ServicePrincipal

A non-human identity (client credentials) for pipelines, maintenance and collectors.

Spec

Field	Type	Required	Default	Description	Constraints
`spec.audiences`	array of string	No	`["trino","lakekeeper"]`	What the principal's tokens are valid for; at least one, both engines by default (`trino` for SQL, `lakekeeper` for `stardelt.spark()` in a notebook).	min 1, max 2
`spec.existingSecretRef`	object (nullable)	No		Only with an external identity provider: the Secret that holds the app registration's credentials.
`spec.existingSecretRef.name`	string	Yes			min 1, max 253; pattern `^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$`
`spec.ownerGroup`	string	Yes		The group whose members may use the principal. Members never read its credentials.	min 1, max 64; pattern `^[A-Za-z0-9][A-Za-z0-9._-]*$`
`spec.purpose`	string	No	`pipeline`	What a service principal is for. It decides nothing by itself (grants do); it makes the intent visible in `kubectl get` and in Nova.	`pipeline`, `maintenance`, `collector`

Field	Type	Required	Default	Description	Constraints
`status.clientId`	string (nullable)	No
`status.conditions`	array of object	No	`[]`
`status.conditions[].lastTransitionTime`	string (nullable)	No
`status.conditions[].message`	string (nullable)	No
`status.conditions[].observedGeneration`	integer (nullable)	No			format `int64`
`status.conditions[].reason`	string (nullable)	No
`status.conditions[].status`	string	Yes
`status.conditions[].type`	string	Yes
`status.observedGeneration`	integer (nullable)	No			format `int64`
`status.ready`	boolean	No	`false`	True when the client exists (or the referenced Secret is valid) and the Secret is written.
`status.secretName`	string (nullable)	No