API Reference

littlehorse.io/v1

Resource Types:

• LHCanaryAggregator
• LHCanaryMetronome
• LHCluster
• LHDashboard
• LHKafkaConnector
• LHKafka
• LHKafkaUser
• LHKeycloakClient
• LHKeycloakOIDCProvider
• LHKeycloakRealm
• LHKeycloak
• LHOperator
• LHPrincipal
• LHTenant

LHCanaryAggregator

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHCanaryAggregator	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHCanaryAggregator.spec

^{↩ Parent}

Name	Type	Description	Required
image	string	The Docker Image to use	true
imagePullPolicy	enum	Image Pull Policy for the Canary Image Enum: Always, IfNotPresent, Never	true
kafka	object	Configures access to the Kafka cluster	true
storage	object	Configures storage for the LHCanary Statefulset	true
additionalConfigs	map[string]string	Configurations to pass to the LHCanaryAggregator.	false
defaultLabels	map[string]string	Labels to put on all created resources	false
logLevel	enum	Log Level for the aggregator Enum: DEBUG, INFO, TRACE, WARN	false
podMonitor	object	Configures PodMonitor resources for the Aggregator	false
replicas	integer	Number of replicas for the LH Canary Statefulset Minimum: 1	false

LHCanaryAggregator.spec.kafka

^{↩ Parent}

Configures access to the Kafka cluster

Name	Type	Description	Required
lhKafkaRef	object	Points to an LHKafka Cluster	false
partitions	integer	Number of partitions to use for the Canary's internal Kafka topics Minimum: 1	false
replicationFactor	integer	Replication factor for the Canary Kafka Topics Minimum: 0	false

LHCanaryAggregator.spec.kafka.lhKafkaRef

^{↩ Parent}

Points to an LHKafka Cluster

Name	Type	Description	Required
clusterWideQuotas	object	Quotas for the Canary. Includes Metronomes as well as the Aggregator since both share the same credentials.	true
clusterName	string	The name of the LHKaka resource that the Aggregator connects to	false

LHCanaryAggregator.spec.kafka.lhKafkaRef.clusterWideQuotas

^{↩ Parent}

Quotas for the Canary. Includes Metronomes as well as the Aggregator since both share the same credentials.

Name	Type	Description	Required
consumerThroughputPerSecond	int or string	The throughput in bytes per second that may be consumed by this Kafka principal	true
producerThroughputPerSecond	int or string	The throughput in bytes per second that may be produced by this Kafka principal	true

LHCanaryAggregator.spec.storage

^{↩ Parent}

Configures storage for the LHCanary Statefulset

Name	Type	Description	Required
storageClassName	string	The name of the storageclass with which to provision storage for the server	true
volumeSize	int or string	The size of the persistent volume.	true

LHCanaryAggregator.spec.podMonitor

^{↩ Parent}

Configures PodMonitor resources for the Aggregator

Name	Type	Description	Required
podMonitorLabels	map[string]string	Labels to add to the generated PodMonitor resources	false

LHCanaryAggregator.status

^{↩ Parent}

Name	Type	Description	Required
conditions	[]object		false
observedGeneration	integer		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false

LHCanaryAggregator.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHCanaryMetronome

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHCanaryMetronome	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHCanaryMetronome.spec

^{↩ Parent}

Name	Type	Description	Required
aggregatorRef	object	Specifies the LHCanaryAggregator for this Metronome	true
lhCluster	object	Specifies the LittleHorse Cluster to monitor	true
replicas	integer	Number of metronome replicas to deploy	true
storage	object	Storage Configuration for the Metronome	true
additionalConfigs	map[string]string	Configurations to pass to the LHCanaryMetronome.	false
defaultLabels	map[string]string	Labels to put on all created resources	false
image	string	The docker image for the LH Canary Default: ghcr.io/littlehorse-enterprises/littlehorse/lh-canary:master	false
imagePullPolicy	enum	ImagePullPolicy for the LH Canary Enum: Always, IfNotPresent, Never	false
logLevel	enum	Log Level for the metronome Enum: DEBUG, INFO, TRACE, WARN	false

LHCanaryMetronome.spec.aggregatorRef

^{↩ Parent}

Specifies the LHCanaryAggregator for this Metronome

Name	Type	Description	Required
name	string	Name of the LHCanaryAggregator that should aggregate beats from this Metronome.	false

LHCanaryMetronome.spec.lhCluster

^{↩ Parent}

Specifies the LittleHorse Cluster to monitor

Name	Type	Description	Required
externalClusterRef	object	Specifies a LittleHorse Cluster not managed by the same Operator as this Metronome	false

LHCanaryMetronome.spec.lhCluster.externalClusterRef

^{↩ Parent}

Specifies a LittleHorse Cluster not managed by the same Operator as this Metronome

Name	Type	Description	Required
apiHost	string	The API Host of the LH Cluster to monitor	true
apiPort	integer	The API Port of the LH Cluster to monitor	true
dataplaneId	string	Specifies a LittleHorse Dataplane id to match prometheus metrics	true
serverId	string	Specifies a LittleHorse Cluster id to match prometheus metrics	true
listenerName	string	The Listener Name to connect to	false
oauth	object	Configures OAuth authentication with the LittleHorse server	false
protocol	enum	The protocol of the listener either TLS or PLAINTEXT. Defaults to PLAINTEXT. If oauth is present it defaults to TLS Enum: PLAINTEXT, TLS	false
tenantId	string	The Tenant to use Default: default	false

LHCanaryMetronome.spec.lhCluster.externalClusterRef.oauth

^{↩ Parent}

Configures OAuth authentication with the LittleHorse server

Name	Type	Description	Required
accessTokenUrl	string	URL of the OIDC provider access token endpoint	true
credentials	object	Configuration of the ClientId and ClientSecret for the OAuth client	true

LHCanaryMetronome.spec.lhCluster.externalClusterRef.oauth.credentials

^{↩ Parent}

Configuration of the ClientId and ClientSecret for the OAuth client

Name	Type	Description	Required
secretRef	object	Reference to secret with a clientId and a clientSecret key. If those keys are not present, the deployment will fail	true

LHCanaryMetronome.spec.lhCluster.externalClusterRef.oauth.credentials.secretRef

^{↩ Parent}

Reference to secret with a clientId and a clientSecret key. If those keys are not present, the deployment will fail

Name	Type	Description	Required
name	string		true

LHCanaryMetronome.spec.storage

^{↩ Parent}

Storage Configuration for the Metronome

Name	Type	Description	Required
storageClassName	string	The name of the storageclass with which to provision storage for the server	true
volumeSize	int or string	The size of the persistent volume.	true

LHCanaryMetronome.status

^{↩ Parent}

Name	Type	Description	Required
conditions	[]object		false
observedGeneration	integer		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false

LHCanaryMetronome.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHCluster

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHCluster	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHCluster.spec

^{↩ Parent}

Name	Type	Description	Required
kafka	object		true
server	object		true
dashboard	object	Specifies to create Dashboard resources for the cluster	false
defaultLabels	map[string]string		false
internalComms	object	Configuration for internal communication (server to server and server to dashboard)	false
podMonitor	object		false

LHCluster.spec.kafka

^{↩ Parent}

Name	Type	Description	Required
clusterPartitions	integer		true
externalClusterRef	object		false
lhKafkaRef	object		false
replicationFactor	integer		false
strimziClusterRef	object		false

LHCluster.spec.kafka.externalClusterRef

^{↩ Parent}

Name	Type	Description	Required
bootstrapServers	string		true
securityProtocol	string		true
createTopics	boolean		false
kafkaKeyStore	object		false
kafkaTrustStore	object		false
saslJaasConfig	object		false
saslMechanism	string		false

LHCluster.spec.kafka.externalClusterRef.kafkaKeyStore

^{↩ Parent}

Name	Type	Description	Required
name	string		true

LHCluster.spec.kafka.externalClusterRef.kafkaTrustStore

^{↩ Parent}

Name	Type	Description	Required
name	string		true

LHCluster.spec.kafka.externalClusterRef.saslJaasConfig

^{↩ Parent}

Name	Type	Description	Required
name	string		true

LHCluster.spec.kafka.lhKafkaRef

^{↩ Parent}

Name	Type	Description	Required
clusterName	string		true
clusterWideQuotas	object		true
deleteKafkaTopics	boolean	Delete Kafka Topics when the LHCluster is deleted. If false, the topics will be left in place.	false

LHCluster.spec.kafka.lhKafkaRef.clusterWideQuotas

^{↩ Parent}

Name	Type	Description	Required
consumerThroughputPerSecond	int or string	The throughput in bytes per second that may be consumed by this Kafka principal	true
producerThroughputPerSecond	int or string	The throughput in bytes per second that may be produced by this Kafka principal	true

LHCluster.spec.kafka.strimziClusterRef

^{↩ Parent}

Name	Type	Description	Required
clusterName	string		true
createTopics	boolean		true
listener	object		true
deleteKafkaTopics	boolean	Delete Kafka Topics when the LHCluster is deleted. If false, the topics will be left in place.	false
quotas	object		false

LHCluster.spec.kafka.strimziClusterRef.listener

^{↩ Parent}

Name	Type	Description	Required
port	integer		true
authentication	string		false
tls	boolean		false

LHCluster.spec.kafka.strimziClusterRef.quotas

^{↩ Parent}

Name	Type	Description	Required
consumerByteRate	integer		false
controllerMutationRate	number		false
producerByteRate	integer		false
requestPercentage	integer		false

LHCluster.spec.server

^{↩ Parent}

Name	Type	Description	Required
replicas	integer	Desired number of LH Server pods Minimum: 1	true
storage	object	Specification for persistent storage used by the server	true
authentication	object	Determines how the LH Servers will determine Principal identity	false
compute	object	Specifies the compute resources allocated to the Server pods	false
coreStreamsCommitIntervalMs	integer	Sets commit.interval.ms for the Core topology.	false
experimentalConfigOverride	map[string]string	EXPERIMENTAL: specific configurations to override on the LH Server. Only applies to configs that are constant across all server instances.	false
hotStandbyReplicas	integer	The number of Kafka Streams standby replicas	false
image	string	Image to use for the LH Server	false
imagePullPolicy	enum	Image Pull Policy for LH Server Pods Enum: Always, IfNotPresent, Never	false
lingerMs	integer	Desired value for linger.ms on the Command Producer.	false
listeners	[]object	Listeners to expose on the LH Server for use by clients of the LHCluster	false
logLevel	enum	Log Level for the LH Server Enum: DEBUG, INFO, TRACE, WARN	false
nodeSelector	map[string]string	Node Selector for LH Server pods.	false
podAnnotations	map[string]string	Labels to put on LH Server Pods	false
podLabels	map[string]string	Annotations to put on LH Server Pods	false
priorityClassName	string	Priority Class for LH Server pods.	false
rackAwareness	object	Specifies rack awareness for the LH Servers	false
serviceAnnotations	map[string]string	Annotations to put on LH Server Services	false
serviceLabels	map[string]string	Labels to put on LH Server Services	false
sessionTimeoutMs	integer	Session Timeout for the LH Server Kafka Streams topology. Default: 45000	false
streamsMetricsLevel	enum	Level of Kafka Streams metrics to collect. Setting to DEBUG or TRACE impacts performance. Enum: DEBUG, INFO, TRACE, WARN	false
tolerations	[]object	Tolerations for LH Server pods.	false
version	string	Version of the LH Server to deploy	false

LHCluster.spec.server.storage

^{↩ Parent}

Specification for persistent storage used by the server

Name	Type	Description	Required
storageClassName	string	The name of the storageclass with which to provision storage for the server	true
volumeSize	int or string	The size of the persistent volume.	true

LHCluster.spec.server.authentication

^{↩ Parent}

Determines how the LH Servers will determine Principal identity

Name	Type	Description	Required
mtls	object		false
oauth	object		false

LHCluster.spec.server.authentication.mtls

^{↩ Parent}

Name	Type	Description	Required
clientCaCert	object		true

LHCluster.spec.server.authentication.mtls.clientCaCert

^{↩ Parent}

Name	Type	Description	Required
secretRef	object		true

LHCluster.spec.server.authentication.mtls.clientCaCert.secretRef

^{↩ Parent}

Name	Type	Description	Required
name	string		true

LHCluster.spec.server.authentication.oauth

^{↩ Parent}

Name	Type	Description	Required
credentials	object		true
introspectionEndpointUrl	string		true

LHCluster.spec.server.authentication.oauth.credentials

^{↩ Parent}

Name	Type	Description	Required
secretRef	object		true

LHCluster.spec.server.authentication.oauth.credentials.secretRef

^{↩ Parent}

Name	Type	Description	Required
name	string		true

LHCluster.spec.server.compute

^{↩ Parent}

Specifies the compute resources allocated to the Server pods

Name	Type	Description	Required
cpu	int or string	The amount of CPU to assign to the server pod. Sets request and limit. Influences rocksdb and kafka streams configs.	false
memory	int or string	The amount of memory to assign to the server pod. Sets request and limit. Influences RocksDB Configs.	false

LHCluster.spec.server.listeners[index]

^{↩ Parent}

Name	Type	Description	Required
name	string		true
port	integer		true
advertisedListeners	object		false
authentication	object		false
infrastructure	object		false
tls	object		false

LHCluster.spec.server.listeners[index].advertisedListeners

^{↩ Parent}

Name	Type	Description	Required
bootstrap	object		false
serverHostSuffix	string		false
servers	[]object		false

LHCluster.spec.server.listeners[index].advertisedListeners.bootstrap

^{↩ Parent}

Name	Type	Description	Required
host	string		true

LHCluster.spec.server.listeners[index].advertisedListeners.servers[index]

^{↩ Parent}

Name	Type	Description	Required
host	string		true
port	integer		true

LHCluster.spec.server.listeners[index].authentication

^{↩ Parent}

Name	Type	Description	Required
type	enum	Enum: MTLS, NONE, OAUTH	true

LHCluster.spec.server.listeners[index].infrastructure

^{↩ Parent}

Name	Type	Description	Required
ingress	object	Specifies to create Ingress resources for the listener.	false
tlsRoute	object	Specifies to create TLSRoute according to the Gateway API. Requires a listener with the 'Passthrough' TLS mode enabled.	false

LHCluster.spec.server.listeners[index].infrastructure.ingress

^{↩ Parent}

Specifies to create Ingress resources for the listener.

Name	Type	Description	Required
ingressClassName	string		true
ingressAnnotations	map[string]string		false

LHCluster.spec.server.listeners[index].infrastructure.tlsRoute

^{↩ Parent}

Specifies to create TLSRoute according to the Gateway API. Requires a listener with the 'Passthrough' TLS mode enabled.

Name	Type	Description	Required
advertisedPort	integer	The advertised port. May differ from Gateway port depending on load balancer configuration.	true
gatewayRef	object	Specifies the Gateway to create routes for.	true
tlsRouteAnnotations	map[string]string	Optional additional annotations to apply to the generated TLSRoutes.	false
tlsRouteLabels	map[string]string	Optional additional labels to apply to the generated TLSRoutes.	false

LHCluster.spec.server.listeners[index].infrastructure.tlsRoute.gatewayRef

^{↩ Parent}

Specifies the Gateway to create routes for.

Name	Type	Description	Required
name	string	The name of the Gateway.	true
sectionName	string	The sectionName, usually a port name, of the referenced Gateway to attach to.	true
namespace	string	The namespace of the Gateway to attach to. Defaults to current namespace.	false

LHCluster.spec.server.listeners[index].tls

^{↩ Parent}

Name	Type	Description	Required
issuerRef	object		false
secretRef	object		false

LHCluster.spec.server.listeners[index].tls.issuerRef

^{↩ Parent}

Name	Type	Description	Required
name	string	Name of the CertManager Issuer or ClusterIssuer	true
kind	string	Kind of the CertManager Issuer or ClusterIssuer	false

LHCluster.spec.server.listeners[index].tls.secretRef

^{↩ Parent}

Name	Type	Description	Required
name	string		true

LHCluster.spec.server.rackAwareness

^{↩ Parent}

Specifies rack awareness for the LH Servers

Name	Type	Description	Required
zoneIds	[]string	List of all possible Racks. Required to avoid giving the Operator a ClusterRole.	true
zoneKey	string	The name of the label on K8s nodes which contains the Rack information	true

LHCluster.spec.server.tolerations[index]

^{↩ Parent}

Name	Type	Description	Required
effect	string		false
key	string		false
operator	string		false
tolerationSeconds	integer		false
value	string		false

LHCluster.spec.dashboard

^{↩ Parent}

Specifies to create Dashboard resources for the cluster

Name	Type	Description	Required
image	string	Dashboard image for the pod. If not provided it defaults to ghcr.io/littlehorse-enterprises/littlehorse/lh-dashboard with either latest or the server version if spec.server.version is set	false
imagePullPolicy	string	Image pull policy for the dashboard container	false
infrastructure	object	Configures K8s infrastructure to allow external access to the dashboard.	false
oauth	object	Configure OAuth for users of the dashboard	false
replicas	integer	Number of dashboard pod replicas. Defaults to 1 Minimum: 1	false
tls	object	Configure TLS for port that clients use to connect to the dashboard.	false

LHCluster.spec.dashboard.infrastructure

^{↩ Parent}

Configures K8s infrastructure to allow external access to the dashboard.

Name	Type	Description	Required
ingress	object	Specifies to create Ingress resources for the dashboard	false
tlsRoute	object	Specifies to create TLSRoute according to the Gateway API. Requires a listener with the 'Passthrough' TLS mode enabled.	false

LHCluster.spec.dashboard.infrastructure.ingress

^{↩ Parent}

Specifies to create Ingress resources for the dashboard

Name	Type	Description	Required
hostname	string	The host to be used in the Ingress resource rule	true
ingressClassName	string	The name of the Ingress class to be used in the ingressClassName property of the Ingress resource	true
annotations	map[string]string	Annotations to put in the Ingress resource	false

LHCluster.spec.dashboard.infrastructure.tlsRoute

^{↩ Parent}

Specifies to create TLSRoute according to the Gateway API. Requires a listener with the 'Passthrough' TLS mode enabled.

Name	Type	Description	Required
gatewayRef	object	Specifies the Gateway to create routes for.	true
hostname	string	The host to be added to the TLSRoute hostnames	true
annotations	map[string]string	Optional additional annotations to apply to the generated TLSRoute.	false
labels	map[string]string	Optional additional labels to apply to the generated TLSRoute.	false

LHCluster.spec.dashboard.infrastructure.tlsRoute.gatewayRef

^{↩ Parent}

Specifies the Gateway to create routes for.

Name	Type	Description	Required
name	string	The name of the Gateway.	true
sectionName	string	The sectionName, usually a port name, of the referenced Gateway to attach to.	true
namespace	string	The namespace of the Gateway to attach to. Defaults to current namespace.	false

LHCluster.spec.dashboard.oauth

^{↩ Parent}

Configure OAuth for users of the dashboard

Name	Type	Description	Required
callbackUrl	string	Canonical URL of the Dashboard site. Used by the Authorization Server to return the control to the LH Dashboard.More information can be found here: https://next-auth.js.org/configuration/options#nextauth_url	true
secretRef	object	Reference to a Secret with the OAuth clientId and clientSecret. If clientId entry and clientSecret entry are not present on the Secret, the deployment will fail	true
serverUrl	string	OAuth server url	true
callbackUrlInternal	string	Internal URL of the Dashboard server. Used by the Dashboard Server to query itself.Should only be set when the callbackUrl cannot be reached by the dashboard server.More information can be found here: https://next-auth.js.org/configuration/options#nextauth_url_internal	false

LHCluster.spec.dashboard.oauth.secretRef

^{↩ Parent}

Reference to a Secret with the OAuth clientId and clientSecret. If clientId entry and clientSecret entry are not present on the Secret, the deployment will fail

Name	Type	Description	Required
name	string		true

LHCluster.spec.dashboard.tls

^{↩ Parent}

Configure TLS for port that clients use to connect to the dashboard.

Name	Type	Description	Required
secretRef	object	Configures the dashboard to use TLS by providing a reference to a Secret with a tls.crt for the cert and a tls.key entry for the key. If tls.cert and tls.key are not present on the Secret, the deployment will fail	true

LHCluster.spec.dashboard.tls.secretRef

^{↩ Parent}

Configures the dashboard to use TLS by providing a reference to a Secret with a tls.crt for the cert and a tls.key entry for the key. If tls.cert and tls.key are not present on the Secret, the deployment will fail

Name	Type	Description	Required
name	string		true

LHCluster.spec.internalComms

^{↩ Parent}

Configuration for internal communication (server to server and server to dashboard)

Name	Type	Description	Required
encryptionEnabled	boolean	Automatically generates certs and the appropriate configuration for encrypting internal communication (server to server and server to dashboard). This property shouldn't be changed once set, or else it will cause downtime. LHO_CERTMANAGER_ENABLED should be set to true for this feature to work	true

LHCluster.spec.podMonitor

^{↩ Parent}

Name	Type	Description	Required
metricRelabelings	[]object	Relabelings for the metrics exposed by the server	false
podMonitorLabels	map[string]string	Labels to add to the generated PodMonitor resources	false

LHCluster.spec.podMonitor.metricRelabelings[index]

^{↩ Parent}

Name	Type	Description	Required
action	string		false
modulus	integer		false
regex	string		false
replacement	string		false
separator	string		false
sourceLabels	[]string		false
targetLabel	string		false

LHCluster.status

^{↩ Parent}

Name	Type	Description	Required
adminPrincipal	string		false
clusterHealth	object		false
conditions	[]object		false
kafkaType	enum	Enum: EXTERNAL, LHKAFKA, STRIMZI	false
lastBounceTime	integer		false
lastBouncedPod	integer		false
observedGeneration	integer		false
partitions	integer		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false
volumeSizeInternal	int or string		false

LHCluster.status.clusterHealth

^{↩ Parent}

Name	Type	Description	Required
offlineTasks	integer	Number of Active Core Streams Tasks that are under restoration.	false
streamTasks	[]object	Health of each Core Topology Stream Task, ordered by partition number	false
underReplicatedCoreTasks	integer	Total number of Core Streams Tasks that don't have enough caught-up Standbys	false
warmingUpCoreTasks	integer	Number of Core Streams Tasks that are being moved to different instances	false

LHCluster.status.clusterHealth.streamTasks[index]

^{↩ Parent}

Name	Type	Description	Required
activeTask	object		false
standbys	[]object		false

LHCluster.status.clusterHealth.streamTasks[index].activeTask

^{↩ Parent}

Name	Type	Description	Required
instanceId	integer		false
restorationLag	integer		false

LHCluster.status.clusterHealth.streamTasks[index].standbys[index]

^{↩ Parent}

Name	Type	Description	Required
instanceId	integer		false
lag	integer		false

LHCluster.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHDashboard

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHDashboard	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHDashboard.spec

^{↩ Parent}

Name	Type	Description	Required
api	object	Configures how the dashboard talks to the LH Server.	true
image	string	The image to be used by the Dashboard.	true
replicas	integer	The number of dashboard Pods to deploy. Minimum: 1	true
authentication	object	Configures authentication for users of the dashboard.	false
defaultLabels	map[string]string	Labels to place on all dependent resources of the LHDashboard.	false
imagePullPolicy	string	The ImagePullPolicy to be used for the Dashboard Pods.	false
infrastructure	object	Configures ingress-like infrastructure to be deployed for the LHDashboard.	false
resources	object	Configures compute resources for the dashboard pods.	false
tls	object	Configures TLS for incoming connections.	false

LHDashboard.spec.api

^{↩ Parent}

Configures how the dashboard talks to the LH Server.

Name	Type	Description	Required
host	string		true
port	integer		true
caCert	object		false
protocol	enum	Enum: PLAINTEXT, TLS	false

LHDashboard.spec.api.caCert

^{↩ Parent}

Name	Type	Description	Required
secretRef	object		true

LHDashboard.spec.api.caCert.secretRef

^{↩ Parent}

Name	Type	Description	Required
name	string		true

LHDashboard.spec.authentication

^{↩ Parent}

Configures authentication for users of the dashboard.

Name	Type	Description	Required
oauth	object		true

LHDashboard.spec.authentication.oauth

^{↩ Parent}

Name	Type	Description	Required
callbackUrl	string	Canonical URL of the Dashboard site. Used by the Authorization Server to return the control to the LH Dashboard.More information can be found here: https://next-auth.js.org/configuration/options#nextauth_url	true
credentials	object		true
serverUrl	string	OAuth server url	true
callbackUrlInternal	string	Internal URL of the Dashboard server. Used by the Dashboard Server to query itself.Should only be set when the callbackUrl cannot be reached by the dashboard server.More information can be found here: https://next-auth.js.org/configuration/options#nextauth_url_internal	false

LHDashboard.spec.authentication.oauth.credentials

^{↩ Parent}

Name	Type	Description	Required
secretRef	object	Reference to secret with a clientId and a clientSecret key. If those keys are not present, the deployment will fail	true

LHDashboard.spec.authentication.oauth.credentials.secretRef

^{↩ Parent}

Reference to secret with a clientId and a clientSecret key. If those keys are not present, the deployment will fail

Name	Type	Description	Required
name	string		true

LHDashboard.spec.infrastructure

^{↩ Parent}

Configures ingress-like infrastructure to be deployed for the LHDashboard.

Name	Type	Description	Required
ingress	object	Specifies to create Ingress resources for the dashboard	false
tlsRoute	object	Specifies to create TLSRoute according to the Gateway API. Requires a listener with the 'Passthrough' TLS mode enabled.	false

LHDashboard.spec.infrastructure.ingress

^{↩ Parent}

Specifies to create Ingress resources for the dashboard

Name	Type	Description	Required
hostname	string	The host to be used in the Ingress resource rule	true
ingressClassName	string	The name of the Ingress class to be used in the ingressClassName property of the Ingress resource	true
annotations	map[string]string	Annotations to put in the Ingress resource	false

LHDashboard.spec.infrastructure.tlsRoute

^{↩ Parent}

Specifies to create TLSRoute according to the Gateway API. Requires a listener with the 'Passthrough' TLS mode enabled.

Name	Type	Description	Required
gatewayRef	object	Specifies the Gateway to create routes for.	true
hostname	string	The host to be added to the TLSRoute hostnames	true
annotations	map[string]string	Optional additional annotations to apply to the generated TLSRoute.	false
labels	map[string]string	Optional additional labels to apply to the generated TLSRoute.	false

LHDashboard.spec.infrastructure.tlsRoute.gatewayRef

^{↩ Parent}

Specifies the Gateway to create routes for.

Name	Type	Description	Required
name	string	The name of the Gateway.	true
sectionName	string	The sectionName, usually a port name, of the referenced Gateway to attach to.	true
namespace	string	The namespace of the Gateway to attach to. Defaults to current namespace.	false

LHDashboard.spec.resources

^{↩ Parent}

Configures compute resources for the dashboard pods.

Name	Type	Description	Required
claims	[]object		false
limits	map[string]int or string		false
requests	map[string]int or string		false

LHDashboard.spec.resources.claims[index]

^{↩ Parent}

Name	Type	Description	Required
name	string		false
request	string		false

LHDashboard.spec.tls

^{↩ Parent}

Configures TLS for incoming connections.

Name	Type	Description	Required
secretRef	object	Configures the dashboard to use TLS by providing a reference to a Secret with a tls.crt for the cert and a tls.key entry for the key. If tls.cert and tls.key are not present on the Secret, the deployment will fail	true

LHDashboard.spec.tls.secretRef

^{↩ Parent}

Configures the dashboard to use TLS by providing a reference to a Secret with a tls.crt for the cert and a tls.key entry for the key. If tls.cert and tls.key are not present on the Secret, the deployment will fail

Name	Type	Description	Required
name	string		true

LHDashboard.status

^{↩ Parent}

Name	Type	Description	Required
conditions	[]object		false
observedGeneration	integer		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false

LHDashboard.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHKafkaConnector

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHKafkaConnector	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHKafkaConnector.spec

^{↩ Parent}

Name	Type	Description	Required
className	string	The Java class that implements the connector	true
config	object	The configuration for this Kafka Connector	true
kafkaRef	object	The name of the LHKafka cluster that this connector connects to	true
tasksMax	integer	Maximum number of tasks for this connector. Minimum: 1	true
autoRestart	object	Allows specifying automatic restarts for failed connectors	false
desiredState	enum	The desired state of the connector. Either running, paused, or stopped Enum: paused, running, stopped	false
plugins	[]object	List of plugins required to run this connector	false
sinkTopic	string	The topic that this connector should use. Only for source connector.	false
sourceTopics	string	The topic regex that this connector should use. Only for sink connector.	false

LHKafkaConnector.spec.config

^{↩ Parent}

The configuration for this Kafka Connector

Name	Type	Description	Required
configSecret	object	A reference to a secret containing configuration properties for the connector logic.	false
fileBasedConfigs	[]object	Configurations that require mounting a file on a disk (eg. TLS certificates).	false
plainConfigs	map[string]string	App-level configurations for the connector which can be set in plaintext.	false

LHKafkaConnector.spec.config.configSecret

^{↩ Parent}

A reference to a secret containing configuration properties for the connector logic.

Name	Type	Description	Required
name	string		true

LHKafkaConnector.spec.kafkaRef

^{↩ Parent}

The name of the LHKafka cluster that this connector connects to

Name	Type	Description	Required
name	string	The name of the LHKafka cluster that this connector connects to	true

LHKafkaConnector.spec.autoRestart

^{↩ Parent}

Allows specifying automatic restarts for failed connectors

Name	Type	Description	Required
enabled	boolean		false
maxRestarts	integer		false

LHKafkaConnector.spec.plugins[index]

^{↩ Parent}

Name	Type	Description	Required
artifacts	[]object		false
name	string		false

LHKafkaConnector.spec.plugins[index].artifacts[index]

^{↩ Parent}

Name	Type	Description	Required
jar	object		false
maven	object		false
other	object		false
tgz	object		false
zip	object		false

LHKafkaConnector.spec.plugins[index].artifacts[index].jar

^{↩ Parent}

Name	Type	Description	Required
insecure	boolean		false
sha512sum	string		false
url	string		false

LHKafkaConnector.spec.plugins[index].artifacts[index].maven

^{↩ Parent}

Name	Type	Description	Required
artifact	string		false
group	string		false
insecure	boolean		false
repository	string		false
version	string		false

LHKafkaConnector.spec.plugins[index].artifacts[index].other

^{↩ Parent}

Name	Type	Description	Required
fileName	string		false
insecure	boolean		false
sha512sum	string		false
url	string		false

LHKafkaConnector.spec.plugins[index].artifacts[index].tgz

^{↩ Parent}

Name	Type	Description	Required
insecure	boolean		false
sha512sum	string		false
url	string		false

LHKafkaConnector.spec.plugins[index].artifacts[index].zip

^{↩ Parent}

Name	Type	Description	Required
insecure	boolean		false
sha512sum	string		false
url	string		false

LHKafkaConnector.status

^{↩ Parent}

Name	Type	Description	Required
conditions	[]object		false
observedGeneration	integer		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false

LHKafkaConnector.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHKafka

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHKafka	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHKafka.spec

^{↩ Parent}

Name	Type	Description	Required
controllers	object	Specifies the controllers for the Kafka cluster. If brokers is not set, then these pods are both brokers and controllers.	true
brokers	object	Specifies the brokers for the Kafka cluster. If not set, then the controllers are both brokers and controllers.	false
connect	object	Configures the deployment of a Kafka Connect cluster connected to this LHKafka.	false
externalAccess	object	Configures external access to the Kafka cluster from outside Kubernetes	false
kafkaVersion	string	The desired kafka version. If null (recommended), uses the newest available version	false
podMonitor	object	Configures PodMonitor's to be deployed for this LHKafka	false
rackNodeLabel	string	The k8s node label to be used for rack awareness	false

LHKafka.spec.controllers

^{↩ Parent}

Specifies the controllers for the Kafka cluster. If brokers is not set, then these pods are both brokers and controllers.

Name	Type	Description	Required
replicas	integer	Minimum: 1	true
storage	object		true
compute	object		false
nodeSelectorTerms	[]object		false
tolerations	[]object		false

LHKafka.spec.controllers.storage

^{↩ Parent}

Name	Type	Description	Required
storageClassName	string	The name of the storageclass with which to provision storage for the server	true
volumeSize	int or string	The size of the persistent volume.	true

LHKafka.spec.controllers.compute

^{↩ Parent}

Name	Type	Description	Required
cpu	int or string	The amount of CPU to assign to the server pod. Sets request and limit. Influences rocksdb and kafka streams configs.	false
memory	int or string	The amount of memory to assign to the server pod. Sets request and limit. Influences RocksDB Configs.	false

LHKafka.spec.controllers.nodeSelectorTerms[index]

^{↩ Parent}

Name	Type	Description	Required
matchExpressions	[]object		false
matchFields	[]object		false

LHKafka.spec.controllers.nodeSelectorTerms[index].matchExpressions[index]

^{↩ Parent}

Name	Type	Description	Required
key	string		false
operator	string		false
values	[]string		false

LHKafka.spec.controllers.nodeSelectorTerms[index].matchFields[index]

^{↩ Parent}

Name	Type	Description	Required
key	string		false
operator	string		false
values	[]string		false

LHKafka.spec.controllers.tolerations[index]

^{↩ Parent}

Name	Type	Description	Required
effect	string		false
key	string		false
operator	string		false
tolerationSeconds	integer		false
value	string		false

LHKafka.spec.brokers

^{↩ Parent}

Specifies the brokers for the Kafka cluster. If not set, then the controllers are both brokers and controllers.

Name	Type	Description	Required
replicas	integer	Minimum: 1	true
storage	object		true
compute	object		false
nodeSelectorTerms	[]object		false
tolerations	[]object		false

LHKafka.spec.brokers.storage

^{↩ Parent}

Name	Type	Description	Required
storageClassName	string	The name of the storageclass with which to provision storage for the server	true
volumeSize	int or string	The size of the persistent volume.	true

LHKafka.spec.brokers.compute

^{↩ Parent}

Name	Type	Description	Required
cpu	int or string	The amount of CPU to assign to the server pod. Sets request and limit. Influences rocksdb and kafka streams configs.	false
memory	int or string	The amount of memory to assign to the server pod. Sets request and limit. Influences RocksDB Configs.	false

LHKafka.spec.brokers.nodeSelectorTerms[index]

^{↩ Parent}

Name	Type	Description	Required
matchExpressions	[]object		false
matchFields	[]object		false

LHKafka.spec.brokers.nodeSelectorTerms[index].matchExpressions[index]

^{↩ Parent}

Name	Type	Description	Required
key	string		false
operator	string		false
values	[]string		false

LHKafka.spec.brokers.nodeSelectorTerms[index].matchFields[index]

^{↩ Parent}

Name	Type	Description	Required
key	string		false
operator	string		false
values	[]string		false

LHKafka.spec.brokers.tolerations[index]

^{↩ Parent}

Name	Type	Description	Required
effect	string		false
key	string		false
operator	string		false
tolerationSeconds	integer		false
value	string		false

LHKafka.spec.connect

^{↩ Parent}

Configures the deployment of a Kafka Connect cluster connected to this LHKafka.

Name	Type	Description	Required
quotas	object	Quotas for the Kafka Connect cluster	true
replicas	integer	The number of Kafka Connect workers to deploy Minimum: 1	true
compute	object		false

LHKafka.spec.connect.quotas

^{↩ Parent}

Quotas for the Kafka Connect cluster

Name	Type	Description	Required
consumerThroughputPerSecond	int or string	The throughput in bytes per second that may be consumed by this Kafka principal	true
producerThroughputPerSecond	int or string	The throughput in bytes per second that may be produced by this Kafka principal	true

LHKafka.spec.connect.compute

^{↩ Parent}

Name	Type	Description	Required
cpu	int or string	The amount of CPU to assign to the server pod. Sets request and limit. Influences rocksdb and kafka streams configs.	false
memory	int or string	The amount of memory to assign to the server pod. Sets request and limit. Influences RocksDB Configs.	false

LHKafka.spec.externalAccess

^{↩ Parent}

Configures external access to the Kafka cluster from outside Kubernetes

Name	Type	Description	Required
advertisedListeners	object	Specifies the advertised listeners that clients will connect to	true
tls	object	Configures TLS for the external access	true
infrastructure	object	Configures K8s resources to be deployed to access the LHKafka	false

LHKafka.spec.externalAccess.advertisedListeners

^{↩ Parent}

Specifies the advertised listeners that clients will connect to

Name	Type	Description	Required
wildcardDomainSuffix	string	Subdomain that all brokers will be exposed on. Must start with a '.' character.	true
advertisedPort	integer	Port that clients will use to connect to the Kafka cluster. Default: 9092	false

LHKafka.spec.externalAccess.tls

^{↩ Parent}

Configures TLS for the external access

Name	Type	Description	Required
secretRef	object	Reference to a Secret containing a TLS certificate to be used by the Kafka brokers	false

LHKafka.spec.externalAccess.tls.secretRef

^{↩ Parent}

Reference to a Secret containing a TLS certificate to be used by the Kafka brokers

Name	Type	Description	Required
name	string		true

LHKafka.spec.externalAccess.infrastructure

^{↩ Parent}

Configures K8s resources to be deployed to access the LHKafka

Name	Type	Description	Required
ingresses	object	Specifies Ingresses to expose LHKafka	false
tlsRoutes	object	Specifies TLSRoute's to create to access LHKafka using Gateway API	false

LHKafka.spec.externalAccess.infrastructure.ingresses

^{↩ Parent}

Specifies Ingresses to expose LHKafka

Name	Type	Description	Required
ingressClassName	string	Specifies Ingress class name	true
annotations	map[string]string	Specifies Annotations as key value pair	false

LHKafka.spec.externalAccess.infrastructure.tlsRoutes

^{↩ Parent}

Specifies TLSRoute's to create to access LHKafka using Gateway API

Name	Type	Description	Required
gatewayRef	object	Specifies the Gateway to create routes for.	true
annotations	map[string]string	Optional additional annotations to apply to the generated TLSRoutes.	false
labels	map[string]string	Optional additional labels to apply to the generated TLSRoutes.	false

LHKafka.spec.externalAccess.infrastructure.tlsRoutes.gatewayRef

^{↩ Parent}

Specifies the Gateway to create routes for.

Name	Type	Description	Required
name	string	The name of the Gateway.	true
sectionName	string	The sectionName, usually a port name, of the referenced Gateway to attach to.	true
namespace	string	The namespace of the Gateway to attach to. Defaults to current namespace.	false

LHKafka.spec.podMonitor

^{↩ Parent}

Configures PodMonitor's to be deployed for this LHKafka

Name	Type	Description	Required
podMonitorLabels	map[string]string		false

LHKafka.status

^{↩ Parent}

Name	Type	Description	Required
conditions	[]object		false
currentActiveBrokers	[]integer		false
internalTopicReplicationFactor	integer		false
kafkaVersion	string		false
numControllers	integer		false
observedGeneration	integer		false
ongoingRebalance	object		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false
rackNodeLabel	string		false

LHKafka.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHKafka.status.ongoingRebalance

^{↩ Parent}

Name	Type	Description	Required
dedicatedBrokersAfter	[]integer		false
dedicatedBrokersBefore	[]integer		false
lastRebalanceAttempt	integer		false
shouldHoldBrokerNodePool	boolean		false
shouldHoldMixedPool	boolean		false

LHKafkaUser

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHKafkaUser	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHKafkaUser.spec

^{↩ Parent}

Name	Type	Description	Required
quotas	object	The quotas for this user.	true
acls	object	Configures the ACL's of the Kafka User.	false
aclsPrefix	string	DEPRECATED: use acls.simple.prefix instead The prefix for the ACL's that will be created for this user. Mutually exclusive with strimziAcls. If this is provided, then the LH Operator will create opinionated ACL's that allow the user to read/write to topics, txns, and consumer groups that start with this prefix, but not create or delete topics nor take cluster actions	false
externalAccess	object	Configures authentication for the Kafka User to access Kafka from outside the K8s cluster	false
lhKafkaClusterName	string	DEPRECATED: use lhKafkaRef instead. The name of the LHKafka cluster this user will be created in. Must be in the same namespace.	false
lhKafkaRef	object	Reference to the LHKafka in which this LHKafkaUser will be created.	false

LHKafkaUser.spec.quotas

^{↩ Parent}

The quotas for this user.

Name	Type	Description	Required
consumerThroughputPerSecond	int or string	The throughput in bytes per second that may be consumed by this Kafka principal	true
producerThroughputPerSecond	int or string	The throughput in bytes per second that may be produced by this Kafka principal	true

LHKafkaUser.spec.acls

^{↩ Parent}

Configures the ACL's of the Kafka User.

Name	Type	Description	Required
simple	object	Simple ACL's designed to namespace-scope a user, allowing actions to publish/consume from topics and groups within a prefix scope.	true

LHKafkaUser.spec.acls.simple

^{↩ Parent}

Simple ACL's designed to namespace-scope a user, allowing actions to publish/consume from topics and groups within a prefix scope.

Name	Type	Description	Required
prefix	string	The prefix for the ACL's that will be created for this user. Mutually exclusive with strimziAcls. If this is provided, then the LH Operator will create opinionated ACL's that allow the user to read/write to topics, txns, and consumer groups that start with this prefix, but not create or delete topics nor take cluster actions	true
allowTopicManagement	boolean	Whether the user should be able to create and delete topics	false

LHKafkaUser.spec.externalAccess

^{↩ Parent}

Configures authentication for the Kafka User to access Kafka from outside the K8s cluster

Name	Type	Description	Required
scramSha512	object	Configures the SCRAM-SHA-512 authentication for the user	true

LHKafkaUser.spec.externalAccess.scramSha512

^{↩ Parent}

Configures the SCRAM-SHA-512 authentication for the user

Name	Type	Description	Required
passwordSecretRef	object	Reference to the secret containing the password for the user. If null, one will be generated with a random password, and a name matching the name of the LHKafkaUser but with the prefix 'lhku-'.	false

LHKafkaUser.spec.externalAccess.scramSha512.passwordSecretRef

^{↩ Parent}

Reference to the secret containing the password for the user. If null, one will be generated with a random password, and a name matching the name of the LHKafkaUser but with the prefix 'lhku-'.

Name	Type	Description	Required
secretKeyRef	object		false

LHKafkaUser.spec.externalAccess.scramSha512.passwordSecretRef.secretKeyRef

^{↩ Parent}

Name	Type	Description	Required
key	string		false
name	string		false
optional	boolean		false

LHKafkaUser.spec.lhKafkaRef

^{↩ Parent}

Reference to the LHKafka in which this LHKafkaUser will be created.

Name	Type	Description	Required
name	string	Name of the LHKafka cluster this user will be created in. Must be in the same namespace.	true

LHKafkaUser.status

^{↩ Parent}

Name	Type	Description	Required
conditions	[]object		false
lhKafkaClusterName	string		false
observedGeneration	integer		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false
ready	boolean		false

LHKafkaUser.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHKeycloakClient

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHKeycloakClient	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHKeycloakClient.spec

^{↩ Parent}

Name	Type	Description	Required
client	object		true
realm	object		true

LHKeycloakClient.spec.client

^{↩ Parent}

Name	Type	Description	Required
clientId	string		true
authorizationServicesEnabled	boolean		false
clientSecret	object	Customize the clientSecret. Keycloak will create a secret if empty	false
description	string		false
directAccessGrantsEnabled	boolean		false
enabled	boolean		false
frontchannelLogout	boolean		false
implicitFlowEnabled	boolean		false
protocol	string		false
protocolMappers	[]object		false
publicClient	boolean		false
redirectUris	[]string		false
serviceAccountsEnabled	boolean		false
standardFlowEnabled	boolean		false
surrogateAuthRequired	boolean		false

LHKeycloakClient.spec.client.clientSecret

^{↩ Parent}

Customize the clientSecret. Keycloak will create a secret if empty

Name	Type	Description	Required
labels	map[string]string	Optional additional labels to apply to the generated Secret	false
name	string	Name of the generated Secret if not empty, otherwise it will take the name of the LHKeycloakClient	false
secretKeyRef	object	External secret to extract the clientSecret from. Keycloak will create a secret if empty	false

LHKeycloakClient.spec.client.clientSecret.secretKeyRef

^{↩ Parent}

External secret to extract the clientSecret from. Keycloak will create a secret if empty

Name	Type	Description	Required
key	string	The key of the data	true
name	string	The name of the Secret	true

LHKeycloakClient.spec.client.protocolMappers[index]

^{↩ Parent}

Name	Type	Description	Required
name	string		true
protocolMapper	string		true
config	map[string]string		false
protocol	string		false

LHKeycloakClient.spec.realm

^{↩ Parent}

Name	Type	Description	Required
lhKeycloakRealmRef	object		true

LHKeycloakClient.spec.realm.lhKeycloakRealmRef

^{↩ Parent}

Name	Type	Description	Required
name	string		true

LHKeycloakClient.status

^{↩ Parent}

Name	Type	Description	Required
clientId	string	Client ID. Used for OAuth authentication	false
conditions	[]object		false
observedGeneration	integer		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false
realmName	string		false
status	string	Current client state. Enabled: the client was created and is enabled. Disabled: the client was created and is disabled.	false

LHKeycloakClient.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHKeycloakOIDCProvider

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHKeycloakOIDCProvider	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHKeycloakOIDCProvider.spec

^{↩ Parent}

Name	Type	Description	Required
alias	string	The alias uniquely identifies an identity provider and it is also used to build the redirect uri	true
authorizationUrl	string	URL of the OpenID Provider's OAuth 2.0 Authorization Endpoint. This URL MUST use the https scheme and MAY contain port, path, and query parameter components.	true
credentials	object	Configuration of the ClientId and ClientSecret for the OAuth client	true
realm	object	Realm this Identity Provider belongs to	true
tokenUrl	string	URL of the OpenID Provider's OAuth 2.0 Token Endpoint. This URL MUST use the https scheme and MAY contain port, path, and query parameter components.	true
clientAuthMethod	enum	The client authentication method. Only client_secret_basic and client_secret_post are supported Enum: client_secret_basic, client_secret_post Default: client_secret_post	false
displayName	string	The name to be displayed on the frontend for this identity provider	false
enabled	boolean	If true, this identity provider will be turned on Default: true	false
hideOnLogin	boolean	If hidden, login with this provider is possible only if requested explicitly, for example using the 'kc_idp_hint' parameter. Default: false	false
issuer	string	URL using the https scheme with no query or fragment components that the OpenID Provider's asserts as its Issuer Identifier.	false
jwksUrl	string	URL of the OpenID Provider's JWK Set document. If validateSignature is true, then this property is required	false
linkOnly	boolean	If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don't want to allow login from the provider, but want to integrate with a provider Default: false	false
logoutUrl	string	URL of the OpenID Provider's endpoint/page for ending the session.	false
storeToken	boolean	Enable/disable if tokens must be stored after authenticating users. Default: false	false
syncMode	enum	Default sync mode for all mappers. The sync mode determines when user data will be synced using the mappers. Possible values are: 'legacy' to keep the behaviour before this option was introduced, 'import' to only import the user once during first login of the user with this identity provider, 'force' to always update the user during every login with this identity provider. Enum: FORCE, IMPORT, LEGACY Default: LEGACY	false
trustEmail	boolean	If enabled, email provided by this provider is not verified even if verification is enabled for the realm. Default: false	false
userInfoUrl	string	URL of the OpenID Provider's UserInfo Endpoint. This URL MUST use the https scheme and MAY contain port, path, and query parameter components.	false
validateSignature	boolean	If true, validates the token signature using the keys from the jwksUrl Default: false	false

LHKeycloakOIDCProvider.spec.credentials

^{↩ Parent}

Configuration of the ClientId and ClientSecret for the OAuth client

Name	Type	Description	Required
secretRef	object	Reference to secret with a clientId and a clientSecret key. If those keys are not present, the deployment will fail	true

LHKeycloakOIDCProvider.spec.credentials.secretRef

^{↩ Parent}

Reference to secret with a clientId and a clientSecret key. If those keys are not present, the deployment will fail

Name	Type	Description	Required
name	string		true

LHKeycloakOIDCProvider.spec.realm

^{↩ Parent}

Realm this Identity Provider belongs to

Name	Type	Description	Required
lhKeycloakRealmRef	object		true

LHKeycloakOIDCProvider.spec.realm.lhKeycloakRealmRef

^{↩ Parent}

Name	Type	Description	Required
name	string	LHKeycloakRealm name	true

LHKeycloakOIDCProvider.status

^{↩ Parent}

Name	Type	Description	Required
alias	string	OIDC unique alias to identify within the realm	false
conditions	[]object		false
observedGeneration	integer		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false
realmName	string		false
status	string	Current identity provider state. Enabled: the identity provider was created and is enabled. Disable: the identity provider was created and is disabled.	false

LHKeycloakOIDCProvider.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHKeycloakRealm

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHKeycloakRealm	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHKeycloakRealm.spec

^{↩ Parent}

Name	Type	Description	Required
keycloak	object		true
realm	object		true

LHKeycloakRealm.spec.keycloak

^{↩ Parent}

Name	Type	Description	Required
lhKeycloakRef	object		true

LHKeycloakRealm.spec.keycloak.lhKeycloakRef

^{↩ Parent}

Name	Type	Description	Required
name	string		true

LHKeycloakRealm.spec.realm

^{↩ Parent}

Name	Type	Description	Required
name	string		true
accessTokenLifespan	integer		false
bruteForceProtected	boolean		false
displayName	string		false
duplicateEmailsAllowed	boolean		false
editUsernameAllowed	boolean		false
enabled	boolean		false
loginTheme	string		false
loginWithEmailAllowed	boolean		false
registrationAllowed	boolean		false
resetPasswordAllowed	boolean		false
sslRequired	string		false
ssoSessionIdleTimeout	integer		false
ssoSessionMaxLifespan	integer		false

LHKeycloakRealm.status

^{↩ Parent}

Name	Type	Description	Required
conditions	[]object		false
observedGeneration	integer		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false
realmName	string		false
status	string	Current realm state. Enabled: the realm was created and is enabled. Disable: the realm was created and is disabled.	false

LHKeycloakRealm.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHKeycloak

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHKeycloak	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHKeycloak.spec

^{↩ Parent}

Name	Type	Description	Required
http	object	HTTP listener configurations	true
replicas	integer	The number of Keycloak pods to deploy. A minimum of 1 is required Minimum: 1	true
cache	object	Cache configurations	false
database	object	Database configurations	false
defaultLabels	map[string]string	Labels to place on all dependent resources of the LHKeycloak.	false
hostname	object	Hostname configurations. More info at https://www.keycloak.org/server/hostname	false
image	string	Image to use for Keycloak Server. If not set defaults to quay.io/keycloak/keycloak:26.2.1	false
imagePullPolicy	enum	Image pull policy for Keycloak pods Enum: Always, IfNotPresent, Never	false
operator	object	Configurations for the operator connection with the Keycloak server	false
outgoingHttp	object	Configuring outgoing HTTP requests. More info at https://www.keycloak.org/server/outgoinghttp#_client_configuration_command	false
podMonitor	object	Configuration for the PodMonitor to be deployed for this LHKeycloak	false
resources	object	Configures compute resources for the keycloak pods.	false

LHKeycloak.spec.http

^{↩ Parent}

HTTP listener configurations

Name	Type	Description	Required
enableHttp	boolean	Enables the HTTP listener. If false and tls is not provided, then an error will be thrown Default: false	false
infrastructure	object		false
tls	object	Certificate to encrypt/decrypt the network traffic. The secret should contain tls.crt and tls.key keys. Enables HTTPS listener.	false

LHKeycloak.spec.http.infrastructure

^{↩ Parent}

Name	Type	Description	Required
tlsRoute	object	Specifies to create TLSRoute according to the Gateway API. Requires a listener with the 'Passthrough' TLS mode enabled.	false

LHKeycloak.spec.http.infrastructure.tlsRoute

^{↩ Parent}

Specifies to create TLSRoute according to the Gateway API. Requires a listener with the 'Passthrough' TLS mode enabled.

Name	Type	Description	Required
gatewayRef	object	Specifies the Gateway to create routes for.	true
hostname	string	The host to be added to the TLSRoute hostnames	true
annotations	map[string]string	Optional additional annotations to apply to the generated TLSRoute.	false
labels	map[string]string	Optional additional labels to apply to the generated TLSRoute.	false

LHKeycloak.spec.http.infrastructure.tlsRoute.gatewayRef

^{↩ Parent}

Specifies the Gateway to create routes for.

Name	Type	Description	Required
name	string	The name of the Gateway.	true
sectionName	string	The sectionName, usually a port name, of the referenced Gateway to attach to.	true
namespace	string	The namespace of the Gateway to attach to. Defaults to current namespace.	false

LHKeycloak.spec.http.tls

^{↩ Parent}

Certificate to encrypt/decrypt the network traffic. The secret should contain tls.crt and tls.key keys. Enables HTTPS listener.

Name	Type	Description	Required
secretRef	object		true

LHKeycloak.spec.http.tls.secretRef

^{↩ Parent}

Name	Type	Description	Required
name	string		true

LHKeycloak.spec.cache

^{↩ Parent}

Cache configurations

Name	Type	Description	Required
encryptionEnabled	boolean	Automatically generates certs and the appropriate configuration for encrypting internal cache communication when type is ispn. LHO_CERTMANAGER_ENABLED should be set to true for this feature to work	true
type	enum	Defines the cache mechanism, either ispn or local. Defaults to ispn Enum: ispn, local	false

LHKeycloak.spec.database

^{↩ Parent}

Database configurations

Name	Type	Description	Required
externalRef	object		false

LHKeycloak.spec.database.externalRef

^{↩ Parent}

Name	Type	Description	Required
credentials	object		true
database	string	Sets the database name of the default JDBC URL of the chosen vendor.	true
host	string	Sets the hostname of the default JDBC URL of the chosen vendor.	true
caCert	object	CA cert to encrypt/decrypt the communication between keycloak and the database. The secret should contain a ca.crt key. Should be set if the database is using a cert not signed by a well-known CA. The certificate will be placed in the /tls/database/ca.crt absolute path. It will also be loaded into the default JVM truststore. If the JDBC driver doesn't support the default JVM certs then you will need to specify the cert path in the properties	false
port	integer	Sets the port of the default JDBC URL of the chosen vendor. Defaults to 5432 Default: 5432	false
properties	string	Sets the properties of the default JDBC URL of the chosen vendor. Make sure to set the properties accordingly to the format expected by the database vendor, as well as appending the right character at the beginning of this property value. e.g. "?sslmode=verify-full&sslrootcert=/customCA/database/ca.crt"	false
vendor	enum	The database vendor. Accepted Values: dev-file, dev-mem, mariadb, mssql, mysql, oracle, and postgres. Defaults to dev-file Enum: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres	false

LHKeycloak.spec.database.externalRef.credentials

^{↩ Parent}

Name	Type	Description	Required
secretRef	object	Reference to secret of type kubernetes.io/basic-auth with username and password keys	true

LHKeycloak.spec.database.externalRef.credentials.secretRef

^{↩ Parent}

Reference to secret of type kubernetes.io/basic-auth with username and password keys

Name	Type	Description	Required
name	string		true

LHKeycloak.spec.database.externalRef.caCert

^{↩ Parent}

CA cert to encrypt/decrypt the communication between keycloak and the database. The secret should contain a ca.crt key. Should be set if the database is using a cert not signed by a well-known CA. The certificate will be placed in the /tls/database/ca.crt absolute path. It will also be loaded into the default JVM truststore. If the JDBC driver doesn't support the default JVM certs then you will need to specify the cert path in the properties

Name	Type	Description	Required
secretRef	object		true

LHKeycloak.spec.database.externalRef.caCert.secretRef

^{↩ Parent}

Name	Type	Description	Required
name	string		true

LHKeycloak.spec.hostname

^{↩ Parent}

Hostname configurations. More info at https://www.keycloak.org/server/hostname

Name	Type	Description	Required
admin	string	The hostname for accessing the administration console.	false
enableBackchannelDynamic	boolean	Enables dynamic resolving of backchannel URLs, including hostname, scheme, port and context path. Set to true if your application accesses Keycloak via a private network. Defaults to false Default: false	false
enableDebug	boolean	Enables the hostname debug page that is accessible at /realms/master/hostname-debug. Defaults to false Default: false	false
enableStrict	boolean	Enables dynamically resolving the hostname from request headers. Defaults to true Default: true	false
hostname	string	Hostname for the Keycloak server	false

LHKeycloak.spec.operator

^{↩ Parent}

Configurations for the operator connection with the Keycloak server

Name	Type	Description	Required
caCert	object	CA cert to encrypt/decrypt the communication within the keycloak service and the operator. Should be set if the Keycloak server is using a cert not signed by a well-known CA. The secret should contain a ca.crt key	false
keycloakUrl	string	URL for the operator to connect with Keycloak. Should be set if the operator is not able to reach the Keycloak server through the internal kubernetes URL. Defaults to https://lhkeycloak-name-service.namespace.svc.cluster.local:8443	false

LHKeycloak.spec.operator.caCert

^{↩ Parent}

CA cert to encrypt/decrypt the communication within the keycloak service and the operator. Should be set if the Keycloak server is using a cert not signed by a well-known CA. The secret should contain a ca.crt key

Name	Type	Description	Required
secretRef	object		true

LHKeycloak.spec.operator.caCert.secretRef

^{↩ Parent}

Name	Type	Description	Required
name	string		true

LHKeycloak.spec.outgoingHttp

^{↩ Parent}

Configuring outgoing HTTP requests. More info at https://www.keycloak.org/server/outgoinghttp#_client_configuration_command

Name	Type	Description	Required
disableTrustManager	boolean	If an outgoing request requires HTTPS and this configuration option is set to true, you do not have to specify a truststore. This setting should be used only during development and never in production because it will disable verification of SSL certificates. Default: false. Default: false	false

LHKeycloak.spec.podMonitor

^{↩ Parent}

Configuration for the PodMonitor to be deployed for this LHKeycloak

Name	Type	Description	Required
labels	map[string]string	Labels to add to the generated PodMonitor resources	false
metricRelabelings	[]object	Relabelings for the metrics exposed by the keycloak	false

LHKeycloak.spec.podMonitor.metricRelabelings[index]

^{↩ Parent}

Name	Type	Description	Required
action	string		false
modulus	integer		false
regex	string		false
replacement	string		false
separator	string		false
sourceLabels	[]string		false
targetLabel	string		false

LHKeycloak.spec.resources

^{↩ Parent}

Configures compute resources for the keycloak pods.

Name	Type	Description	Required
claims	[]object		false
limits	map[string]int or string		false
requests	map[string]int or string		false

LHKeycloak.spec.resources.claims[index]

^{↩ Parent}

Name	Type	Description	Required
name	string		false
request	string		false

LHKeycloak.status

^{↩ Parent}

Name	Type	Description	Required
conditions	[]object		false
connectionHash	string		false
observedGeneration	integer		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false

LHKeycloak.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHOperator

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHOperator	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHOperator.status

^{↩ Parent}

Name	Type	Description	Required
conditions	[]object		false
observedGeneration	integer		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false
reconciledBy	[]string		false

LHOperator.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHPrincipal

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHPrincipal	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHPrincipal.spec

^{↩ Parent}

Name	Type	Description	Required
lhCluster	object	Specifies the LittleHorse Cluster	true
globalACLs	[]object	Global ACL's to add to the Principal to be created in the LH Server. These permissions apply to all Tenants inside the LH Server.	false
perTenantACLs	[]object	Allows assigning permissions to the Principal to access specific Tenants inside the LH Server.	false
principalName	string	The name of the Principal to be created in the LH Server. If null, uses the LHPrincipal name.	false

LHPrincipal.spec.lhCluster

^{↩ Parent}

Specifies the LittleHorse Cluster

Name	Type	Description	Required
lhClusterRef	object	Specifies a LittleHorse Cluster managed by the same Operator	true

LHPrincipal.spec.lhCluster.lhClusterRef

^{↩ Parent}

Specifies a LittleHorse Cluster managed by the same Operator

Name	Type	Description	Required
name	string	Specifies a the name of the LittleHorse Cluster	true

LHPrincipal.spec.globalACLs[index]

^{↩ Parent}

Name	Type	Description	Required
actions	[]string		false
resource	string		false

LHPrincipal.spec.perTenantACLs[index]

^{↩ Parent}

Name	Type	Description	Required
acls	[]object		false
tenant	string		false

LHPrincipal.spec.perTenantACLs[index].acls[index]

^{↩ Parent}

Name	Type	Description	Required
actions	[]string		false
resource	string		false

LHPrincipal.status

^{↩ Parent}

Name	Type	Description	Required
conditions	[]object		false
isCreated	boolean	DEPRECATED. Please check the for an Available condition instead. Whether the Principal has been created in the LH Server	false
lhCluster	string	The LHCluster that the Principal belongs to	false
observedGeneration	integer		false
principalId	string	The ID of the created Principal in the LHCluster.	false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false

LHPrincipal.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false

LHTenant

^{↩ Parent}

Name	Type	Description	Required
apiVersion	string	littlehorse.io/v1	true
kind	string	LHTenant	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

LHTenant.spec

^{↩ Parent}

Name	Type	Description	Required
lhCluster	object	Specifies the LittleHorse Cluster	true
tenantName	string	Name of the Tenant in LittleHorse. If not provided, inferred from LHTenant name.	false

LHTenant.spec.lhCluster

^{↩ Parent}

Specifies the LittleHorse Cluster

Name	Type	Description	Required
lhClusterRef	object	Specifies a LittleHorse Cluster managed by the same Operator	true

LHTenant.spec.lhCluster.lhClusterRef

^{↩ Parent}

Specifies a LittleHorse Cluster managed by the same Operator

Name	Type	Description	Required
name	string	Specifies a the name of the LittleHorse Cluster	true

LHTenant.status

^{↩ Parent}

Name	Type	Description	Required
conditions	[]object		false
isCreated	boolean	DEPRECATED. Please check for a Available condition instead. Whether the Tenant has been successfully created in the LH Cluster	false
lhCluster	string	The LHCluster that the Tenant belongs to	false
observedGeneration	integer		false
problems	string	DEPRECATED. Please check for a ReconciliationError condition instead.	false
tenantId	string	The ID of the created Tenant in the LHCluster.	false

LHTenant.status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
lastTransitionTime	string	The last time the condition transitioned from one status to another. The required format is ISO 8601 'yyyy-MM-ddTHH:mm:ssZ'	true
reason	string	Reason contains a programmatic identifier indicating the reason for the condition's last transition.	true
status	enum	Status of the condition, one of True, False, Unknown. Enum: False, True, Unknown	true
type	string	Type of condition	true
message	string	A human readable message indicating details about the transition.	false