Custom Resources

CodeInstance

Scope: Cluster
Version: v1

• apiVersion

  string
• kind

  string
• metadata

  object
• spec

  object

  CodeInstanceSpec defines the desired state of the CodeInstance.
  • spec.appConfig

    object

    Parameters for modifying general settings of Rails components.

    Default: {}

    • spec.appConfig.contentSecurityPolicy

      object

      Content Security Policy (CSP) settings for preventing XSS attacks.

      Default: {}

      • spec.appConfig.contentSecurityPolicy.directives

        object

        CSP directives.

        Default: {}

        • spec.appConfig.contentSecurityPolicy.directives.child_src

          string
        • spec.appConfig.contentSecurityPolicy.directives.connect_src

          string
        • spec.appConfig.contentSecurityPolicy.directives.default_src

          string
        • spec.appConfig.contentSecurityPolicy.directives.font_src

          string
        • spec.appConfig.contentSecurityPolicy.directives.frame_ancestors

          string
        • spec.appConfig.contentSecurityPolicy.directives.frame_src

          string
        • spec.appConfig.contentSecurityPolicy.directives.img_src

          string
        • spec.appConfig.contentSecurityPolicy.directives.media_src

          string
        • spec.appConfig.contentSecurityPolicy.directives.object_src

          string
        • spec.appConfig.contentSecurityPolicy.directives.script_src

          string
        • spec.appConfig.contentSecurityPolicy.directives.style_src

          string
      • spec.appConfig.contentSecurityPolicy.enabled

        boolean

        Enable CSP.

        Default: true

      • spec.appConfig.contentSecurityPolicy.reportOnly

        boolean

        Enable CSP in report-only mode.

        Default: false

    • spec.appConfig.cronJobs

      object

      List of periodically executed jobs for self-healing, synchronizing, etc.

      Default: {}

      • spec.appConfig.cronJobs.<KEY_NAME>

        object

        <KEY_NAME> — jobName

        CronJob name.

        • spec.appConfig.cronJobs.<KEY_NAME>.cron

          string

          Required value

          Job schedule in the cron format.
        • spec.appConfig.cronJobs.<KEY_NAME>.jobClass

          string

          Warning. This parameter is intended for advanced users.

          Overriding the job execution class.

    • spec.appConfig.customHtmlHeaderTags

      string

      Additional custom HTML header tags for the UI.

      Default:

    • spec.appConfig.defaultColorMode

      string

      Default color mode for the UI.

      Default: Light

      Allowed values: Light, Dark, Auto

    • spec.appConfig.ldap

      object

      LDAP integration settings.
      • spec.appConfig.ldap.preventSignin

        boolean

        Prevent user authentication via LDAP in the web UI.

        Default: false

      • spec.appConfig.ldap.servers

        object

        Required value

        Configuration of LDAP servers.

        Default: {}

        • spec.appConfig.ldap.servers.<KEY_NAME>

          object

          <KEY_NAME> — serverName

          LDAP server name. At least one server must be named main.

          Default: {}

          • spec.appConfig.ldap.servers.<KEY_NAME>.activeDirectory

            boolean

            Specifies whether the LDAP server is an Active Directory server.

            Default: true

          • spec.appConfig.ldap.servers.<KEY_NAME>.allowUsernameOrEmailLogin

            boolean

            If enabled, Code ignores the login part after the first @ symbol submitted by the user on sign-in.

            Default: false

          • spec.appConfig.ldap.servers.<KEY_NAME>.attributes

            object

            Settings with LDAP attribute mapping.

            Default: {}

            • spec.appConfig.ldap.servers.<KEY_NAME>.attributes.email

              array of strings

              LDAP attribute for the user email.

              Default: [ "mail", "email", "userPrincipalName" ]

            • spec.appConfig.ldap.servers.<KEY_NAME>.attributes.firstName

              string

              LDAP attribute for the user’s first name.

              Default: givenName

            • spec.appConfig.ldap.servers.<KEY_NAME>.attributes.lastName

              string

              LDAP attribute for the user’s last name.

              Default: sn

            • spec.appConfig.ldap.servers.<KEY_NAME>.attributes.name

              string

              LDAP attribute for the displayed username.

              Default: cn

            • spec.appConfig.ldap.servers.<KEY_NAME>.attributes.username

              array of strings

              The @username that the Code account will be provisioned with. If the value contains an email address, the Code login is the part of the email address before the @ symbol.

              Default: [ "uid", "userid", "sAMAccountName" ]

          • spec.appConfig.ldap.servers.<KEY_NAME>.base

            string

            Required value

            Base DN where users can be searched.

            Default:

          • spec.appConfig.ldap.servers.<KEY_NAME>.bindDn

            string

            Full DN of the username used for connecting and synchronizing with LDAP.

            Default:

          • spec.appConfig.ldap.servers.<KEY_NAME>.blockAutoCreatedUsers

            boolean

            Block automatically created users until they have been cleared by an administrator.

            Default: false

          • spec.appConfig.ldap.servers.<KEY_NAME>.encryption

            string

            Required value

            Connection encryption method.

            Default: Plain

            Allowed values: Plain, SimpleTls, StartTls

          • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync

            object

            Settings for group and membership synchronization.

            Default: {}

            • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.base

              string

              Required value

              Base DN where groups can be searched.

              Default:

            • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.createGroups

              boolean

              Create groups automatically.

              Default: false

            • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.filter

              string

              Filter LDAP groups in the format of RFC 4515.

              Default:

            • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.nameMask

              string

              Regular expression to retrieve group names from DN.

              Default:

            • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.owner

              string

              Owner of groups synchronized with LDAP. The root user is used by default.

              Default: root

            • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.prefix

              object

              Optional section for group hierarchy settings.

              Default: {}

              • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.prefix.attribute

                string

                Required value

                Name of the LDAP group attribute containing information about the parent group.

                Default:

              • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.prefix.default

                string

                Required value

                Default parent group if prefix.attribute is empty.

                Default:

              • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.prefix.nameMask

                string

                Regular expression to retrieve parent group name from CN.
            • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.roleMapping

              array of objects

              List of dictionaries for mapping Code roles with roles retrieved from LDAP group names.

              Default: []

              • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.roleMapping.byName

                string

                Regular expression for retrieving a role name from the LDAP group.

                Default:

              • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.roleMapping.gitlabRole

                string

                Code role name.

                Default: Guest

                Allowed values: Guest, Planner, Reporter, Developer, Maintainer, Owner

            • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.scope

              number

              Group search scope:

              • 0: Base
              • 1: SingleLevel
              • 2: WholeSubtree

              Default: 1

              Allowed values: 0, 1, 2

            • spec.appConfig.ldap.servers.<KEY_NAME>.groupSync.topLevelGroup

              string

              Parent group name where LDAP groups are synchronized to. If there’s no parent group, the synchronization is performed tp the root group.

              Default:

          • spec.appConfig.ldap.servers.<KEY_NAME>.host

            string

            Required value

            FQDN address of the LDAP server.

            Default:

          • spec.appConfig.ldap.servers.<KEY_NAME>.label

            string

            Required value

            LDAP server name. At least one server must be named main.

            Default: LDAP

          • spec.appConfig.ldap.servers.<KEY_NAME>.lowercaseUsernames

            boolean

            If enabled, Code converts user logins to lower case.

            Default: false

          • spec.appConfig.ldap.servers.<KEY_NAME>.password

            string

            Password of the username used for synchronizing with LDAP.

            Default:

          • spec.appConfig.ldap.servers.<KEY_NAME>.port

            number

            Required value

            LDAP server connection port.

            Default: 389

            Allowed values: 0 <= X <= 65535

          • spec.appConfig.ldap.servers.<KEY_NAME>.syncName

            boolean

            Sync Code username with LDAP.

            Default: false

          • spec.appConfig.ldap.servers.<KEY_NAME>.timeout

            number

            Timeout (in seconds) for LDAP requests.

            Default: 10

            Allowed values: 0 <= X

          • spec.appConfig.ldap.servers.<KEY_NAME>.uid

            string

            Required value

            LDAP attribute that maps to the username that users use to sign in.

            Default: sAMAccountName

          • spec.appConfig.ldap.servers.<KEY_NAME>.userFilter

            string

            Filter LDAP users. Follows the format of RFC 4515.

            Default:

          • spec.appConfig.ldap.servers.<KEY_NAME>.verifyCertificates

            boolean

            Enable SSL certificate verification when the encryption method ‘SimpleTls’ or ‘SimpleTls’ is used.

            Default: true

    • spec.appConfig.omniauth

      object

      OmniAuth configuration.
      • spec.appConfig.omniauth.allowBypassTwoFactor

        array of strings

        Allow signing-in without using two-factor authentication (2FA).

        Default: []

      • spec.appConfig.omniauth.allowSingleSignOn

        array of strings

        Allow using the single sign-on (SSO).

        Default: []

      • spec.appConfig.omniauth.autoLinkLdapUser

        boolean

        Automatically link LDAP users with existing Code users.

        Default: false

      • spec.appConfig.omniauth.autoLinkSamlUser

        boolean

        Automatically link SAML users with existing Code users.

        Default: false

      • spec.appConfig.omniauth.autoLinkUser

        array of strings

        Automatically link OmniAuth users with existing Code users.

        Default: []

      • spec.appConfig.omniauth.autoSignInWithProvider

        string

        Automatically sign in via your OmniAuth provider.
      • spec.appConfig.omniauth.blockAutoCreatedUsers

        boolean

        Block automatically-created users.

        Default: true

      • spec.appConfig.omniauth.enabled

        boolean

        Enable OmniAuth.

        Default: false

      • spec.appConfig.omniauth.externalProviders

        array of strings

        External OmniAuth providers.

        Default: []

      • spec.appConfig.omniauth.providers

        array of objects

        List of supported OmniAuth providers.

        Default: []

        • spec.appConfig.omniauth.providers.args

          object
          • spec.appConfig.omniauth.providers.args.client_options

            object
        • spec.appConfig.omniauth.providers.icon

          string
        • spec.appConfig.omniauth.providers.label

          string
        • spec.appConfig.omniauth.providers.name

          string

          Allowed values: alicloud, atlassioan_oauth2, auth0, cognito, azute_activedirectory_v2, bitbucket, oauth2_generic, github, gitlab, google_oauth2, jwt, kerberos, openid_connect, salesforce, saml, shibboleth

        • spec.appConfig.omniauth.providers.uid

          string

          This fields is intended for the operator’s needs only. Do not edit the set value.

          Default:

      • spec.appConfig.omniauth.syncProfileAttributes

        array of strings

        List of profile attributes to sync from the provider.

        Default: [ "name", "email" ]

      • spec.appConfig.omniauth.syncProfileFromProvider

        array of strings

        Sync profile information from your OmniAuth provider.

        Default: []

    • spec.appConfig.rackAttack

      object

      RackAttack contains basic authentication settings.
      • spec.appConfig.rackAttack.gitlabBasicAuth

        object

        Rate-limiting parameters applied in Code to configure blocking and limiting user authentication attempts.
        • spec.appConfig.rackAttack.gitlabBasicAuth.banTime

          integer

          Duration (in seconds) for which an IP address is blocked after exceeding the allowed number of attempts.

          Allowed values: 0 <= X

        • spec.appConfig.rackAttack.gitlabBasicAuth.findTime

          integer

          Time window (in seconds) after which the authentication attempt counter for an IP address is reset.

          Allowed values: 0 <= X

        • spec.appConfig.rackAttack.gitlabBasicAuth.ipWhitelist

          array of strings

          List of IP addresses excluded from Rack Attack rules.
        • spec.appConfig.rackAttack.gitlabBasicAuth.maxRetry

          integer

          Maximum number of Git HTTP authentication attempts per IP address.

          Allowed values: 0 <= X

    • spec.appConfig.signInEnabled

      boolean

      Enable the standard sign-in page.

      Can be turned off to enforce LDAP-based authentication.

      Default: true

    • spec.appConfig.signUpEnabled

      boolean

      Allow the user to create new accounts.

      This will also allow regular users to sign up on their own.

      Default: false

    • spec.appConfig.usernameChangingEnabled

      boolean

      Allow username changes for existing accounts.

      Default: false

  • spec.backup

    object

    Backup configuration.

    Default: {}

    • spec.backup.backupBeforeUpdate

      boolean

      Enable automatic backup before module update.

      Default: false

    • spec.backup.backupStorageGb

      integer

      Overall expected size of backups (TAR archive size) to configure underlying storage.

      Default: 3

      Allowed values: 1 <= X

    • spec.backup.cronSchedule

      string

      If specified, enables automatic backups based on a cron-formatted schedule.
    • spec.backup.enabled

      boolean

      Enables the ability to work with backups.

      Default: false

    • spec.backup.nodeSelector

      object

      Selector to choose a node where to run the backup process from (by toolbox).
    • spec.backup.persistentVolumeClaim

      object

      Parameters of the PersistentVolumeClaim resource.

      Default: {}

      • spec.backup.persistentVolumeClaim.enabled

        boolean

        Enable PersistentVolumes. If disabled, emptyDir is used instead.

        Default: false

      • spec.backup.persistentVolumeClaim.storageClass

        string

        If persistentVolumeClaim.enabled is set to true, this parameter must include the name of an existing StorageClass for a PersistentVolume in the cluster.
    • spec.backup.s3

      object

      S3 storage connection settings for backups.
      • spec.backup.s3.bucketName

        string

        Name of the S3 bucket for backups.

        Default: d8-code-backups

      • spec.backup.s3.external

        object
        • spec.backup.s3.external.accessKey

          string

          Required value

          Bucket access key.
        • spec.backup.s3.external.endpoint

          string

          Custom S3-compatible storage service endpoint to use for requests.

          If the schema (http:// or https://) is not explicitly provided, the system will default to using https://. For example, an endpoint specified as s3.example.com will automatically be interpreted as https://s3.example.com.

          Default:

        • spec.backup.s3.external.provider

          string

          Required value

          S3 storage cloud provider. For storage in a local environment, use Generic.

          Allowed values: Generic, YCloud

        • spec.backup.s3.external.region

          string

          Bucket region.

          Default:

        • spec.backup.s3.external.secretKey

          string

          Required value

          Secret key for accessing the buckets.
      • spec.backup.s3.mode

        string

        Storage type.

        Default: External

      • spec.backup.s3.tmpBucketName

        string

        Temporary object storage bucket name used exclusively during the backup and restore process.

        Default: d8-code-tmp

    • spec.backup.skipComponents

      array of strings

      List of components excluded from backups.

      Default: []

      • spec.backup.skipComponents.Element of the array

        string

        Allowed values: Db, Repositories, Uploads, Builds, Artifacts, Pages, Lfs, TerraformState, Registry, Packages, CiSecureFiles, ExternalDiffs

    • spec.backup.tolerations

      array of objects

      Tolerations for running a Pod responsible for backups (via toolbox) on a specific node.

      Default: []

      • spec.backup.tolerations.effect

        string
      • spec.backup.tolerations.key

        string
      • spec.backup.tolerations.operator

        string
      • spec.backup.tolerations.tolerationSeconds

        integer
      • spec.backup.tolerations.value

        string
  • spec.features

    object

    Configuration of optional components that are enabled as necessary.

    Default: {}

    • spec.features.mail

      object

      Configuration of all email types.

      Default: {}

      • spec.features.mail.incomingEmail

        object

        Incoming email configuration.

        Default: { "address": "", "enabled": false, "host": "", "password": "", "user": "" }

        • spec.features.mail.incomingEmail.address

          string

          Required value

          Email address template for a resource or project where a reply is sent to (for example, code-incoming+%{key}@gmail.com).

          The entire +%{key} suffix should be included within the email address and should not be replaced by any other value.

          Default:

        • spec.features.mail.incomingEmail.enabled

          boolean

          Required value

          Enable incoming email for the module.

          Default: false

        • spec.features.mail.incomingEmail.host

          string

          Required value

          Remote email server address.

          Default: imap.gmail.com

        • spec.features.mail.incomingEmail.password

          string

          Required value

          User password for IMAP authentication.

          Default:

        • spec.features.mail.incomingEmail.port

          integer

          Email server connection port.

          Default: 993

        • spec.features.mail.incomingEmail.serviceDeskEmail

          object

          Incoming email configuration for project support desk.

          Default: { "address": "", "enabled": false, "host": "", "password": "", "user": "" }

          • spec.features.mail.incomingEmail.serviceDeskEmail.address

            string

            Required value

            Email address template for a resource or project where a reply is sent to (for example, project_contact+%{key}@gmail.com).

            The entire +%{key} suffix should be included within the email address and should not be replaced by any other value.

            Default:

          • spec.features.mail.incomingEmail.serviceDeskEmail.enabled

            boolean

            Required value

            Enable incoming email configuration for project support desk.

            Applied if incoming emails are configured for the module.

            Default: false

          • spec.features.mail.incomingEmail.serviceDeskEmail.host

            string

            Required value

            Remote email server address.

            Default: imap.gmail.com

          • spec.features.mail.incomingEmail.serviceDeskEmail.password

            string

            Required value

            User password for IMAP authentication.

            Default:

          • spec.features.mail.incomingEmail.serviceDeskEmail.port

            integer

            Email server connection port.

            Default: 993

          • spec.features.mail.incomingEmail.serviceDeskEmail.ssl

            boolean

            Use SSL connection if it’s enabled on the IMAP server.

            Default: true

          • spec.features.mail.incomingEmail.serviceDeskEmail.startTls

            boolean

            Use STARTTLS connection if it’s enabled on the IMAP server.

            Default: false

          • spec.features.mail.incomingEmail.serviceDeskEmail.user

            string

            Required value

            Username for IMAP authentication.

            Default:

        • spec.features.mail.incomingEmail.ssl

          boolean

          Use SSL connection if it’s enabled on the IMAP server.

          Default: true

        • spec.features.mail.incomingEmail.startTls

          boolean

          Use STARTTLS connection if it’s enabled on the IMAP server.

          Default: false

        • spec.features.mail.incomingEmail.user

          string

          Required value

          Username for IMAP authentication.

          Default:

      • spec.features.mail.outgoingEmail

        object

        Default: { "displayName": "Deckhouse Code", "from": "no-reply@deckhouse.io", "replyTo": "no-reply@deckhouse.io" }

        • spec.features.mail.outgoingEmail.displayName

          string

          Required value

          Sender name displayed in the outgoing email.

          Default: Deckhouse Code

        • spec.features.mail.outgoingEmail.from

          string

          Required value

          Sender email address displayed in the outgoing email.

          Default: deckhouse.code@example.com

        • spec.features.mail.outgoingEmail.replyTo

          string

          Required value

          Email address displayed in the Reply-To header.

          Default: noreply@example.com

        • spec.features.mail.outgoingEmail.smtp

          object

          SMTP configuration for the module.

          Default: {}

          • spec.features.mail.outgoingEmail.smtp.address

            string

            Remote SMTP server address.

            Default: smtp.mailgun.org

          • spec.features.mail.outgoingEmail.smtp.authentication

            string

            SMTP authentication type.

            Allowed values: None, Plain, Login, CramMd5

          • spec.features.mail.outgoingEmail.smtp.domain

            string

            Optional HELO domain for SMTP connection.

            Default:

          • spec.features.mail.outgoingEmail.smtp.enabled

            boolean

            Enable outgoing email.

            Default: false

          • spec.features.mail.outgoingEmail.smtp.opensslVerifyMode

            string

            TLS certificate verification mode.

            Default: Peer

            Allowed values: None, Peer, ClientOnce, FailIfNoPeerCert

          • spec.features.mail.outgoingEmail.smtp.password

            string

            User password for SMTP authentication.

            Default:

          • spec.features.mail.outgoingEmail.smtp.port

            integer

            SMTP server connection port.

            Default: 25

          • spec.features.mail.outgoingEmail.smtp.starttlsAuto

            boolean

            Use STARTTLS if it’s supported by the SMTP server.

            Default: false

          • spec.features.mail.outgoingEmail.smtp.tls

            boolean

            Use SMTP/TLS (SMTPS — SMTP over direct TLS connection).

            Default: false

          • spec.features.mail.outgoingEmail.smtp.username

            string

            Username for SMTP authentication.

            Default:

        • spec.features.mail.outgoingEmail.subjectSuffix

          string

          Suffix added to the subject of all outgoing email of the module.

          Default:

    • spec.features.pages

      object

      Configuration of the Pages component.

      Default: {}

      • spec.features.pages.enabled

        boolean

        Enable the Pages component.

        Default: false

      • spec.features.pages.ingress

        object

        Incoming network connection settings for the Pages component.

        Default: {}

        • spec.features.pages.ingress.annotations

          object

          Map of additional annotations for the Pages component.
        • spec.features.pages.ingress.hostname

          string

          Redefined domain name for the Pages service.

          Default:

        • spec.features.pages.ingress.https

          object

          HTTPS configuration for incoming connections.
          • spec.features.pages.ingress.https.certManager

            object

            Configuration of the cert-manager.
            • spec.features.pages.ingress.https.certManager.clusterIssuerName

              string

              Name of the ClusterIssuer issuing the SSL certificates.

              Default: letsencrypt

          • spec.features.pages.ingress.https.customCertificate

            object

            Custom certificate mode parameters.
            • spec.features.pages.ingress.https.customCertificate.secretName

              string

              Name of Secret where the custom certificate is stored.
          • spec.features.pages.ingress.https.mode

            string

            Default: CertManager

            Allowed values: CertManager, CustomCertificate

        • spec.features.pages.ingress.ingressClass

          string

          Ingress class to use for Pages. If empty, it defaults to the instance global.
      • spec.features.pages.s3

        object

        S3 storage connection settings.
        • spec.features.pages.s3.bucketName

          string

          Name of the S3 bucket used by the Pages component.

          Default: d8-code-pages

        • spec.features.pages.s3.external

          object

          External S3 storage configuration.
          • spec.features.pages.s3.external.accessKey

            string

            Required value

            Bucket access key.
          • spec.features.pages.s3.external.endpoint

            string

            Custom S3-compatible storage service endpoint to use for requests.

            If the schema (http:// or https://) is not explicitly provided, the system will default to using https://. For example, an endpoint specified as s3.example.com will automatically be interpreted as https://s3.example.com.

            Default:

          • spec.features.pages.s3.external.provider

            string

            Required value

            S3 storage cloud provider. For storage in a local environment, use Generic.

            Allowed values: Generic, YCloud

          • spec.features.pages.s3.external.region

            string

            Bucket region.

            Default:

          • spec.features.pages.s3.external.secretKey

            string

            Required value

            Secret key for accessing the buckets.
          • spec.features.pages.s3.external.storageOptions

            object

            Default: {}

            • spec.features.pages.s3.external.storageOptions.serverSideEncryption

              string

              S3 bucket encryption mode.

              Allowed values: AES256, AwsKms

            • spec.features.pages.s3.external.storageOptions.serverSideEncryptionKmsKeyId

              string

              Amazon Resource Name (ARN) of the KMS key. Only needed when AwsKms is used in serverSideEncryption.
        • spec.features.pages.s3.mode

          string

          Storage type.

          Default: External

          Allowed values: Internal, External

    • spec.features.registry

      object

      Configuration of the Registry component.

      Default: {}

      • spec.features.registry.enabled

        boolean

        Enable the Registry component.

        Default: false

      • spec.features.registry.garbageCollector

        object

        Garbage collector configuration.
        • spec.features.registry.garbageCollector.blobs

          object

          Blob garbage collector configuration.
          • spec.features.registry.garbageCollector.blobs.enabled

            boolean

            Enable the blob garbage collector.

            Default: false

          • spec.features.registry.garbageCollector.blobs.interval

            string

            Interval between the blob garbage collector launches.

            Default: 5s

        • spec.features.registry.garbageCollector.enabled

          boolean

          Enable garbage collector.

          Default: false

        • spec.features.registry.garbageCollector.manifests

          object

          Manifest garbage collector configuration.
          • spec.features.registry.garbageCollector.manifests.enabled

            boolean

            Enable the manifest garbage collector.

            Default: false

          • spec.features.registry.garbageCollector.manifests.interval

            string

            Interval between the manifest garbage collector launches.

            Default: 5s

      • spec.features.registry.ingress

        object

        Incoming network connection settings for the Registry component.

        Default: {}

        • spec.features.registry.ingress.annotations

          object

          Map of additional annotations for the Registry component.
        • spec.features.registry.ingress.hostname

          string

          Redefined domain name for the Registry service.

          Default:

        • spec.features.registry.ingress.https

          object

          HTTPS configuration for incoming connections of the Registry component.
          • spec.features.registry.ingress.https.certManager

            object

            Configuration of the cert-manager.
            • spec.features.registry.ingress.https.certManager.clusterIssuerName

              string

              Name of the ClusterIssuer issuing the SSL certificates.

              Default: letsencrypt

          • spec.features.registry.ingress.https.customCertificate

            object

            Custom certificate mode parameters.
            • spec.features.registry.ingress.https.customCertificate.secretName

              string

              Name of Secret where the custom certificate is stored.
          • spec.features.registry.ingress.https.mode

            string

            Default: CertManager

            Allowed values: CertManager, CustomCertificate

        • spec.features.registry.ingress.ingressClass

          string

          Ingress class to use for Registry. If empty, it defaults to the instance global.
      • spec.features.registry.maintenance

        object

        Registry maintenance settings.

        Default: {}

        • spec.features.registry.maintenance.readOnly

          object

          Read-only mode.

          Default: {}

          • spec.features.registry.maintenance.readOnly.enabled

            boolean

            Enable the read-only mode for Registry for the duration of maintenance.

            Default: false

        • spec.features.registry.maintenance.uploadPurging

          object

          Configuration of the maintenance feature allowing to delete image upload artifacts from the storage. This does not delete the image data.

          Default: {}

          • spec.features.registry.maintenance.uploadPurging.age

            string

            Age thresholds (in hours) for artifacts to be deleted.

            Default: 168h

            Pattern: ^(\d+)h$

          • spec.features.registry.maintenance.uploadPurging.dryrun

            boolean

            Run the upload purging in dry-run mode.

            Default: false

          • spec.features.registry.maintenance.uploadPurging.enabled

            boolean

            Enable the upload purging. Disabled by default while in the read-only mode.

            Default: true

          • spec.features.registry.maintenance.uploadPurging.interval

            string

            Interval of the purging runs.

            Default: 24h

            Pattern: ^(\d+)h$

      • spec.features.registry.postgres

        object

        PostgreSQL database connection settings.
        • spec.features.registry.postgres.external

          object

          External PostgreSQL database connection settings.
          • spec.features.registry.postgres.external.database

            string

            Required value

            Main database name.

            Minimal length: 3

          • spec.features.registry.postgres.external.host

            string

            IP address or domain name of the PostgreSQL server.
          • spec.features.registry.postgres.external.password

            string

            User password for the metadata database.
          • spec.features.registry.postgres.external.port

            integer

            Port for connecting to the PostgreSQL server.
          • spec.features.registry.postgres.external.serverCA

            string

            CA certificate for the PostgreSQL server.
          • spec.features.registry.postgres.external.sslMode

            string

            Priority of the SSL connection to the PostgreSQL server through TCP/IP.

            Default: prefer

            Allowed values: allow, prefer, require, verify-ca, verify-full

          • spec.features.registry.postgres.external.username

            string

            Username for the metadata database.
        • spec.features.registry.postgres.mode

          string

          Database type.

          Allowed values: External

      • spec.features.registry.s3

        object

        S3 storage connection settings.

        Default: {}

        • spec.features.registry.s3.bucketName

          string

          List of “key-value” pairs naming all required buckets.

          Default: d8-code-registry

        • spec.features.registry.s3.external

          object
          • spec.features.registry.s3.external.accessKey

            string

            Required value

            S3 bucket access key.
          • spec.features.registry.s3.external.endpoint

            string

            Custom S3-compatible storage service endpoint to use for requests.

            If the schema (http:// or https://) is not explicitly provided, the system will default to using https://. For example, an endpoint specified as s3.example.com will be automatically interpreted as https://s3.example.com.

            Default:

          • spec.features.registry.s3.external.provider

            string

            Required value

            S3 storage cloud provider. For storage in a local environment, use Generic.

            Allowed values: Generic, YCloud

          • spec.features.registry.s3.external.region

            string

            S3 bucket region.

            Default:

          • spec.features.registry.s3.external.secretKey

            string

            Required value

            Secret key for accessing the S3 buckets.
        • spec.features.registry.s3.mode

          string

          Object storage type for the Registry component.

          Default: External

          Allowed values: Internal, External

  • spec.gitData

    object

    Git data configuration.
    • spec.gitData.replicas

      integer

      Number of Gitaly nodes when the high-availability mode is enabled (highAvailability).

      Allowed values: 1 <= X

    • spec.gitData.resources

      object

      Size of resources for Git data (Gitaly).
    • spec.gitData.storageClass

      string

      Kubernetes storageClass used for Git data storage (for PVC in Gitaly Pods).
    • spec.gitData.storagePerReplicaGb

      integer

      Size of the entire Git data. Required to calculate the size of volumes for each replica.

      Default: 1

      Allowed values: 1 <= X

  • spec.network

    object

    Network configuration parameters.

    Default: {}

    • spec.network.certificates

      object

      Section for configuring and managing TLS-certificates.

      Default: {}

      • spec.network.certificates.customCAs

        array of objects

        List of Secret and ConfigMap objects to fetch CA certificates from.

        To see an example of the list, refer to Network.

        Default: []

        • spec.network.certificates.customCAs.configMap

          string
        • spec.network.certificates.customCAs.keys

          array of strings
        • spec.network.certificates.customCAs.secret

          string
    • spec.network.gitSsh

      object

      SSH-related parameters.
      • spec.network.gitSsh.hostname

        string

        Hostname where Git SSH will be available.

        Leave empty to use the name corresponding with the web UI. Make sure that both services are available via the same IP address.

        Default:

      • spec.network.gitSsh.service

        object

        Service configuration for accessing the Git SSH.
        • spec.network.gitSsh.service.annotations

          object

          Map of additional annotations for the shell deployment.
        • spec.network.gitSsh.service.nodePort

          integer

          Port number to be used to expose the shell component when the NodePort service type is selected.

          Allowed values: 30000 <= X <= 32767

        • spec.network.gitSsh.service.type

          string

          Type of a Kubernetes service for exposing your shell component.

          For a single-node cluster, NodePort is reasonable, otherwise LoadBalancer is recommended.

          Allowed values: LoadBalancer, NodePort, ClusterIP

    • spec.network.ingressClass

      string

      Ingress class to use in the module. If empty, it defaults to the Deckhouse global Ingress class.

      Default:

    • spec.network.ownLoadBalancer

      object

      HAProxy configuration parameters.

      Default: {}

      • spec.network.ownLoadBalancer.annotations

        object

        Map of annotations for the HAProxy service.
      • spec.network.ownLoadBalancer.enabled

        boolean

        Deploy an additional LoadBalancer for both Git SSH and web UI.

        Default: true

      • spec.network.ownLoadBalancer.httpBackends

        array of strings

        List of IngressNginxController names to route HTTP(S) traffic to. Defaults to a Kubernetes service based on the Ingress class name.

        Default: []

    • spec.network.web

      object

      Web service (UI) network parameters.
      • spec.network.web.annotations

        object

        Map of additional annotations for the web service.
      • spec.network.web.hostname

        string

        Hostname where UI will be available. If left empty, it defaults to the cluster domain template.

        Important. Make sure that https.mode and the TLS certificate are valid for the specified hostname.

        Default:

      • spec.network.web.https

        object

        Type of the certificate used.

        Whenever this parameter is used, the global.modules.https settings are overridden completely.

        • spec.network.web.https.certManager

          object

          Parameters of the cert-manager.
          • spec.network.web.https.certManager.clusterIssuerName

            string

            ClusterIssuer type to be used to issue an SSL certificate. The following types are currently available: letsencrypt, letsencrypt-staging, and selfsigned, but you can also specify a custom type as well.

            Default: letsencrypt

        • spec.network.web.https.customCertificate

          object

          Parameters for a custom certificate usage.
          • spec.network.web.https.customCertificate.secretName

            string

            Name of a Secret in the d8-code namespace to be used for the Code web UI.

            The Secret must correspond with the kubernetes.io/tls format.

        • spec.network.web.https.mode

          string

          HTTPS mode:

          • CertManager: The web UI is accessed over HTTPS using a certificate obtained from a ClusterIssuer specified in the certManager.clusterIssuerName parameter.
          • CustomCertificate: The web UI is accessed over HTTPS using a certificate from the d8-code namespace.

          Default: CertManager

          Allowed values: CertManager, CustomCertificate

  • spec.placement

    object

    CR component placement settings.

    Default: {}

    • spec.placement.dedicated

      boolean

      Lets you define control over the placement of the Code module on specific nodes. If enabled, Code components are placed on nodes labeled with node-role.deckhouse.io/code=.

      For details about managing placement of components, refer to the section about Deckhouse configuration.

      Default: true

  • spec.scaling

    object

    Scaling-related configurations

    Default: {}

    • spec.scaling.highAvailability

      boolean

      Enable the High Availability (HA) mode.

      Default: false

    • spec.scaling.targetUserCount

      integer

      Estimated number of the module users.

      Default: 100

      Allowed values: 10, 100, 300, 500, 1000

  • spec.storages

    object

    Required value

    Configuration of storages used by Code. At the moment, only external storages are supported.
    • spec.storages.postgres

      object

      Required value

      PostgreSQL database connection settings.
      • spec.storages.postgres.external

        object

        External PostgreSQL database connection settings.
        • spec.storages.postgres.external.database

          string

          Required value

          Main database name.
        • spec.storages.postgres.external.host

          string

          Required value

          IP address or domain name of the PostgreSQL server.

          Default: localhost

        • spec.storages.postgres.external.password

          string

          PostgreSQL user password.
        • spec.storages.postgres.external.port

          integer

          Port for connecting to the PostgreSQL server.

          Default: 5432

        • spec.storages.postgres.external.praefectDatabase

          string

          PostgreSQL database name used for Praefect.

          Default:

        • spec.storages.postgres.external.praefectPassword

          string

          PostgreSQL user password for accessing Praefect.
        • spec.storages.postgres.external.praefectUsername

          string

          PostgreSQL username for accessing Praefect.

          Default: postgres

        • spec.storages.postgres.external.serverCA

          string

          CA certificate for the PostgreSQL server.
        • spec.storages.postgres.external.sslMode

          string

          Priority of the SSL connection to the PostgreSQL server through TCP/IP.

          Default: prefer

          Allowed values: allow, prefer, require, verify-ca, verify-full

        • spec.storages.postgres.external.username

          string

          Required value

          PostgreSQL user password.

          Default: postgres

      • spec.storages.postgres.mode

        string

        Database type.

        Allowed values: Internal, External

    • spec.storages.redis

      object

      Required value

      Redis connection settings.
      • spec.storages.redis.external

        object

        External Redis connection settings.
        • spec.storages.redis.external.auth

          object

          Required value

          Authentication settings for connecting to Redis. for Redis.
          • spec.storages.redis.external.auth.enabled

            boolean

            Required value

            Enable Redis authentication.

            Default: false

          • spec.storages.redis.external.auth.password

            string

            Redis user password when authentication is enabled.
          • spec.storages.redis.external.auth.username

            string

            Redis username when authentication is enabled
        • spec.storages.redis.external.host

          string

          Redis server domain name or IP address. Not required if Sentinel is used.

          Default:

        • spec.storages.redis.external.masterName

          string

          Master node name for the Sentinel cluster in Redis.
        • spec.storages.redis.external.port

          integer

          Redis server connection port.

          Default: 6379

        • spec.storages.redis.external.scheme

          string

          Redis server connection scheme.

          Default: redis

          Allowed values: redis, rediss, tcp

        • spec.storages.redis.external.sentinels

          array of objects
          • spec.storages.redis.external.sentinels.host

            string
          • spec.storages.redis.external.sentinels.port

            integer
        • spec.storages.redis.external.serverCA

          string

          CA certificate for connecting to the Redis server.
      • spec.storages.redis.mode

        string

        Required value

        Redis type.

        Allowed values: Internal, External

    • spec.storages.s3

      object

      Required value

      S3 storage connection settings.
      • spec.storages.s3.bucketNames

        object

        List of “key-value” pairs naming all required buckets.

        Default: {}

        • spec.storages.s3.bucketNames.artifacts

          string

          Name of the bucket for artifact storage.

          Default: d8-code-artifacts

        • spec.storages.s3.bucketNames.ciSecureFiles

          string

          Name of the bucket for storing secure CI files.

          Default: d8-code-ci-secure-files

        • spec.storages.s3.bucketNames.dependencyProxy

          string

          Name of the bucket for storing artifacts of the dependency proxy.

          Default: d8-code-dependency-proxy

        • spec.storages.s3.bucketNames.externalDiffs

          string

          Name of the bucket for storing Merge Request diff files.

          Default: d8-code-mr-diffs

        • spec.storages.s3.bucketNames.lfs

          string

          Name of the bucket for storing Git LFS data.

          Default: d8-code-git-lfs

        • spec.storages.s3.bucketNames.packages

          string

          Name of the bucket for storing packages.

          Default: d8-code-packages

        • spec.storages.s3.bucketNames.terraformState

          string

          Name of the bucket for storing Terraform state information.

          Default: d8-code-terraform-state

        • spec.storages.s3.bucketNames.uploads

          string

          Name of the bucket for storing uploaded files.

          Default: d8-code-uploads

      • spec.storages.s3.external

        object

        External S3 storage settings.
        • spec.storages.s3.external.accessKey

          string

          Required value

          S3 bucket access key.
        • spec.storages.s3.external.endpoint

          string

          Custom S3-compatible storage service endpoint to use for requests.

          If the schema (http:// or https://) is not explicitly provided, the system will default to using https://. For example, an endpoint specified as s3.example.com will be automatically interpreted as https://s3.example.com.

          Default:

        • spec.storages.s3.external.provider

          string

          Required value

          S3 storage cloud provider. For storage in a local environment, use Generic.

          Allowed values: Generic, YCloud

        • spec.storages.s3.external.proxyDownload

          boolean

          Enable the proxy for all downloads via Code instead of direct downloads from S3 buckets.

          Default: true

        • spec.storages.s3.external.region

          string

          S3 bucket region.

          Default:

        • spec.storages.s3.external.secretKey

          string

          Required value

          Secret key for accessing the S3 buckets.
        • spec.storages.s3.external.storageOptions

          object
          • spec.storages.s3.external.storageOptions.serverSideEncryption

            string

            S3 bucket encryption mode.

            Allowed values: , AES256, AwsKms

          • spec.storages.s3.external.storageOptions.serverSideEncryptionKmsKeyId

            string

            Amazon Resource Name (ARN) of the KMS key. Only needed when AwsKms is used in serverSideEncryption.
      • spec.storages.s3.mode

        string

        Default: External

        Allowed values: Internal, External