SchemaRegistry
Expand a field to see its description, example, and default behavior. Nested fields are grouped under their parent.
Required fields must be present when their parent object exists. [] denotes an array item; {key} denotes a map value. status is written by the operator. Reconcile-time checks and runtime defaults can add requirements beyond the schema.
Examples are illustrative JSON values. Open “View JSON example” for an object or array. Adapt names, endpoints, and credentials to your cluster. Kubernetes applies schema defaults when the containing object exists. Runtime and omission notes describe operator behavior. Status examples show reported data.
Runtime notes and domain examples were reviewed against operator source at b409b56.
View the complete CRD manifest at 618d621Example manifest
This example includes the required spec fields. Adapt its values and create any referenced resources before applying it.
apiVersion: krabka.io/v1alpha1
kind: SchemaRegistry
metadata:
name: example
namespace: default
labels:
krabka.io/cluster: my-cluster
spec:
replicas: 1No fields match. Change the search or reset the filters.
krabka.io/v1alpha1
Complete OpenAPI schema (JSON)
{
"description": "Auto-generated derived type for SchemaRegistrySpec via `CustomResource`",
"properties": {
"spec": {
"properties": {
"authentication": {
"description": "REST authentication.",
"nullable": true,
"properties": {
"basic": {
"nullable": true,
"properties": {
"usersSecretKey": {
"description": "Secret key holding the htpasswd-style file. Default `users`.",
"nullable": true,
"type": "string"
},
"usersSecretName": {
"description": "Secret with one key that holds `user:cred` entries, one on each\nline. The cred is plaintext or a `$2…` bcrypt hash. The operator\nmounts the key as a file and gives it in `--basic-auth-file`.",
"type": "string"
}
},
"required": [
"usersSecretName"
],
"type": "object"
},
"bearer": {
"nullable": true,
"properties": {
"jwksEndpointUri": {
"description": "JWKS endpoint URI. It is necessary when `mode` is `Jwks`.",
"nullable": true,
"type": "string"
},
"jwksExpectedAudience": {
"description": "Expected `aud` claim value.",
"nullable": true,
"type": "string"
},
"jwksPrincipalClaim": {
"description": "JWT claim to use as the principal when the mode is `Jwks`. It\noverrides `principalClaim` on the JWKS paths.",
"nullable": true,
"type": "string"
},
"jwksRefresh": {
"description": "JWKS key-set refresh interval. Default `1m`.",
"nullable": true,
"type": "string"
},
"jwksTlsSecretName": {
"description": "Name of the Secret whose `ca.crt` key the operator mounts and\ngives in `--bearer-jwks-ca`.",
"nullable": true,
"type": "string"
},
"jwksValidIssuer": {
"description": "Expected `iss` claim value.",
"nullable": true,
"type": "string"
},
"mode": {
"enum": [
"Unsecured",
"Jwks"
],
"type": "string"
},
"principalClaim": {
"description": "JWT claim used as the principal name. Default `sub`.",
"nullable": true,
"type": "string"
}
},
"required": [
"mode"
],
"type": "object"
},
"realm": {
"description": "`WWW-Authenticate: basic realm=\"<realm>\"`.",
"nullable": true,
"type": "string"
},
"requireAuth": {
"default": false,
"description": "Reject anonymous requests with 401.",
"type": "boolean"
}
},
"type": "object"
},
"authorization": {
"description": "REST authorization, based on the Kafka ACLs.",
"nullable": true,
"properties": {
"aclRefresh": {
"description": "ACL-cache refresh interval. Default `30s`.",
"nullable": true,
"type": "string"
},
"enabled": {
"default": false,
"type": "boolean"
},
"superUsers": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "object"
},
"bootstrapServers": {
"description": "Bootstrap override for an external Kafka that the operator does\nnot manage. When unset, the operator derives the bootstrap from the\ninternal listener of the Kafka with the `krabka.io/cluster` label.\nSettings in `kafka_client` secure both external and managed bootstrap\nconnections.",
"nullable": true,
"type": "string"
},
"clientId": {
"description": "Kafka client id used by the registry. Default `krabka-schema-registry`.",
"minLength": 1,
"nullable": true,
"type": "string"
},
"groupId": {
"description": "Election group id. Default `schema-registry`.",
"nullable": true,
"type": "string"
},
"healthChecks": {
"description": "Kubernetes probe timing overrides.",
"nullable": true,
"properties": {
"livenessInitialDelaySeconds": {
"format": "int32",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"livenessPeriodSeconds": {
"format": "int32",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"readinessInitialDelaySeconds": {
"format": "int32",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"readinessPeriodSeconds": {
"format": "int32",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"startupFailureThreshold": {
"description": "Failed startup probes before the kubelet restarts the container.\nDefault 60.\n\nSet it so that `startupPeriodSeconds` times this value covers the\nlongest replay of the schemas topic. The defaults allow 5 minutes.",
"format": "int32",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"startupPeriodSeconds": {
"description": "Seconds between two startup probes. Default 5.\n\nThe registry binds its REST port only after it replays the schemas\ntopic. The startup probe holds the liveness probe back until then.",
"format": "int32",
"minimum": 1,
"nullable": true,
"type": "integer"
}
},
"type": "object"
},
"image": {
"description": "Container image. Defaults to the operator's\n`--default-schema-registry-image`.",
"nullable": true,
"type": "string"
},
"kafkaClient": {
"description": "Client security from the SR to the broker, with SASL and TLS. It\nmaps to the `--kafka-*` flags.",
"nullable": true,
"properties": {
"sasl": {
"description": "SASL credentials for the connection from the SR to the broker.",
"nullable": true,
"properties": {
"mechanism": {
"description": "For example `PLAIN`, `SCRAM-SHA-256`, or `SCRAM-SHA-512`.",
"type": "string"
},
"secretRef": {
"description": "Name of the Secret that holds the `username` and `password` keys.",
"type": "string"
}
},
"required": [
"mechanism",
"secretRef"
],
"type": "object"
},
"securityProtocol": {
"description": "For example `PLAINTEXT`, `SASL_PLAINTEXT`, `SSL`, or `SASL_SSL`.",
"nullable": true,
"type": "string"
},
"tls": {
"description": "TLS settings for the connection from the SR to the broker.",
"nullable": true,
"properties": {
"caSecretName": {
"description": "Secret with a `ca.crt` key that gives the broker CA.",
"nullable": true,
"type": "string"
},
"serverNameOverride": {
"description": "Override the server name for TLS SNI and hostname verification.",
"nullable": true,
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
},
"replicas": {
"description": "Number of stateless replicas. All of them join the election\ngroup. Default 1.",
"format": "int32",
"maximum": 1000,
"minimum": 1,
"type": "integer"
},
"resources": {
"description": "Pod resource requirements.",
"nullable": true,
"properties": {
"claims": {
"description": "Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.\n\nThis is an alpha field and requires enabling the DynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.",
"items": {
"description": "ResourceClaim references one entry in PodSpec.ResourceClaims.",
"properties": {
"name": {
"description": "Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.",
"type": "string"
},
"request": {
"description": "Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object"
},
"type": "array"
},
"limits": {
"additionalProperties": {
"description": "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n``` <quantity> ::= <signedNumber><suffix>\n\n\t(Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n\n<digit> ::= 0 | 1 | ... | 9 <digits> ::= <digit> | <digit><digits> <number> ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign> ::= \"+\" | \"-\" <signedNumber> ::= <number> | <sign><number> <suffix> ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI> ::= Ki | Mi | Gi | Ti | Pi | Ei\n\n\t(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n\n<decimalSI> ::= m | \"\" | k | M | G | T | P | E\n\n\t(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber> ```\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n\n- No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.\n\nThe sign will be omitted unless the number is negative.\n\nExamples:\n\n- 1.5 will be serialized as \"1500m\" - 1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.",
"x-kubernetes-int-or-string": true
},
"description": "Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
"type": "object"
},
"requests": {
"additionalProperties": {
"description": "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n``` <quantity> ::= <signedNumber><suffix>\n\n\t(Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n\n<digit> ::= 0 | 1 | ... | 9 <digits> ::= <digit> | <digit><digits> <number> ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign> ::= \"+\" | \"-\" <signedNumber> ::= <number> | <sign><number> <suffix> ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI> ::= Ki | Mi | Gi | Ti | Pi | Ei\n\n\t(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n\n<decimalSI> ::= m | \"\" | k | M | G | T | P | E\n\n\t(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber> ```\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n\n- No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.\n\nThe sign will be omitted unless the number is negative.\n\nExamples:\n\n- 1.5 will be serialized as \"1500m\" - 1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.",
"x-kubernetes-int-or-string": true
},
"description": "Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
"type": "object"
}
},
"type": "object"
},
"runtime": {
"description": "Schema Registry runtime policy.",
"nullable": true,
"properties": {
"clientDispatchQueueCapacity": {
"description": "Kafka client request-dispatch queue capacity.",
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"clientFrameMax": {
"description": "Maximum accepted Kafka client frame size.",
"nullable": true,
"type": "string"
},
"defaultCompatibilityLevel": {
"nullable": true,
"type": "string"
},
"defaultMode": {
"nullable": true,
"type": "string"
},
"electionHeartbeatInterval": {
"nullable": true,
"type": "string"
},
"electionRebalanceTimeout": {
"nullable": true,
"type": "string"
},
"electionReconnectBackoff": {
"nullable": true,
"type": "string"
},
"electionSessionTimeout": {
"nullable": true,
"type": "string"
},
"forwardMaxBody": {
"nullable": true,
"type": "string"
},
"schemasTopicCreateTimeout": {
"nullable": true,
"type": "string"
},
"storeReaderFetchMax": {
"nullable": true,
"type": "string"
},
"storeReaderFetchMaxWait": {
"nullable": true,
"type": "string"
},
"storeReaderRetryBackoff": {
"nullable": true,
"type": "string"
}
},
"type": "object"
},
"schemasTopic": {
"description": "Backing compacted topic. Default `_schemas`.",
"nullable": true,
"type": "string"
},
"schemasTopicReplicationFactor": {
"description": "Replication factor for `_schemas` when auto-created. Default 3.",
"format": "int32",
"nullable": true,
"type": "integer"
},
"tls": {
"description": "Server TLS for the HTTPS REST surface. `None` means plain HTTP.",
"nullable": true,
"properties": {
"clientAuth": {
"description": "Client-cert mode. Default `Disabled`.",
"enum": [
"Disabled",
"Optional",
"Required",
null
],
"nullable": true,
"type": "string"
},
"clientCaSecretName": {
"description": "Secret with `ca.crt` that verifies the client certs. It is\nnecessary when `clientAuth` is not Disabled.",
"nullable": true,
"type": "string"
},
"issuerRef": {
"description": "cert-manager issuer reference. Do not set it together with\n`secretName`.",
"nullable": true,
"properties": {
"group": {
"description": "API group. Default `cert-manager.io`.",
"nullable": true,
"type": "string"
},
"kind": {
"description": "The default is `Issuer`. Set `ClusterIssuer` for an issuer with\ncluster scope.",
"nullable": true,
"type": "string"
},
"name": {
"type": "string"
}
},
"required": [
"name"
],
"type": "object"
},
"secretName": {
"description": "Secret of type kubernetes.io/tls with `tls.crt` and `tls.key`. Do\nnot set it together with `issuerRef`.",
"nullable": true,
"type": "string"
}
},
"type": "object"
}
},
"required": [
"replicas"
],
"type": "object"
},
"status": {
"nullable": true,
"properties": {
"conditions": {
"default": [],
"description": "Kubernetes-style conditions: `KafkaReady`, `Available`, and\n`Ready`.",
"items": {
"properties": {
"lastTransitionTime": {
"description": "RFC3339 timestamp.",
"type": "string"
},
"message": {
"description": "Human-readable message.",
"type": "string"
},
"reason": {
"description": "CamelCase machine reason.",
"type": "string"
},
"status": {
"description": "`True`, `False`, or `Unknown`.",
"type": "string"
},
"type": {
"description": "For example, `Ready`.",
"type": "string"
}
},
"required": [
"lastTransitionTime",
"message",
"reason",
"status",
"type"
],
"type": "object"
},
"type": "array"
},
"observedGeneration": {
"description": "`metadata.generation` of the last successfully-reconciled spec.",
"format": "int64",
"nullable": true,
"type": "integer"
},
"readyReplicas": {
"format": "int32",
"nullable": true,
"type": "integer"
},
"replicas": {
"format": "int32",
"nullable": true,
"type": "integer"
},
"url": {
"description": "In-cluster REST URL that the clients use.",
"nullable": true,
"type": "string"
}
},
"type": "object"
}
},
"required": [
"spec"
],
"title": "SchemaRegistry",
"type": "object"
}
spec
spec
object
Required
14 fields
- Example
-
View JSON example
{ "replicas": 1 } - Default No schema default
- Not declared
authentication
object | null
Optional
4 fields
REST authentication.
- Example
-
View JSON example
{ "basic": { "usersSecretName": "schema-registry-users" } } - Default No schema default
- Not declared
basic
object | null
Optional
2 fields
- Example
-
View JSON example
{ "usersSecretName": "schema-registry-users" } - Default No schema default
- Not declared
usersSecretKey
string | null
Optional
Secret key holding the htpasswd-style file. Default users.
- Example
-
"users" - Default Documented behavior
Default
users.
usersSecretName
string
Required
Secret with one key that holds user:cred entries, one on each line. The cred is plaintext or a $2… bcrypt hash. The operator mounts the key as a file and gives it in --basic-auth-file.
- Example
-
"schema-registry-users" - Default No schema default
- Not declared
bearer
object | null
Optional
8 fields
- Example
-
View JSON example
{ "mode": "Jwks", "jwksEndpointUri": "https://identity.example.com/.well-known/jwks.json", "principalClaim": "sub" } - Default No schema default
- Not declared
jwksEndpointUri
string | null
Optional
JWKS endpoint URI. It is necessary when mode is Jwks.
- Example
-
"https://identity.example.com/.well-known/jwks.json" - Default No schema default
- Not declared
jwksExpectedAudience
string | null
Optional
Expected aud claim value.
- Example
-
"schema-registry" - Default No schema default
- Not declared
jwksPrincipalClaim
string | null
Optional
JWT claim to use as the principal when the mode is Jwks. It overrides principalClaim on the JWKS paths.
- Example
-
"sub" - Default No schema default
- Not declared
jwksRefresh
string | null
Optional
JWKS key-set refresh interval. Default 1m.
- Example
-
"1m" - Default Documented behavior
Default
1m.
jwksTlsSecretName
string | null
Optional
Name of the Secret whose ca.crt key the operator mounts and gives in --bearer-jwks-ca.
- Example
-
"identity-ca" - Default No schema default
- Not declared
jwksValidIssuer
string | null
Optional
Expected iss claim value.
- Example
-
"https://identity.example.com/" - Default No schema default
- Not declared
mode
string
Required
- Example
-
"Jwks" - Default No schema default
- Not declared
"Unsecured""Jwks"
principalClaim
string | null
Optional
JWT claim used as the principal name. Default sub.
- Example
-
"sub" - Default Documented behavior
Default
sub.
realm
string | null
Optional
WWW-Authenticate: basic realm="<realm>".
- Example
-
"schema-registry" - Default No schema default
- Not declared
requireAuth
boolean
Optional
Reject anonymous requests with 401.
- Example
-
false - Default Schema default
false
authorization
object | null
Optional
3 fields
REST authorization, based on the Kafka ACLs.
- Example
-
View JSON example
{ "aclRefresh": "30s" } - Default No schema default
- Not declared
bootstrapServers
string | null
Optional
Bootstrap override for an external Kafka that the operator does not manage. When unset, the operator derives the bootstrap from the internal listener of the Kafka with the krabka.io/cluster label. Settings in kafka_client secure both external and managed bootstrap connections.
- Example
-
"my-cluster-bootstrap.kafka.svc.cluster.local:9092" - Default Documented behavior
When unset, the operator derives the bootstrap from the internal listener of the Kafka with the
krabka.io/clusterlabel.
clientId
string | null
Optional
Kafka client id used by the registry. Default krabka-schema-registry.
- Example
-
"krabka-schema-registry" - Default Documented behavior
Default
krabka-schema-registry.
Validation and schema details
- Minimum length
1
groupId
string | null
Optional
Election group id. Default schema-registry.
- Example
-
"schema-registry" - Default Documented behavior
Default
schema-registry.
healthChecks
object | null
Optional
6 fields
Kubernetes probe timing overrides.
- Example
-
View JSON example
{ "livenessInitialDelaySeconds": 10 } - Default No schema default
- Not declared
livenessInitialDelaySeconds
integer | null (int32)
Optional
- Example
-
10 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
livenessPeriodSeconds
integer | null (int32)
Optional
- Example
-
10 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
readinessInitialDelaySeconds
integer | null (int32)
Optional
- Example
-
5 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
readinessPeriodSeconds
integer | null (int32)
Optional
- Example
-
10 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
startupFailureThreshold
integer | null (int32)
Optional
Failed startup probes before the kubelet restarts the container. Default 60.
Set it so that startupPeriodSeconds times this value covers the longest replay of the schemas topic. The defaults allow 5 minutes.
- Example
-
60 - Default Documented behavior
Default 60. The defaults allow 5 minutes.
Validation and schema details
- Minimum
1
startupPeriodSeconds
integer | null (int32)
Optional
Seconds between two startup probes. Default 5.
The registry binds its REST port only after it replays the schemas topic. The startup probe holds the liveness probe back until then.
- Example
-
5 - Default Documented behavior
Default 5.
Validation and schema details
- Minimum
1
image
string | null
Optional
Container image. Defaults to the operator's --default-schema-registry-image.
- Example
-
"registry.example.com/krabka/schema-registry:1.0.0" - Default Runtime / omission
Use the operator's --default-schema-registry-image value when omitted.
kafkaClient
object | null
Optional
3 fields
Client security from the SR to the broker, with SASL and TLS. It maps to the --kafka-* flags.
- Example
-
View JSON example
{ "securityProtocol": "SASL_SSL", "sasl": { "mechanism": "SCRAM-SHA-512", "secretRef": "schema-registry-kafka" }, "tls": { "caSecretName": "my-cluster-ca" } } - Default No schema default
- Not declared
sasl
object | null
Optional
2 fields
SASL credentials for the connection from the SR to the broker.
- Example
-
View JSON example
{ "mechanism": "SCRAM-SHA-512", "secretRef": "schema-registry-kafka" } - Default No schema default
- Not declared
mechanism
string
Required
For example PLAIN, SCRAM-SHA-256, or SCRAM-SHA-512.
- Example
-
"SCRAM-SHA-512" - Default No schema default
- Not declared
secretRef
string
Required
Name of the Secret that holds the username and password keys.
- Example
-
"schema-registry-kafka" - Default No schema default
- Not declared
securityProtocol
string | null
Optional
For example PLAINTEXT, SASL_PLAINTEXT, SSL, or SASL_SSL.
- Example
-
"SASL_SSL" - Default No schema default
- Not declared
tls
object | null
Optional
2 fields
TLS settings for the connection from the SR to the broker.
- Example
-
View JSON example
{ "caSecretName": "my-cluster-ca" } - Default No schema default
- Not declared
caSecretName
string | null
Optional
Secret with a ca.crt key that gives the broker CA.
- Example
-
"my-cluster-ca" - Default No schema default
- Not declared
serverNameOverride
string | null
Optional
Override the server name for TLS SNI and hostname verification.
- Example
-
"my-cluster-bootstrap.kafka.svc.cluster.local" - Default No schema default
- Not declared
replicas
integer (int32)
Required
Number of stateless replicas. All of them join the election group. Default 1.
- Example
-
1 - Default Runtime / omission
Required; no CRD default. 1 is the documented baseline.
Validation and schema details
- Maximum
1000
- Minimum
1
resources
object | null
Optional
3 fields
Pod resource requirements.
- Example
-
View JSON example
{ "claims": [ { "name": "example" } ] } - Default No schema default
- Not declared
claims
array
Optional
1 field
Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.
This is an alpha field and requires enabling the DynamicResourceAllocation feature gate.
This field is immutable. It can only be set for containers.
- Example
-
View JSON example
[ { "name": "example" } ] - Default No schema default
- Not declared
[]
object
Array item
2 fields
ResourceClaim references one entry in PodSpec.ResourceClaims.
- Example
-
View JSON example
{ "name": "example" } - Default No independent default
- Defined by the parent
name
string
Required
Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.
- Example
-
"example" - Default No schema default
- Not declared
request
string
Optional
Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.
- Example
-
"example" - Default No schema default
- Not declared
limits
object
Optional
1 field
Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
- Example
-
View JSON example
{ "example": "256Mi" } - Default No schema default
- Not declared
Validation and schema details
- Additional properties
{ "description": "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n``` <quantity> ::= <signedNumber><suffix>\n\n\t(Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n\n<digit> ::= 0 | 1 | ... | 9 <digits> ::= <digit> | <digit><digits> <number> ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign> ::= \"+\" | \"-\" <signedNumber> ::= <number> | <sign><number> <suffix> ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI> ::= Ki | Mi | Gi | Ti | Pi | Ei\n\n\t(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n\n<decimalSI> ::= m | \"\" | k | M | G | T | P | E\n\n\t(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber> ```\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n\n- No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.\n\nThe sign will be omitted unless the number is negative.\n\nExamples:\n\n- 1.5 will be serialized as \"1500m\" - 1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.", "x-kubernetes-int-or-string": true }
{key}
integer | string
Map value
Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.
The serialization format is:
<quantity> ::= <signedNumber><suffix>
(Note that <suffix> may be empty, from the "" case in <decimalSI>.)
<digit> ::= 0 | 1 | ... | 9 <digits> ::= <digit> | <digit><digits> <number> ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign> ::= "+" | "-" <signedNumber> ::= <number> | <sign><number> <suffix> ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI> ::= Ki | Mi | Gi | Ti | Pi | Ei
(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)
<decimalSI> ::= m | "" | k | M | G | T | P | E
(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)
<decimalExponent> ::= "e" <signedNumber> | "E" <signedNumber>No matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.
When a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.
Before serializing, Quantity will be put in "canonical form". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:
- No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.
The sign will be omitted unless the number is negative.
Examples:
- 1.5 will be serialized as "1500m" - 1.5Gi will be serialized as "1536Mi"
Note that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.
Non-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)
This format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.
- Example
-
"256Mi" - Default No independent default
- Defined by the parent
Validation and schema details
- x-kubernetes-int-or-string
true
requests
object
Optional
1 field
Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
- Example
-
View JSON example
{ "example": "256Mi" } - Default Documented behavior
If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value.
Validation and schema details
- Additional properties
{ "description": "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n``` <quantity> ::= <signedNumber><suffix>\n\n\t(Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n\n<digit> ::= 0 | 1 | ... | 9 <digits> ::= <digit> | <digit><digits> <number> ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign> ::= \"+\" | \"-\" <signedNumber> ::= <number> | <sign><number> <suffix> ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI> ::= Ki | Mi | Gi | Ti | Pi | Ei\n\n\t(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n\n<decimalSI> ::= m | \"\" | k | M | G | T | P | E\n\n\t(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber> ```\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n\n- No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.\n\nThe sign will be omitted unless the number is negative.\n\nExamples:\n\n- 1.5 will be serialized as \"1500m\" - 1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.", "x-kubernetes-int-or-string": true }
{key}
integer | string
Map value
Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.
The serialization format is:
<quantity> ::= <signedNumber><suffix>
(Note that <suffix> may be empty, from the "" case in <decimalSI>.)
<digit> ::= 0 | 1 | ... | 9 <digits> ::= <digit> | <digit><digits> <number> ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign> ::= "+" | "-" <signedNumber> ::= <number> | <sign><number> <suffix> ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI> ::= Ki | Mi | Gi | Ti | Pi | Ei
(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)
<decimalSI> ::= m | "" | k | M | G | T | P | E
(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)
<decimalExponent> ::= "e" <signedNumber> | "E" <signedNumber>No matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.
When a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.
Before serializing, Quantity will be put in "canonical form". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:
- No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.
The sign will be omitted unless the number is negative.
Examples:
- 1.5 will be serialized as "1500m" - 1.5Gi will be serialized as "1536Mi"
Note that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.
Non-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)
This format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.
- Example
-
"256Mi" - Default No independent default
- Defined by the parent
Validation and schema details
- x-kubernetes-int-or-string
true
runtime
object | null
Optional
13 fields
Schema Registry runtime policy.
- Example
-
View JSON example
{ "clientDispatchQueueCapacity": 1024 } - Default No schema default
- Not declared
clientDispatchQueueCapacity
integer | null (uint)
Optional
Kafka client request-dispatch queue capacity.
- Example
-
1024 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
clientFrameMax
string | null
Optional
Maximum accepted Kafka client frame size.
- Example
-
"100MiB" - Default No schema default
- Not declared
defaultCompatibilityLevel
string | null
Optional
- Example
-
"BACKWARD" - Default No schema default
- Not declared
defaultMode
string | null
Optional
- Example
-
"READWRITE" - Default No schema default
- Not declared
electionHeartbeatInterval
string | null
Optional
- Example
-
"3s" - Default No schema default
- Not declared
electionRebalanceTimeout
string | null
Optional
- Example
-
"1m" - Default No schema default
- Not declared
electionReconnectBackoff
string | null
Optional
- Example
-
"500ms" - Default No schema default
- Not declared
electionSessionTimeout
string | null
Optional
- Example
-
"30s" - Default No schema default
- Not declared
forwardMaxBody
string | null
Optional
- Example
-
"4MiB" - Default No schema default
- Not declared
schemasTopicCreateTimeout
string | null
Optional
- Example
-
"30s" - Default No schema default
- Not declared
storeReaderFetchMax
string | null
Optional
- Example
-
"10MiB" - Default No schema default
- Not declared
storeReaderFetchMaxWait
string | null
Optional
- Example
-
"1s" - Default No schema default
- Not declared
storeReaderRetryBackoff
string | null
Optional
- Example
-
"500ms" - Default No schema default
- Not declared
schemasTopic
string | null
Optional
Backing compacted topic. Default _schemas.
- Example
-
"_schemas" - Default Documented behavior
Default
_schemas.
schemasTopicReplicationFactor
integer | null (int32)
Optional
Replication factor for _schemas when auto-created. Default 3.
- Example
-
3 - Default Documented behavior
Default 3.
tls
object | null
Optional
4 fields
Server TLS for the HTTPS REST surface. None means plain HTTP.
- Example
-
View JSON example
{ "secretName": "schema-registry-tls", "clientAuth": "Disabled" } - Default Runtime / omission
Absent: serve plain HTTP.
clientAuth
string | null
Optional
Client-cert mode. Default Disabled.
- Example
-
"Disabled" - Default Documented behavior
Default
Disabled.
"Disabled""Optional""Required"null
clientCaSecretName
string | null
Optional
Secret with ca.crt that verifies the client certs. It is necessary when clientAuth is not Disabled.
- Example
-
"schema-registry-client-ca" - Default No schema default
- Not declared
issuerRef
object | null
Optional
3 fields
cert-manager issuer reference. Do not set it together with secretName.
- Example
-
View JSON example
{ "name": "internal-ca", "kind": "Issuer", "group": "cert-manager.io" } - Default No schema default
- Not declared
group
string | null
Optional
API group. Default cert-manager.io.
- Example
-
"cert-manager.io" - Default Documented behavior
Default
cert-manager.io.
kind
string | null
Optional
The default is Issuer. Set ClusterIssuer for an issuer with cluster scope.
- Example
-
"Issuer" - Default Documented behavior
The default is
Issuer.
name
string
Required
- Example
-
"internal-ca" - Default No schema default
- Not declared
secretName
string | null
Optional
Secret of type kubernetes.io/tls with tls.crt and tls.key. Do not set it together with issuerRef.
- Example
-
"schema-registry-tls" - Default No schema default
- Not declared
status
status
object | null
Optional
5 fields
- Example
-
View JSON example
{ "conditions": [ { "lastTransitionTime": "2026-10-05T12:00:00Z", "message": "The resource is ready.", "reason": "Reconciled", "status": "True", "type": "Ready" } ] } - Default No schema default
- Not declared
conditions
array
Optional
1 field
Kubernetes-style conditions: KafkaReady, Available, and Ready.
- Example
-
View JSON example
[ { "lastTransitionTime": "2026-10-05T12:00:00Z", "message": "The resource is ready.", "reason": "Reconciled", "status": "True", "type": "Ready" } ] - Default Schema default
[]
[]
object
Array item
5 fields
- Example
-
View JSON example
{ "lastTransitionTime": "2026-10-05T12:00:00Z", "message": "The resource is ready.", "reason": "Reconciled", "status": "True", "type": "Ready" } - Default No schema default
- Not declared
lastTransitionTime
string
Required
RFC3339 timestamp.
- Example
-
"2026-10-05T12:00:00Z" - Default No schema default
- Not declared
message
string
Required
Human-readable message.
- Example
-
"The resource is ready." - Default No schema default
- Not declared
reason
string
Required
CamelCase machine reason.
- Example
-
"Reconciled" - Default No schema default
- Not declared
status
string
Required
True, False, or Unknown.
- Example
-
"True" - Default No schema default
- Not declared
type
string
Required
For example, Ready.
- Example
-
"Ready" - Default No schema default
- Not declared
observedGeneration
integer | null (int64)
Optional
metadata.generation of the last successfully-reconciled spec.
- Example
-
1 - Default No schema default
- Not declared
readyReplicas
integer | null (int32)
Optional
- Example
-
1 - Default No schema default
- Not declared
replicas
integer | null (int32)
Optional
- Example
-
1 - Default No schema default
- Not declared
url
string | null
Optional
In-cluster REST URL that the clients use.
- Example
-
"http://schema-registry.kafka.svc.cluster.local:8081" - Default No schema default
- Not declared
Resource schema
Resource schema
object
Resource schema
Auto-generated derived type for SchemaRegistrySpec via CustomResource
- Example
-
View JSON example
{ "apiVersion": "krabka.io/v1alpha1", "kind": "SchemaRegistry", "metadata": { "name": "example", "namespace": "default", "labels": { "krabka.io/cluster": "my-cluster" } }, "spec": { "replicas": 1 } } - Default No resource default
- None