spec.baseDomain | string (nullable) | No | | Public DNS name the platform is served under, for example data.example.com: Nova answers on the name itself and every other application on a subdomain (id, trino, superset...). | min 3, max 253; pattern ^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$ |
spec.dryRun | boolean | No | true | Plan only (no cluster changes) until explicitly disabled. Safe default. | |
spec.identity | object | No | {"adminGroup":"stardelt-admins","mode":"none","provider":"oidc"} | How users sign in; see [IdentitySpec]. | |
spec.identity.adminGroup | string | No | stardelt-admins | Members of this group are platform administrators. | |
spec.identity.apiAudience | string (nullable) | No | | external only: the audience the engine and the catalog accept. | min 1, max 256; pattern ^\S+$ |
spec.identity.clients | object (map of object) | No | | external only: the app registrations the customer made, one entry per client. | |
spec.identity.clients{}.clientId | string | Yes | | | min 1, max 256; pattern ^\S+$ |
spec.identity.clients{}.clientSecretRef | object (nullable) | No | | Required for every client except the public lakekeeper one. Never the value itself. | |
spec.identity.clients{}.clientSecretRef.key | string | No | client-secret | | min 1, max 253 |
spec.identity.clients{}.clientSecretRef.name | string | Yes | | | min 1, max 253; pattern ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$ |
spec.identity.groupClaim | string (nullable) | No | | Name of the token claim that carries group (or role) names. Defaults to roles for entra and groups otherwise. | |
spec.identity.issuerUrl | string (nullable) | No | | OIDC issuer URL, https:// only. Required for external; for platform it is derived from baseDomain and must be left out. | |
spec.identity.mode | string | No | none | Where users sign in. Two modes besides none: an identity provider the organization already runs (external, for example Entra or Okta), or one the platform runs itself (platform, Keycloak). An organization often runs the platform several times against one external provider; each instance then has its own app registrations and group mapping. | none, platform, external |
spec.identity.provider | string | No | oidc | external only: which kind of provider this instance talks to. | oidc, entra |
spec.ingress | object | No | {"enabled":false,"tls":{"enabled":false,"secretNameTemplate":"{host}-tls"}} | How the applications are reached from outside the cluster; see [IngressSettings]. | |
spec.ingress.className | string (nullable) | No | | IngressClass name, for example nginx or traefik. Absent: the cluster default. | min 1, max 253 |
spec.ingress.enabled | boolean | No | false | Create an Ingress for Nova (on baseDomain itself); the identity provider on id. with identity.mode: platform; Airflow on airflow. with the pipelines pillar; JupyterHub on jupyter. with notebooks. | |
spec.ingress.tls | object | No | {"enabled":false,"secretNameTemplate":"{host}-tls"} | TLS through cert-manager. | |
spec.ingress.tls.enabled | boolean | No | false | Requires cert-manager. Leave off when TLS ends elsewhere (a cloud load balancer, an edge proxy). | |
spec.ingress.tls.issuer | string (nullable) | No | | Name of a cert-manager ClusterIssuer; written as the cert-manager.io/cluster-issuer annotation of every Ingress. | min 1, max 253 |
spec.ingress.tls.secretNameTemplate | string | No | {host}-tls | Name of the Secret that holds the certificate; {host} becomes the host name with the dots turned into dashes. | min 1, max 253 |
spec.namespace | string | No | stardelt | Namespace the platform's own components are installed into. | |
spec.pillars | object | No | {"batch":false,"dashboards":false,"lakehouse":true,"ml":false,"notebooks":false,"pipelines":false,"streaming":false} | Which pillars a platform instance enables. | |
spec.pillars.batch | boolean | No | false | | |
spec.pillars.dashboards | boolean | No | false | BI dashboards (Superset). Off by default: it brings a metadata database, Redis and three long-running pods. People sign in through the platform IdP, with the local administrator kept as break-glass; each group sees the dashboards its catalog role allows. | |
spec.pillars.lakehouse | boolean | No | true | | |
spec.pillars.ml | boolean | No | false | | |
spec.pillars.notebooks | boolean | No | false | Multi-user notebooks (JupyterHub). Off by default: a notebook stack is heavy, and a cluster that only serves queries should not carry it. | |
spec.pillars.pipelines | boolean | No | false | Scheduled pipelines and jobs (Airflow, run as KubernetesExecutor). Off by default: it brings a metadata database and four long-running pods, and a cluster that only serves queries does not need them. Nova's Pipelines page and stardelt bundle run need it. | |
spec.pillars.streaming | boolean | No | false | | |
spec.profile | string | No | demo | Deployment size / capability profile. | demo, full, airgap |
spec.secrets | object | No | {"mode":"none"} | Where the credentials of Connection objects come from; see [SecretsSpec]. | |
spec.secrets.external | object (nullable) | No | | The enterprise's store; required for external, refused for the other modes. | |
spec.secrets.external.provider | object | Yes | | The provider block of the ClusterSecretStore (vault, aws, azurekv, …), passed to External Secrets verbatim. Exactly one provider key; credentials are referenced by Secret name inside the block, never inline. | |
spec.secrets.groups | array of string | No | | Owner groups that get their own store entry in secrets.mode: platform: each one may read only its own path. Mirrors the platform's STORE_GROUPS. | max 20 |
spec.secrets.mode | string | No | none | Which secret store the platform uses for user credentials. | none, platform, external |
spec.set | object (map of object (map of string)) | No | | --set overrides per component: set.<component>.<helm.key>: "value". Highest precedence — Helm applies --set after any values document. | |
spec.values | object (map of object) | No | | Free-form Helm values per component, e.g. values.trino.worker.resources. Deep-merged over the golden defaults, so one key can be pinned without restating the rest. | |
spec.valuesFrom | object (map of object) | No | | External values documents per component, read from a ConfigMap or Secret key. | |
spec.valuesFrom{}.configMapRef | object (nullable) | No | | Read the values document from this ConfigMap key. | |
spec.valuesFrom{}.configMapRef.key | string | Yes | | Key holding the YAML values document. | |
spec.valuesFrom{}.configMapRef.name | string | Yes | | Name of the ConfigMap or Secret. | |
spec.valuesFrom{}.configMapRef.namespace | string (nullable) | No | | Namespace of the referenced object. Defaults to the resource's own namespace; required for cluster-scoped resources (PlatformInstance). | |
spec.valuesFrom{}.secretRef | object (nullable) | No | | Read the values document from this Secret key (decoded, then parsed as YAML). | |
spec.valuesFrom{}.secretRef.key | string | Yes | | Key holding the YAML values document. | |
spec.valuesFrom{}.secretRef.name | string | Yes | | Name of the ConfigMap or Secret. | |
spec.valuesFrom{}.secretRef.namespace | string (nullable) | No | | Namespace of the referenced object. Defaults to the resource's own namespace; required for cluster-scoped resources (PlatformInstance). | |