spec.config | object (map of string) | No | | Non-secret settings, for example host, port, database, bucket, baseUrl. | max 32 |
spec.ownerGroup | string (nullable) | No | | Scope group: the Keycloak group whose members manage and use the connection. | min 1, max 64; pattern ^[A-Za-z0-9][A-Za-z0-9._-]*$ |
spec.refreshInterval | string | No | 15m | How often the synced Secret is refreshed from the store, for example 15m. Between one minute and 24 hours. | pattern ^[0-9]{1,4}(m|h)$ |
spec.scope | string | No | group | Whose credential a connection holds and who may use it. Personal connections have no resource: they live only in the secret store and never reach a pipeline. | group, managed |
spec.secret | object (nullable) | No | | The secret fields, when this connection has any. Absent for a connection that needs no credentials (the platform's own Kafka bus, an anonymous generic endpoint). The per-type validation below still requires it for every type that authenticates. | |
spec.secret.keys | array of string | Yes | | Names of the secret fields, for example user and password. They become the keys of the synced Kubernetes Secret and the environment variables CONN_<NAME>_<KEY>. | min 1, max 16 |
spec.secret.remoteRef | string (nullable) | No | | Path in the secret store. Absent: derived from the scope, connections/group/<ownerGroup>/<name> or connections/managed/<name>. Set it only when the platform reads the customer's own store (spec.secrets mode external); in platform mode the controller refuses a value, because a path chosen by the author could point at another group's secret. | min 1, max 512; pattern ^[A-Za-z0-9][A-Za-z0-9_./-]*$ |
spec.type | string | Yes | | What a connection reaches. The type decides which settings and secret keys are required. | postgresql, mysql, sqlserver, oracle, rest-api, s3, kafka, sftp, generic |
spec.usableBy | array of string | No | | Scope managed: the groups whose platform-run work may use the connection. | max 20 |