API Reference #

Packages #

api.astarte-platform.org/v2alpha1 #

Package v2alpha1 contains API Schema definitions for the api v2alpha1 API group

Resource Types #

Astarte #

Astarte is the Schema for the astartes API

Custom Astarte annotations Astarte support a set of custom annotations that can be used to toggle custom behaviors that are not directly supported by the CRD schema. This is often the case for features that are still experimental, or that are not expected to be widely used, and that would therefore add unnecessary complexity to the CRD schema.

Enable or disable the Astarte Dashboard sidebar

  • Annotation: api.astarte-platform.org/hide-dashboard-sidebar
  • Values: "true" or "false"

Appears in:

Field Description Default Validation
apiVersion string api.astarte-platform.org/v2alpha1
kind string Astarte
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec AstarteSpec
status AstarteStatus

AstarteAPISpec #

Appears in:

Field Description Default Validation
ssl boolean Enable or disable SSL for the Astarte API. Default: true. Optional: {}
host string

AstarteAppengineAPISpec #

AstarteAppengineAPISpec configures the AppEngine API component.

Appears in:

Field Description Default Validation
deploy boolean When true, the component is deployed. When false, the component is removed (if
already present) or skipped. All components default to true except Flow, which
defaults to false and must be explicitly enabled.		 Optional: {}
replicas integer The number of replicas for this component. Optional: {}
antiAffinity boolean When true, pods of this component are spread across nodes using
podAntiAffinity.		 Optional: {}
customAffinity Affinity Custom affinity rules for this component. When set, overrides the default
antiAffinity configuration entirely.		 Optional: {}
deploymentStrategy DeploymentStrategy The deployment strategy for this specific component. Overrides the global
spec.deploymentStrategy. Note that DataUpdaterPlant, TriggerEngine, and Flow
always use Recreate regardless of this setting.		 Optional: {}
version string The Astarte version (image tag) for this specific component. Overrides the
global spec.version. Useful for pinning a component to a different version
during upgrades or debugging.		 Optional: {}
image string The full container image reference (registry/name:tag) for this component.
When set, overrides both the distributionChannel and version settings for
this component.		 Optional: {}
imagePullPolicy PullPolicy The image pull policy for this component. Overrides the global
spec.imagePullPolicy. Default: inherits from spec.imagePullPolicy.		 Optional: {}
imagePullSecrets LocalObjectReference array Additional image pull secrets for this component’s pods. These are appended
to the global spec.imagePullSecrets.		 Optional: {}
resources ResourceRequirements Compute Resources for this Component. Optional: {}
additionalEnv EnvVar array Additional environment variables for this Component. These are appended after
the operator-managed environment variables and can override them.		 Optional: {}
podLabels object (keys:string, values:string) Additional labels for this Component’s pod(s).
Label keys can’t be of the form “app”, “component”, “astarte-”, “flow-”		 Optional: {}
autoscaler AstarteGenericClusteredResourceAutoscalerSpec Autoscaling resources for this deployment/statefulset.
If autoscaling is enabled, this will take precedence over the “Replicas” field.
The autoscaling feature must be enabled globally via features.autoscaling.		 Optional: {}
priorityClass string The PriorityClass for this component.
Must be one of “high”, “mid”, “low” or unspecified.
Ignored if astartePodPriorities is not enabled.		 Enum: [high mid low ]
Optional: {}
livenessProbe Probe Override the default Liveness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
readinessProbe Probe Override the default Readiness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
startupProbe Probe Override the default Startup probe for this component.
If not set, no startup probe is configured by default.		 Optional: {}
disableAuthentication boolean When true, disables authentication for this API component. This is useful
in development or when an external auth proxy is used. Do not disable
authentication in production without an external auth mechanism.		 Optional: {}
maxResultsLimit integer The maximum number of results returned by a single AppEngine API query.
Must be at least 100. Defaults to 10000.		 Minimum: 100
Optional: {}
roomEventsQueueName string Configures the name of the Room Events queue. Should be configured only in installations with a highly
customized RabbitMQ. It is advised to leave empty unless you know exactly what you’re doing.		 Optional: {}
roomEventsExchangeName string Configures the name of the Room Events exchange. Should be configured only in installations with a highly
customized RabbitMQ. It is advised to leave empty unless you know exactly what you’re doing.		 Optional: {}

AstarteCFSSLCARootConfigSigningCAConstraintSpec #

AstarteCFSSLCARootConfigSigningCAConstraintSpec defines constraints on the CA certificate.

Appears in:

Field Description Default Validation
max_path_len integer
is_ca boolean
max_path_len_zero boolean

AstarteCFSSLCARootConfigSigningDefaultSpec #

AstarteCFSSLCARootConfigSigningDefaultSpec defines the default signing parameters for the CFSSL CA.

Appears in:

Field Description Default Validation
usages string array
expiry string
ca_constraint AstarteCFSSLCARootConfigSigningCAConstraintSpec

AstarteCFSSLCARootConfigSpec #

AstarteCFSSLCARootConfigSpec defines the root CA configuration for CFSSL.

Appears in:

Field Description Default Validation
signingDefault AstarteCFSSLCARootConfigSigningDefaultSpec

AstarteCFSSLCSRRootCAKeySpec #

AstarteCFSSLCSRRootCAKeySpec defines the key algorithm and size for the CFSSL root CA.

Appears in:

Field Description Default Validation
algo string The key algorithm (e.g. “rsa”, “ecdsa”).
size integer The key size in bits (e.g. 2048, 4096).

AstarteCFSSLCSRRootCANamesSpec #

AstarteCFSSLCSRRootCANamesSpec defines the distinguished name components for the CFSSL root CA certificate.

Appears in:

Field Description Default Validation
C string
L string
O string
OU string
ST string

AstarteCFSSLCSRRootCASpec #

AstarteCFSSLCSRRootCASpec defines the certificate signing request for the CFSSL root CA.

Appears in:

Field Description Default Validation
CN string
key AstarteCFSSLCSRRootCAKeySpec
names AstarteCFSSLCSRRootCANamesSpec array
expiry string

AstarteCFSSLDBConfigSpec #

AstarteCFSSLDBConfigSpec configures the database backend used by CFSSL.

Appears in:

Field Description Default Validation
driver string The database driver (e.g. “sqlite3”, “postgres”).
dataSource string The database data source name (connection string).

AstarteCFSSLSpec #

AstarteCFSSLSpec configures CFSSL (Cloudflare’s PKI/TLS toolkit), the internal certificate authority used by Astarte for mutual TLS between components. By default, CFSSL is deployed and managed by the Operator.

Appears in:

Field Description Default Validation
deploy boolean When true, deploy CFSSL. When false, an external CFSSL instance must be
provided via the url field. Default: true.		 Optional: {}
url string The URL of the CFSSL instance. Can be manually set when deploy is false to use an external CFSSL.
Default: http://-cfssl..svc.cluster.local		 Optional: {}
caExpiry string The expiry duration for the CA certificate (e.g. “87600h”). Only applies
when CFSSL is deployed by the Operator.		 Optional: {}
caSecret LocalObjectReference A reference to a Kubernetes Secret containing an externally-managed CA
certificate. The Secret must be in the same namespace as Astarte.
When set, CFSSL uses this CA instead of generating a new one.		 Optional: {}
certificateExpiry string The expiry duration for certificates issued by CFSSL (e.g. “8760h”). Optional: {}
dbConfig AstarteCFSSLDBConfigSpec Database configuration for CFSSL’s certificate storage. Optional: {}
resources ResourceRequirements Compute Resources for this Component. Optional: {}
version string The CFSSL container version (image tag) to use. Overrides the global
spec.version for CFSSL specifically.		 Optional: {}
image string The full CFSSL container image reference. Overrides the distributionChannel
and version for CFSSL.		 Optional: {}
storage AstartePersistentStorageSpec Persistent storage configuration for CFSSL’s certificate database. Optional: {}
csrRootCa AstarteCFSSLCSRRootCASpec Certificate signing request configuration for the root CA. Optional: {}
caRootConfig AstarteCFSSLCARootConfigSpec Root CA configuration for signing certificates. Optional: {}
podLabels object (keys:string, values:string) Additional labels for this Component’s pod(s).
Label keys can’t be of the form “app”, “component”, “astarte-”, “flow-”		 Optional: {}
priorityClass string The PriorityClass for this component.
Must be one of “high”, “mid”, “low” or unspecified.
Ignored if astartePodPriorities is not enabled.		 Enum: [high mid low ]
Optional: {}
livenessProbe Probe Override the default Liveness probe for CFSSL.
If not set, a default HTTP GET probe is configured to check the /api/v1/cfssl/health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
readinessProbe Probe Override the default Readiness probe for CFSSL.
If not set, a default HTTP GET probe is configured to check the /api/v1/cfssl/health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
startupProbe Probe Override the default Startup probe for CFSSL.
If not set, no startup probe is configured by default.		 Optional: {}

AstarteCassandraConnectionSpec #

AstarteCassandraConnectionSpec defines the connection to an external Cassandra/ScyllaDB cluster.

Appears in:

Field Description Default Validation
sslConfiguration GenericSSLConfigurationSpec SSL configuration for the connection. Optional: {}
credentialsSecret LoginCredentialsSecret The secret containing Username and Password to login.
Either this field or connectionStringSecret must be set.		 Optional: {}
connectionStringSecret ConnectionStringSecret The secret containing a connection string to the service.
Either this field or credentialsSecret must be set.
put as-is in the env. Therefore, setting this field is a no-op.
Not using credentialsSecret WILL break your Astarte instance.		 Optional: {}
nodes HostAndPort array The list of Cassandra/ScyllaDB seed nodes. At least one node must be provided.
poolSize integer The size of the connection pool to each Cassandra/ScyllaDB node.
Adjust this value if you need to increase or limit the number of concurrent
queries per node.		 Optional: {}
enableKeepalive boolean Enable or disable the keepalive option for the xandra connection.
Default: true.		 Optional: {}

AstarteCassandraSpec #

AstarteCassandraSpec configures the Cassandra/ScyllaDB backend for Astarte.

Appears in:

Field Description Default Validation
connection AstarteCassandraConnectionSpec The Cassandra/ScyllaDB connection configuration. Required. Required: {}
astarteSystemKeyspace AstarteSystemKeyspaceSpec The keyspace configuration for Astarte’s system keyspace. Required. Required: {}

AstarteClusterHealth #

Underlying type: string

AstarteClusterHealth represents the overall health of the cluster

Appears in:

Field Description
red AstarteClusterHealthRed means the cluster is experiencing serious malfunctions or is down
yellow AstarteClusterHealthYellow means the cluster is experiencing downtimes related to a single service
green AstarteClusterHealthGreen means the cluster is healthy, up and running

AstarteComponentsSpec #

AstarteComponentsSpec configures all Astarte service components.

Appears in:

Field Description Default Validation
resources ResourceRequirements Compute Resources shared across all components. Can be overridden
per-component by setting the component’s own resources field.		 Optional: {}
flow AstarteGenericAPIComponentSpec Flow component configuration. Defaults to deploy: false. Optional: {}
housekeeping AstarteGenericAPIComponentSpec Housekeeping component configuration. Optional: {}
realmManagement AstarteGenericAPIComponentSpec RealmManagement component configuration. Optional: {}
pairing AstarteGenericAPIComponentSpec Pairing component configuration. Optional: {}
dataUpdaterPlant AstarteDataUpdaterPlantSpec DataUpdaterPlant component configuration. Optional: {}
appengineApi AstarteAppengineAPISpec AppengineAPI component configuration. Optional: {}
triggerEngine AstarteTriggerEngineSpec TriggerEngine component configuration. Optional: {}
dashboard AstarteDashboardSpec Dashboard component configuration. Optional: {}

AstarteDashboardConfigAuthSpec #

AstarteDashboardConfigAuthSpec defines an authentication provider configuration for the Astarte Dashboard.

Appears in:

Field Description Default Validation
type string The authentication type (e.g. “token”, “oauth”).
oauth_api_url string The OAuth API URL (only used when type is “oauth”). Optional: {}

AstarteDashboardConfigSpec #

AstarteDashboardConfigSpec configures the Astarte Dashboard UI settings.

Appears in:

Field Description Default Validation
realmManagementApiUrl string The URL of the Realm Management API. When set, overrides the default
(derived from the Astarte API host).		 Optional: {}
appEngineApiUrl string The URL of the AppEngine API. When set, overrides the default. Optional: {}
pairingApiUrl string The URL of the Pairing API. When set, overrides the default. Optional: {}
flowApiUrl string The URL of the Flow API. When set, overrides the default. Optional: {}
defaultRealm string The default realm for the Dashboard. On first access, the Dashboard
will pre-select this realm.		 Optional: {}
defaultAuth string The default authentication method for the Dashboard. Default: “token”. Optional: {}
auth AstarteDashboardConfigAuthSpec array Authentication provider configurations available in the Dashboard.
If not set, defaults to a single “token” auth provider.		 Optional: {}

AstarteDashboardSpec #

AstarteDashboardSpec configures the Astarte Dashboard component.

Appears in:

Field Description Default Validation
deploy boolean When true, the component is deployed. When false, the component is removed (if
already present) or skipped. All components default to true except Flow, which
defaults to false and must be explicitly enabled.		 Optional: {}
replicas integer The number of replicas for this component. Optional: {}
antiAffinity boolean When true, pods of this component are spread across nodes using
podAntiAffinity.		 Optional: {}
customAffinity Affinity Custom affinity rules for this component. When set, overrides the default
antiAffinity configuration entirely.		 Optional: {}
deploymentStrategy DeploymentStrategy The deployment strategy for this specific component. Overrides the global
spec.deploymentStrategy. Note that DataUpdaterPlant, TriggerEngine, and Flow
always use Recreate regardless of this setting.		 Optional: {}
version string The Astarte version (image tag) for this specific component. Overrides the
global spec.version. Useful for pinning a component to a different version
during upgrades or debugging.		 Optional: {}
image string The full container image reference (registry/name:tag) for this component.
When set, overrides both the distributionChannel and version settings for
this component.		 Optional: {}
imagePullPolicy PullPolicy The image pull policy for this component. Overrides the global
spec.imagePullPolicy. Default: inherits from spec.imagePullPolicy.		 Optional: {}
imagePullSecrets LocalObjectReference array Additional image pull secrets for this component’s pods. These are appended
to the global spec.imagePullSecrets.		 Optional: {}
resources ResourceRequirements Compute Resources for this Component. Optional: {}
additionalEnv EnvVar array Additional environment variables for this Component. These are appended after
the operator-managed environment variables and can override them.		 Optional: {}
podLabels object (keys:string, values:string) Additional labels for this Component’s pod(s).
Label keys can’t be of the form “app”, “component”, “astarte-”, “flow-”		 Optional: {}
autoscaler AstarteGenericClusteredResourceAutoscalerSpec Autoscaling resources for this deployment/statefulset.
If autoscaling is enabled, this will take precedence over the “Replicas” field.
The autoscaling feature must be enabled globally via features.autoscaling.		 Optional: {}
priorityClass string The PriorityClass for this component.
Must be one of “high”, “mid”, “low” or unspecified.
Ignored if astartePodPriorities is not enabled.		 Enum: [high mid low ]
Optional: {}
livenessProbe Probe Override the default Liveness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
readinessProbe Probe Override the default Readiness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
startupProbe Probe Override the default Startup probe for this component.
If not set, no startup probe is configured by default.		 Optional: {}
realmManagementApiUrl string The URL of the Realm Management API. When set, overrides the default
(derived from the Astarte API host).		 Optional: {}
appEngineApiUrl string The URL of the AppEngine API. When set, overrides the default. Optional: {}
pairingApiUrl string The URL of the Pairing API. When set, overrides the default. Optional: {}
flowApiUrl string The URL of the Flow API. When set, overrides the default. Optional: {}
defaultRealm string The default realm for the Dashboard. On first access, the Dashboard
will pre-select this realm.		 Optional: {}
defaultAuth string The default authentication method for the Dashboard. Default: “token”. Optional: {}
auth AstarteDashboardConfigAuthSpec array Authentication provider configurations available in the Dashboard.
If not set, defaults to a single “token” auth provider.		 Optional: {}

AstarteDataUpdaterPlantSpec #

AstarteDataUpdaterPlantSpec configures the Data Updater Plant (DUP) component, which handles data ingestion from the MQTT broker into the database.

Appears in:

Field Description Default Validation
deploy boolean When true, the component is deployed. When false, the component is removed (if
already present) or skipped. All components default to true except Flow, which
defaults to false and must be explicitly enabled.		 Optional: {}
replicas integer The number of replicas for this component. Optional: {}
antiAffinity boolean When true, pods of this component are spread across nodes using
podAntiAffinity.		 Optional: {}
customAffinity Affinity Custom affinity rules for this component. When set, overrides the default
antiAffinity configuration entirely.		 Optional: {}
deploymentStrategy DeploymentStrategy The deployment strategy for this specific component. Overrides the global
spec.deploymentStrategy. Note that DataUpdaterPlant, TriggerEngine, and Flow
always use Recreate regardless of this setting.		 Optional: {}
version string The Astarte version (image tag) for this specific component. Overrides the
global spec.version. Useful for pinning a component to a different version
during upgrades or debugging.		 Optional: {}
image string The full container image reference (registry/name:tag) for this component.
When set, overrides both the distributionChannel and version settings for
this component.		 Optional: {}
imagePullPolicy PullPolicy The image pull policy for this component. Overrides the global
spec.imagePullPolicy. Default: inherits from spec.imagePullPolicy.		 Optional: {}
imagePullSecrets LocalObjectReference array Additional image pull secrets for this component’s pods. These are appended
to the global spec.imagePullSecrets.		 Optional: {}
resources ResourceRequirements Compute Resources for this Component. Optional: {}
additionalEnv EnvVar array Additional environment variables for this Component. These are appended after
the operator-managed environment variables and can override them.		 Optional: {}
podLabels object (keys:string, values:string) Additional labels for this Component’s pod(s).
Label keys can’t be of the form “app”, “component”, “astarte-”, “flow-”		 Optional: {}
autoscaler AstarteGenericClusteredResourceAutoscalerSpec Autoscaling resources for this deployment/statefulset.
If autoscaling is enabled, this will take precedence over the “Replicas” field.
The autoscaling feature must be enabled globally via features.autoscaling.		 Optional: {}
priorityClass string The PriorityClass for this component.
Must be one of “high”, “mid”, “low” or unspecified.
Ignored if astartePodPriorities is not enabled.		 Enum: [high mid low ]
Optional: {}
livenessProbe Probe Override the default Liveness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
readinessProbe Probe Override the default Readiness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
startupProbe Probe Override the default Startup probe for this component.
If not set, no startup probe is configured by default.		 Optional: {}
dataQueueCount integer Controls the number of data queues used by the Data Updater Plant.
This corresponds to the AMQP queues from which DUP consumers pull data.
Defaults to 128. You should change this only when fine-tuning a
custom RabbitMQ setup.		 Optional: {}
prefetchCount integer Controls the prefetch count for Data Updater Plant. When fine-tuning Astarte, this parameter
can make a difference for what concerns Data Updater Plant ingestion performance. However,
it can also degrade performance significantly and/or increase risk of data loss when misconfigured.
Configure this value only if you know what you’re doing and you have experience with RabbitMQ.
Defaults to 300		 Optional: {}

AstarteFDOSpec #

AstarteFDOSpec configures FDO (FIDO Device Onboarding) support in Astarte. Available as an opt-in feature starting from Astarte 1.3. From Astarte 1.4.0 onwards, FDO is mandatory and cannot be disabled.

Appears in:

Field Description Default Validation
enable boolean When true, enable FDO support. For Astarte < 1.4.0, this is optional.
For Astarte >= 1.4.0, FDO is always enabled and this field cannot be
set to false (validating webhook enforces this).		 Optional: {}
rendezvousServer AstarteRendezvousServerSpec The FDO Rendezvous Server configuration. Required when FDO is enabled.
For Astarte >= 1.4.0, this is always required since FDO cannot be disabled.		 Optional: {}

AstarteFeatures #

AstarteFeatures enables/disables selectively a set of global, opt-in features in Astarte. All features default to false (disabled) unless explicitly set.

Appears in:

Field Description Default Validation
realmDeletion boolean Enable realm deletion support. When enabled, realms can be deleted
through the Realm Management API.		 Optional: {}
autoscaling boolean Enable horizontal pod autoscaling for Astarte components. When enabled,
each component’s autoscaler configuration (if set) will be used to
dynamically scale replicas based on resource utilization. Requires
a metrics server to be installed in the cluster.		 Optional: {}
astartePodPriorities AstartePodPrioritiesSpec Configure pod priority classes for Astarte components. When enabled,
the Operator creates three PriorityClasses (high, mid, low) and assigns
them to components based on their priorityClass field. Note that enabling
this feature might generate some counter-intuitive scheduling behaviour
if not done properly.		 Optional: {}

AstarteGenericAPIComponentSpec #

AstarteGenericAPIComponentSpec extends the base clustered resource with an option to disable authentication on the component. Used by all Astarte API components (Flow, Housekeeping, RealmManagement, Pairing, AppengineAPI).

Appears in:

Field Description Default Validation
deploy boolean When true, the component is deployed. When false, the component is removed (if
already present) or skipped. All components default to true except Flow, which
defaults to false and must be explicitly enabled.		 Optional: {}
replicas integer The number of replicas for this component. Optional: {}
antiAffinity boolean When true, pods of this component are spread across nodes using
podAntiAffinity.		 Optional: {}
customAffinity Affinity Custom affinity rules for this component. When set, overrides the default
antiAffinity configuration entirely.		 Optional: {}
deploymentStrategy DeploymentStrategy The deployment strategy for this specific component. Overrides the global
spec.deploymentStrategy. Note that DataUpdaterPlant, TriggerEngine, and Flow
always use Recreate regardless of this setting.		 Optional: {}
version string The Astarte version (image tag) for this specific component. Overrides the
global spec.version. Useful for pinning a component to a different version
during upgrades or debugging.		 Optional: {}
image string The full container image reference (registry/name:tag) for this component.
When set, overrides both the distributionChannel and version settings for
this component.		 Optional: {}
imagePullPolicy PullPolicy The image pull policy for this component. Overrides the global
spec.imagePullPolicy. Default: inherits from spec.imagePullPolicy.		 Optional: {}
imagePullSecrets LocalObjectReference array Additional image pull secrets for this component’s pods. These are appended
to the global spec.imagePullSecrets.		 Optional: {}
resources ResourceRequirements Compute Resources for this Component. Optional: {}
additionalEnv EnvVar array Additional environment variables for this Component. These are appended after
the operator-managed environment variables and can override them.		 Optional: {}
podLabels object (keys:string, values:string) Additional labels for this Component’s pod(s).
Label keys can’t be of the form “app”, “component”, “astarte-”, “flow-”		 Optional: {}
autoscaler AstarteGenericClusteredResourceAutoscalerSpec Autoscaling resources for this deployment/statefulset.
If autoscaling is enabled, this will take precedence over the “Replicas” field.
The autoscaling feature must be enabled globally via features.autoscaling.		 Optional: {}
priorityClass string The PriorityClass for this component.
Must be one of “high”, “mid”, “low” or unspecified.
Ignored if astartePodPriorities is not enabled.		 Enum: [high mid low ]
Optional: {}
livenessProbe Probe Override the default Liveness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
readinessProbe Probe Override the default Readiness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
startupProbe Probe Override the default Startup probe for this component.
If not set, no startup probe is configured by default.		 Optional: {}
disableAuthentication boolean When true, disables authentication for this API component. This is useful
in development or when an external auth proxy is used. Do not disable
authentication in production without an external auth mechanism.		 Optional: {}

AstarteGenericClusteredResource #

AstarteGenericClusteredResource is a base struct shared by all Astarte components that are deployed as either a Deployment or StatefulSet. It provides common configuration options such as replicas, affinity, probes, resources, and autoscaling that apply uniformly across components.

Appears in:

Field Description Default Validation
deploy boolean When true, the component is deployed. When false, the component is removed (if
already present) or skipped. All components default to true except Flow, which
defaults to false and must be explicitly enabled.		 Optional: {}
replicas integer The number of replicas for this component. Optional: {}
antiAffinity boolean When true, pods of this component are spread across nodes using
podAntiAffinity.		 Optional: {}
customAffinity Affinity Custom affinity rules for this component. When set, overrides the default
antiAffinity configuration entirely.		 Optional: {}
deploymentStrategy DeploymentStrategy The deployment strategy for this specific component. Overrides the global
spec.deploymentStrategy. Note that DataUpdaterPlant, TriggerEngine, and Flow
always use Recreate regardless of this setting.		 Optional: {}
version string The Astarte version (image tag) for this specific component. Overrides the
global spec.version. Useful for pinning a component to a different version
during upgrades or debugging.		 Optional: {}
image string The full container image reference (registry/name:tag) for this component.
When set, overrides both the distributionChannel and version settings for
this component.		 Optional: {}
imagePullPolicy PullPolicy The image pull policy for this component. Overrides the global
spec.imagePullPolicy. Default: inherits from spec.imagePullPolicy.		 Optional: {}
imagePullSecrets LocalObjectReference array Additional image pull secrets for this component’s pods. These are appended
to the global spec.imagePullSecrets.		 Optional: {}
resources ResourceRequirements Compute Resources for this Component. Optional: {}
additionalEnv EnvVar array Additional environment variables for this Component. These are appended after
the operator-managed environment variables and can override them.		 Optional: {}
podLabels object (keys:string, values:string) Additional labels for this Component’s pod(s).
Label keys can’t be of the form “app”, “component”, “astarte-”, “flow-”		 Optional: {}
autoscaler AstarteGenericClusteredResourceAutoscalerSpec Autoscaling resources for this deployment/statefulset.
If autoscaling is enabled, this will take precedence over the “Replicas” field.
The autoscaling feature must be enabled globally via features.autoscaling.		 Optional: {}
priorityClass string The PriorityClass for this component.
Must be one of “high”, “mid”, “low” or unspecified.
Ignored if astartePodPriorities is not enabled.		 Enum: [high mid low ]
Optional: {}
livenessProbe Probe Override the default Liveness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
readinessProbe Probe Override the default Readiness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
startupProbe Probe Override the default Startup probe for this component.
If not set, no startup probe is configured by default.		 Optional: {}

AstarteGenericClusteredResourceAutoscalerSpec #

AstarteGenericClusteredResourceAutoscalerSpec configures autoscaling for an Astarte component. Currently only horizontal autoscaling is supported.

Appears in:

Field Description Default Validation
horizontal string Name of the HorizontalPodAutoscaler for this deployment/statefulset.
This will take precedence over the “Replicas” field of the parent Astarte component.
The HPA resource must exist in the same namespace as Astarte and the
features.autoscaling flag must be enabled.		 Optional: {}

AstarteList #

AstarteList contains a list of Astarte

Field Description Default Validation
apiVersion string api.astarte-platform.org/v2alpha1
kind string AstarteList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items Astarte array

AstartePersistentStorageSpec #

AstartePersistentStorageSpec configures persistent storage for Astarte components that require it (VerneMQ, CFSSL).

Appears in:

Field Description Default Validation
size Quantity The size of the persistent volume. When not set, the Operator uses a
sensible default size.		 Optional: {}
className string The storage class name for the persistent volume. When not set, the
global spec.storageClassName is used as fallback.		 Optional: {}
volumeDefinition Volume A complete volume definition that replaces the Operator-managed
persistent volume claim. Use this to reference an externally-managed
volume. When set, size and className are ignored.		 Optional: {}

AstartePodPrioritiesSpec #

AstartePodPriorities allows to set different priorityClasses for Astarte pods. Note that enabling this feature might generate some counter-intuitive scheduling beahaviour if not done properly.

Appears in:

Field Description Default Validation
enable boolean Optional: {}
astarteHighPriority integer The value of the highest PriorityClass for Astarte pods.
Once the value is set, updating it will not have effect.		 1000 Minimum: 0
Optional: {}
astarteMidPriority integer The value of the medium PriorityClass for Astarte pods.
Once the value is set, updating it will not have effect.		 100 Minimum: 0
Optional: {}
astarteLowPriority integer The value of the least PriorityClass for Astarte pods.
Once the value is set, updating it will not have effect.		 10 Minimum: 0
Optional: {}

AstarteRabbitMQBaseConnectionSpec #

AstarteRabbitMQBaseConnectionSpec defines the host, port, credentials, and SSL settings for connecting to a RabbitMQ endpoint (AMQP or Management API).

Appears in:

Field Description Default Validation
host string The hostname or IP address of the service. MinLength: 1
Required: {}
port integer The port number the service listens on. Maximum: 65535
Minimum: 1
Required: {}
sslConfiguration GenericSSLConfigurationSpec SSL configuration for the connection. Optional: {}
credentialsSecret LoginCredentialsSecret The secret containing Username and Password to login.
Either this field or connectionStringSecret must be set.		 Optional: {}
connectionStringSecret ConnectionStringSecret The secret containing a connection string to the service.
Either this field or credentialsSecret must be set.
put as-is in the env. Therefore, setting this field is a no-op.
Not using credentialsSecret WILL break your Astarte instance.		 Optional: {}

AstarteRabbitMQConnectionSpec #

AstarteRabbitMQConnectionSpec extends the base RabbitMQ connection with an optional virtual host for the AMQP connection.

Appears in:

Field Description Default Validation
host string The hostname or IP address of the service. MinLength: 1
Required: {}
port integer The port number the service listens on. Maximum: 65535
Minimum: 1
Required: {}
sslConfiguration GenericSSLConfigurationSpec SSL configuration for the connection. Optional: {}
credentialsSecret LoginCredentialsSecret The secret containing Username and Password to login.
Either this field or connectionStringSecret must be set.		 Optional: {}
connectionStringSecret ConnectionStringSecret The secret containing a connection string to the service.
Either this field or credentialsSecret must be set.
put as-is in the env. Therefore, setting this field is a no-op.
Not using credentialsSecret WILL break your Astarte instance.		 Optional: {}
virtualHost string The virtual host for the RabbitMQ AMQP connection. Default: “/”. Optional: {}

AstarteRabbitMQSpec #

AstarteRabbitMQSpec defines the RabbitMQ configuration for Astarte. Both the AMQP connection and the Management API connection are required.

Appears in:

Field Description Default Validation
connection AstarteRabbitMQConnectionSpec RabbitMQ AMQP connection details. Required. Required: {}
managementConnection AstarteRabbitMQBaseConnectionSpec RabbitMQ management APIs connection details. Required. Required: {}
dataQueuesPrefix string Configures the data queues prefix on RabbitMQ. You should change this setting only
in custom RabbitMQ installations.		 Optional: {}
eventsExchangeName string Configures the events exchange name on RabbitMQ. You should change this setting only
in custom RabbitMQ installations.		 Optional: {}

AstarteRendezvousServerConnectionSpec #

AstarteRendezvousServerConnectionSpec defines the connection to an FDO Rendezvous Server.

Appears in:

Field Description Default Validation
host string The hostname or IP address of the service. MinLength: 1
Required: {}
port integer The port number the service listens on. Maximum: 65535
Minimum: 1
Required: {}
sslConfiguration GenericSSLConfigurationSpec SSL configuration for the Rendezvous Server connection. Optional: {}

AstarteRendezvousServerSpec #

AstarteRendezvousServerSpec configures the FDO Rendezvous Server connection.

Appears in:

Field Description Default Validation
connection AstarteRendezvousServerConnectionSpec The Rendezvous Server connection details. Optional: {}

AstarteSpec #

AstarteSpec defines the desired state of Astarte

Appears in:

Field Description Default Validation
version string The Astarte version for this Resource. This field is required and must be a valid
semver string (e.g. “1.3.0” or “1.4.1”). The Operator uses this version
to determine which images to pull and what features to enable.
features AstarteFeatures Features allows enabling or disabling a set of global, opt-in Astarte features. Optional: {}
imagePullPolicy PullPolicy The default image pull policy for all Astarte services. Can be overridden
per-component by setting the component’s imagePullPolicy field.
Default: “IfNotPresent”.		 IfNotPresent Optional: {}
imagePullSecrets LocalObjectReference array Image pull secrets that will be added to all Astarte pods. Each component can
add additional secrets through its own imagePullSecrets field.		 Optional: {}
distributionChannel string The distribution channel (container registry prefix) for Astarte images.
This setting can be overridden by explicitly setting the ‘image’ value for
each service. Defaults to “astarte”.		 astarte Optional: {}
deploymentStrategy DeploymentStrategy The global default deployment strategy for Astarte components. Can be overridden
per-component by setting the component’s deploymentStrategy field. Note that
DataUpdaterPlant, TriggerEngine, and Flow always use Recreate regardless
of this setting. When left unset, defaults to RollingUpdate.		 Optional: {}
storageClassName string The default storage class name for persistent storage claims. When a component
requires a persistent volume and does not specify its own className, this value
is used as a fallback.		 Optional: {}
api AstarteAPISpec API defines the external API host and SSL configuration for Astarte services.
The Host field is required.
rabbitmq AstarteRabbitMQSpec RabbitMQ connection and management configuration for the Astarte message broker. Optional: {}
cassandra AstarteCassandraSpec Cassandra/ScyllaDB connection configuration for the Astarte database.
The connection and astarteSystemKeyspace fields are required.		 Optional: {}
vernemq AstarteVerneMQSpec VerneMQ broker configuration including networking, storage, and device heartbeat settings.
vault AstarteVaultSpec Vault is used to connect to a OpenBao or HashiCorp Vault instance.
Setting this field is supported and mandatory for Astarte version 1.4 and later.
The field is ignored for Astarte 1.3.		 Optional: {}
fdo AstarteFDOSpec FDO (FIDO Device Onboarding) configuration. Available as an opt-in feature
starting from Astarte 1.3. From Astarte 1.4.0 onwards, FDO is mandatory
and cannot be disabled.		 Optional: {}
cfssl AstarteCFSSLSpec CFSSL (Cloudflare’s PKI/TLS toolkit) configuration. CFSSL is an internal
certificate authority used by Astarte for mutual TLS. By default, CFSSL is
deployed automatically (deploy=true).		 Optional: {}
components AstarteComponentsSpec Components configures the individual Astarte services (Flow, Housekeeping,
RealmManagement, Pairing, DataUpdaterPlant, AppengineAPI, TriggerEngine, Dashboard).
Each component can override its image, resources, replicas, and other settings.		 Optional: {}
astarteInstanceID string AstarteInstanceID is the unique ID that is associated with an Astarte instance. This parameter
is used to let different Astarte instances employ a shared database infrastructure.
Once set, the AstarteInstanceID cannot be changed. Defaults to “”.		 Optional: {}
Pattern: ^[a-z]?[a-z0-9]\{0,47\}$
manualMaintenanceMode boolean ManualMaintenanceMode pauses all reconciliation activities but still computes the resource
status. It should be used only when the managed Astarte resources requires manual intervention
and the Operator cannot break out of the problem by itself. Do not set this field unless you
know exactly what you are doing.		 false Optional: {}

AstarteStatus #

AstarteStatus defines the observed state of Astarte. The Operator updates this subresource as it reconciles the CR, providing visibility into the current reconciliation phase, cluster health, and connection endpoints.

Appears in:

Field Description Default Validation
phase ReconciliationPhase The current reconciliation phase of the Astarte resource.
astarteVersion string The Astarte version currently deployed.
operatorVersion string The version of the Astarte Operator managing this resource.
health AstarteClusterHealth The overall health status of the Astarte cluster (red, yellow, or green).
baseAPIURL string The base URL for Astarte API endpoints (derived from spec.api.host and SSL setting).
brokerURL string The broker URL for MQTT connections (derived from spec.vernemq.host and port).

AstarteSystemKeyspaceSpec #

AstarteSystemKeyspaceSpec configures the ScyllaDB/Cassandra keyspace for Astarte.

By configuring these fields, you control the replication strategy, replication factor, and (for multi-datacenter deployments) the replica distribution per datacenter. These settings take effect only upon keyspace creation.

Fields:

  • ReplicationStrategy chooses the replication strategy for the keyspace.
  • ReplicationFactor (for SimpleStrategy or for default replication factor with NetworkTopologyStrategy).
  • DataCenterReplication (for flexible NetworkTopologyStrategy configurations).

These fields must be set at the first apply of the CR and cannot be changed later on, for this reason no default is provided: the user shall make a conscious choice.

Appears in:

Field Description Default Validation
replicationStrategy string ReplicationStrategy specifies the Cassandra/ScyllaDB replication strategy for the keyspace.
Must be either “SimpleStrategy” or “NetworkTopologyStrategy” (for production deployments and/or
multi-datacenter deployments).		 Enum: [SimpleStrategy NetworkTopologyStrategy]
Required: {}
replicationFactor integer ReplicationFactor sets the total number of replicas for the keyspace when using SimpleStrategy.
Must be at least 1. Must be odd. Defaults to 1.
Shall be set if and only if replicationStrategy is SimpleStrategy (checked with Admission Webhooks).
This field is ignored if ReplicationStrategy is set to NetworkTopologyStrategy.		 Minimum: 1
Optional: {}
dataCenterReplication string DataCenterReplication specifies custom replication factors per datacenter when using NetworkTopologyStrategy.
If set, this string must be a comma-separated list of : entries
(e.g., “dc1:3,dc2:5”). must be odd.
Shall be set if and only if replicationStrategy is NetworkTopologyStrategy (checked with Admission Webhooks)
This field is ignored if ReplicationStrategy is set to SimpleStrategy.		 Optional: {}

AstarteTriggerEngineSpec #

AstarteTriggerEngineSpec configures the Trigger Engine component, which processes Astarte triggers (user-defined rules) and dispatches events.

Appears in:

Field Description Default Validation
deploy boolean When true, the component is deployed. When false, the component is removed (if
already present) or skipped. All components default to true except Flow, which
defaults to false and must be explicitly enabled.		 Optional: {}
replicas integer The number of replicas for this component. Optional: {}
antiAffinity boolean When true, pods of this component are spread across nodes using
podAntiAffinity.		 Optional: {}
customAffinity Affinity Custom affinity rules for this component. When set, overrides the default
antiAffinity configuration entirely.		 Optional: {}
deploymentStrategy DeploymentStrategy The deployment strategy for this specific component. Overrides the global
spec.deploymentStrategy. Note that DataUpdaterPlant, TriggerEngine, and Flow
always use Recreate regardless of this setting.		 Optional: {}
version string The Astarte version (image tag) for this specific component. Overrides the
global spec.version. Useful for pinning a component to a different version
during upgrades or debugging.		 Optional: {}
image string The full container image reference (registry/name:tag) for this component.
When set, overrides both the distributionChannel and version settings for
this component.		 Optional: {}
imagePullPolicy PullPolicy The image pull policy for this component. Overrides the global
spec.imagePullPolicy. Default: inherits from spec.imagePullPolicy.		 Optional: {}
imagePullSecrets LocalObjectReference array Additional image pull secrets for this component’s pods. These are appended
to the global spec.imagePullSecrets.		 Optional: {}
resources ResourceRequirements Compute Resources for this Component. Optional: {}
additionalEnv EnvVar array Additional environment variables for this Component. These are appended after
the operator-managed environment variables and can override them.		 Optional: {}
podLabels object (keys:string, values:string) Additional labels for this Component’s pod(s).
Label keys can’t be of the form “app”, “component”, “astarte-”, “flow-”		 Optional: {}
autoscaler AstarteGenericClusteredResourceAutoscalerSpec Autoscaling resources for this deployment/statefulset.
If autoscaling is enabled, this will take precedence over the “Replicas” field.
The autoscaling feature must be enabled globally via features.autoscaling.		 Optional: {}
priorityClass string The PriorityClass for this component.
Must be one of “high”, “mid”, “low” or unspecified.
Ignored if astartePodPriorities is not enabled.		 Enum: [high mid low ]
Optional: {}
livenessProbe Probe Override the default Liveness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
readinessProbe Probe Override the default Readiness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
startupProbe Probe Override the default Startup probe for this component.
If not set, no startup probe is configured by default.		 Optional: {}
eventsQueueName string Configures the name of the Events queue. Should be configured only in installations with a highly
customized RabbitMQ. It is advised to leave empty unless you know exactly what you’re doing.		 Optional: {}
eventsRoutingKey string Configures the routing key for Trigger Events. Should be configured only in installations
with a highly customized RabbitMQ and a custom Trigger Engine setup. It is advised to leave
empty unless you know exactly what you’re doing, misconfiguring this value can cause heavy
breakage within Trigger Engine.		 Optional: {}

AstarteVaultConnectionSpec #

AstarteVaultConnectionSpec defines the connection to an OpenBao or HashiCorp Vault instance.

Appears in:

Field Description Default Validation
host string The hostname or IP address of the service. MinLength: 1
Required: {}
port integer The port number the service listens on. Maximum: 65535
Minimum: 1
Required: {}
sslConfiguration GenericSSLConfigurationSpec SSL configuration for the Vault connection. Optional: {}
connectionStringSecret ConnectionStringSecret The secret containing a token to login. The Secret must be in the same
namespace as the Astarte resource.		 Optional: {}

AstarteVaultSpec #

AstarteVaultSpec configures the OpenBao/HashiCorp Vault integration. Required for Astarte >= 1.4.0. Ignored for Astarte 1.3.

Appears in:

Field Description Default Validation
connection AstarteVaultConnectionSpec The Vault connection details. Optional: {}
baseNamespace string Base vault namespace prefix under which Astarte will create further sub-namespaces Optional: {}

AstarteVerneMQSpec #

AstarteVerneMQSpec configures the VerneMQ MQTT broker component.

Appears in:

Field Description Default Validation
deploy boolean When true, the component is deployed. When false, the component is removed (if
already present) or skipped. All components default to true except Flow, which
defaults to false and must be explicitly enabled.		 Optional: {}
replicas integer The number of replicas for this component. Optional: {}
antiAffinity boolean When true, pods of this component are spread across nodes using
podAntiAffinity.		 Optional: {}
customAffinity Affinity Custom affinity rules for this component. When set, overrides the default
antiAffinity configuration entirely.		 Optional: {}
deploymentStrategy DeploymentStrategy The deployment strategy for this specific component. Overrides the global
spec.deploymentStrategy. Note that DataUpdaterPlant, TriggerEngine, and Flow
always use Recreate regardless of this setting.		 Optional: {}
version string The Astarte version (image tag) for this specific component. Overrides the
global spec.version. Useful for pinning a component to a different version
during upgrades or debugging.		 Optional: {}
image string The full container image reference (registry/name:tag) for this component.
When set, overrides both the distributionChannel and version settings for
this component.		 Optional: {}
imagePullPolicy PullPolicy The image pull policy for this component. Overrides the global
spec.imagePullPolicy. Default: inherits from spec.imagePullPolicy.		 Optional: {}
imagePullSecrets LocalObjectReference array Additional image pull secrets for this component’s pods. These are appended
to the global spec.imagePullSecrets.		 Optional: {}
resources ResourceRequirements Compute Resources for this Component. Optional: {}
additionalEnv EnvVar array Additional environment variables for this Component. These are appended after
the operator-managed environment variables and can override them.		 Optional: {}
podLabels object (keys:string, values:string) Additional labels for this Component’s pod(s).
Label keys can’t be of the form “app”, “component”, “astarte-”, “flow-”		 Optional: {}
autoscaler AstarteGenericClusteredResourceAutoscalerSpec Autoscaling resources for this deployment/statefulset.
If autoscaling is enabled, this will take precedence over the “Replicas” field.
The autoscaling feature must be enabled globally via features.autoscaling.		 Optional: {}
priorityClass string The PriorityClass for this component.
Must be one of “high”, “mid”, “low” or unspecified.
Ignored if astartePodPriorities is not enabled.		 Enum: [high mid low ]
Optional: {}
livenessProbe Probe Override the default Liveness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
readinessProbe Probe Override the default Readiness probe for this component.
If not set, a default HTTP GET probe is configured to check the /health endpoint on the http port.
Default settings: InitialDelaySeconds=10, TimeoutSeconds=5, PeriodSeconds=30, FailureThreshold=5 (15 for Housekeeping).
Note: VerneMQ uses different defaults: /metrics endpoint on port 8888, InitialDelaySeconds=60, PeriodSeconds=20, FailureThreshold=3.		 Optional: {}
startupProbe Probe Override the default Startup probe for this component.
If not set, no startup probe is configured by default.		 Optional: {}
host string The hostname or IP address of the service. MinLength: 1
Required: {}
port integer The port number the service listens on. Maximum: 65535
Minimum: 1
Required: {}
caSecret string The name of a Kubernetes Secret containing the CA certificate for VerneMQ
internal TLS communication (for Astarte >= 1.2). The Secret must be in
the same namespace as the Astarte resource.		 Optional: {}
storage AstartePersistentStorageSpec Persistent storage configuration for VerneMQ. If not set, the default
storage size and class (from spec.storageClassName) are used.		 Optional: {}
deviceHeartbeatSeconds integer Controls the device heartbeat from the broker to Astarte. The heartbeat is sent periodically
to prevent Astarte from keeping up stale connections from Devices in case the broker misbehaves
and does not send disconnection events. You should usually not tweak this value. Moreover, keep
in mind that when a lot of devices are connected simultaneously, having a short heartbeat time
might cause performance issues. When not set, no heartbeat env var is passed and the VerneMQ
container default (1 hour) is used.		 Optional: {}
maxOfflineMessages integer The maximum number of QoS 1 or 2 messages to hold in the offline queue.
Defaults to 1000000. Set to -1 for no maximum (not recommended). Set to 0
if no messages should be stored offline.		 Optional: {}
persistentClientExpiration string This option allows persistent clients ( = clean session set to
false) to be removed if they do not reconnect within ‘persistent_client_expiration’.
This is a non-standard option. As far as the MQTT specification is concerned,
persistent clients persist forever.
The expiration period should be an integer followed by one of ’d’, ‘w’, ’m’, ‘y’ for
day, week, month, and year.
Default: 1 year		 Optional: {}
mirrorQueue string Configures the mirror queue for VerneMQ. When set, all MQTT messages are
forwarded to the specified queue for audit/logging purposes. Leave empty
unless you have a specific mirror queue setup.		 Optional: {}
sslListener boolean This option allows, when true, to handle SSL termination at VerneMQ level.
Default: false		 Optional: {}
sslListenerCertSecretName string Reference the name of the secret containing the TLS certificate for VerneMQ.
The secret must be present in the same namespace in which Astarte resides.
The field will be used only if SSLListener is set to true.		 Optional: {}

ConnectionStringSecret #

ConnectionStringSecret references a Kubernetes Secret containing a connection string (e.g. a full URL or DSN) for an external service.

Appears in:

Field Description Default Validation
name string The name of the Kubernetes Secret. MinLength: 1
key string The key within the Secret that holds the connection string. MinLength: 1

GenericConnectionSpec #

GenericConnectionSpec holds common connection configuration for external services (Cassandra, RabbitMQ, Vault). It supports either username/password credentials or a raw connection string.

Appears in:

Field Description Default Validation
sslConfiguration GenericSSLConfigurationSpec SSL configuration for the connection. Optional: {}
credentialsSecret LoginCredentialsSecret The secret containing Username and Password to login.
Either this field or connectionStringSecret must be set.		 Optional: {}
connectionStringSecret ConnectionStringSecret The secret containing a connection string to the service.
Either this field or credentialsSecret must be set.
put as-is in the env. Therefore, setting this field is a no-op.
Not using credentialsSecret WILL break your Astarte instance.		 Optional: {}

GenericSSLConfigurationSpec #

GenericSSLConfigurationSpec configures SSL/TLS for connections to external services.

Appears in:

Field Description Default Validation
enable boolean When true, enable SSL for the connection. Default: false. Optional: {}
customCASecret LocalObjectReference A reference to a Kubernetes Secret containing a custom CA certificate
to validate the server’s TLS certificate. The Secret must be in the
same namespace as the Astarte resource.		 Optional: {}
sni boolean When false, disable SNI (Server Name Indication) for the connection.
Default: true (SNI is enabled).		 Optional: {}
customSNI string A custom SNI hostname to use for the connection. When set, overrides
the default hostname-based SNI.		 Optional: {}

HostAndPort #

HostAndPort represents a network endpoint with a hostname and port.

Appears in:

Field Description Default Validation
host string The hostname or IP address of the service. MinLength: 1
Required: {}
port integer The port number the service listens on. Maximum: 65535
Minimum: 1
Required: {}

LoginCredentialsSecret #

LoginCredentialsSecret references a Kubernetes Secret containing login credentials (username and password) for connecting to an external service.

Appears in:

Field Description Default Validation
name string The name of the Kubernetes Secret. MinLength: 1
usernameKey string The key within the Secret that holds the username. MinLength: 1
passwordKey string The key within the Secret that holds the password. MinLength: 1

ReconciliationPhase #

Underlying type: string

ReconciliationPhase describes the reconciliation phase the Resource is in

Appears in:

Field Description
`` ReconciliationPhaseUnknown represents an Unknown Phase of the Resource. When in this state, it might
have never been reconciled
Reconciling ReconciliationPhaseReconciling means the Resource is currently in the process of being reconciled
Upgrading ReconciliationPhaseUpgrading means the Resource is currently in the process of being upgraded to a new Astarte version.
When successful, the Resource will transition to ReconciliationPhaseReconciling
Reconciled ReconciliationPhaseReconciled means the Resource is currently reconciled and stable. The resource should stay in this
state for most of the time.
Disabled, in Manual Maintenance Mode ReconciliationPhaseManualMaintenanceMode means the Resource is currently not being reconciled as the resource is in
Manual Maintenance Mode. This happens only when the user explicitly requires that.
Failed ReconciliationPhaseFailed means the Resource failed to reconcile. If this state persists, a manual intervention
might be necessary.

flow.astarte-platform.org/v2alpha1 #

Package v2alpha1 contains API Schema definitions for the flow v2alpha1 API group

Resource Types #

BlockWorker #

BlockWorker defines a Worker for a Container Block

Appears in:

Field Description Default Validation
id string
dataProvider DataProvider

ContainerBlockSpec #

ContainerBlockSpec defines a Container Block in a Flow

Appears in:

Field Description Default Validation
id string
image string
imagePullSecrets LocalObjectReference array Optional: {}
environment EnvVar array Optional: {}
resources ResourceRequirements Optional: {}
config string Configuration represents the JSON string carrying the user configuration for this block
workers BlockWorker array MinItems: 1

DataProvider #

DataProvider is a struct which defines which Data Providers (e.g. Brokers) are available for a Worker

Appears in:

Field Description Default Validation
rabbitmq RabbitMQDataProvider Optional: {}

Flow #

Flow is the Schema for the flows API

Appears in:

Field Description Default Validation
apiVersion string flow.astarte-platform.org/v2alpha1
kind string Flow
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec FlowSpec
status FlowStatus

FlowList #

FlowList contains a list of Flow

Field Description Default Validation
apiVersion string flow.astarte-platform.org/v2alpha1
kind string FlowList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items Flow array

FlowSpec #

FlowSpec defines the desired state of Flow

Appears in:

Field Description Default Validation
astarte LocalObjectReference
astarteRealm string
nativeBlocks integer Defines the amount of non-container blocks in the Flow
nativeBlocksResources ResourceList Defines the overall resources consumed by Native Blocks
flowPool LocalObjectReference EE Only: Defines the Flow Pool in which the Flow will be allocated.
blocks ContainerBlockSpec array

FlowState #

Underlying type: string

FlowState describes the global state of a Flow

Appears in:

Field Description
`` FlowStateUnknown represents an Unknown State of the Flow. When in this state, it might
have never been reconciled.
Unstable FlowStateUnstable means the Flow is either reconciling or restarting some of its blocks.
It usually transitions to this State before moving to Flowing.
Unhealthy FlowStateUnhealthy means the Flow is currently having some non-transient or unrecoverable errors.
Manual intervention might be required.
Flowing FlowStateFlowing means the Flow is currently active and all of its blocks are stable. A healthy flow should stay
in this state for most of its lifecycle.

FlowStatus #

FlowStatus defines the observed state of Flow

Appears in:

Field Description Default Validation
state FlowState State defines the overall state of the Flow
totalContainerBlocks integer Represents the total number of the Container Blocks in the Flow
readyContainerBlocks integer Represents the total number of Ready Container Blocks in the Flow. In a healthy Flow,
this matches the number of Total Container Blocks.
resources ResourceList The overall resources allocated in the cluster for this Block
failingContainerBlocks integer Represents the total number of Container Blocks with non temporary failures. Present only
if any of the Blocks is in such state. When present, manual intervention is most likely required.		 Optional: {}
unrecoverableFailures ContainerState array UnrecoverableFailures lists all the ContainerStates of failing containers, for further inspection. Optional: {}

RabbitMQConfig #

RabbitMQConfig represents configuration for RabbitMQ

Appears in:

Field Description Default Validation
host string
port integer Maximum: 65535
Minimum: 1
Optional: {}
ssl boolean Optional: {}
username string
password string

RabbitMQDataProvider #

RabbitMQDataProvider is a representation of a Data Provider based upon RabbitMQ

Appears in:

Field Description Default Validation
queues string array Optional: {}
exchange RabbitMQExchange Optional: {}
rabbitmq RabbitMQConfig RabbitMQConfig is an optional field which allows to specify configuration for an external RabbitMQ
broker. If not specified, Astarte’s main Broker will be used.		 Optional: {}

RabbitMQExchange #

RabbitMQExchange is a representation of a RabbitMQ Exchange

Appears in:

Field Description Default Validation
name string
routingKey string

ingress.astarte-platform.org/v2alpha1 #

Package v2alpha1 contains API Schema definitions for the ingress v2alpha1 API group

Resource Types #

AstarteDefaultIngress #

AstarteDefaultIngress is the Schema for the astartedefaultingresses API

Custom ADI annotations

Custom Content-Security-Policy

  • Annotation: ingress.astarte-platform.org/content-security-policy
  • Values: string (valid Content-Security-Policy header value)
  • Description: This annotation allows you to specify a custom Content Security Policy for the Astarte Operator’s ingress. If this annotation is set, it wil override the default Content Security Policy defined by the Astarte Operator and any value set in the custom-frame-ancestors annotation.

Custom frame-ancestors

  • Annotation: ingress.astarte-platform.org/frame-ancestors
  • Values: string (valid frame-ancestors directive value)
  • Description: This annotation allows you to specify custom frame ancestors for the Astarte Operator’s ingress. If not set, the default value is frame-ancestors 'self'.

Appears in:

Field Description Default Validation
apiVersion string ingress.astarte-platform.org/v2alpha1
kind string AstarteDefaultIngress
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec AstarteDefaultIngressSpec
status AstarteDefaultIngressStatus

AstarteDefaultIngressAPISpec #

AstarteDefaultIngressAPISpec defines how the Astarte APIs are served.

Appears in:

Field Description Default Validation
deploy boolean When true, deploy the API ingress.
tlsSecret string The secret containing the TLS certificates and keys used to access the Astarte API. The secret
must be present in the namespace in which Astarte resides. If set, this secret overrides the TLSSecret
field contained in AstarteDefaultIngressSpec.
cors boolean When true, enable Cross-Origin Resource Sharing (CORS). Default: false.
exposeHousekeeping boolean When true, the housekeeping endpoint is publicly exposed. Default: true.

AstarteDefaultIngressBrokerSpec #

AstarteDefaultIngressBrokerSpec defines how the Astarte Broker is served.

Appears in:

Field Description Default Validation
deploy boolean When true, expose the Broker.
serviceType ServiceType Set the type of service employed to expose the broker. Supported values are “NodePort” and “LoadBalancer”.
The AstarteDefaultIngress handles TLS termination at VerneMQ level and, as such, no TLSSecret is needed to
configure the broker service.
Default: “LoadBalancer”
kubebuilder:validation:Enum:=LoadBalancer,NodePort
kubebuilder:validation:Default:=LoadBalancer
loadBalancerIP string Set the LoadBalancerIP if and only if the broker service is of type “LoadBalancer”. This feature depends on
whether the cloud provider supports specifying the LoadBalancerIP when a load balancer is created.
serviceAnnotations object (keys:string, values:string) Additional annotations for the service exposing this broker.

AstarteDefaultIngressDashboardSpec #

AstarteDefaultIngressDashboardSpec defines how the Astarte Dashboard is served.

Appears in:

Field Description Default Validation
deploy boolean When true, deploy the Ingress for the Dashboard.
ssl boolean When true, enable TLS authentication for the Dashboard.
host string The host handling requests addressed to the dashboard. When deploy is true and host is not set,
the dashboard will be exposed at the following URL: https:///dashboard.
tlsSecret string The secret containing the TLS certificates and keys used to access the Astarte Dashboard. The secret
must be present in the namespace in which Astarte resides. If set, this secret overrides the TLSSecret
field contained in AstarteDefaultIngressSpec.

AstarteDefaultIngressList #

AstarteDefaultIngressList contains a list of AstarteDefaultIngress

Field Description Default Validation
apiVersion string ingress.astarte-platform.org/v2alpha1
kind string AstarteDefaultIngressList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items AstarteDefaultIngress array

AstarteDefaultIngressSpec #

AstarteDefaultIngressSpec defines the desired state of AstarteDefaultIngress

Appears in:

Field Description Default Validation
astarte string The name of the Astarte instance served by the AstarteDefaultIngress.
ingressClass string In clusters with more than one ingress controllers, all
instances of the controllers must be aware of which Ingress object they must serve.
The ingressClass field of a ingress object is the way to let the controller know about that.
If empty, admission webhooks set default IngressClass based on Ingress Controller selection
defined in the annotation ingress.astarte-platform.org/ingress-controller-selector.
If the annotation is not set, HAProxy Ingress Controller is assumed by default.
api AstarteDefaultIngressAPISpec Define the desired state of the AstarteDefaultIngressAPISpec resource.
dashboard AstarteDefaultIngressDashboardSpec Define the desired state of the AstarteDefaultIngressDashboardSpec resource.
broker AstarteDefaultIngressBrokerSpec Define the desired state of the AstarteDefaultIngressBrokerSpec resource.
tlsSecret string The secret containing the TLS certificates and keys used to connect to Astarte. The secret
must be present in the namespace in which Astarte resides and it will be used to authenticate
requests for API and Dashboard. If specific configurations are required,
the TLSSecret can be overridden by setting the secret in any of AstarteDefaultIngressAPISpec
and AstarteDefaultIngressDashboardSpec.

AstarteDefaultIngressStatus #

AstarteDefaultIngressStatus defines the observed state of AstarteDefaultIngress

Appears in:

Field Description Default Validation
api IngressStatus
broker ServiceStatus

AstarteFDOIngress #

AstarteFDOIngress is the Schema for the astartefdoingresses API.

Appears in:

Field Description Default Validation
apiVersion string ingress.astarte-platform.org/v2alpha1
kind string AstarteFDOIngress
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec AstarteFDOIngressSpec
status AstarteFDOIngressStatus

AstarteFDOIngressList #

AstarteFDOIngressList contains a list of AstarteFDOIngress.

Field Description Default Validation
apiVersion string ingress.astarte-platform.org/v2alpha1
kind string AstarteFDOIngressList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items AstarteFDOIngress array

AstarteFDOIngressSpec #

AstarteFDOIngressSpec defines the desired state of AstarteFDOIngress.

Appears in:

Field Description Default Validation
astarte string The name of the Astarte instance for which the FDO Ingress is being created.
ingressClass string In clusters with more than one ingress controllers, all
instances of the controllers must be aware of which Ingress object they must serve.
The ingressClass field of a ingress object is the way to let the controller know about that.
If the annotation is not set, HAProxy Ingress Controller is assumed by default.		 haproxy
tlsSecret string The secret containing the TLS certificates and keys used to connect to Astarte FDO Ingress. The secret
must be present in the namespace in which Astarte resides and it will be used to authenticate
requests to Astarte Pairing using FDO.

AstarteFDOIngressStatus #

AstarteFDOIngressStatus defines the observed state of AstarteFDOIngress.

Appears in:

Field Description Default Validation
loadBalancer IngressLoadBalancerStatus loadBalancer contains the current status of the load-balancer.