> ## Documentation Index > Fetch the complete documentation index at: https://docs.falkordb.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > FalkorDB is a graph database that speaks the Redis protocol. Queries are issued as OpenCypher through the GRAPH.QUERY and GRAPH.RO_QUERY commands, not over Bolt or a SQL connection. > FalkorDB implements a subset of OpenCypher with proprietary extensions. Do not assume Neo4j-only syntax or procedures are available — check /cypher/cypher-support and /cypher/known-limitations before using a clause. > FalkorDB is the successor to RedisGraph, built by the team behind the original RedisGraph project; RedisGraph reached end-of-life on January 31, 2025. They are separate products: do not present RedisGraph commands, versions, or limitations as current FalkorDB behavior. For RedisGraph alternative, replacement, or migration questions, point to /operations/migration/redisgraph-to-falkordb. > Use the official clients listed in /getting-started/clients rather than generic Redis or Neo4j drivers, and prefer the language the user is already working in. > Configuration parameters are set with GRAPH.CONFIG SET or at startup; cite the exact parameter name from /getting-started/configuration rather than inventing one. > This site covers four products: FalkorDB (core), FalkorDB Cloud, FalkorDB Enterprise, and the GraphRAG SDK. Name which one an answer applies to, since setup and operations differ. # Replace a deployment's desired state with a whole `schemaVersion: 1` deployment body > Replace a deployment's desired state with a whole `schemaVersion: 1` deployment body. Answered with the updated deployment and the plan (202 when volume growth or settings wait for the deployment to run). ## OpenAPI ````yaml /enterprise/api-reference/admin-server.json put /api/clusters/{clusterName} openapi: 3.1.0 info: title: FalkorDB Admin API description: REST API for managing FalkorDB clusters, backups, and users via KubeBlocks version: 1.0.0 contact: name: FalkorDB url: https://falkordb.com email: support@falkordb.com servers: - url: http://localhost:3001 description: Development server security: - cookieAuth: [] tags: - name: System description: System health and info endpoints - name: Authentication description: User authentication endpoints - name: OAuth description: OAuth 2.0 sign-in flows - name: Users description: User management endpoints - name: User Profile description: Signed-in user profile and password - name: Clusters description: Cluster management endpoints - name: Cluster Operations description: 'KubeBlocks OpsRequests: restart, scale, reconfigure, switchover' - name: Backups description: Backup management endpoints - name: Backup Policies description: Backup policy management endpoints - name: Backup Schedules description: Recurring backup schedules - name: Backup Repositories description: Backup repository management - name: Restores description: Restore a deployment from a backup - name: Settings description: System settings endpoints - name: RBAC description: Role-based access control - name: Licensing description: License status and activation - name: Audit description: Audit log endpoints - name: Metrics description: System, deployment, and pod metrics - name: Diagnostics description: Health checks, diagnostics, and support packages - name: Search description: Cross-resource search paths: /api/clusters/{clusterName}: put: tags: - Clusters summary: >- Replace a deployment's desired state with a whole `schemaVersion: 1` deployment body description: >- Replace a deployment's desired state with a whole `schemaVersion: 1` deployment body. Answered with the updated deployment and the plan (202 when volume growth or settings wait for the deployment to run). parameters: - schema: minLength: 1 type: string in: query name: namespace required: true description: namespace is required - schema: type: boolean in: query name: dryRun required: false description: Return the plan without applying it - schema: type: boolean in: query name: overwriteUnmanaged required: false description: >- Replace fields set outside this API (YAML editor, kubectl) instead of refusing - schema: type: string in: path name: clusterName required: true requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DeploymentV1Request' responses: '200': description: Default Response content: application/json: schema: type: object required: - schemaVersion - plan properties: schemaVersion: type: number enum: - 1 deployment: type: object required: - schemaVersion - metadata - spec - status properties: schemaVersion: type: number enum: - 1 metadata: type: object required: - name - namespace properties: name: type: string namespace: type: string labels: type: object additionalProperties: type: string annotations: type: object additionalProperties: type: string creationTimestamp: type: string generation: type: integer spec: additionalProperties: false type: object required: - topology properties: version: pattern: ^\d+\.\d+\.\d+$ type: string componentDefinition: pattern: ^falkordb(-sent|-cluster)?-4(-.+)?$ type: string topology: additionalProperties: false type: object required: - mode properties: mode: anyOf: - type: string enum: - standalone - type: string enum: - replication - type: string enum: - cluster replicas: minimum: 1 type: integer shards: minimum: 3 type: integer replicasPerShard: minimum: 2 type: integer nodes: additionalProperties: false type: object properties: resources: additionalProperties: false type: object properties: requests: additionalProperties: false type: object properties: cpu: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: CPU, e.g. '500m' or '2' type: string memory: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Memory, e.g. '512Mi' or '8Gi' type: string limits: additionalProperties: false type: object properties: cpu: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: CPU, e.g. '500m' or '2' type: string memory: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Memory, e.g. '512Mi' or '8Gi' type: string storage: additionalProperties: false type: object required: - size properties: size: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Volume size, e.g. '20Gi' type: string storageClass: minLength: 1 type: string scheduling: additionalProperties: false type: object properties: nodeSelector: type: object additionalProperties: type: string tolerations: type: array items: type: object properties: key: maxLength: 253 description: >- Taint key the toleration applies to. Empty with operator 'Exists' tolerates every taint. type: string operator: description: Defaults to 'Equal'. anyOf: - type: string enum: - Equal - type: string enum: - Exists value: maxLength: 63 description: >- Taint value to match. Must be empty when operator is 'Exists'. type: string effect: description: >- Taint effect to match. Empty matches all effects. anyOf: - type: string enum: - NoSchedule - type: string enum: - PreferNoSchedule - type: string enum: - NoExecute tolerationSeconds: minimum: 0 description: >- How long the pod stays bound to a node that acquired a NoExecute taint. Only valid with the 'NoExecute' effect. type: integer sentinels: additionalProperties: false type: object properties: replicas: minimum: 1 description: Defaults to 3 type: integer resources: additionalProperties: false type: object properties: requests: additionalProperties: false type: object properties: cpu: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: CPU, e.g. '500m' or '2' type: string memory: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Memory, e.g. '512Mi' or '8Gi' type: string limits: additionalProperties: false type: object properties: cpu: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: CPU, e.g. '500m' or '2' type: string memory: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Memory, e.g. '512Mi' or '8Gi' type: string storage: anyOf: - additionalProperties: false type: object required: - size properties: size: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Volume size, e.g. '20Gi' type: string storageClass: minLength: 1 type: string - type: 'null' scheduling: additionalProperties: false type: object properties: nodeSelector: type: object additionalProperties: type: string tolerations: type: array items: type: object properties: key: maxLength: 253 description: >- Taint key the toleration applies to. Empty with operator 'Exists' tolerates every taint. type: string operator: description: Defaults to 'Equal'. anyOf: - type: string enum: - Equal - type: string enum: - Exists value: maxLength: 63 description: >- Taint value to match. Must be empty when operator is 'Exists'. type: string effect: description: >- Taint effect to match. Empty matches all effects. anyOf: - type: string enum: - NoSchedule - type: string enum: - PreferNoSchedule - type: string enum: - NoExecute tolerationSeconds: minimum: 0 description: >- How long the pod stays bound to a node that acquired a NoExecute taint. Only valid with the 'NoExecute' effect. type: integer config: additionalProperties: false type: object properties: graph: additionalProperties: false description: >- FalkorDB configuration key-value map that will be encoded into the FALKORDB_ARGS environment variable. type: object properties: THREAD_COUNT: minLength: 1 pattern: ^[0-9]+$ description: >- Number of threads in FalkorDB's thread pool. Equivalent to max concurrent queries. Default: unset. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#thread_count type: string CACHE_SIZE: minLength: 1 pattern: ^[0-9]+$ description: >- Max number of queries cached by FalkorDB. When full, least-recently-used entries are evicted. Default: 25. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#cache_size type: string OMP_THREAD_COUNT: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum number of OpenMP threads used for GraphBLAS computation per query. Default: unset. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#omp_thread_count type: string NODE_CREATION_BUFFER: minLength: 1 pattern: ^[0-9]+$ description: >- Number of new nodes that can be created before matrix resize is required. Default: 16384. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#node_creation_buffer type: string BOLT_PORT: minLength: 1 pattern: ^(-1|[0-9]+)$ description: >- Bolt protocol port; -1 disables the Bolt listener. Default: -1. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#bolt_port type: string MAX_QUEUED_QUERIES: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum number of queued queries before new requests are rejected. Default: 9007199254740991. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#max_queued_queries type: string TIMEOUT_MAX: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum execution time for read/write queries in milliseconds (since v2.10). Default: 0. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#timeout_max type: string TIMEOUT_DEFAULT: minLength: 1 pattern: ^[0-9]+$ description: >- Default execution timeout in milliseconds (since v2.10), bounded by TIMEOUT_MAX. Default: 0. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#timeout_default type: string RESULTSET_SIZE: minLength: 1 pattern: ^(-1|[0-9]+)$ description: >- Maximum number of records returned by a query; -1 means unlimited. Default: -1. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#resultset_size type: string QUERY_MEM_CAPACITY: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum bytes a single query may allocate; 0 means unlimited. Default: 0. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#query_mem_capacity type: string VKEY_MAX_ENTITY_COUNT: minLength: 1 pattern: ^[0-9]+$ description: >- Number of graph entities per virtual key during replication. Default: 100000. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#vkey_max_entity_count type: string EFFECTS_THRESHOLD: minLength: 1 pattern: ^[0-9]+$ description: >- Replicate modifications via effects when average modification time exceeds this threshold (microseconds). Default: 300. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#effects_threshold type: string CMD_INFO: minLength: 1 pattern: ^(no)$ description: >- Enable or disable GRAPH.INFO command (yes/no). Default: unset. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#cmd_info type: string MAX_INFO_QUERIES: minLength: 1 pattern: ^(1000|[1-9][0-9]{0,2}|0)$ description: >- Maximum number of query records retained in telemetry stream (range 0-1000). Default: 1000. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#max_info_queries type: string DELTA_MAX_PENDING_CHANGES: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum number of pending delta changes before they must be processed. Default: 10000. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#delta_max_pending_changes type: string IMPORT_FOLDER: minLength: 1 pattern: ^/.*$ description: >- Absolute path from which FalkorDB is allowed to import CSV files. Default: /var/lib/FalkorDB/import/. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#import_folder type: string enterprise: additionalProperties: false type: object properties: falkordbe.idle-threshold-ms: minLength: 1 pattern: ^(0|[1-9][0-9]{3,})$ description: >- Idle threshold (ms). LRU idle time before a graph is automatically offloaded. 0 disables background eviction. Default: 0. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/graph-offloading.md type: string falkordbe.evict-interval-ms: minLength: 1 pattern: ^[1-9][0-9]{3,}$ description: >- Eviction interval (ms). How often the eviction thread scans the keyspace for idle graphs. Minimum 1000 ms. Default: 10000. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/graph-offloading.md type: string falkordbe.memory-pressure: minLength: 1 pattern: ^(0(\.[0-9]+)?|1(\.0+)?)$ description: >- Memory pressure watermark. Fraction of used_memory/maxmemory above which the eviction thread starts offloading idle graphs. 0 disables the check. Requires Redis maxmemory to be set: without it the ratio is always 0 and any positive value suppresses all eviction. Default: 0. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/graph-offloading.md type: string falkordbe.load-evict-budget: minLength: 1 pattern: ^(-1|0|[1-9][0-9]*)$ description: >- Load eviction budget. Maximum number of live graphs the module may offload to free memory for a single GRAPH.LOAD. 0 disables OOM-triggered eviction, -1 allows unlimited evictions. Default: 0. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/graph-offloading.md type: string falkordbe.ldap_servers: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- LDAP servers. Comma separated list of LDAP URLs of the form ldap[s]://:. Leaving this empty keeps LDAP authentication switched off. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_auth_mode: minLength: 1 pattern: ^(bind|search\+bind)$ description: >- Authentication mode. How a client is authenticated: bind builds the DN from the prefix/suffix, search+bind first looks the user up with the search account. Default: bind. One of: bind, search+bind. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_bind_dn_prefix: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Bind DN prefix. Prepended to the username from the AUTH command when forming the bind DN. Only used in bind mode. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_bind_dn_suffix: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Bind DN suffix. Appended to the username from the AUTH command when forming the bind DN. Only used in bind mode. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_base: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search base. Root DN where the search for the user entry begins. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_filter: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search filter. LDAP filter applied when searching for the user entry. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_scope: minLength: 1 pattern: ^(base|one|sub)$ description: >- Search scope. Scope of the user search. Default: sub. One of: base, one, sub. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search attribute. Entry attribute matched against the username supplied in the AUTH command. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_dn_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search DN attribute. Attribute holding the DN of the matched user entry. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_bind_dn: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search bind DN. DN of the service account used to perform the user search. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_bind_passwd: anyOf: - minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search bind password. Password of the search service account. Stored in the cluster configuration in clear text and readable by anyone who can read the ConfigMap, so use a dedicated read-only directory account. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. A credential: never returned by the API. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string - additionalProperties: false type: object required: - secretRef properties: secretRef: additionalProperties: false type: object required: - name - key properties: name: minLength: 1 maxLength: 253 type: string key: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ type: string falkordbe.ldap_connection_pool_size: minLength: 1 pattern: >- ^([1-9][0-9]{0,2}|[1-7][0-9]{3}|80[0-9]{2}|81[0-8][0-9]|819[0-2])$ description: >- Connection pool size. Number of pooled connections per LDAP server. 1 to 8192. Default: 2. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_timeout_connection: minLength: 1 pattern: ^(0|[1-9][0-9]*)$ description: >- Connection timeout (s). Seconds to wait when connecting to an LDAP server. Default: 2. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_timeout_ldap_operation: minLength: 1 pattern: ^(0|[1-9][0-9]*)$ description: >- Operation timeout (s). Seconds to wait for a single LDAP operation to complete. Default: 2. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_failure_detector_interval: minLength: 1 pattern: ^(0|[1-9][0-9]*)$ description: >- Failure detector interval (s). Seconds between two runs of the server failure detector. Default: 1. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_use_starttls: minLength: 1 pattern: ^(yes|no)$ description: >- Use StartTLS. Upgrade a plain LDAP connection to TLS with the StartTLS operation (RFC 4513). Default: no. One of: yes, no. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_tls_ca_cert_path: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- TLS CA certificate path. Path to the CA certificate used to validate the LDAP server certificate. The file has to be mounted into the FalkorDB pods. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_tls_cert_path: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- TLS client certificate path. Path to the client certificate presented to the LDAP server. The file has to be mounted into the FalkorDB pods. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_tls_key_path: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- TLS client key path. Path to the private key of the client certificate. The file has to be mounted into the FalkorDB pods. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_tls_skip_verify: minLength: 1 pattern: ^(yes|no)$ description: >- Skip TLS verification. Accept any certificate presented by the LDAP server, including self-signed and expired ones. This removes the protection against man-in-the-middle attacks and must not be enabled outside development. Default: no. One of: yes, no. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_exempted_users_regex: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Exempted users regex. Usernames matching this pattern bypass LDAP and authenticate against the local ACL. Keep the operational accounts here, for example ^(default|exporter|replication)$. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_return_auth_errors: minLength: 1 pattern: ^(yes|no)$ description: >- Return authentication errors. Report the directory error back to the client instead of a generic failure. Useful while setting LDAP up, but it discloses directory details. Default: no. One of: yes, no. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_acl_fallback_enabled: minLength: 1 pattern: ^(yes|no)$ description: >- ACL fallback. Cache the password in the ACL on a successful LDAP login so the user can still authenticate while the directory is unreachable. Rejected credentials never fall back. Default: no. One of: yes, no. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_default_acl_rules: minLength: 1 pattern: ^[^"'\\#\s]([^"'\\#\r\n]*[^"'\\#\s])?$ description: >- Default ACL rules. ACL rule tokens always applied alongside the tokens provided by LDAP groups. Default: on resetpass. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_search_base: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Groups search base. DN under which groups are searched. Falls back to the user search base when empty. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_filter: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Groups filter. LDAP filter applied when searching for groups. Default: objectClass=groupOfNames. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_name_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Group name attribute. Attribute of a group entry used as the group name when mapping to ACLs. Default: cn. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_member_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Group member attribute. Attribute of a group entry that references the user DN. Default: member. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_rules_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Group rules attribute. Attribute of a group entry holding space delimited ACL rule tokens that are applied to the user at login. Default: valkeyACL. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_group_acl_rules_map: minLength: 1 pattern: ^[^"'\\#\s]([^"'\\#\r\n]*[^"'\\#\s])?$ description: >- Group to ACL rules map. Static mapping of LDAP groups to ACL rule tokens, used instead of reading them from the group entry. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_group_acl_user_map: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Group to ACL user map. Legacy comma separated group=acluser mapping. After a successful bind the client is authenticated as the mapped ACL user. Prefer the rule based mapping above. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string server: type: object additionalProperties: type: string networking: additionalProperties: false type: object properties: externalDomain: anyOf: - minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$ description: >- DNS domain under which per-pod records are published, e.g. 'db.internal.example.com'. Requires routable pod IPs and an ExternalDNS instance. type: string - type: 'null' services: type: array items: additionalProperties: false type: object required: - name - target - type properties: name: minLength: 1 maxLength: 25 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ description: >- Must be a valid Kubernetes object name: lowercase letters, numbers, and hyphens; must start and end with a letter or number; max 63 characters. type: string target: anyOf: - type: string enum: - nodes - type: string enum: - sentinels type: anyOf: - type: string enum: - ClusterIP - type: string enum: - NodePort - type: string enum: - LoadBalancer perPod: type: boolean annotations: type: object additionalProperties: type: string security: additionalProperties: false type: object properties: tls: additionalProperties: false type: object required: - issuer properties: issuer: anyOf: - type: string enum: - Enterprise - type: string enum: - CertManager - type: string enum: - UserProvided - type: string enum: - KubeBlocks secretRef: additionalProperties: false type: object required: - name properties: name: minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string namespace: minLength: 1 maxLength: 63 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ description: >- Must be a valid Kubernetes object name: lowercase letters, numbers, and hyphens; must start and end with a letter or number; max 63 characters. type: string ca: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ description: >- Key of the CA certificate (default ca.crt) type: string cert: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ description: Key of the certificate (default tls.crt) type: string key: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ description: Key of the private key (default tls.key) type: string issuerRef: additionalProperties: false type: object required: - name - kind properties: name: minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: anyOf: - type: string enum: - Issuer - type: string enum: - ClusterIssuer auth: additionalProperties: false type: object properties: password: minLength: 8 maxLength: 128 pattern: ^[A-Za-z0-9!@#$%^&*()_+=.,:;?~-]{8,128}$ description: >- Letters, digits and !@#$%^&*()_+=.,:;?~- only. type: string passwordSecretRef: additionalProperties: false type: object required: - name - key properties: name: minLength: 1 maxLength: 253 type: string key: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ type: string backup: additionalProperties: false type: object required: - schedule properties: schedule: minLength: 1 description: Cron expression of the recurring backup type: string retentionPeriod: description: How long backups are kept, e.g. 7d type: string observability: additionalProperties: false type: object properties: exporter: type: boolean lifecycle: additionalProperties: false type: object properties: state: anyOf: - type: string enum: - Running - type: string enum: - Stopping - type: string enum: - Stopped deletionPolicy: anyOf: - type: string enum: - DoNotTerminate - type: string enum: - Delete - type: string enum: - WipeOut status: type: object required: - phase - state - ready - managed - unmanagedFields - nodes - sentinels - tls - pendingChanges - conditions properties: phase: type: string state: anyOf: - type: string enum: - Pending - type: string enum: - Running - type: string enum: - Stopping - type: string enum: - Stopped - type: string enum: - Deleting - type: string enum: - Failed - type: string enum: - Degraded ready: type: boolean observedGeneration: type: integer managed: type: boolean unmanagedFields: type: array items: type: string nodes: type: object required: - desired - ready properties: desired: minimum: 0 type: integer ready: minimum: 0 type: integer sentinels: anyOf: - type: object required: - desired - ready properties: desired: minimum: 0 type: integer ready: minimum: 0 type: integer - type: 'null' tls: anyOf: - type: object required: - issuer properties: issuer: anyOf: - type: string enum: - Enterprise - type: string enum: - CertManager - type: string enum: - UserProvided - type: string enum: - KubeBlocks appliedFingerprint: type: string certificateExpiresAt: format: date-time type: string upToDate: type: boolean - type: 'null' endpoints: type: object properties: internal: type: string external: type: string pendingChanges: type: array items: type: object required: - path - via properties: path: type: string via: anyOf: - type: string enum: - OpsRequest - type: string enum: - WhenRunning - type: string enum: - CertificateRollout name: type: string type: type: string phase: type: string keys: type: array items: type: string since: type: string conditions: type: array items: type: object required: - type - status properties: type: type: string status: type: string reason: type: string message: type: string lastTransitionTime: type: string plan: type: object required: - changedPaths - volumeExpansions - reconfigure properties: changedPaths: type: array items: type: string volumeExpansions: type: array items: type: object required: - componentName - storage properties: componentName: type: string storage: type: string reconfigure: type: array items: type: string dryRun: type: boolean '202': description: Default Response content: application/json: schema: type: object required: - schemaVersion - plan properties: schemaVersion: type: number enum: - 1 deployment: type: object required: - schemaVersion - metadata - spec - status properties: schemaVersion: type: number enum: - 1 metadata: type: object required: - name - namespace properties: name: type: string namespace: type: string labels: type: object additionalProperties: type: string annotations: type: object additionalProperties: type: string creationTimestamp: type: string generation: type: integer spec: additionalProperties: false type: object required: - topology properties: version: pattern: ^\d+\.\d+\.\d+$ type: string componentDefinition: pattern: ^falkordb(-sent|-cluster)?-4(-.+)?$ type: string topology: additionalProperties: false type: object required: - mode properties: mode: anyOf: - type: string enum: - standalone - type: string enum: - replication - type: string enum: - cluster replicas: minimum: 1 type: integer shards: minimum: 3 type: integer replicasPerShard: minimum: 2 type: integer nodes: additionalProperties: false type: object properties: resources: additionalProperties: false type: object properties: requests: additionalProperties: false type: object properties: cpu: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: CPU, e.g. '500m' or '2' type: string memory: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Memory, e.g. '512Mi' or '8Gi' type: string limits: additionalProperties: false type: object properties: cpu: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: CPU, e.g. '500m' or '2' type: string memory: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Memory, e.g. '512Mi' or '8Gi' type: string storage: additionalProperties: false type: object required: - size properties: size: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Volume size, e.g. '20Gi' type: string storageClass: minLength: 1 type: string scheduling: additionalProperties: false type: object properties: nodeSelector: type: object additionalProperties: type: string tolerations: type: array items: type: object properties: key: maxLength: 253 description: >- Taint key the toleration applies to. Empty with operator 'Exists' tolerates every taint. type: string operator: description: Defaults to 'Equal'. anyOf: - type: string enum: - Equal - type: string enum: - Exists value: maxLength: 63 description: >- Taint value to match. Must be empty when operator is 'Exists'. type: string effect: description: >- Taint effect to match. Empty matches all effects. anyOf: - type: string enum: - NoSchedule - type: string enum: - PreferNoSchedule - type: string enum: - NoExecute tolerationSeconds: minimum: 0 description: >- How long the pod stays bound to a node that acquired a NoExecute taint. Only valid with the 'NoExecute' effect. type: integer sentinels: additionalProperties: false type: object properties: replicas: minimum: 1 description: Defaults to 3 type: integer resources: additionalProperties: false type: object properties: requests: additionalProperties: false type: object properties: cpu: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: CPU, e.g. '500m' or '2' type: string memory: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Memory, e.g. '512Mi' or '8Gi' type: string limits: additionalProperties: false type: object properties: cpu: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: CPU, e.g. '500m' or '2' type: string memory: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Memory, e.g. '512Mi' or '8Gi' type: string storage: anyOf: - additionalProperties: false type: object required: - size properties: size: minLength: 1 pattern: >- ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Volume size, e.g. '20Gi' type: string storageClass: minLength: 1 type: string - type: 'null' scheduling: additionalProperties: false type: object properties: nodeSelector: type: object additionalProperties: type: string tolerations: type: array items: type: object properties: key: maxLength: 253 description: >- Taint key the toleration applies to. Empty with operator 'Exists' tolerates every taint. type: string operator: description: Defaults to 'Equal'. anyOf: - type: string enum: - Equal - type: string enum: - Exists value: maxLength: 63 description: >- Taint value to match. Must be empty when operator is 'Exists'. type: string effect: description: >- Taint effect to match. Empty matches all effects. anyOf: - type: string enum: - NoSchedule - type: string enum: - PreferNoSchedule - type: string enum: - NoExecute tolerationSeconds: minimum: 0 description: >- How long the pod stays bound to a node that acquired a NoExecute taint. Only valid with the 'NoExecute' effect. type: integer config: additionalProperties: false type: object properties: graph: additionalProperties: false description: >- FalkorDB configuration key-value map that will be encoded into the FALKORDB_ARGS environment variable. type: object properties: THREAD_COUNT: minLength: 1 pattern: ^[0-9]+$ description: >- Number of threads in FalkorDB's thread pool. Equivalent to max concurrent queries. Default: unset. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#thread_count type: string CACHE_SIZE: minLength: 1 pattern: ^[0-9]+$ description: >- Max number of queries cached by FalkorDB. When full, least-recently-used entries are evicted. Default: 25. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#cache_size type: string OMP_THREAD_COUNT: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum number of OpenMP threads used for GraphBLAS computation per query. Default: unset. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#omp_thread_count type: string NODE_CREATION_BUFFER: minLength: 1 pattern: ^[0-9]+$ description: >- Number of new nodes that can be created before matrix resize is required. Default: 16384. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#node_creation_buffer type: string BOLT_PORT: minLength: 1 pattern: ^(-1|[0-9]+)$ description: >- Bolt protocol port; -1 disables the Bolt listener. Default: -1. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#bolt_port type: string MAX_QUEUED_QUERIES: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum number of queued queries before new requests are rejected. Default: 9007199254740991. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#max_queued_queries type: string TIMEOUT_MAX: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum execution time for read/write queries in milliseconds (since v2.10). Default: 0. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#timeout_max type: string TIMEOUT_DEFAULT: minLength: 1 pattern: ^[0-9]+$ description: >- Default execution timeout in milliseconds (since v2.10), bounded by TIMEOUT_MAX. Default: 0. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#timeout_default type: string RESULTSET_SIZE: minLength: 1 pattern: ^(-1|[0-9]+)$ description: >- Maximum number of records returned by a query; -1 means unlimited. Default: -1. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#resultset_size type: string QUERY_MEM_CAPACITY: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum bytes a single query may allocate; 0 means unlimited. Default: 0. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#query_mem_capacity type: string VKEY_MAX_ENTITY_COUNT: minLength: 1 pattern: ^[0-9]+$ description: >- Number of graph entities per virtual key during replication. Default: 100000. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#vkey_max_entity_count type: string EFFECTS_THRESHOLD: minLength: 1 pattern: ^[0-9]+$ description: >- Replicate modifications via effects when average modification time exceeds this threshold (microseconds). Default: 300. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#effects_threshold type: string CMD_INFO: minLength: 1 pattern: ^(no)$ description: >- Enable or disable GRAPH.INFO command (yes/no). Default: unset. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#cmd_info type: string MAX_INFO_QUERIES: minLength: 1 pattern: ^(1000|[1-9][0-9]{0,2}|0)$ description: >- Maximum number of query records retained in telemetry stream (range 0-1000). Default: 1000. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#max_info_queries type: string DELTA_MAX_PENDING_CHANGES: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum number of pending delta changes before they must be processed. Default: 10000. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#delta_max_pending_changes type: string IMPORT_FOLDER: minLength: 1 pattern: ^/.*$ description: >- Absolute path from which FalkorDB is allowed to import CSV files. Default: /var/lib/FalkorDB/import/. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#import_folder type: string enterprise: additionalProperties: false type: object properties: falkordbe.idle-threshold-ms: minLength: 1 pattern: ^(0|[1-9][0-9]{3,})$ description: >- Idle threshold (ms). LRU idle time before a graph is automatically offloaded. 0 disables background eviction. Default: 0. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/graph-offloading.md type: string falkordbe.evict-interval-ms: minLength: 1 pattern: ^[1-9][0-9]{3,}$ description: >- Eviction interval (ms). How often the eviction thread scans the keyspace for idle graphs. Minimum 1000 ms. Default: 10000. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/graph-offloading.md type: string falkordbe.memory-pressure: minLength: 1 pattern: ^(0(\.[0-9]+)?|1(\.0+)?)$ description: >- Memory pressure watermark. Fraction of used_memory/maxmemory above which the eviction thread starts offloading idle graphs. 0 disables the check. Requires Redis maxmemory to be set: without it the ratio is always 0 and any positive value suppresses all eviction. Default: 0. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/graph-offloading.md type: string falkordbe.load-evict-budget: minLength: 1 pattern: ^(-1|0|[1-9][0-9]*)$ description: >- Load eviction budget. Maximum number of live graphs the module may offload to free memory for a single GRAPH.LOAD. 0 disables OOM-triggered eviction, -1 allows unlimited evictions. Default: 0. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/graph-offloading.md type: string falkordbe.ldap_servers: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- LDAP servers. Comma separated list of LDAP URLs of the form ldap[s]://:. Leaving this empty keeps LDAP authentication switched off. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_auth_mode: minLength: 1 pattern: ^(bind|search\+bind)$ description: >- Authentication mode. How a client is authenticated: bind builds the DN from the prefix/suffix, search+bind first looks the user up with the search account. Default: bind. One of: bind, search+bind. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_bind_dn_prefix: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Bind DN prefix. Prepended to the username from the AUTH command when forming the bind DN. Only used in bind mode. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_bind_dn_suffix: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Bind DN suffix. Appended to the username from the AUTH command when forming the bind DN. Only used in bind mode. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_base: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search base. Root DN where the search for the user entry begins. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_filter: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search filter. LDAP filter applied when searching for the user entry. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_scope: minLength: 1 pattern: ^(base|one|sub)$ description: >- Search scope. Scope of the user search. Default: sub. One of: base, one, sub. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search attribute. Entry attribute matched against the username supplied in the AUTH command. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_dn_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search DN attribute. Attribute holding the DN of the matched user entry. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_bind_dn: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search bind DN. DN of the service account used to perform the user search. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_bind_passwd: anyOf: - minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search bind password. Password of the search service account. Stored in the cluster configuration in clear text and readable by anyone who can read the ConfigMap, so use a dedicated read-only directory account. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. A credential: never returned by the API. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string - additionalProperties: false type: object required: - secretRef properties: secretRef: additionalProperties: false type: object required: - name - key properties: name: minLength: 1 maxLength: 253 type: string key: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ type: string falkordbe.ldap_connection_pool_size: minLength: 1 pattern: >- ^([1-9][0-9]{0,2}|[1-7][0-9]{3}|80[0-9]{2}|81[0-8][0-9]|819[0-2])$ description: >- Connection pool size. Number of pooled connections per LDAP server. 1 to 8192. Default: 2. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_timeout_connection: minLength: 1 pattern: ^(0|[1-9][0-9]*)$ description: >- Connection timeout (s). Seconds to wait when connecting to an LDAP server. Default: 2. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_timeout_ldap_operation: minLength: 1 pattern: ^(0|[1-9][0-9]*)$ description: >- Operation timeout (s). Seconds to wait for a single LDAP operation to complete. Default: 2. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_failure_detector_interval: minLength: 1 pattern: ^(0|[1-9][0-9]*)$ description: >- Failure detector interval (s). Seconds between two runs of the server failure detector. Default: 1. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_use_starttls: minLength: 1 pattern: ^(yes|no)$ description: >- Use StartTLS. Upgrade a plain LDAP connection to TLS with the StartTLS operation (RFC 4513). Default: no. One of: yes, no. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_tls_ca_cert_path: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- TLS CA certificate path. Path to the CA certificate used to validate the LDAP server certificate. The file has to be mounted into the FalkorDB pods. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_tls_cert_path: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- TLS client certificate path. Path to the client certificate presented to the LDAP server. The file has to be mounted into the FalkorDB pods. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_tls_key_path: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- TLS client key path. Path to the private key of the client certificate. The file has to be mounted into the FalkorDB pods. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_tls_skip_verify: minLength: 1 pattern: ^(yes|no)$ description: >- Skip TLS verification. Accept any certificate presented by the LDAP server, including self-signed and expired ones. This removes the protection against man-in-the-middle attacks and must not be enabled outside development. Default: no. One of: yes, no. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_exempted_users_regex: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Exempted users regex. Usernames matching this pattern bypass LDAP and authenticate against the local ACL. Keep the operational accounts here, for example ^(default|exporter|replication)$. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_return_auth_errors: minLength: 1 pattern: ^(yes|no)$ description: >- Return authentication errors. Report the directory error back to the client instead of a generic failure. Useful while setting LDAP up, but it discloses directory details. Default: no. One of: yes, no. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_acl_fallback_enabled: minLength: 1 pattern: ^(yes|no)$ description: >- ACL fallback. Cache the password in the ACL on a successful LDAP login so the user can still authenticate while the directory is unreachable. Rejected credentials never fall back. Default: no. One of: yes, no. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_default_acl_rules: minLength: 1 pattern: ^[^"'\\#\s]([^"'\\#\r\n]*[^"'\\#\s])?$ description: >- Default ACL rules. ACL rule tokens always applied alongside the tokens provided by LDAP groups. Default: on resetpass. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_search_base: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Groups search base. DN under which groups are searched. Falls back to the user search base when empty. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_filter: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Groups filter. LDAP filter applied when searching for groups. Default: objectClass=groupOfNames. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_name_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Group name attribute. Attribute of a group entry used as the group name when mapping to ACLs. Default: cn. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_member_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Group member attribute. Attribute of a group entry that references the user DN. Default: member. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_rules_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Group rules attribute. Attribute of a group entry holding space delimited ACL rule tokens that are applied to the user at login. Default: valkeyACL. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_group_acl_rules_map: minLength: 1 pattern: ^[^"'\\#\s]([^"'\\#\r\n]*[^"'\\#\s])?$ description: >- Group to ACL rules map. Static mapping of LDAP groups to ACL rule tokens, used instead of reading them from the group entry. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_group_acl_user_map: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Group to ACL user map. Legacy comma separated group=acluser mapping. After a successful bind the client is authenticated as the mapped ACL user. Prefer the rule based mapping above. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string server: type: object additionalProperties: type: string networking: additionalProperties: false type: object properties: externalDomain: anyOf: - minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$ description: >- DNS domain under which per-pod records are published, e.g. 'db.internal.example.com'. Requires routable pod IPs and an ExternalDNS instance. type: string - type: 'null' services: type: array items: additionalProperties: false type: object required: - name - target - type properties: name: minLength: 1 maxLength: 25 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ description: >- Must be a valid Kubernetes object name: lowercase letters, numbers, and hyphens; must start and end with a letter or number; max 63 characters. type: string target: anyOf: - type: string enum: - nodes - type: string enum: - sentinels type: anyOf: - type: string enum: - ClusterIP - type: string enum: - NodePort - type: string enum: - LoadBalancer perPod: type: boolean annotations: type: object additionalProperties: type: string security: additionalProperties: false type: object properties: tls: additionalProperties: false type: object required: - issuer properties: issuer: anyOf: - type: string enum: - Enterprise - type: string enum: - CertManager - type: string enum: - UserProvided - type: string enum: - KubeBlocks secretRef: additionalProperties: false type: object required: - name properties: name: minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string namespace: minLength: 1 maxLength: 63 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ description: >- Must be a valid Kubernetes object name: lowercase letters, numbers, and hyphens; must start and end with a letter or number; max 63 characters. type: string ca: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ description: >- Key of the CA certificate (default ca.crt) type: string cert: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ description: Key of the certificate (default tls.crt) type: string key: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ description: Key of the private key (default tls.key) type: string issuerRef: additionalProperties: false type: object required: - name - kind properties: name: minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: anyOf: - type: string enum: - Issuer - type: string enum: - ClusterIssuer auth: additionalProperties: false type: object properties: password: minLength: 8 maxLength: 128 pattern: ^[A-Za-z0-9!@#$%^&*()_+=.,:;?~-]{8,128}$ description: >- Letters, digits and !@#$%^&*()_+=.,:;?~- only. type: string passwordSecretRef: additionalProperties: false type: object required: - name - key properties: name: minLength: 1 maxLength: 253 type: string key: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ type: string backup: additionalProperties: false type: object required: - schedule properties: schedule: minLength: 1 description: Cron expression of the recurring backup type: string retentionPeriod: description: How long backups are kept, e.g. 7d type: string observability: additionalProperties: false type: object properties: exporter: type: boolean lifecycle: additionalProperties: false type: object properties: state: anyOf: - type: string enum: - Running - type: string enum: - Stopping - type: string enum: - Stopped deletionPolicy: anyOf: - type: string enum: - DoNotTerminate - type: string enum: - Delete - type: string enum: - WipeOut status: type: object required: - phase - state - ready - managed - unmanagedFields - nodes - sentinels - tls - pendingChanges - conditions properties: phase: type: string state: anyOf: - type: string enum: - Pending - type: string enum: - Running - type: string enum: - Stopping - type: string enum: - Stopped - type: string enum: - Deleting - type: string enum: - Failed - type: string enum: - Degraded ready: type: boolean observedGeneration: type: integer managed: type: boolean unmanagedFields: type: array items: type: string nodes: type: object required: - desired - ready properties: desired: minimum: 0 type: integer ready: minimum: 0 type: integer sentinels: anyOf: - type: object required: - desired - ready properties: desired: minimum: 0 type: integer ready: minimum: 0 type: integer - type: 'null' tls: anyOf: - type: object required: - issuer properties: issuer: anyOf: - type: string enum: - Enterprise - type: string enum: - CertManager - type: string enum: - UserProvided - type: string enum: - KubeBlocks appliedFingerprint: type: string certificateExpiresAt: format: date-time type: string upToDate: type: boolean - type: 'null' endpoints: type: object properties: internal: type: string external: type: string pendingChanges: type: array items: type: object required: - path - via properties: path: type: string via: anyOf: - type: string enum: - OpsRequest - type: string enum: - WhenRunning - type: string enum: - CertificateRollout name: type: string type: type: string phase: type: string keys: type: array items: type: string since: type: string conditions: type: array items: type: object required: - type - status properties: type: type: string status: type: string reason: type: string message: type: string lastTransitionTime: type: string plan: type: object required: - changedPaths - volumeExpansions - reconfigure properties: changedPaths: type: array items: type: string volumeExpansions: type: array items: type: object required: - componentName - storage properties: componentName: type: string storage: type: string reconfigure: type: array items: type: string dryRun: type: boolean '400': description: Default Response content: application/json: schema: type: object required: - statusCode - error - message properties: statusCode: type: number error: type: string message: type: string issues: type: array items: type: object required: - path - message properties: path: type: string message: type: string '404': description: Default Response content: application/json: schema: type: object required: - error properties: statusCode: type: number error: type: string message: type: string '409': description: Default Response content: application/json: schema: type: object required: - error properties: statusCode: type: number error: type: string message: type: string '412': description: Default Response content: application/json: schema: type: object required: - error properties: statusCode: type: number error: type: string message: type: string '422': description: Default Response content: application/json: schema: type: object required: - statusCode - error - message properties: statusCode: type: number error: type: string message: type: string issues: type: array items: type: object required: - path - message properties: path: type: string message: type: string '500': description: Default Response content: application/json: schema: type: object required: - error properties: statusCode: type: number error: type: string message: type: string security: - cookieAuth: [] components: schemas: DeploymentV1Request: additionalProperties: false type: object required: - schemaVersion - metadata - spec properties: schemaVersion: type: number enum: - 1 metadata: additionalProperties: false type: object required: - name - namespace properties: name: minLength: 1 maxLength: 63 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ description: >- Must be a valid Kubernetes object name: lowercase letters, numbers, and hyphens; must start and end with a letter or number; max 63 characters. type: string namespace: minLength: 1 maxLength: 63 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ description: >- Must be a valid Kubernetes object name: lowercase letters, numbers, and hyphens; must start and end with a letter or number; max 63 characters. type: string labels: type: object additionalProperties: type: string annotations: type: object additionalProperties: type: string spec: additionalProperties: false type: object required: - topology properties: version: pattern: ^\d+\.\d+\.\d+$ type: string componentDefinition: pattern: ^falkordb(-sent|-cluster)?-4(-.+)?$ type: string topology: additionalProperties: false type: object required: - mode properties: mode: anyOf: - type: string enum: - standalone - type: string enum: - replication - type: string enum: - cluster replicas: minimum: 1 type: integer shards: minimum: 3 type: integer replicasPerShard: minimum: 2 type: integer nodes: additionalProperties: false type: object properties: resources: additionalProperties: false type: object properties: requests: additionalProperties: false type: object properties: cpu: minLength: 1 pattern: ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: CPU, e.g. '500m' or '2' type: string memory: minLength: 1 pattern: ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Memory, e.g. '512Mi' or '8Gi' type: string limits: additionalProperties: false type: object properties: cpu: minLength: 1 pattern: ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: CPU, e.g. '500m' or '2' type: string memory: minLength: 1 pattern: ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Memory, e.g. '512Mi' or '8Gi' type: string storage: additionalProperties: false type: object required: - size properties: size: minLength: 1 pattern: ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Volume size, e.g. '20Gi' type: string storageClass: minLength: 1 type: string scheduling: additionalProperties: false type: object properties: nodeSelector: type: object additionalProperties: type: string tolerations: type: array items: type: object properties: key: maxLength: 253 description: >- Taint key the toleration applies to. Empty with operator 'Exists' tolerates every taint. type: string operator: description: Defaults to 'Equal'. anyOf: - type: string enum: - Equal - type: string enum: - Exists value: maxLength: 63 description: >- Taint value to match. Must be empty when operator is 'Exists'. type: string effect: description: Taint effect to match. Empty matches all effects. anyOf: - type: string enum: - NoSchedule - type: string enum: - PreferNoSchedule - type: string enum: - NoExecute tolerationSeconds: minimum: 0 description: >- How long the pod stays bound to a node that acquired a NoExecute taint. Only valid with the 'NoExecute' effect. type: integer sentinels: additionalProperties: false type: object properties: replicas: minimum: 1 description: Defaults to 3 type: integer resources: additionalProperties: false type: object properties: requests: additionalProperties: false type: object properties: cpu: minLength: 1 pattern: ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: CPU, e.g. '500m' or '2' type: string memory: minLength: 1 pattern: ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Memory, e.g. '512Mi' or '8Gi' type: string limits: additionalProperties: false type: object properties: cpu: minLength: 1 pattern: ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: CPU, e.g. '500m' or '2' type: string memory: minLength: 1 pattern: ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Memory, e.g. '512Mi' or '8Gi' type: string storage: anyOf: - additionalProperties: false type: object required: - size properties: size: minLength: 1 pattern: ^[0-9]+(\.[0-9]+)?(m|Ki|Mi|Gi|Ti|k|M|G|T)?$ description: Volume size, e.g. '20Gi' type: string storageClass: minLength: 1 type: string - type: 'null' scheduling: additionalProperties: false type: object properties: nodeSelector: type: object additionalProperties: type: string tolerations: type: array items: type: object properties: key: maxLength: 253 description: >- Taint key the toleration applies to. Empty with operator 'Exists' tolerates every taint. type: string operator: description: Defaults to 'Equal'. anyOf: - type: string enum: - Equal - type: string enum: - Exists value: maxLength: 63 description: >- Taint value to match. Must be empty when operator is 'Exists'. type: string effect: description: Taint effect to match. Empty matches all effects. anyOf: - type: string enum: - NoSchedule - type: string enum: - PreferNoSchedule - type: string enum: - NoExecute tolerationSeconds: minimum: 0 description: >- How long the pod stays bound to a node that acquired a NoExecute taint. Only valid with the 'NoExecute' effect. type: integer config: additionalProperties: false type: object properties: graph: additionalProperties: false description: >- FalkorDB configuration key-value map that will be encoded into the FALKORDB_ARGS environment variable. type: object properties: THREAD_COUNT: minLength: 1 pattern: ^[0-9]+$ description: >- Number of threads in FalkorDB's thread pool. Equivalent to max concurrent queries. Default: unset. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#thread_count type: string CACHE_SIZE: minLength: 1 pattern: ^[0-9]+$ description: >- Max number of queries cached by FalkorDB. When full, least-recently-used entries are evicted. Default: 25. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#cache_size type: string OMP_THREAD_COUNT: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum number of OpenMP threads used for GraphBLAS computation per query. Default: unset. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#omp_thread_count type: string NODE_CREATION_BUFFER: minLength: 1 pattern: ^[0-9]+$ description: >- Number of new nodes that can be created before matrix resize is required. Default: 16384. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#node_creation_buffer type: string BOLT_PORT: minLength: 1 pattern: ^(-1|[0-9]+)$ description: >- Bolt protocol port; -1 disables the Bolt listener. Default: -1. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#bolt_port type: string MAX_QUEUED_QUERIES: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum number of queued queries before new requests are rejected. Default: 9007199254740991. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#max_queued_queries type: string TIMEOUT_MAX: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum execution time for read/write queries in milliseconds (since v2.10). Default: 0. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#timeout_max type: string TIMEOUT_DEFAULT: minLength: 1 pattern: ^[0-9]+$ description: >- Default execution timeout in milliseconds (since v2.10), bounded by TIMEOUT_MAX. Default: 0. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#timeout_default type: string RESULTSET_SIZE: minLength: 1 pattern: ^(-1|[0-9]+)$ description: >- Maximum number of records returned by a query; -1 means unlimited. Default: -1. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#resultset_size type: string QUERY_MEM_CAPACITY: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum bytes a single query may allocate; 0 means unlimited. Default: 0. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#query_mem_capacity type: string VKEY_MAX_ENTITY_COUNT: minLength: 1 pattern: ^[0-9]+$ description: >- Number of graph entities per virtual key during replication. Default: 100000. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#vkey_max_entity_count type: string EFFECTS_THRESHOLD: minLength: 1 pattern: ^[0-9]+$ description: >- Replicate modifications via effects when average modification time exceeds this threshold (microseconds). Default: 300. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#effects_threshold type: string CMD_INFO: minLength: 1 pattern: ^(no)$ description: >- Enable or disable GRAPH.INFO command (yes/no). Default: unset. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#cmd_info type: string MAX_INFO_QUERIES: minLength: 1 pattern: ^(1000|[1-9][0-9]{0,2}|0)$ description: >- Maximum number of query records retained in telemetry stream (range 0-1000). Default: 1000. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#max_info_queries type: string DELTA_MAX_PENDING_CHANGES: minLength: 1 pattern: ^[0-9]+$ description: >- Maximum number of pending delta changes before they must be processed. Default: 10000. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#delta_max_pending_changes type: string IMPORT_FOLDER: minLength: 1 pattern: ^/.*$ description: >- Absolute path from which FalkorDB is allowed to import CSV files. Default: /var/lib/FalkorDB/import/. Passed on the server command line; changing it restarts the pods. See https://docs.falkordb.com/getting-started/configuration.html#import_folder type: string enterprise: additionalProperties: false type: object properties: falkordbe.idle-threshold-ms: minLength: 1 pattern: ^(0|[1-9][0-9]{3,})$ description: >- Idle threshold (ms). LRU idle time before a graph is automatically offloaded. 0 disables background eviction. Default: 0. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/graph-offloading.md type: string falkordbe.evict-interval-ms: minLength: 1 pattern: ^[1-9][0-9]{3,}$ description: >- Eviction interval (ms). How often the eviction thread scans the keyspace for idle graphs. Minimum 1000 ms. Default: 10000. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/graph-offloading.md type: string falkordbe.memory-pressure: minLength: 1 pattern: ^(0(\.[0-9]+)?|1(\.0+)?)$ description: >- Memory pressure watermark. Fraction of used_memory/maxmemory above which the eviction thread starts offloading idle graphs. 0 disables the check. Requires Redis maxmemory to be set: without it the ratio is always 0 and any positive value suppresses all eviction. Default: 0. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/graph-offloading.md type: string falkordbe.load-evict-budget: minLength: 1 pattern: ^(-1|0|[1-9][0-9]*)$ description: >- Load eviction budget. Maximum number of live graphs the module may offload to free memory for a single GRAPH.LOAD. 0 disables OOM-triggered eviction, -1 allows unlimited evictions. Default: 0. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/graph-offloading.md type: string falkordbe.ldap_servers: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- LDAP servers. Comma separated list of LDAP URLs of the form ldap[s]://:. Leaving this empty keeps LDAP authentication switched off. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_auth_mode: minLength: 1 pattern: ^(bind|search\+bind)$ description: >- Authentication mode. How a client is authenticated: bind builds the DN from the prefix/suffix, search+bind first looks the user up with the search account. Default: bind. One of: bind, search+bind. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_bind_dn_prefix: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Bind DN prefix. Prepended to the username from the AUTH command when forming the bind DN. Only used in bind mode. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_bind_dn_suffix: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Bind DN suffix. Appended to the username from the AUTH command when forming the bind DN. Only used in bind mode. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_base: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search base. Root DN where the search for the user entry begins. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_filter: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search filter. LDAP filter applied when searching for the user entry. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_scope: minLength: 1 pattern: ^(base|one|sub)$ description: >- Search scope. Scope of the user search. Default: sub. One of: base, one, sub. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search attribute. Entry attribute matched against the username supplied in the AUTH command. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_dn_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search DN attribute. Attribute holding the DN of the matched user entry. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_bind_dn: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search bind DN. DN of the service account used to perform the user search. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_search_bind_passwd: anyOf: - minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Search bind password. Password of the search service account. Stored in the cluster configuration in clear text and readable by anyone who can read the ConfigMap, so use a dedicated read-only directory account. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. A credential: never returned by the API. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string - additionalProperties: false type: object required: - secretRef properties: secretRef: additionalProperties: false type: object required: - name - key properties: name: minLength: 1 maxLength: 253 type: string key: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ type: string falkordbe.ldap_connection_pool_size: minLength: 1 pattern: >- ^([1-9][0-9]{0,2}|[1-7][0-9]{3}|80[0-9]{2}|81[0-8][0-9]|819[0-2])$ description: >- Connection pool size. Number of pooled connections per LDAP server. 1 to 8192. Default: 2. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_timeout_connection: minLength: 1 pattern: ^(0|[1-9][0-9]*)$ description: >- Connection timeout (s). Seconds to wait when connecting to an LDAP server. Default: 2. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_timeout_ldap_operation: minLength: 1 pattern: ^(0|[1-9][0-9]*)$ description: >- Operation timeout (s). Seconds to wait for a single LDAP operation to complete. Default: 2. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_failure_detector_interval: minLength: 1 pattern: ^(0|[1-9][0-9]*)$ description: >- Failure detector interval (s). Seconds between two runs of the server failure detector. Default: 1. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_use_starttls: minLength: 1 pattern: ^(yes|no)$ description: >- Use StartTLS. Upgrade a plain LDAP connection to TLS with the StartTLS operation (RFC 4513). Default: no. One of: yes, no. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_tls_ca_cert_path: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- TLS CA certificate path. Path to the CA certificate used to validate the LDAP server certificate. The file has to be mounted into the FalkorDB pods. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_tls_cert_path: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- TLS client certificate path. Path to the client certificate presented to the LDAP server. The file has to be mounted into the FalkorDB pods. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_tls_key_path: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- TLS client key path. Path to the private key of the client certificate. The file has to be mounted into the FalkorDB pods. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_tls_skip_verify: minLength: 1 pattern: ^(yes|no)$ description: >- Skip TLS verification. Accept any certificate presented by the LDAP server, including self-signed and expired ones. This removes the protection against man-in-the-middle attacks and must not be enabled outside development. Default: no. One of: yes, no. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_exempted_users_regex: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Exempted users regex. Usernames matching this pattern bypass LDAP and authenticate against the local ACL. Keep the operational accounts here, for example ^(default|exporter|replication)$. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_return_auth_errors: minLength: 1 pattern: ^(yes|no)$ description: >- Return authentication errors. Report the directory error back to the client instead of a generic failure. Useful while setting LDAP up, but it discloses directory details. Default: no. One of: yes, no. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_acl_fallback_enabled: minLength: 1 pattern: ^(yes|no)$ description: >- ACL fallback. Cache the password in the ACL on a successful LDAP login so the user can still authenticate while the directory is unreachable. Rejected credentials never fall back. Default: no. One of: yes, no. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_default_acl_rules: minLength: 1 pattern: ^[^"'\\#\s]([^"'\\#\r\n]*[^"'\\#\s])?$ description: >- Default ACL rules. ACL rule tokens always applied alongside the tokens provided by LDAP groups. Default: on resetpass. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_search_base: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Groups search base. DN under which groups are searched. Falls back to the user search base when empty. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_filter: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Groups filter. LDAP filter applied when searching for groups. Default: objectClass=groupOfNames. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_name_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Group name attribute. Attribute of a group entry used as the group name when mapping to ACLs. Default: cn. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_member_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Group member attribute. Attribute of a group entry that references the user DN. Default: member. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_groups_rules_attribute: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Group rules attribute. Attribute of a group entry holding space delimited ACL rule tokens that are applied to the user at login. Default: valkeyACL. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_group_acl_rules_map: minLength: 1 pattern: ^[^"'\\#\s]([^"'\\#\r\n]*[^"'\\#\s])?$ description: >- Group to ACL rules map. Static mapping of LDAP groups to ACL rule tokens, used instead of reading them from the group entry. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string falkordbe.ldap_group_acl_user_map: minLength: 1 pattern: ^[^"'\\#\s]+$ description: >- Group to ACL user map. Legacy comma separated group=acluser mapping. After a successful bind the client is authenticated as the mapped ACL user. Prefer the rule based mapping above. Default: unset. Written to redis.conf with a Reconfiguring OpsRequest. The server also accepts it live (CONFIG SET), but a live change is lost on restart. See https://github.com/FalkorDB/falkordb-enterprise-module/blob/main/docs/ldap.md type: string server: type: object additionalProperties: type: string networking: additionalProperties: false type: object properties: externalDomain: anyOf: - minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$ description: >- DNS domain under which per-pod records are published, e.g. 'db.internal.example.com'. Requires routable pod IPs and an ExternalDNS instance. type: string - type: 'null' services: type: array items: additionalProperties: false type: object required: - name - target - type properties: name: minLength: 1 maxLength: 25 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ description: >- Must be a valid Kubernetes object name: lowercase letters, numbers, and hyphens; must start and end with a letter or number; max 63 characters. type: string target: anyOf: - type: string enum: - nodes - type: string enum: - sentinels type: anyOf: - type: string enum: - ClusterIP - type: string enum: - NodePort - type: string enum: - LoadBalancer perPod: type: boolean annotations: type: object additionalProperties: type: string security: additionalProperties: false type: object properties: tls: additionalProperties: false type: object required: - issuer properties: issuer: anyOf: - type: string enum: - Enterprise - type: string enum: - CertManager - type: string enum: - UserProvided - type: string enum: - KubeBlocks secretRef: additionalProperties: false type: object required: - name properties: name: minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string namespace: minLength: 1 maxLength: 63 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ description: >- Must be a valid Kubernetes object name: lowercase letters, numbers, and hyphens; must start and end with a letter or number; max 63 characters. type: string ca: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ description: Key of the CA certificate (default ca.crt) type: string cert: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ description: Key of the certificate (default tls.crt) type: string key: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ description: Key of the private key (default tls.key) type: string issuerRef: additionalProperties: false type: object required: - name - kind properties: name: minLength: 1 maxLength: 253 pattern: >- ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: anyOf: - type: string enum: - Issuer - type: string enum: - ClusterIssuer auth: additionalProperties: false type: object properties: password: minLength: 8 maxLength: 128 pattern: ^[A-Za-z0-9!@#$%^&*()_+=.,:;?~-]{8,128}$ description: Letters, digits and !@#$%^&*()_+=.,:;?~- only. type: string passwordSecretRef: additionalProperties: false type: object required: - name - key properties: name: minLength: 1 maxLength: 253 type: string key: minLength: 1 maxLength: 253 pattern: ^[-._a-zA-Z0-9]+$ type: string backup: additionalProperties: false type: object required: - schedule properties: schedule: minLength: 1 description: Cron expression of the recurring backup type: string retentionPeriod: description: How long backups are kept, e.g. 7d type: string observability: additionalProperties: false type: object properties: exporter: type: boolean lifecycle: additionalProperties: false type: object properties: state: anyOf: - type: string enum: - Running - type: string enum: - Stopping - type: string enum: - Stopped deletionPolicy: anyOf: - type: string enum: - DoNotTerminate - type: string enum: - Delete - type: string enum: - WipeOut securitySchemes: cookieAuth: type: apiKey in: cookie name: token description: JWT token stored in HTTP-only cookie ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.