spec.catalog | string | Yes | | The catalog (Lakehouse) this volume belongs to; the owner group is inherited. | min 1, max 40; pattern ^[a-z]([-a-z0-9]*[a-z0-9])?$ |
spec.grants | array of object | No | [] | | max 20 |
spec.grants[].group | string | Yes | | The Keycloak group whose members hold these verbs. | min 1, max 64; pattern ^[A-Za-z0-9][A-Za-z0-9._-]*$ |
spec.grants[].verbs | array of string | Yes | | At least one verb; each verb at most once. | min 1, max 3 |
spec.purpose | string | No | data | What a volume holds. A libraries volume is code that every reader executes, so it restricts write to groups that also manage it. | data, libraries |
spec.storage | object | Yes | | Where a volume's files live: exactly one of platform-managed storage or an external prefix. Files live in the volume bucket, never in the table bucket. | |
spec.storage.external | object (nullable) | No | | A prefix in the customer's own bucket, reached through an s3 connection. | |
spec.storage.external.connection | string | Yes | | Name of the s3 connection that holds the endpoint, bucket and credentials. | min 1, max 40; pattern ^[a-z]([-a-z0-9]*[a-z0-9])?$ |
spec.storage.external.prefix | string (nullable) | No | | Key prefix inside the bucket; absent means the prefix the connection already scopes. | max 512; pattern ^[A-Za-z0-9][A-Za-z0-9_./-]*$ |
spec.storage.managed | object (nullable) | No | | Storage the platform owns: the volume gets volumes/<catalog>/<name>/ in the platform object store. managed: {} selects it. | |