 items:Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?([.][a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ Optional: {}
allowInsecureEndpoint boolean	Admit a plain-http object-store endpoint, over which the credentials cross the network in clear text. Off, such an endpoint is refused (UnsupportedObjectStore), except for the deprecated behaviour of an empty allowedSecrets.		Optional: {}
serverName string	The Barman server name (the first key prefix under the destination). Defaults to the Cluster's serverName plugin parameter, else the Cluster's name — the same rule the barman-cloud plugin applies.		MaxLength: 256 MinLength: 1 Optional: {}
image ImageSpec	The agent image. Omitted, the operator's default applies. The repository must be in the operator's allow-list (--evidence-agent-image-repositories; by default the default image's repository only): the agent Pod mounts the object-store credentials.		Optional: {}
resources ResourceRequirements	Compute resources of the agent container.		Optional: {}
refreshInterval Duration	How often the agent re-reads the repository.		Optional: {}
exposure ExposureSpec	Exposure of the agent. Only clusterIP is accepted: the console in the cluster is the agent's only client.		Optional: {}
tls EvidenceAgentTLSSpec	Serving certificate.		Optional: {}
workloadIdentity WorkloadIdentitySpec	Workload identity of the agent, for a repository read with the Pod's own cloud identity (s3Credentials.inheritFromIAMRole, azureCredentials.inheritFromAzureAD or useDefaultAzureCredentials, googleCredentials.gkeEnvironment, a pgBackRest key type auto or web-id): the agent's ServiceAccount and Pod carry what the platform's identity webhook or metadata server needs to grant the agent a role that can read the repository.		Optional: {}
pgbackrest EvidenceAgentPgBackRestSpec	pgBackRest settings, for a Cluster backed up with a pgBackRest plugin (pgbackrest.dalibo.com or pgbackrest.cnpg.opera.com). Omitted, such a Cluster is read from repo1 with the system's trusted roots.		Optional: {}

EvidenceAgentStatus

EvidenceAgentStatus is the observed state of an EvidenceAgent. A console reads endpoint, caBundle, fingerprint and producerEpoch to call the agent and to judge its answers (docs: the evidence agent channel).

Appears in:

• EvidenceAgent

Field	Description	Default	Validation
observedGeneration integer	The generation the status was computed from.		Optional: {}
endpoint string	The in-cluster HTTPS URL of the agent's Service.		MaxLength: 512 Optional: {}
caBundle integer array	PEM CA bundle that verifies the agent's serving certificate for the endpoint's host. Public material, never a key.		MaxLength: 65536 Optional: {}
fingerprint string	The repository identity the agent reads (sha256: domain-separated, region-free fingerprint of endpoint, bucket, prefix, format and server); a snapshot whose destination_fingerprint differs is not this repository's.		Pattern: ^sha256:[0-9a-f]\{64\}$ Optional: {}
producerEpoch integer	The configuration epoch of the running agent: the generation its Deployment was rendered from, published once that rollout completed. Every snapshot carries it as producer_epoch; a snapshot with an older epoch comes from a superseded configuration.		Optional: {}
objectStoreName string	The resolved ObjectStore and Barman server name.		MaxLength: 253 Optional: {}
serverName string			MaxLength: 256 Optional: {}
pgbackrest EvidenceAgentPgBackRestStatus	The resolved pgBackRest repository, for a Cluster backed up with a pgBackRest plugin.		Optional: {}
image string	The image reference the agent runs.		MaxLength: 512 Optional: {}
conditions Condition array	Conditions: Ready (summary), ConfigurationValid, WorkloadReady, ServingCertificateReady, Progressing and Stalled.		MaxItems: 16 Optional: {}

EvidenceAgentTLSSpec

EvidenceAgentTLSSpec configures the agent's serving certificate.

Appears in:

• EvidenceAgentSpec

Field	Description	Default	Validation
issuer EvidenceAgentCertificateIssuer	Who issues the serving certificate.	Operator	Enum: [Operator OpenShiftServiceCA] Optional: {}

ExposureSpec

ExposureSpec configures access to a workload from outside its Service.

Appears in:

• EvidenceAgentSpec
• PgAdminSpec
• PgToolBoxConsoleExposureSpec

Field	Description	Default	Validation
type ExposureType	The exposure mechanism.	clusterIP	Enum: [clusterIP route ingress gateway] Optional: {}
hostname string	The external hostname. Required for route, ingress and gateway.		MaxLength: 253 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ Optional: {}
tls ExposureTLSSpec	TLS for route and ingress exposure. A Route always terminates TLS at the edge; an Ingress uses certificateSecretRef, or the controller's default certificate when it is omitted. For gateway exposure TLS terminates at the Gateway listener.		Optional: {}
ingressClassName string	IngressClass name, for ingress exposure only.		MaxLength: 253 Optional: {}
gateway GatewayExposureSpec	Gateway API attachment, for gateway exposure only.		Optional: {}
annotations object (keys:string, values:string)	Annotations added to the exposure object; keys under pgtoolbox.fyannk.dev/ are rejected.		MaxProperties: 32 Optional: {}
labels object (keys:string, values:string)	Labels added to the exposure object under the operator's own identity labels, which always win. Ingress controllers and OpenShift router shards select by label; keys under pgtoolbox.fyannk.dev/ are rejected.		MaxProperties: 32 Optional: {}

ExposureTLSSpec

ExposureTLSSpec configures TLS for route and ingress exposure.

Appears in:

• ExposureSpec
• PgToolBoxConsoleExposureSpec

Field	Description	Default	Validation
certificateSecretRef LocalObjectReference	TLS certificate Secret (kubernetes.io/tls) in the CR's namespace, for ingress exposure.		Optional: {}

ExposureType

Underlying type: string

ExposureType selects how a workload is published.

Validation:

• Enum: [clusterIP route ingress gateway]

Appears in:

• ExposureSpec
• PgToolBoxConsoleExposureSpec

Field	Description
clusterIP	ExposureTypeClusterIP exposes the workload only inside the cluster.
route	ExposureTypeRoute publishes an OpenShift Route (edge TLS).
ingress	ExposureTypeIngress publishes a Kubernetes Ingress.
gateway	ExposureTypeGateway publishes a Gateway API HTTPRoute.

GatewayExposureSpec

GatewayExposureSpec configures the HTTPRoute parent reference.

Appears in:

• ExposureSpec
• PgToolBoxConsoleExposureSpec

Field	Description	Default	Validation
parentRef GatewayParentRef	The Gateway listener to attach to.

GatewayParentRef

GatewayParentRef identifies a Gateway listener. A Gateway in another namespace admits the route only through its own listener's allowedRoutes (and a ReferenceGrant where its implementation needs one): the grant is the Gateway owner's, never this object's.

Appears in:

• GatewayExposureSpec

Field	Description	Default	Validation
name string	Gateway name.		MaxLength: 253 MinLength: 1
namespace string	Gateway namespace; defaults to the CR's namespace.		MaxLength: 63 Optional: {}
sectionName string	Listener (section) name on the Gateway.		MaxLength: 253 Optional: {}

ImageSpec

ImageSpec selects a container image. Omitted, the operator's default image applies — a digest-pinned reference built into the operator and echoed into the kind's status. A tag alone is accepted but the resolved reference in status says it is not pinned; production use names a digest.

Appears in:

• EvidenceAgentSpec
• PgAdminOpenShiftOAuthProxySpec
• PgAdminSpec
• PgToolBoxConsoleSpec

Field	Description	Default	Validation
repository string	Image repository, without tag or digest (registry/path/name).		MaxLength: 255 MinLength: 1 Pattern: ^[a-z0-9]+([._-][a-z0-9]+)*(:[0-9]\{1,5\})?(/[a-z0-9]+([._-][a-z0-9]+)*)*$
tag string	Image tag; informative when a digest is set.		MaxLength: 128 Pattern: ^[A-Za-z0-9_][A-Za-z0-9_.-]\{0,127\}$ Optional: {}
digest string	Image digest; when set it is what the Pod runs.		Pattern: ^sha256:[a-f0-9]\{64\}$ Optional: {}
pullPolicy PullPolicy	Image pull policy. Defaults to IfNotPresent for a digest and Always for a tag alone.		Enum: [Always IfNotPresent Never] Optional: {}
pullSecrets LocalObjectReference array	Pull secrets for the image registry, in the CR's namespace.		MaxItems: 8 Optional: {}

LabelValue

Underlying type: string

LabelValue is a Kubernetes label value (the keys are allow-listed by the map's own rule).

Validation:

• MaxLength: 63
• Pattern: ^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$

Appears in:

• WorkloadIdentitySpec

LocalObjectReference

LocalObjectReference names an object in the referencing object's own namespace. Cross-namespace references do not exist in v1alpha1; a future one goes through an explicit grant object in the target namespace, never through a selector.

Appears in:

• EvidenceAgentSpec
• ExposureTLSSpec
• ImageSpec
• PgAdminAccessSpec
• PgAdminConfigDatabaseSpec
• PgAdminSpec
• PgToolBoxConsoleOIDCSpec
• PgToolBoxConsoleOpenShiftSpec
• PgToolBoxConsolePrometheusSpec
• PgToolBoxConsoleSpec

Field	Description	Default	Validation
name string	The name of the referenced object.		MaxLength: 253 MinLength: 1 Pattern: ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$

MetadataPropagation

MetadataPropagation copies labels and annotations onto generated objects (cost-centre labels, backup-tool annotations, mesh opt-outs). The operator's own keys always win, keys under pgtoolbox.fyannk.dev/ are rejected, and a change rolls only the objects it targets.

Appears in:

• PgAdminSpec
• PgToolBoxConsoleSpec

Field	Description	Default	Validation
target PropagationTarget	Which generated objects receive the metadata.		Enum: [All Workload Pod Service Exposure Storage]
labels object (keys:string, values:string)	Labels to add.		MaxProperties: 32 Optional: {}
annotations object (keys:string, values:string)	Annotations to add.		MaxProperties: 32 Optional: {}

PgAccessRequest

PgAccessRequest asks for one of the console's two ClusterRoles (pgtoolbox-console-viewer, pgtoolbox-console-operator) in this namespace. Whoever may create RoleBindings here and update the request's status approves it through the console, which creates the RoleBinding with the approver's own token; the operator deletes it when the request expires, is revoked or is deleted.

Appears in:

• PgAccessRequestList

Field	Description	Default	Validation
apiVersion string	pgtoolbox.fyannk.dev/v1alpha1
kind string	PgAccessRequest
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec PgAccessRequestSpec
status PgAccessRequestStatus			Optional: {}

PgAccessRequestList

PgAccessRequestList contains a list of PgAccessRequest.

Field	Description	Default	Validation
apiVersion string	pgtoolbox.fyannk.dev/v1alpha1
kind string	PgAccessRequestList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items PgAccessRequest array

PgAccessRequestPhase

Underlying type: string

PgAccessRequestPhase is where a request stands.

Validation:

• Enum: [Pending Approved Denied Expired Revoked]

Appears in:

• PgAccessRequestStatus

Field	Description
Pending	AccessPhasePending is waiting for a decision.
Approved	AccessPhaseApproved means a RoleBinding grants the capability.
Denied	AccessPhaseDenied is a refusal; terminal.
Expired	AccessPhaseExpired means expiresAt passed; terminal.
Revoked	AccessPhaseRevoked means the grant was withdrawn; terminal.

PgAccessRequestSpec

PgAccessRequestSpec is a request for access to the CloudNativePG Clusters of this namespace through the console. A request is immutable: to change it, make a new one.

Appears in:

• PgAccessRequest

Field	Description	Default	Validation
subject AccessSubject	Who the access is for.
cluster string	The Cluster, in this namespace, the access is wanted for. Empty: every Cluster of the namespace. Informative only: a RoleBinding cannot be narrowed to one Cluster, so an approved request grants the capability on every Cluster of the namespace, and its status says so.		MaxLength: 253 Pattern: ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$ Optional: {}
capability AccessCapability	The capability requested.		Enum: [viewer operator]
justification string	Why the access is needed; shown to whoever decides.		MaxLength: 1024 MinLength: 1
expiresAt Time	When the access ends. The operator deletes the RoleBinding at this time and marks the request Expired; a Pending request past it can no longer be approved. Omitted: until revoked.		Optional: {}

PgAccessRequestStatus

PgAccessRequestStatus is the decision and its effect. The decision fields are written by the deciding person (through the console, with their own token: the API server records who wrote them); the conditions by the operator.

Appears in:

• PgAccessRequest

Field	Description	Default	Validation
observedGeneration integer	The generation the conditions were computed from.		Optional: {}
phase PgAccessRequestPhase	Where the request stands. Empty until the operator or a decision first writes it.		Enum: [Pending Approved Denied Expired Revoked] Optional: {}
decidedBy string	The username of the person who approved or denied the request, as the API server named them when the console asked.		MaxLength: 512 Optional: {}
decidedAt Time	When the request was approved or denied.		Optional: {}
revokedBy string	The username of the person who revoked the grant, or "pgtoolbox-operator" when the operator revoked a self-approval.		MaxLength: 512 Optional: {}
revokedAt Time	When the grant was revoked.		Optional: {}
note string	The decider's note: why it was denied (required), approved or revoked; or the operator's explanation of a revocation.		MaxLength: 1024 Optional: {}
roleBinding string	The RoleBinding of an approved request, in this namespace.		MaxLength: 253 Optional: {}
clusterRole string	The ClusterRole the RoleBinding references.		MaxLength: 253 Optional: {}
grantedScope AccessGrantScope	How far the grant reaches: always Namespace, since a RoleBinding cannot be narrowed to one Cluster, even when spec.cluster names one.		Enum: [Namespace] Optional: {}
conditions Condition array	Conditions: Ready (summary), ConfigurationValid, RoleBindingSynced, Progressing and Stalled.		MaxItems: 16 Optional: {}

PgAdmin

PgAdmin is one pgAdmin for a team namespace, registered against the CloudNativePG Clusters of that namespace. Only dba may open it: whoever reaches it holds the credentials of every role it offers.

Appears in:

• PgAdminList

Field	Description	Default	Validation
apiVersion string	pgtoolbox.fyannk.dev/v1alpha1
kind string	PgAdmin
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec PgAdminSpec
status PgAdminStatus			Optional: {}

PgAdminAccess

PgAdminAccess is a grant, in the namespace of the Clusters it names: the PgAdmin it names, in another namespace, may register those Clusters and read their offered credentials. Creating one is the decision of whoever may read this namespace's Secrets; who may create PgAdminAccess objects here is therefore an RBAC decision of the namespace owner. Like the Gateway API's ReferenceGrant it has no status: the PgAdmin reports whether it is granted (ConfigurationValid, GrantMissing). Deleting it revokes the access (the Role and RoleBinding it owns are garbage collected).

Appears in:

• PgAdminAccessList

Field	Description	Default	Validation
apiVersion string	pgtoolbox.fyannk.dev/v1alpha1
kind string	PgAdminAccess
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec PgAdminAccessSpec

PgAdminAccessList

PgAdminAccessList contains a list of PgAdminAccess.

Field	Description	Default	Validation
apiVersion string	pgtoolbox.fyannk.dev/v1alpha1
kind string	PgAdminAccessList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items PgAdminAccess array

PgAdminAccessSpec

PgAdminAccessSpec grants one PgAdmin of another namespace the registration of named Clusters of this namespace.

Appears in:

• PgAdminAccess

Field	Description	Default	Validation
pgAdmin PgAdminReference	The PgAdmin granted access.
clusters LocalObjectReference array	The Clusters of this namespace it may register. Their credentials (the Secrets its spec.credentials offers and each Cluster's CA) become readable by that PgAdmin's ServiceAccount through a name-scoped Role the operator maintains here while this grant exists.		MaxItems: 32 MinItems: 1
allowPrivileged boolean	Whether the privileged credentials of these Clusters (the superuser, and DatabaseRoles that are superuser, createrole, bypassrls or replication or members of a privileged role) may be offered, when the PgAdmin asks for them (spec.credentials.superuser). Off by default: the PgAdmin's own spec cannot widen what this grant allows.	false	Optional: {}

PgAdminAuthSpec

PgAdminAuthSpec selects the single sign-on mode: pgAdmin's native OAuth2 against the platform's identity provider (Kubernetes), or the OpenShift oauth-proxy in front of pgAdmin, which admits only users that may connect to this PgAdmin (OpenShift).

Appears in:

• PgAdminSpec

Field	Description	Default	Validation
oauth2 PgAdminOAuth2Spec	pgAdmin's native OAuth2 / OpenID Connect sign-in.		Optional: {}
openshiftOAuthProxy PgAdminOpenShiftOAuthProxySpec	The OpenShift oauth-proxy, authorizing with a SubjectAccessReview "connect pgadmins/<name>" (granted by the pgtoolbox-console-operator role; not get, which the view role carries on OLM).		Optional: {}

PgAdminClusterReference

PgAdminClusterReference names a Cluster of another namespace.

Appears in:

• PgAdminSpec

Field	Description	Default	Validation
namespace string	The namespace of the Cluster.		MaxLength: 63 MinLength: 1 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
name string	The name of the Cluster.		MaxLength: 253 MinLength: 1 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$

PgAdminConfigDatabaseSpec

PgAdminConfigDatabaseSpec puts pgAdmin's settings database on a CloudNativePG Cluster.

Appears in:

• PgAdminSpec

Field	Description	Default	Validation
clusterRef LocalObjectReference	The Cluster, in this namespace.
database string	The database, and the role that owns it. Defaults to pgadmin_<PgAdmin name, dashes as underscores>; a name given here starts with pgadmin_ too. CloudNativePG adopts a role of that name that already exists in PostgreSQL and resets its password and memberships: the prefix keeps the PgAdmin off the roles a DBA or an application created.		MaxLength: 63 Pattern: ^pgadmin_[a-z0-9_]+$ Optional: {}

PgAdminCredentialsSpec

PgAdminCredentialsSpec selects the credentials every registered Cluster offers. Each offered credential becomes one shared server per endpoint.

Appears in:

• PgAdminSpec

Field	Description	Default	Validation
application boolean	The application user (the Cluster's app Secret, or the Secret its bootstrap names).	true	Optional: {}
superuser boolean	The privileged credentials: the superuser (when the Cluster enables superuser access) and DatabaseRoles that are superuser, createrole, bypassrls or replication, or members, directly or through roles the Cluster declares, of a pg_* role, the superuser, the application owner or another privileged role. Off by default.	false	Optional: {}
databaseRoles boolean	DatabaseRoles of the Cluster that CloudNativePG reports applied, with the password Secret at the version it applied. Privileged ones need superuser as well. CloudNativePG 1.30 and later serve the DatabaseRole kind; where an install does not (its CRDs lack it), none is offered and the PgAdmin is still Ready: the ConfigurationValid message says so. Where the operator may not list DatabaseRoles, ConfigurationValid is False (DatabaseRoleAPIUnavailable).	true	Optional: {}

PgAdminList

PgAdminList contains a list of PgAdmin.

Field	Description	Default	Validation
apiVersion string	pgtoolbox.fyannk.dev/v1alpha1
kind string	PgAdminList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items PgAdmin array

PgAdminNetworkPolicySpec

PgAdminNetworkPolicySpec configures the optional NetworkPolicy.

Appears in:

• PgAdminSpec

Field	Description	Default	Validation
enabled boolean	Whether the operator renders a NetworkPolicy around the pgAdmin Pod (ingress and egress). Off by default.	false	Optional: {}
ingressFrom NetworkPolicyPeer array	Who may reach pgAdmin's port. Empty: any source (the router or ingress controller of the exposure lives in a namespace only the admin knows).		MaxItems: 16 Optional: {}
identityProviderCIDRs string array	The identity provider's addresses (CIDRs), for pgAdmin's server-side OAuth2 calls. Without them the generated rule allows port 443 to any address, and PgAdminEgressConfined says so.		MaxItems: 16 items:MaxLength: 49 items:Pattern: ^[0-9a-fA-F:.]+/[0-9]\{1,3\}$ Optional: {}
extraEgress NetworkPolicyEgressRule array	Additional egress rules, appended to the generated ones.		MaxItems: 16 Optional: {}

PgAdminOAuth2Spec

PgAdminOAuth2Spec configures pgAdmin's OAuth2 provider from an OpenID Connect issuer.

Appears in:

• PgAdminAuthSpec

Field	Description	Default	Validation
issuerURL string	The issuer; pgAdmin reads <issuerURL>/.well-known/openid-configuration.		MaxLength: 512 Pattern: ^https://[^\s'"\\]+$
clientID string	The OAuth2 client ID.		MaxLength: 256 MinLength: 1 Pattern: ^[^\s'"\\]+$
clientSecretRef SecretKeySelector	The Secret (this namespace) holding the client secret. pgAdmin reads it from a mounted file; it never enters the Pod spec or the operator.
requiredClaims object (keys:string, values:ClaimValues)	The claims a user must carry to sign in, e.g. {"groups": ["dba"]}. Required: on Kubernetes the identity provider, not RBAC, decides who reaches pgAdmin, so this must name the same people the namespace's pgtoolbox-console-operator RoleBinding names.		MaxProperties: 8 MinProperties: 1
usernameClaim string	The claim that becomes the pgAdmin username.	email	MaxLength: 64 Pattern: ^[A-Za-z0-9_.:-]+$ Optional: {}
scopes string array	Scopes requested.	[openid email profile]	MaxItems: 16 items:Pattern: ^[A-Za-z0-9_.:/-]\{1,128\}$ Optional: {}
displayName string	The button label on pgAdmin's login page.		MaxLength: 64 Pattern: ^[^'"\\\r\n]*$ Optional: {}

PgAdminOpenShiftOAuthProxySpec

PgAdminOpenShiftOAuthProxySpec configures the OpenShift oauth-proxy.

Appears in:

• PgAdminAuthSpec

Field	Description	Default	Validation
image ImageSpec	The oauth-proxy image. Omitted, the operator's default.		Optional: {}
sessionMaxAge Duration	How long an oauth-proxy session lasts (--cookie-expire). The proxy reviews connect at sign-in only, so this bounds how long a revoked person keeps pgAdmin open; when it ends the proxy signs the person in again, silently while their OpenShift session lasts, but a request in flight (a form being posted) can be lost. Default 1h.		Optional: {}

PgAdminReference

PgAdminReference names a PgAdmin, in any namespace.

Appears in:

• PgAdminAccessSpec

Field	Description	Default	Validation
namespace string	The namespace of the PgAdmin.		MaxLength: 63 MinLength: 1 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
name string	The name of the PgAdmin.		MaxLength: 40 MinLength: 1 Pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$

PgAdminRetainPolicy

Underlying type: string

PgAdminRetainPolicy says what happens to the settings volume when the PgAdmin is deleted.

Validation:

• Enum: [Retain Delete]

Appears in:

• PgAdminStorageSpec

Field	Description
Retain	PgAdminRetainPolicyRetain keeps the settings volume (no owner reference); a PgAdmin of the same name re-adopts it.
Delete	PgAdminRetainPolicyDelete lets garbage collection delete it.

PgAdminServerStatus

PgAdminServerStatus is one server pgAdmin offers, or a credential it does not. It names the role, never a secret.

Appears in:

• PgAdminStatus

Field	Description	Default	Validation
cluster string	The Cluster.		MaxLength: 253
endpoint string	The endpoint (rw, ro, r, pooler:<name>).		MaxLength: 70
user string	The PostgreSQL role.		MaxLength: 128 Optional: {}
pgAdminUser string	The pgAdmin user a personal server belongs to; empty for a shared server.		MaxLength: 254 Optional: {}
state ServerState	The registration state.		Enum: [Registered Pending NotOffered]
message string	Why a credential is not offered.		MaxLength: 256 Optional: {}

PgAdminSpec

PgAdminSpec declares one pgAdmin for a team namespace: the Clusters of that namespace it registers, the credentials it offers, how people sign in, and how it is published.

Who may open it: dba only. Whoever reaches pgAdmin holds the credentials of every role it offers (pgAdmin hides the passwords but a connected role can change its own, and a server a user registers can name a managed libpq service), so opening it is equivalent to reading those Secrets.

Appears in:

• PgAdmin

Field	Description	Default	Validation
clusterRefs LocalObjectReference array	The CloudNativePG Clusters to register, by name, in this namespace. Exactly one of clusterRefs and clusterSelector.		MaxItems: 32 MinItems: 1 Optional: {}
clusterSelector LabelSelector	A label selector over the Clusters of this namespace only; Clusters of other namespaces are never selected, only named in crossNamespaceClusterRefs. At most one of clusterRefs and clusterSelector.		Optional: {}
crossNamespaceClusterRefs PgAdminClusterReference array	Clusters of other namespaces, by namespace and name. Each is registered only while a PgAdminAccess in its namespace grants this PgAdmin that Cluster (ConfigurationValid=False, GrantMissing, otherwise); the grant is the target namespace owner's decision.		MaxItems: 32 MinItems: 1 Optional: {}
endpoints Endpoint array	Which Services of every registered Cluster get a server.	[rw]	MaxItems: 8 MaxLength: 70 MinItems: 1 Pattern: ^(rw|ro|r|pooler:[a-z0-9]([-a-z0-9]*[a-z0-9])?)$ Optional: {}
credentials PgAdminCredentialsSpec	Which credentials each registered Cluster offers.	{ }	Optional: {}
image ImageSpec	The pgAdmin image. Omitted, the operator's digest-pinned default. Changing the image backs up pgAdmin's settings database before the new image rolls out (status.conditions: UpgradeBackup*).		Optional: {}
storage PgAdminStorageSpec	The settings volume (pgAdmin's SQLite database and STORAGE_DIR). Unused with configDatabase: STORAGE_DIR is then per Pod and ephemeral.	{ }	Optional: {}
configDatabase PgAdminConfigDatabaseSpec	pgAdmin's settings database on a CloudNativePG Cluster of this namespace instead of SQLite on the settings volume (pgAdmin's CONFIG_DATABASE_URI). The operator owns a DatabaseRole whose password CloudNativePG generates (1.31 and later) and a Database it owns; the password reaches the pgAdmin Pod only. Set at creation only.		Optional: {}
replicas integer	pgAdmin Pods. Above 1 only with configDatabase; the Service then keeps a client on one Pod (sessionAffinity ClientIP), and the exposure must be sticky too.	1	Maximum: 10 Minimum: 1 Optional: {}
auth PgAdminAuthSpec	How people sign in. pgAdmin has no local password login here.
admins string array	Usernames (as the identity provider presents them) that get pgAdmin's Administrator role; everyone else who signs in is a User.		MaxItems: 32 items:MaxLength: 254 items:MinLength: 1 items:Pattern: ^[^-\s'"\\][^\s'"\\]*$ Optional: {}
exposure ExposureSpec	How pgAdmin is published.	{ }	Optional: {}
networkPolicy PgAdminNetworkPolicySpec	An optional NetworkPolicy around the pgAdmin Pod. Off by default: a NetworkPolicy is the installing admin's choice, never a product precondition. Whether it confines egress is reported by the advisory PgAdminEgressConfined condition.	{ }	Optional: {}
resources ResourceRequirements	The pgAdmin container's resources. Defaults to a request of 100m CPU and 256Mi memory and a 1Gi memory limit.		Optional: {}
metadataPropagation MetadataPropagation array	Labels and annotations copied onto generated objects.		MaxItems: 8 Optional: {}

PgAdminStatus

PgAdminStatus is the observed state of a PgAdmin.

Appears in:

• PgAdmin

Field	Description	Default	Validation
observedGeneration integer	The generation the status was computed from.		Optional: {}
url string	Where pgAdmin is reached: the exposure URL, or the in-cluster Service URL for clusterIP exposure.		MaxLength: 512 Optional: {}
image string	The image the Ready workload runs (the resolved reference, with its digest when pinned).		MaxLength: 512 Optional: {}
upgradeBackup PgAdminUpgradeBackupStatus	The last image change the pre-upgrade backup released. It outlives the backup Job (deleted an hour after it finishes), so that a new image slow to become Ready is neither rolled back nor backed up again.		Optional: {}
pgAdminVersion string	The pgAdmin version the last registration Job reported.		MaxLength: 32 Optional: {}
registeredHash string	The hash of the offered set the last successful registration applied.		MaxLength: 64 Optional: {}
personalServerOwners string array	The pgAdmin users the last successful registration gave personal servers (per-person DatabaseRoles); the next registration removes the managed personal servers of those no longer among them.		MaxItems: 64 items:MaxLength: 254 Optional: {}
servers PgAdminServerStatus array	The servers pgAdmin offers and the credentials it does not.		MaxItems: 256 Optional: {}
publishedExposureKinds string array	The exposure kinds (Route, HTTPRoute) the operator published for this PgAdmin and has not seen gone since: where it is later refused one of them, it reports what may remain of it.		MaxItems: 2 items:Enum: [Route HTTPRoute] Optional: {}
conditions Condition array	Conditions: Ready (summary of ConfigurationValid, WorkloadReady, ExposureReady and ServersSynced), Progressing, Stalled, and the advisory PgAdminEgressConfined, which never enters Ready.		MaxItems: 16 Optional: {}

PgAdminStorageSpec

PgAdminStorageSpec configures the settings volume.

Appears in:

• PgAdminSpec

Field	Description	Default	Validation
size Quantity	Requested size; may grow, never shrink. Defaults to 1Gi.		Optional: {}
storageClassName string	The StorageClass; the cluster default when omitted. Immutable.		MaxLength: 253 Optional: {}
retainPolicy PgAdminRetainPolicy	What happens to the volume when the PgAdmin is deleted.	Retain	Enum: [Retain Delete] Optional: {}

PgAdminUpgradeBackupStatus

PgAdminUpgradeBackupStatus is one image change the pre-upgrade backup released.

Appears in:

• PgAdminStatus

Field	Description	Default	Validation
from string	The image whose settings database was backed up: the image the Ready workload ran before the change.		MaxLength: 512
to string	The image the backup released.		MaxLength: 512
hash string	The hash of the change: it names the backup Job and labels the backup file.		MaxLength: 64
skipped boolean	The backup was not taken: the skip-upgrade-backup annotation named this target.		Optional: {}

PgToolBoxConsole

PgToolBoxConsole runs the pgToolBox console for the CloudNativePG Clusters of its namespace: the same console the chart installs, kept converged by the operator. The console's own authority is read-only in this namespace; whoever may create a PgToolBoxConsole may create a Deployment here anyway.

Appears in:

• PgToolBoxConsoleList

Field	Description	Default	Validation
apiVersion string	pgtoolbox.fyannk.dev/v1alpha1
kind string	PgToolBoxConsole
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec PgToolBoxConsoleSpec
status PgToolBoxConsoleStatus			Optional: {}

PgToolBoxConsoleAuthProvider

Underlying type: string

PgToolBoxConsoleAuthProvider selects how people sign in to the console.

Validation:

• Enum: [token oidc openshift]

Appears in:

• PgToolBoxConsoleAuthSpec

Field	Description
token	PgToolBoxConsoleAuthToken signs in with an API-server token the user pastes (break-glass; works everywhere).
oidc	PgToolBoxConsoleAuthOIDC signs in through the code flow of an IdP the API server also trusts, so the token is an API-server token.
openshift	PgToolBoxConsoleAuthOpenShift signs in through the OpenShift OAuth code flow, with the console's ServiceAccount as the OAuth client.

PgToolBoxConsoleAuthSpec

PgToolBoxConsoleAuthSpec configures sign-in.

Appears in:

• PgToolBoxConsoleSpec

Field	Description	Default	Validation
provider PgToolBoxConsoleAuthProvider	The sign-in provider.	token	Enum: [token oidc openshift] Optional: {}
oidc PgToolBoxConsoleOIDCSpec	OpenID Connect, for provider oidc.		Optional: {}
openshift PgToolBoxConsoleOpenShiftSpec	OpenShift OAuth, for provider openshift.		Optional: {}
tokenLogin boolean	Shows the break-glass form (paste an API-server token) next to SSO. Default true.		Optional: {}
sessionIdleTimeout Duration	Idle timeout of a session. Default 1h.		Optional: {}
sessionMaxAge Duration	Maximum age of a session whatever its activity. Default 12h.		Optional: {}

PgToolBoxConsoleDigestDeliverySpec

PgToolBoxConsoleDigestDeliverySpec names the channels. Each credential is a Secret key the operator mounts as a file; the console reads no Secret through the API.

Appears in:

• PgToolBoxConsoleDigestSpec

Field	Description	Default	Validation
chatWebhookSecretRef SecretKeyReference	A Slack or Mattermost incoming-webhook URL (https), which receives POST {"text": ...}.		Optional: {}
webhookSecretRef SecretKeyReference	A generic webhook URL (https), which receives the digest's JSON summary.		Optional: {}
smtp PgToolBoxConsoleDigestSMTPSpec	Mail over TLS.		Optional: {}
timeout Duration	Bound of one delivery attempt. Default 10s.		Optional: {}

PgToolBoxConsoleDigestSMTPSpec

PgToolBoxConsoleDigestSMTPSpec is the mail channel.

Appears in:

• PgToolBoxConsoleDigestDeliverySpec

Field	Description	Default	Validation
address string	The mail server, host:port.		MaxLength: 261 Pattern: ^[A-Za-z0-9]([-A-Za-z0-9.]*[A-Za-z0-9])?:[0-9]\{1,5\}$
tls PgToolBoxConsoleDigestSMTPTLS	starttls (required, never optional) or tls (implicit, port 465). Default starttls.	starttls	Enum: [starttls tls] Optional: {}
username string	The user for AUTH PLAIN (over TLS only).		MaxLength: 256 Optional: {}
passwordSecretRef SecretKeyReference	The password.		Optional: {}
from string	The sender, one bare address.		MaxLength: 254 MinLength: 3
to string array	The recipients, bare addresses.		MaxItems: 20 MinItems: 1 items:MaxLength: 254

PgToolBoxConsoleDigestSMTPTLS

Underlying type: string

PgToolBoxConsoleDigestSMTPTLS is how the mail connection is secured; there is no plaintext mode.

Validation:

• Enum: [starttls tls]

Appears in:

• PgToolBoxConsoleDigestSMTPSpec

PgToolBoxConsoleDigestSpec

PgToolBoxConsoleDigestSpec configures the daily digest (DIGEST_*).

Appears in:

• PgToolBoxConsoleSpec

Field	Description	Default	Validation
enabled boolean	Make a digest every day. Default: on with persistent history; with in-memory history each replica would make its own, so it is on only when set.		Optional: {}
hour integer	The UTC hour at which each digest closes its 24 hours. Default 7.		Maximum: 23 Minimum: 0 Optional: {}
retention Duration	How long digests are kept. Default 720h (30 days).		Optional: {}
delivery PgToolBoxConsoleDigestDeliverySpec	Where each digest is sent: a summary and a link, never the details. Omitted: nowhere (the page only).		Optional: {}

PgToolBoxConsoleDrillNetworkPolicy

PgToolBoxConsoleDrillNetworkPolicy is the drill Pods' NetworkPolicy: egress to DNS, the API server and the object store; ingress from the CloudNativePG operator and the console on the instance's status and metrics ports.

Appears in:

• PgToolBoxConsoleRestoreDrillsSpec

Field	Description	Default	Validation
enabled boolean	Whether the operator renders it. Default true: unlike the pgAdmin policy, it fences a copy of production data the console created.	true	Optional: {}
operatorNamespace string	The CloudNativePG operator's namespace, which reaches every instance's status port. Omitted: cnpg-system.		MaxLength: 63 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ Optional: {}
apiServerCIDRs string array	The API server's addresses (CIDRs). Empty: ports 443 and 6443 to any address.		MaxItems: 16 items:MaxLength: 49 items:Pattern: ^[0-9a-fA-F:.]+/[0-9]\{1,3\}$ Optional: {}
objectStore NetworkPolicyPeer array	The object store the drills restore from: an ipBlock, or a namespaceSelector and podSelector for an in-cluster store. Empty: objectStorePorts to any address.		MaxItems: 16 Optional: {}
objectStorePorts integer array	The object store's ports. Omitted: 443.		MaxItems: 8 items:Maximum: 65535 items:Minimum: 1 Optional: {}

PgToolBoxConsoleDrillQuantities

PgToolBoxConsoleDrillQuantities are a CPU and a memory quantity.

Appears in:

• PgToolBoxConsoleDrillResources

Field	Description	Default	Validation
cpu Quantity			Optional: {}
memory Quantity			Optional: {}

PgToolBoxConsoleDrillResources

PgToolBoxConsoleDrillResources are a drill instance's requests and limits. The console refuses to start on a quantity that is not positive or a limit below its request (CEL quantity functions are not available on every supported API server).

Appears in:

• PgToolBoxConsoleRestoreDrillsSpec

Field	Description	Default	Validation
requests PgToolBoxConsoleDrillQuantities			Optional: {}
limits PgToolBoxConsoleDrillQuantities			Optional: {}

PgToolBoxConsoleDrillStorage

PgToolBoxConsoleDrillStorage is a drill instance's volume.

Appears in:

• PgToolBoxConsoleRestoreDrillsSpec

Field	Description	Default	Validation
size Quantity	The volume size. Omitted: the source Cluster's.		Optional: {}
storageClass string	The StorageClass. Omitted: the source Cluster's.		MaxLength: 253 Pattern: ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$ Optional: {}

PgToolBoxConsoleEvidenceSpec

PgToolBoxConsoleEvidenceSpec configures the EvidenceAgent channel.

Appears in:

• PgToolBoxConsoleSpec

Field	Description	Default	Validation
enabled boolean	Read repository evidence from the namespace's EvidenceAgents. Default true. Off, the backups screen says "disabled".		Optional: {}
interval Duration	How often each agent is asked again. Omitted: the console's default.		Optional: {}

PgToolBoxConsoleExposurePolicySpec

PgToolBoxConsoleExposurePolicySpec configures the console's ingress NetworkPolicy.

Appears in:

• PgToolBoxConsoleExposureSpec

Field	Description	Default	Validation
enabled boolean	Whether the operator renders it. Omitted: true for route exposure, and for ingress and gateway exposure when from is set.		Optional: {}
from PgToolBoxConsolePolicyPeer array	Who may reach the console port: the router, ingress controller or gateway Pods. For route exposure the namespaces labelled policy-group.network.openshift.io/ingress (the OpenShift routers, host-network ones included) are always admitted, and from adds to them. Required for ingress and gateway. Every peer listed is trusted to write X-Forwarded-For unless trustedProxy.cidrs narrows it; a peer that admits (nearly) everyone (a namespaceSelector, or a podSelector alone, that pins no label value; a namespaceSelector that pins only labels many namespaces share, pod-security.kubernetes.io/*; an ipBlock wider than /8 or /32, holding a whole private IPv4 range, or a unique-local IPv6 block wider than /64) turns that trust off, and an ipBlock peer is trusted only once a console Pod has an address to check it against. A wider from is applied only once no console Pod trusts every peer any more. The probe port (health and /metrics) stays open to scrapers; it never reads the header.		MaxItems: 16 Optional: {}

PgToolBoxConsoleExposureSpec

PgToolBoxConsoleExposureSpec is the console's exposure: the common ExposureSpec, plus who the console believes about the client's address and who may reach its port.

Appears in:

• PgToolBoxConsoleSpec

Field	Description	Default	Validation
type ExposureType	The exposure mechanism.	clusterIP	Enum: [clusterIP route ingress gateway] Optional: {}
hostname string	The external hostname. Required for route, ingress and gateway.		MaxLength: 253 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ Optional: {}
tls ExposureTLSSpec	TLS for route and ingress exposure. A Route always terminates TLS at the edge; an Ingress uses certificateSecretRef, or the controller's default certificate when it is omitted. For gateway exposure TLS terminates at the Gateway listener.		Optional: {}
ingressClassName string	IngressClass name, for ingress exposure only.		MaxLength: 253 Optional: {}
gateway GatewayExposureSpec	Gateway API attachment, for gateway exposure only.		Optional: {}
annotations object (keys:string, values:string)	Annotations added to the exposure object; keys under pgtoolbox.fyannk.dev/ are rejected.		MaxProperties: 32 Optional: {}
labels object (keys:string, values:string)	Labels added to the exposure object under the operator's own identity labels, which always win. Ingress controllers and OpenShift router shards select by label; keys under pgtoolbox.fyannk.dev/ are rejected.		MaxProperties: 32 Optional: {}
trustedProxy PgToolBoxConsoleTrustedProxySpec	The reverse proxies in front of the console: how many append to X-Forwarded-For and which peers they are (TRUSTED_PROXY_HOPS, TRUSTED_PROXY_CIDRS). The console reads the header only from a peer it trusts, so the per-address sign-in budgets and the audit trail's client_ip follow each client. Omitted: one hop when an exposure object is published; trusted peers per networkPolicy.		Optional: {}
networkPolicy PgToolBoxConsoleExposurePolicySpec	The ingress NetworkPolicy around the console Pods: only the router, ingress controller or gateway reaches the console port. Omitted: on for route exposure (the OpenShift router namespaces carry policy-group.network.openshift.io/ingress), and for ingress and gateway exposure only once from names the controller's namespace; ExposureConfined says which. Never rendered for clusterIP. Every in-cluster client of the Service's http port (a debug Pod, an in-cluster MCP client) is then refused unless from lists it, and is trusted with X-Forwarded-For once listed.		Optional: {}

PgToolBoxConsoleHistorySpec

PgToolBoxConsoleHistorySpec configures the history journal.

Appears in:

• PgToolBoxConsoleSpec

Field	Description	Default	Validation
persistent boolean	Keep the history on a volume per replica, across restarts: the console is a StatefulSet whose claim template makes history-<console>-<ordinal> for each replica. false: history in memory, a Deployment. Default true.	true	Optional: {}
size Quantity	Size of each replica's history volume. Default 1Gi, which holds the default retention of a console of a few hundred instances. A change replaces the StatefulSet (its Pods keep running) and applies to volumes made later; grow an existing one by editing its claim.		Optional: {}
storageClassName string	StorageClass of the history volumes. Omitted: the cluster default. Like size, a change applies to volumes made later.		MaxLength: 253 Optional: {}

PgToolBoxConsoleIPBlock

PgToolBoxConsoleIPBlock is a NetworkPolicy ipBlock.

Appears in:

• PgToolBoxConsolePolicyPeer

Field	Description	Default	Validation
cidr string	The block, as a CIDR (10.0.0.0/8, fd00::/64).		MaxLength: 49
except string array	CIDRs inside cidr that are not admitted.		MaxItems: 16 items:MaxLength: 49 items:XValidation: {isCIDR(self) networkPolicy.from ipBlock.except entries must be CIDRs FieldValueInvalid <nil>} Optional: {}

PgToolBoxConsoleInstanceCABundleStatus

PgToolBoxConsoleInstanceCABundleStatus reports the instance CA bundle.

Appears in:

• PgToolBoxConsoleStatus

Field	Description	Default	Validation
configMap string	The ConfigMap's name.		MaxLength: 253
keptBy PgToolBoxConsoleInstanceCAKeeper	Who keeps it.		Enum: [Operator Referenced]
clusters integer	How many selected Clusters have their server CA in the bundle, when the operator keeps it (Clusters sharing one CA each count).		Optional: {}
missing PgToolBoxConsoleInstanceCAMissing array	The selected Clusters whose server CA is not in the bundle, and why; at most 32, by Cluster name (the condition message has the count).		MaxItems: 32 Optional: {}

PgToolBoxConsoleInstanceCAKeeper

Underlying type: string

PgToolBoxConsoleInstanceCAKeeper says who keeps the instance CA bundle.

Validation:

• Enum: [Operator Referenced]

Appears in:

• PgToolBoxConsoleInstanceCABundleStatus

Field	Description
Operator	InstanceCAKeptByOperator means the operator mirrors the selected Clusters' server CAs into <name>-instance-ca.
Referenced	InstanceCAReferenced means spec.instanceCABundleRef names a ConfigMap the operator never reads or writes.

PgToolBoxConsoleInstanceCAMissing

PgToolBoxConsoleInstanceCAMissing is a Cluster whose server CA the operator could not put in the bundle.

Appears in:

• PgToolBoxConsoleInstanceCABundleStatus

Field	Description	Default	Validation
cluster string	The Cluster's name.		MaxLength: 253
secret string	The server CA Secret read: status.certificates.serverCASecret, else spec.certificates.serverCASecret, else <cluster>-ca.		MaxLength: 253 Optional: {}
reason Reason	Why: SecretNotFound, SecretKeyMissing (no ca.crt), InstanceCAInvalid (ca.crt holds no PEM certificate) or InstanceCABundleFull.		MaxLength: 64

PgToolBoxConsoleLabelRequirement

PgToolBoxConsoleLabelRequirement is one matchExpressions entry.

Appears in:

• PgToolBoxConsoleLabelSelector

Field	Description	Default	Validation
key string	The label key ([prefix/]name).		MaxLength: 317 MinLength: 1 Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?([.][a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?[A-Za-z0-9]([-A-Za-z0-9_.]\{0,61\}[A-Za-z0-9])?$
operator LabelSelectorOperator	In, NotIn, Exists or DoesNotExist.		Enum: [In NotIn Exists DoesNotExist]
values PgToolBoxConsoleLabelValue array	The values, for In and NotIn.		MaxItems: 16 MaxLength: 63 Pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ Optional: {}

PgToolBoxConsoleLabelSelector

PgToolBoxConsoleLabelSelector is a label selector, bounded and checked here so that the API server never refuses the NetworkPolicy rendered from it: label keys and values in their syntax, operators from the four the API knows, values only (and always) for In and NotIn.

Appears in:

• PgToolBoxConsolePolicyPeer

Field	Description	Default	Validation
matchLabels object (keys:string, values:PgToolBoxConsoleLabelValue)	Labels the object must carry, with these values.		MaxProperties: 16 Optional: {}
matchExpressions PgToolBoxConsoleLabelRequirement array	Requirements the object's labels must meet, all of them.		MaxItems: 16 Optional: {}

PgToolBoxConsoleLabelValue

Underlying type: string

PgToolBoxConsoleLabelValue is a label value: at most 63 characters, alphanumeric at both ends, '-', '_' and '.' inside.

Validation:

• MaxLength: 63
• Pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$

Appears in:

• PgToolBoxConsoleLabelRequirement
• PgToolBoxConsoleLabelSelector

PgToolBoxConsoleLifecycleKeeper

Underlying type: string

PgToolBoxConsoleLifecycleKeeper says who keeps the lifecycle ConfigMap.

Validation:

• Enum: [Operator User Referenced]

Appears in:

• PgToolBoxConsoleLifecycleStatus

Field	Description
Operator	LifecycleKeptByOperator means the ConfigMap holds the operator's built-in table, rewritten when the operator brings a newer one.
User	LifecycleKeptByUser means someone edited the ConfigMap the operator created, or annotated it user-managed; the operator no longer writes it.
Referenced	LifecycleReferenced means spec.lifecycleConfigMapRef names a ConfigMap the operator never writes.

PgToolBoxConsoleLifecycleStatus

PgToolBoxConsoleLifecycleStatus reports the lifecycle ConfigMap.

Appears in:

• PgToolBoxConsoleStatus

Field	Description	Default	Validation
configMap string	The ConfigMap's name.		MaxLength: 253
keptBy PgToolBoxConsoleLifecycleKeeper	Who keeps it.		Enum: [Operator User Referenced]
reviewed string	The day the operator's table was last reviewed, when the operator keeps it.		MaxLength: 10 Optional: {}

PgToolBoxConsoleList

PgToolBoxConsoleList contains a list of PgToolBoxConsole.

Field	Description	Default	Validation
apiVersion string	pgtoolbox.fyannk.dev/v1alpha1
kind string	PgToolBoxConsoleList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items PgToolBoxConsole array

PgToolBoxConsoleMCPSpec

PgToolBoxConsoleMCPSpec configures the MCP endpoint. A client authenticates with Authorization: Bearer <token>, never the session cookie: a console grant, which the console issues as the clients' OAuth authorization server once the person signs in and approves the client, or (while auth.tokenLogin is on) a raw API-server token. Every tool is authorized as its owner exactly like the screen it mirrors.

Appears in:

• PgToolBoxConsoleSpec

Field	Description	Default	Validation
enabled boolean	Serve the read-only MCP endpoint. Default false.		Optional: {}
writeTools boolean	Add the MCP write tools (backup, reload, restart, promote) when the console serves operations. Each runs the console's own operation as the person, once, after a confirmation (MCP elicitation): backup and reload in the client's form, which the client relays (it proves the client asked); restart and promote on a console page in the person's own browser session (it proves the person approved). A client that cannot ask is refused. A console grant acts only if consented for "read and operate". Requires enabled. Default false.		Optional: {}
maxResultBytes integer	The cap on one tool result's JSON, in bytes (MCP_MAX_RESULT_BYTES); a larger result is shortened and says so. Omitted: the console's default, 262144 (256 KiB). Used only with enabled.		Maximum: 4.194304e+06 Minimum: 16384 Optional: {}
callTimeout Duration	The time limit of one tool call (MCP_CALL_TIMEOUT). Omitted: the console's default, 20s. Used only with enabled.		Optional: {}
oauthAccessTTL Duration	The lifetime of an access token the console issues to an MCP client (MCP_OAUTH_ACCESS_TTL); the client renews it with its refresh token. Omitted: the console's default, 1h. Used only with enabled.		Optional: {}
oauthClientMetadataDocuments boolean	Accept OAuth client ID metadata documents (MCP_OAUTH_CLIENT_METADATA_DOCUMENTS): a client may name itself with an HTTPS URL, and the console fetches the document at that URL, only from a public address and, when oauthClientMetadataHosts is set, only from those hosts. The console then needs egress to the Internet on TCP 443; the operator renders no NetworkPolicy around the console, so where egress is policed the site's policy must allow it. Dynamic registration, always accepted, needs no egress. Used only with enabled. Default false.		Optional: {}
oauthClientMetadataHosts string array	The only hosts (lower-case DNS names) the console fetches client ID metadata documents from (MCP_OAUTH_CLIENT_METADATA_HOSTS). It takes effect with oauthClientMetadataDocuments and is ignored without it. Omitted: any public address. Used only with enabled.		MaxItems: 32 items:MaxLength: 253 items:Pattern: ^[a-z0-9]([-a-z0-9]\{0,61\}[a-z0-9])?(\.[a-z0-9]([-a-z0-9]\{0,61\}[a-z0-9])?)*$ Optional: {}

PgToolBoxConsoleOIDCClient

PgToolBoxConsoleOIDCClient is one more OIDC client of the console's issuer.

Appears in:

• PgToolBoxConsoleOIDCSpec

Field	Description	Default	Validation
clientID string	The client id.		MaxLength: 256 MinLength: 1
clientSecretRef SecretKeySelector	The Secret key holding the client secret, mounted as a file.

PgToolBoxConsoleOIDCSpec

PgToolBoxConsoleOIDCSpec is the OpenID Connect code flow. Groups come from the API server (SelfSubjectReview), never from a claim.

Appears in:

• PgToolBoxConsoleAuthSpec

Field	Description	Default	Validation
issuerURL string	The issuer, https only.		MaxLength: 512 Pattern: ^https://
clientID string	The client id.		MaxLength: 256 MinLength: 1
clientSecretRef SecretKeySelector	The Secret key holding the client secret, mounted as a file.
redirectURL string	The callback URL. Defaults to <publicURL>/auth/oidc/callback.		MaxLength: 512 Pattern: ^https:// Optional: {}
scopes string array	Scopes requested. Default: openid, email, profile, offline_access.		MaxItems: 16 items:MaxLength: 128 Optional: {}
caConfigMapRef LocalObjectReference	A ConfigMap with ca.crt trusting a private IdP. Omitted: the system roots.		Optional: {}
requireEmailVerified boolean	Refuse a login whose ID token lacks email_verified=true. Default true; set false only for an IdP that omits the claim.		Optional: {}
grantClient PgToolBoxConsoleOIDCClient	A second client of the same issuer for the identity provider sign-ins of console grants (MCP clients), registered with the same redirect URI. An identity provider that keeps one refresh token per person and client (dex) otherwise ends the browser session's renewal each time an assistant connects. The API server's JWT authenticator must accept this client's audience too. Omitted: grants sign in as clientID.		Optional: {}

PgToolBoxConsoleOpenShiftSpec

PgToolBoxConsoleOpenShiftSpec is the OpenShift OAuth code flow. The console's ServiceAccount is the OAuth client; its redirect annotation is rendered from the public URL.

Appears in:

• PgToolBoxConsoleAuthSpec

Field	Description	Default	Validation
clientSecretRef SecretKeyReference	The Secret key holding a long-lived ServiceAccount token to present as the client secret. Omitted: the console presents its projected token.		Optional: {}
caConfigMapRef LocalObjectReference	A ConfigMap with ca.crt trusting the OAuth server. Omitted: the service CA OpenShift publishes in every namespace.		Optional: {}

PgToolBoxConsolePolicyPeer

PgToolBoxConsolePolicyPeer is a NetworkPolicyPeer, bounded so that the API server checks it here rather than refuse the policy the operator renders from it.

Appears in:

• PgToolBoxConsoleExposurePolicySpec

Field	Description	Default	Validation
podSelector PgToolBoxConsoleLabelSelector	Pods (of this namespace, or of the namespaces namespaceSelector selects). Pinning no label value (no matchLabels, no In) with no namespaceSelector: (nearly) every Pod of this namespace, which ExposureConfined reports as broad.		Optional: {}
namespaceSelector PgToolBoxConsoleLabelSelector	Namespaces. Pinning no label value (no matchLabels, no In), or only labels many namespaces share (pod-security.kubernetes.io/, security.openshift.io/, openshift.io/run-level): (nearly) every namespace, which ExposureConfined reports as broad. A label any namespace owner may set on their own namespace is not told apart: pin one only an installer can set (kubernetes.io/metadata.name).		Optional: {}
ipBlock PgToolBoxConsoleIPBlock	Addresses: a CIDR, less the except CIDRs inside it. Alone in its peer. Wider than /8 (IPv4) or /32 (IPv6), holding a whole private IPv4 range, a unique-local (fc00::/7) block wider than /64, or one holding a console Pod's address, is broad.		Optional: {}

PgToolBoxConsolePrometheusSpec

PgToolBoxConsolePrometheusSpec is the Prometheus HTTP API the charts query.

Appears in:

• PgToolBoxConsoleSpec

Field	Description	Default	Validation
url string	The Prometheus (or Thanos querier) URL.		MaxLength: 512 Pattern: ^https?://
tokenSecretRef SecretKeyReference	A Secret key holding a bearer token, mounted as a file.		Optional: {}
projectedToken boolean	Present the console's own ServiceAccount token, projected and rotated by the kubelet (what the OpenShift thanos-querier accepts once the ServiceAccount may view metrics).		Optional: {}
tokenAudience string	The audience of the projected token. Omitted: the API server's own audience, which a TokenReview-based proxy (OpenShift's thanos-querier behind kube-rbac-proxy) expects; such a token is also accepted by the API server itself, so only a Prometheus you trust may receive it. Set it when the server checks a dedicated audience: the token is then useless against the API server.		MaxLength: 256 MinLength: 1 Pattern: ^[^\s]+$ Optional: {}
caConfigMapRef LocalObjectReference	A ConfigMap with ca.crt that signed the server certificate. Omitted: the system roots.		Optional: {}
namespaced boolean	Add namespace=<ns> to each query, as OpenShift's tenancy port requires.		Optional: {}
range Duration	The charts' window. Omitted: 1h.		Optional: {}

PgToolBoxConsoleRestoreDrillsSpec

PgToolBoxConsoleRestoreDrillsSpec configures restore drills. Drill Clusters run in the console's namespace, the only one it watches.

Appears in:

• PgToolBoxConsoleSpec

Field	Description	Default	Validation
enabled boolean	Offer the drill. Default false.		Optional: {}
prefix string	The drill Clusters' name prefix. Omitted: drill-.		MaxLength: 20 Pattern: ^[a-z]([-a-z0-9]*)?$ Optional: {}
timeLimit Duration	When an unfinished drill is recorded as timed out and deleted. Omitted: 2h.		Optional: {}
resources PgToolBoxConsoleDrillResources	The drill instance's CPU and memory. Omitted: the source Cluster's.		Optional: {}
storage PgToolBoxConsoleDrillStorage	The drill instance's storage. Omitted: the source Cluster's.		Optional: {}
maxConcurrent integer	The drills of this console running at once (one per source in any case). Omitted: 3.		Maximum: 20 Minimum: 1 Optional: {}
sealKeySecretRef SecretKeyReference	The drill seal's own keys (RESTORE_DRILL_SEAL_KEY_FILE): a key of a Secret in the console's namespace holding one key per line, at least 32 bytes each (the first seals, all verify), mounted read-only. Keep the Secret readable by the console alone. Omitted: the keys derive from the session secret, so whoever can read the session Secret can forge a seal.		Optional: {}
networkPolicy PgToolBoxConsoleDrillNetworkPolicy	The NetworkPolicy around the drill Pods. A promoted drill is a live copy of a production database: the console turns off the background workers it knows (logical replication, pg_cron, TimescaleDB), and this policy holds the rest to DNS, the API server and the object store.		Optional: {}

PgToolBoxConsoleSpec

PgToolBoxConsoleSpec declares one console in this namespace: the console the chart installs, run and kept converged by the operator. It watches the CloudNativePG Clusters of its own namespace only; every reader still sees only what their own RBAC allows (SubjectAccessReview).

Appears in:

• PgToolBoxConsole

Field	Description	Default	Validation
image ImageSpec	The console image. Omitted, the operator's default applies (the console released with the operator). The repository must be in the operator's allow-list (--console-image-repositories; by default the default image's repository only).		Optional: {}
replicas integer	Replicas of the console, with or without persistent history. Each replica keeps its own history; the exposure keeps a person on one (cookie affinity).	2	Maximum: 5 Minimum: 1 Optional: {}
clusterSelector LabelSelector	Narrows the Clusters shown to those this selector matches, on top of what each user's own RBAC allows. Omitted: every Cluster of the namespace.		Optional: {}
auth PgToolBoxConsoleAuthSpec	How people sign in.	{ provider:token }	Optional: {}
publicURL string	The URL people type, https://host. Used for cookies, redirects and the OpenShift callback. Defaults to https://<exposure.hostname>.		MaxLength: 512 Pattern: ^https://[a-z0-9]([-a-z0-9.]*[a-z0-9])?(:[0-9]\{1,5\})?/?$ Optional: {}
exposure PgToolBoxConsoleExposureSpec	Exposure of the console. The console streams events over SSE; the operator sets the long edge timeouts it knows for each type.	{ type:clusterIP }	Optional: {}
instanceCABundleRef LocalObjectReference	The CA bundle the console verifies each instance's /pg/status with: a ConfigMap with the key ca.crt holding the PEM server CAs of the namespace's Clusters. Omitted (recommended): the operator keeps <name>-instance-ca itself, copying only the public ca.crt of each selected Cluster's server CA Secret, and follows CloudNativePG's CA renewals and Clusters coming and going; the console still reads no Secret. Set: the console mounts the named ConfigMap, which you keep current yourself (CloudNativePG renews its self-signed CA every 90 days, so a one-off copy expires). A Cluster missing from the bundle is shown as "not verifiable", never read unverified.		Optional: {}
lifecycleConfigMapRef LocalObjectReference	The end-of-life table the diagnostics read. Omitted, the operator creates <console>-lifecycle with its built-in table and keeps it at the operator's table until someone edits it (or annotates it pgtoolbox.fyannk.dev/user-managed=true); from then on it is left alone. Set, the console reads that ConfigMap (key lifecycle.json) and the operator creates none.		Optional: {}
evidence PgToolBoxConsoleEvidenceSpec	Repository evidence from the namespace's EvidenceAgents.		Optional: {}
operations boolean	The operations endpoints (backup, reload, restart, promote). Every write is made with the caller's own token and authorized by the API server. Default true.		Optional: {}
podLogs boolean	Pod logs: the bounded log tail and the log-based diagnostics, which need get pods/log. Default true.		Optional: {}
restoreDrills PgToolBoxConsoleRestoreDrillsSpec	Restore drills: the "Run a restore drill" operation of the Backups screen. A person starts a drill with their own token; the console restores the latest backup into a throwaway one-instance Cluster in this namespace (no WAL archiver, no backup configuration), checks it without SQL and deletes it after its check or the time limit. Enabled, the operator also binds the console's ServiceAccount to pgtoolbox-console-restore-drills (get, list, watch and delete clusters, in this namespace only). Needs operations.		Optional: {}
mcp PgToolBoxConsoleMCPSpec	The read-only MCP endpoint at /mcp, for AI agents and IDE assistants. Off by default.		Optional: {}
tracing PgToolBoxConsoleTracingSpec	OpenTelemetry tracing: spans for HTTP requests, the Kubernetes API calls they make and MCP tool calls, exported over OTLP/HTTP. Off when omitted.		Optional: {}
monitoringURL string	The link-out to the site's monitoring system: https, or root-relative.		MaxLength: 512 Optional: {}
prometheus PgToolBoxConsolePrometheusSpec	The PromQL source of the metrics charts. Omitted, the charts come from the console's own ring.		Optional: {}
history PgToolBoxConsoleHistorySpec	The history journal, and with it the state snapshots, the timeline and the digests. Persistent by default: the console is then a StatefulSet with one volume per replica.	{ persistent:true }	Optional: {}
digest PgToolBoxConsoleDigestSpec	The daily digest: a summary page per day, kept with the history, and optional delivery to chat, a webhook or mail. Delivery needs history.persistent (the message links to the digest's page); only the replica holding the Lease <console>-digest delivers.		Optional: {}
resources ResourceRequirements	Compute resources of the console container. Omitted: requests 50m and 128Mi, limits 1 CPU and 512Mi (the chart's).		Optional: {}
metadataPropagation MetadataPropagation array	Labels and annotations copied onto the generated objects.		MaxItems: 8 Optional: {}

PgToolBoxConsoleStatus

PgToolBoxConsoleStatus is the observed state of a PgToolBoxConsole.

Appears in:

• PgToolBoxConsole

Field	Description	Default	Validation
observedGeneration integer	The generation the status was computed from.		Optional: {}
url string	Where the console is reached.		MaxLength: 512 Optional: {}
image string	The image reference the console runs.		MaxLength: 512 Optional: {}
lifecycle PgToolBoxConsoleLifecycleStatus	The ConfigMap the console reads its end-of-life table from, and who keeps it: Operator (the operator's table, updated with the operator), User (edited or annotated user-managed, left alone) or Referenced (spec.lifecycleConfigMapRef).		Optional: {}
instanceCABundle PgToolBoxConsoleInstanceCABundleStatus	The instance CA bundle the console mounts, who keeps it and, when the operator does, how many Clusters it covers and which are missing.		Optional: {}
publishedExposureKinds string array	The exposure kinds (Route, HTTPRoute) the operator published for this console and has not seen gone since: where it is later refused one of them, it reports what may remain of it.		MaxItems: 2 items:Enum: [Route HTTPRoute] Optional: {}
conditions Condition array	Conditions: Ready (summary), ConfigurationValid, WorkloadReady, ExposureReady, Progressing, Stalled and the advisory InstanceCABundleComplete and ExposureConfined.		MaxItems: 16 Optional: {}

PgToolBoxConsoleTracingSpec

PgToolBoxConsoleTracingSpec configures OpenTelemetry tracing (the console's OTEL_* variables). Spans carry no payload unless includePayloads is set; the egress to the collector is the site's NetworkPolicy decision.

Appears in:

• PgToolBoxConsoleSpec

Field	Description	Default	Validation
endpoint string	The OTLP/HTTP base URL (OTEL_EXPORTER_OTLP_ENDPOINT); /v1/traces is appended. For example http://jaeger-collector.monitoring:4318 or https://api.smith.langchain.com/otel.		MaxLength: 512 MinLength: 1 Pattern: ^https?://[^\s/?#@]+(/[^\s?#]*)?$
headersSecretRef SecretKeyReference	A Secret key holding the exporter's headers, key=value,... with percent-encoded values (an API key, a project name), mounted as a file and read at start: the console reads no Secret through the API.		Optional: {}
serviceName string	The service name (OTEL_SERVICE_NAME). Default pgtoolbox-console.		MaxLength: 128 Pattern: ^[A-Za-z0-9][-._A-Za-z0-9]*$ Optional: {}
sampler string	The sampler (OTEL_TRACES_SAMPLER). Default parentbased_always_on: a request the caller traces is traced.		Enum: [always_on always_off traceidratio parentbased_always_on parentbased_always_off parentbased_traceidratio] Optional: {}
samplerArg string	The ratio of the traceidratio samplers (OTEL_TRACES_SAMPLER_ARG), from "0" to "1".		Pattern: ^(0(\.[0-9]\{1,6\})?|1(\.0\{1,6\})?)$ Optional: {}
includePayloads boolean	Add MCP tool arguments and results to the tool spans, redacted and capped (TRACING_INCLUDE_PAYLOADS). Default false; tokens never.		Optional: {}

PgToolBoxConsoleTrustedProxySpec

PgToolBoxConsoleTrustedProxySpec says which X-Forwarded-For entries the console believes.

Appears in:

• PgToolBoxConsoleExposureSpec

Field	Description	Default	Validation
hops integer	How many proxies append to X-Forwarded-For: 2 for a load balancer that appends in front of the router. 0 ignores the header. Omitted: 1 when an exposure object is published, else 0.		Maximum: 8 Minimum: 0 Optional: {}
cidrs string array	The proxies' own addresses, as the console sees them (the router or ingress controller Pods; the nodes for a host-network router). The header is read only from a peer inside one. Omitted: with the NetworkPolicy rendered, any peer it admits (every other Pod is refused by the network); without it, none, and the header is ignored: every client behind the proxy then shares its address, and no per-address sign-in budget applies (only the per-flow, per-token and per-replica bounds).		MaxItems: 32 items:MaxLength: 49 items:XValidation: {isCIDR(self) trustedProxy.cidrs entries must be CIDRs FieldValueInvalid <nil>} Optional: {}

PropagationTarget

Underlying type: string

PropagationTarget selects which generated objects receive propagated metadata.

Validation:

• Enum: [All Workload Pod Service Exposure Storage]

Appears in:

• MetadataPropagation

Field	Description
All	PropagationTargetAll is every generated object.
Workload	PropagationTargetWorkload is Deployments, StatefulSets and Jobs.
Pod	PropagationTargetPod is Pod templates.
Service	PropagationTargetService is Services.
Exposure	PropagationTargetExposure is Routes, Ingresses and HTTPRoutes.
Storage	PropagationTargetStorage is PersistentVolumeClaims.

Reason

Underlying type: string

Reason is a condition or Event reason from the frozen catalogue. Reasons are API surface — alerting and automation key on them — so they are typed, registered once, checked against a golden file by a test, and only ever extended. A reason that copies a child's fact (a Pod's Unschedulable, a Job's failure) names the fact, never "waiting".

Appears in:

• PgToolBoxConsoleInstanceCAMissing

Field	Description
AsExpected	ReasonAsExpected is the healthy reason of every aspect condition and of Ready.
Initializing	ReasonInitializing is the reason of a condition the controller has not evaluated yet: Unknown on first touch.
Reconciling	ReasonReconciling is Progressing=True while children converge.
ReconcileError	ReasonReconcileError is Ready=False when the last reconciliation ended with an error; the message carries the bounded error text.
ReconciliationPaused	ReasonReconciliationPaused is reported while the object carries the reconcile=skip annotation.
ConfigurationInvalid	ReasonConfigurationInvalid is ConfigurationValid=False (and Stalled=True): a cross-object check the CRD cannot express failed.
ResourceNotOwned	ReasonResourceNotOwned is ConfigurationValid=False when an object the operator must manage exists under the generated name and is controlled by someone else.
SecretNotFound	ReasonSecretNotFound names a referenced Secret that does not exist.
SecretKeyMissing	ReasonSecretKeyMissing names a referenced Secret key that is absent.
ConfigMapNotFound	ReasonConfigMapNotFound names a referenced ConfigMap that does not exist.
ClusterNotFound	ReasonClusterNotFound names a referenced CloudNativePG Cluster that does not exist in the namespace (an EvidenceAgent's spec.clusterRef, a PgAdmin's spec.clusterRefs).
ImageNotAllowed	ReasonImageNotAllowed: the image a CR names (spec.image, an oauth-proxy image) is outside the operator's allow-list of repositories (--evidence-agent-image-repositories, --pgadmin-image-repositories).
HostnameNotAllowed	ReasonHostnameNotAllowed: spec.exposure.hostname is outside the operator's allow-list of host suffixes (EXPOSURE_ALLOWED_HOST_SUFFIXES), so the operator publishes no Route, Ingress or HTTPRoute for it.
RolloutInProgress	Workload facts, copied from the child.
RolloutStuck
PodUnschedulable
ImagePullFailed
CrashLoopBackOff
ReplicaFailure
PodNotReady
ScaledToZero
NotRequested	Exposure facts.
NotAdmitted
NotAccepted
GatewayNotFound
HostnameConflict
RouteAPIUnavailable	ReasonRouteAPIUnavailable, ReasonGatewayAPIUnavailable: the optional API the exposure needs is not served or not readable (ProbeListable returned NotFound/NoMatch/Forbidden at start).
GatewayAPIUnavailable
ReconciliationFailed	Event reasons of the classified Warning recorded when an error ends a reconciliation.
QuotaExceeded
AdmissionDenied
NamespaceNotWatched	ReasonNamespaceNotWatched is Ready=Unknown (and the Warning Event of the same reason) on an object of a namespace of WATCH_NAMESPACES the operator left out at start because it lacks some of its permissions there: its status is no longer updated. Written once at start, best effort, only where the operator may still write it; the message names that namespace and the permissions missing there.
BarmanPluginNotConfigured	ReasonBarmanPluginNotConfigured: the Cluster declares neither an enabled barman-cloud plugin with a barmanObjectName nor an in-tree spec.backup.barmanObjectStore, and spec.objectStoreRef is not set.
ObjectStoreNotFound	ReasonObjectStoreNotFound: the resolved ObjectStore, or the pgBackRest plugin's Stanza or Archive, does not exist.
ObjectStoreAPIUnavailable	ReasonObjectStoreAPIUnavailable: barmancloud.cnpg.io ObjectStore (or, for a Cluster backed up with pgBackRest, pgbackrest.dalibo.com Stanza or pgbackrest.cnpg.opera.com Archive) is not served or not readable by the operator.
UnsupportedObjectStore	ReasonUnsupportedObjectStore: the backup configuration (an ObjectStore, the in-tree spec.backup.barmanObjectStore, or a pgBackRest plugin's Stanza or Archive) is outside the agent's profile, or the Cluster backs up through a plugin the agent does not read; the message names the shape and the field.
DestinationInvalid	ReasonDestinationInvalid: destinationPath, endpointURL, the server name (or a pgBackRest bucket, path, endpoint or stanza) is rejected by the shared evidence contract parser.
RegionRequired	ReasonRegionRequired: AWS S3 (no endpointURL) without s3Credentials.region.
ImageRequired	ReasonImageRequired: spec.image is unset and the operator has no default evidence agent image.
ServiceCAPending	ReasonServiceCAPending: the OpenShift service CA has not yet issued the serving certificate or injected the CA bundle.
CertificateIssued	ReasonCertificateIssued is the Event of a newly issued or renewed operator-signed serving certificate.
AwaitingDecision	ReasonAwaitingDecision: the request is Pending; nothing is bound.
AccessGranted	ReasonAccessGranted: the request is Approved and its RoleBinding is in place.
AccessDenied	ReasonAccessDenied: the request was denied; nothing is bound.
AccessExpired	ReasonAccessExpired: spec.expiresAt passed; the RoleBinding, if any, was deleted.
AccessRevoked	ReasonAccessRevoked: the grant was revoked; the RoleBinding was deleted.
RoleBindingMissing	ReasonRoleBindingMissing: the request is Approved and its RoleBinding does not exist (deleted by hand, or the approval's create never landed). The operator never recreates it: revoke and request again.
RoleBindingDrifted	ReasonRoleBindingDrifted: the request's RoleBinding binds another subject or ClusterRole than the request names; the operator deleted it (fail closed).
RoleBindingOrphaned	ReasonRoleBindingOrphaned: a RoleBinding of a request that is not Approved (an approval whose status write failed) outlived the grace period and was deleted.
SelfApprovalRefused	ReasonSelfApprovalRefused: the recorded approver is the subject itself; the operator revoked the grant (four eyes).
RoleBindingDeleted	ReasonRoleBindingDeleted is the Normal Event of a RoleBinding the operator deleted (expiry, revocation, drift, orphan).
NoClusterSelected	ClusterNotFound (a clusterRefs entry names no Cluster) is the shared ReasonClusterNotFound, registered with the EvidenceAgent reasons. ReasonNoClusterSelected: clusterSelector matches no Cluster.
PoolerNotFound	ReasonPoolerNotFound: a pooler:<name> endpoint names no Pooler of a registered Cluster.
TooManyServers	ReasonTooManyServers: the offered set exceeds the bound the credential files and the registration accept.
PgAdminNotRunning	ReasonPgAdminNotRunning: pgAdmin has no Ready Pod yet; registration and the egress statement wait for it.
RegistrationRunning	ReasonRegistrationRunning: the registration Job for the current offered set is running.
RegistrationFailed	ReasonRegistrationFailed: the registration Job failed; the message carries its fact.
ServersRegistered	ReasonServersRegistered is the Event of a successful registration.
RegistrationStarted	ReasonRegistrationStarted is the Event of a new registration Job.
UpgradeBackupRunning	ReasonUpgradeBackupRunning: the pre-upgrade backup of pgAdmin's settings database runs before the new image rolls out.
UpgradeBackupFailed	ReasonUpgradeBackupFailed: the pre-upgrade backup failed; the old image keeps running.
UpgradeBackupCompleted	ReasonUpgradeBackupCompleted is the Event of a completed backup.
UpgradeBackupSkipped	ReasonUpgradeBackupSkipped is the Warning Event of a pre-upgrade backup skipped by AnnotationSkipUpgradeBackup.
RolloutStarted	ReasonRolloutStarted is the Event of a changed workload hash.
PgAdminEgressOpen	ReasonPgAdminEgressOpen: PgAdminEgressConfined=False.
DatabaseRoleAPIUnavailable	ReasonDatabaseRoleAPIUnavailable: the CNPG DatabaseRole API is not readable (a refused List), or not served while spec.configDatabase needs it; only application and superuser credentials are offered. CloudNativePG 1.30 and later serve the kind; an install whose CRDs lack it is not a problem for the offered credentials: none is offered, and the PgAdmin is Ready.
PoolerAPIUnavailable	ReasonPoolerAPIUnavailable: the CNPG Pooler API is not readable.
GrantMissing	ReasonGrantMissing: a crossNamespaceClusterRefs entry names a Cluster no PgAdminAccess of its namespace grants this PgAdmin.
ConfigDatabaseNotReady	ReasonConfigDatabaseNotReady: the configDatabase's DatabaseRole or Database is not applied by CloudNativePG yet, or its generated password Secret is not recorded; pgAdmin waits for it.
PasswordGenerationUnavailable	ReasonPasswordGenerationUnavailable: the CloudNativePG DatabaseRole API of this cluster cannot generate a password (CloudNativePG 1.31 and later can), which configDatabase needs: the operator never holds one.
DatabaseAPIUnavailable	ReasonDatabaseAPIUnavailable: the CloudNativePG Database API, which configDatabase needs, is not served or not readable.
ConsoleImageRequired	ReasonConsoleImageRequired: spec.image is unset and the operator has no default console image.
ConsoleRoleMissing	ReasonConsoleRoleMissing: the ClusterRole the console's RoleBinding references (pgtoolbox-console, shipped with the operator) does not exist, so the console could read nothing.
InstanceCAMissing	ReasonInstanceCAMissing: InstanceCABundleComplete=False, at least one selected Cluster's server CA is not in the mirrored bundle; status.instanceCABundle.missing says which and why.
InstanceCAInvalid	ReasonInstanceCAInvalid: a Cluster's server CA Secret has a ca.crt that holds no PEM certificate.
InstanceCABundleFull	ReasonInstanceCABundleFull: the mirrored bundle reached the size a ConfigMap can hold; the Clusters after it (by name) are left out.
ExposureOpen	ReasonExposureOpen: ExposureConfined=False, the console is exposed without its ingress NetworkPolicy, so any Pod can reach its port. ExposureConfined=Unknown with this reason: the only exposure object is a Route or HTTPRoute the console published before the operator was refused its kind, which the operator may not read either, so it may be gone or still serve unconfined.
ExposurePeersBroad	ReasonExposurePeersBroad: ExposureConfined=False, a networkPolicy.from peer admits (nearly) every namespace (a namespaceSelector that pins no label value), every Pod of the console's namespace (such a podSelector alone), or the Pod network or every address (an ipBlock wider than /8 or /32, holding a whole private range, a console Pod's address, or overlapping a Node's podCIDRs): its peers are not the proxies, so the console trusts none of them with X-Forwarded-For.
ExposurePolicyBypassed	ReasonExposurePolicyBypassed: ExposureConfined=False, another NetworkPolicy of the namespace admits peers the exposure does not list to the console port (NetworkPolicies add up), or there were too many to check: the console trusts none of the peers with X-Forwarded-For.
ExposureTrustUnverified	ReasonExposureTrustUnverified: ExposureConfined=False, the networkPolicy.from peers could not be checked yet, or are held back: an ipBlock peer while no console Pod has an address to check it against and no earlier one verified the same blocks, more console Pods than one bounded list returns, or a widened from that waits until no console Pod trusts every peer any more. The console trusts none of the peers with X-Forwarded-For meanwhile.
ExposurePolicyKept	ReasonExposurePolicyKept: ExposureConfined=False, the ingress NetworkPolicy is no longer rendered (the exposure or the policy was turned off) and is kept while a console Pod may still trust every peer it admits on the operator's grant: until the rollout without the grant is through. The message names a Pod stuck terminating that holds it. Also while the console is stalled on HostnameNotAllowed: its Ingress, Route or HTTPRoute is withdrawn, and the workload and the policy stay as they were.
ExposurePolicyInvalid	ReasonExposurePolicyInvalid: ConfigurationValid=False, the API server refused the ingress NetworkPolicy rendered from spec.exposure.networkPolicy (a selector or block the CRD could not check), or an admission policy or webhook denied it. Looked at again every five minutes and on every spec change.

SecretKeyReference

SecretKeyReference names a key of a Secret in the referencing object's namespace; unlike SecretKeySelector, the key has no default.

Appears in:

• EvidenceAgentPgBackRestSpec
• PgToolBoxConsoleDigestDeliverySpec
• PgToolBoxConsoleDigestSMTPSpec
• PgToolBoxConsoleOpenShiftSpec
• PgToolBoxConsolePrometheusSpec
• PgToolBoxConsoleRestoreDrillsSpec
• PgToolBoxConsoleTracingSpec

Field	Description	Default	Validation
name string	The Secret name.		MaxLength: 253 MinLength: 1 Pattern: ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$
key string	The key.		MaxLength: 253 MinLength: 1 Pattern: ^[-._a-zA-Z0-9]+$

SecretKeySelector

SecretKeySelector names a key of a Secret in the referencing object's namespace.

Appears in:

• PgAdminOAuth2Spec
• PgToolBoxConsoleOIDCClient
• PgToolBoxConsoleOIDCSpec

Field	Description	Default	Validation
name string	The Secret name.		MaxLength: 253 MinLength: 1 Pattern: ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$
key string	The key.	client-secret	MaxLength: 253 Pattern: ^[-._a-zA-Z0-9]+$ Optional: {}

ServerState

Underlying type: string

ServerState is the registration state of one offered server.

Validation:

• Enum: [Registered Pending NotOffered]

Appears in:

• PgAdminServerStatus

Field	Description
Registered	ServerStateRegistered means the last successful registration carries it.
Pending	ServerStatePending means offered, not registered yet.
NotOffered	ServerStateNotOffered marks a credential the Cluster has that this PgAdmin does not offer; the message says why.

WorkloadIdentitySpec

WorkloadIdentitySpec binds the agent to a cloud identity. Setting it (even empty, as GKE workload identity federation needs nothing more) is the opt-in: without it a configuration using the Pod's cloud identity is refused, so it never falls back to the node's.

Appears in:

• EvidenceAgentSpec

Field	Description	Default	Validation
serviceAccountAnnotations object (keys:string, values:string)	Annotations added to the agent's ServiceAccount, among the identity webhooks' own: eks.amazonaws.com/role-arn, eks.amazonaws.com/sts-regional-endpoints, eks.amazonaws.com/token-expiration (IRSA), azure.workload.identity/client-id, azure.workload.identity/tenant-id (Azure workload identity) and iam.gke.io/gcp-service-account (GKE). Any other ServiceAccount annotation can change what the account is (an OpenShift OAuth client, for one) and is refused.		MaxProperties: 6 Optional: {}
podLabels object (keys:string, values:LabelValue)	Labels added to the agent's Pod: azure.workload.identity/use only (Azure workload identity). Any other label could select the agent into a Service or a policy (a CloudNativePG -rw Service, for one).		MaxProperties: 1 Optional: {}

Cross-field rules

Rules written in CEL (x-kubernetes-validations) that the API server enforces and that the Validation column cannot express, with the type or field each applies to. They are collected from the same Go markers (+kubebuilder:validation:XValidation) by docs/site/crd-ref-docs/cel-rules.awk.

• ImageSpec: an image needs a tag, a digest or both
• ExposureSpec: hostname is required for route, ingress and gateway exposure
• ExposureSpec: gateway is required exactly when type is gateway
• ExposureSpec: ingressClassName applies to ingress exposure only
• ExposureSpec: tls.certificateSecretRef applies to ingress exposure only
• ExposureSpec.annotations: annotation keys under pgtoolbox.fyannk.dev/ are reserved
• ExposureSpec.labels: label keys under pgtoolbox.fyannk.dev/ are reserved
• MetadataPropagation.labels: label keys under pgtoolbox.fyannk.dev/ and app.kubernetes.io/ are reserved
• MetadataPropagation.annotations: annotation keys under pgtoolbox.fyannk.dev/ are reserved
• EvidenceAgentSpec: the evidence agent is reachable in-cluster only: exposure.type must be clusterIP
• EvidenceAgentSpec: pgbackrest reads a Cluster backed up with a pgBackRest plugin: objectStoreRef and serverName are barman-cloud settings
• EvidenceAgentSpec.serverName: serverName must not contain '/' or '\' and must not be '.' or '..'
• EvidenceAgentSpec.refreshInterval: refreshInterval must be between 30s and 24h
• WorkloadIdentitySpec.serviceAccountAnnotations: serviceAccountAnnotations accepts only the workload-identity annotations eks.amazonaws.com/role-arn, eks.amazonaws.com/sts-regional-endpoints, eks.amazonaws.com/token-expiration, azure.workload.identity/client-id, azure.workload.identity/tenant-id and iam.gke.io/gcp-service-account
• WorkloadIdentitySpec.podLabels: podLabels accepts only azure.workload.identity/use
• EvidenceAgent: metadata.name must be a DNS-1035 label of at most 40 characters (it prefixes generated object names)
• AccessSubject: a ServiceAccount subject is the name of a ServiceAccount in the request's namespace (a DNS subdomain)
• AccessSubject: system: users and groups cannot be granted access through a request (system:authenticated would grant everyone); name a person, a group or a ServiceAccount
• PgAccessRequestSpec: a PgAccessRequest cannot be changed once made; create a new one
• PgAccessRequestStatus: phase moves only Pending to Approved, Denied or Expired, and Approved to Revoked or Expired
• PgAccessRequestStatus: decidedBy cannot change once recorded
• PgAccessRequestStatus: roleBinding cannot change once recorded
• PgAccessRequestStatus: an Approved or Denied request records decidedBy and decidedAt
• PgAccessRequestStatus: an Approved request records its roleBinding and clusterRole
• PgAccessRequestStatus: a Denied request records why in note
• PgAccessRequestStatus: a Revoked request records revokedBy and revokedAt
• PgAccessRequest: metadata.name must be a DNS-1123 label of at most 63 characters (it names the RoleBinding and labels it)
• PgAdminSpec: clusterRefs and clusterSelector are mutually exclusive
• PgAdminSpec: one of clusterRefs, clusterSelector and crossNamespaceClusterRefs is required
• PgAdminSpec: replicas above 1 need configDatabase: SQLite on a ReadWriteOnce volume serves one pgAdmin
• PgAdminSpec: configDatabase cannot be added to or removed from an existing PgAdmin: pgAdmin's settings do not move between SQLite and PostgreSQL automatically (see the manual move in the documentation)
• PgAdminSpec.configDatabase: configDatabase is immutable
• PgAdminStorageSpec.storageClassName: storageClassName is immutable
• PgAdminAuthSpec: exactly one of oauth2 and openshiftOAuthProxy is required
• PgAdminOAuth2Spec.requiredClaims: claim names are 1-64 characters of letters, digits and _.:-
• PgAdminOpenShiftOAuthProxySpec.sessionMaxAge: sessionMaxAge must be between 5m and 12h
• PgAdmin: metadata.name must be a DNS-1035 label of at most 40 characters (it prefixes generated object names)
• PgToolBoxConsoleExposureSpec: networkPolicy.enabled needs networkPolicy.from for ingress and gateway exposure: the controller's namespace is not known
• PgToolBoxConsolePolicyPeer: each networkPolicy.from peer needs podSelector, namespaceSelector or ipBlock
• PgToolBoxConsolePolicyPeer: a networkPolicy.from peer with ipBlock may not also have podSelector or namespaceSelector
• PgToolBoxConsoleLabelSelector: matchLabels keys must be label keys ([prefix/]name, name at most 63 characters)
• PgToolBoxConsoleLabelRequirement: values are required for In and NotIn and forbidden for Exists and DoesNotExist
• PgToolBoxConsoleIPBlock: networkPolicy.from ipBlock.except entries must be CIDRs strictly inside ipBlock.cidr
• PgToolBoxConsoleIPBlock.cidr: networkPolicy.from ipBlock.cidr must be a CIDR
• PgToolBoxConsoleSpec: auth.oidc is required with auth.provider=oidc
• PgToolBoxConsoleSpec: auth.provider=openshift needs publicURL or exposure.hostname: OpenShift redirects only to the callback the ServiceAccount lists
• PgToolBoxConsoleSpec: mcp needs publicURL or exposure.hostname: the MCP endpoint advertises only its configured origin
• PgToolBoxConsoleSpec: restoreDrills needs operations: a drill is started through the operations endpoints
• PgToolBoxConsoleSpec: prometheus: set tokenSecretRef or projectedToken, not both
• PgToolBoxConsoleSpec: digest.delivery needs history.persistent: a delivered digest links to its page, which in-memory history loses at the next restart
• PgToolBoxConsoleSpec: digest.delivery needs digest.enabled
• PgToolBoxConsoleSpec.monitoringURL: monitoringURL must be https or root-relative
• PgToolBoxConsoleAuthSpec: sessionIdleTimeout must not exceed sessionMaxAge
• PgToolBoxConsoleAuthSpec.sessionIdleTimeout: sessionIdleTimeout must be between 1m and 12h
• PgToolBoxConsoleAuthSpec.sessionMaxAge: sessionMaxAge must be between 5m and 168h
• PgToolBoxConsoleOIDCSpec: oidc.grantClient.clientID must differ from oidc.clientID
• PgToolBoxConsoleEvidenceSpec.interval: evidence.interval must be between 30s and 1h
• PgToolBoxConsoleMCPSpec: mcp.writeTools requires mcp.enabled
• PgToolBoxConsoleMCPSpec.callTimeout: mcp.callTimeout must be between 1s and 50s
• PgToolBoxConsoleMCPSpec.oauthAccessTTL: mcp.oauthAccessTTL must be between 10s and 1h
• PgToolBoxConsoleTracingSpec: tracing.samplerArg needs a traceidratio sampler
• PgToolBoxConsoleRestoreDrillsSpec.timeLimit: restoreDrills.timeLimit must be between 10m and 24h
• PgToolBoxConsolePrometheusSpec: prometheus.tokenAudience applies to projectedToken only
• PgToolBoxConsolePrometheusSpec: prometheus.url must be https when a token is configured: the token is never sent in clear
• PgToolBoxConsolePrometheusSpec.range: prometheus.range must be between 5m and 24h
• PgToolBoxConsoleDigestSpec.retention: digest.retention must be between 24h and 8784h
• PgToolBoxConsoleDigestDeliverySpec: digest.delivery names no channel
• PgToolBoxConsoleDigestDeliverySpec.timeout: digest.delivery.timeout must be between 1s and 1m
• PgToolBoxConsoleDigestSMTPSpec: smtp.username and smtp.passwordSecretRef are set together
• PgToolBoxConsole: metadata.name must be a DNS-1035 label of at most 40 characters (it prefixes generated object names)