diff --git a/pages/api-reference/kubernetes/agent-api-reference.md b/pages/api-reference/kubernetes/agent-api-reference.md index a3dc9a30..c38721f9 100644 --- a/pages/api-reference/kubernetes/agent-api-reference.md +++ b/pages/api-reference/kubernetes/agent-api-reference.md @@ -14,6 +14,7 @@ Package v1alpha1 contains API Schema definitions for the deployments v1alpha1 AP - [AgentRuntime](#agentruntime) - [ClusterDrain](#clusterdrain) - [CustomHealth](#customhealth) +- [ImageWarmer](#imagewarmer) - [IngressReplica](#ingressreplica) - [KubecostExtractor](#kubecostextractor) - [MetricsAggregate](#metricsaggregate) @@ -170,8 +171,10 @@ _Appears in:_ | `prompt` _string_ | Prompt is the task/prompt given to the agent | | Required: \{\}
| | `repository` _string_ | Repository is the git repository the agent will work with | | Required: \{\}
| | `branch` _string_ | Branch is the repository branch the agent should operate on. If omitted, the repository default branch is used. | | Optional: \{\}
| -| `mode` _[AgentRunMode](#agentrunmode)_ | Mode defines how the agent should run (ANALYZE, WRITE) | | Required: \{\}
| +| `mode` _[AgentRunMode](#agentrunmode)_ | Mode defines how the agent should run (ANALYZE, WRITE, REVIEW) | | Required: \{\}
| +| `reviewDepth` _[AgentReviewDepth](#agentreviewdepth)_ | ReviewDepth controls how far a review run explores code adjacent to the pull request changes. | | Optional: \{\}
| | `flowId` _string_ | FlowID is the flow this agent run is associated with (optional) | | Optional: \{\}
| +| `workbenchMcpUrl` _string_ | WorkbenchMCPURL is the Console MCP endpoint for the workbench that
originated this run. It is populated by the AgentRuntime controller. | | Optional: \{\}
| | `language` _[AgentRunLanguage](#agentrunlanguage)_ | Language is the programming language used in the agent run.
Deprecated: No longer used for image selection. Enable dind on the AgentRuntime instead. | | Optional: \{\}
| | `languageVersion` _string_ | LanguageVersion is the version of the language to use, if you wish to specify.
Deprecated: No longer used for image selection. Enable dind on the AgentRuntime instead. | | Optional: \{\}
| @@ -274,15 +277,22 @@ _Appears in:_ | `streamingProxy` _boolean_ | StreamingProxy routes OpenAI-compatible LLM requests through the in-pod mcpserver
sse conversion proxy before they reach the Console AI proxy (/ext/ai). Only valid when aiProxy
is enabled. Applies to CODEX and OPENCODE runtimes. | | Optional: \{\}
| | `dind` _boolean_ | Dind enables Docker-in-Docker for this agent runtime.
When true, the runtime will be configured to run with DinD support. | | Optional: \{\}
| | `memory` _boolean_ | Memory enables team-shared codebase-memory persistence for this agent runtime.
When true, agents may create and commit .codebase-memory/ graph artifacts
by default so future runs can bootstrap from the persisted index. When false
or unset, codebase-memory indexes stay in the pod-local cache and generated
.codebase-memory/ artifacts are excluded from commits. | | Optional: \{\}
| +| `repositoryImage` _string_ | RepositoryImage is an OCI image of precloned git repositories plus manifest.json.
When set, an init container copies it into /plural/shared/repos before bootstrap
so a matching repo can be copied locally instead of git clone. | | Optional: \{\}
| +| `prewarm` _[RepositoryImagePrewarm](#repositoryimageprewarm)_ | Prewarm periodically pulls RepositoryImage onto selected nodes before
agent runs are scheduled. | | Optional: \{\}
| | `allowedRepositories` _string array_ | AllowedRepositories the git repositories allowed to be used with this runtime. | | Optional: \{\}
| | `browser` _[BrowserConfig](#browserconfig)_ | Browser configuration augments agent runtime with a headless browser.
When provided, the runtime will be configured to run with a headless browser available
for the agent to use. | | Optional: \{\}
| | `bootstrapScript` _string_ | BootstrapScript is a bash script that will be executed inside the cloned repository
directory before the coding agent starts. It can be used to install dependencies,
configure tooling, or perform any other setup required by the agent. | | Optional: \{\}
| +| `readOnlyRootFilesystem` _boolean_ | ReadOnlyRootFilesystem controls the default container securityContext.
When unset, the root filesystem stays writable (the current default).
Set true when extending a finished image that already contains compilers.
Set false (or leave unset) together with mise.config to run
`mise bootstrap --yes` at boot: https://mise.jdx.dev/bootstrap.html | | Optional: \{\}
| +| `mise` _[MiseSpec](#misespec)_ | Mise supplies a mise.toml applied before the coding agent starts.
When the default container root is writable, the harness runs
`mise trust` and `mise bootstrap --yes`. When readOnlyRootFilesystem is true,
the config is still mounted so mise exec can use [tools] and [env],
but bootstrap is skipped. | | Optional: \{\}
| | `git` _[GitSpec](#gitspec)_ | Git configure commit signing on agent run. When provided, the runtime will be configured to sign git commits using the provided key reference. | | | | `babysitInterval` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ | BabysitInterval configures the interval for the operator to check on the health of the agent runtime and perform necessary babysitting actions (e.g. restarting unhealthy runtimes). When not provided, a default interval of 1 minute will be used. | | | | `agentTTL` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ | AgentTTL configures the maximum lifetime for agent run pods on this runtime. When not provided, a default TTL of 12 hours will be used. | | Optional: \{\}
| | `scmConnection` _string_ | ScmConnection is the name of an ScmConnection in Console to use for git operations on agent runs using this runtime.
This should match the name of an existing ScmConnection resource or connection created in the Plural UI. | | Optional: \{\}
| | `exaConnection` _[ExaConnection](#exaconnection)_ | ExaConnection enables Exa web search and content retrieval tools on the Plural MCP server. | | | | `mcpServers` _[MCPServer](#mcpserver) array_ | MCPServers are additional remote MCP servers made available to coding agents
on this runtime. Servers are expected to already be deployed and reachable
at the given URL. Built-in servers named "plural" and "codebase-memory-mcp"
are reserved and cannot be overridden. | | Optional: \{\}
| +| `workbenchMcp` _[WorkbenchMCPConfig](#workbenchmcpconfig)_ | WorkbenchMCP exposes the originating workbench's read-only tools to coding
agents through the credential-isolating MCP sidecar. | | Optional: \{\}
| + + #### Binding @@ -776,6 +786,46 @@ _Appears in:_ | `vcluster` _[VClusterHelmConfiguration](#vclusterhelmconfiguration)_ | VCluster allows configuring vcluster specific helm chart options. | | Optional: \{\}
| +#### ImageWarmer + + + +ImageWarmer is the Schema for the imagewarmers API. + + + + + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `apiVersion` _string_ | `deployments.plural.sh/v1alpha1` | | | +| `kind` _string_ | `ImageWarmer` | | | +| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | +| `spec` _[ImageWarmerSpec](#imagewarmerspec)_ | | | | + + +#### ImageWarmerSpec + + + +ImageWarmerSpec defines an image that should periodically be pulled onto +every selected node. + + + +_Appears in:_ +- [ImageWarmer](#imagewarmer) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `cron` _string_ | Cron is a standard five-field cron expression controlling how often the
image is refreshed. | | MinLength: 1
Required: \{\}
| +| `image` _string_ | Image is the OCI image to warm. | | MinLength: 1
Required: \{\}
| +| `template` _[PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#podtemplatespec-v1-core)_ | Template optionally overrides the secure default warmer pod template. | | Optional: \{\}
| +| `selector` _[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#labelselector-v1-meta)_ | Selector restricts warming to nodes matching this label selector. | | Optional: \{\}
| + + + + #### IngressReplica @@ -908,6 +958,23 @@ MetricsAggregate +#### MiseSpec + + + +MiseSpec is an inline mise.toml used for unattended bootstrap. +See https://mise.jdx.dev/bootstrap.html + + + +_Appears in:_ +- [AgentRuntimeSpec](#agentruntimespec) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `config` _string_ | Config is the contents of a mise.toml. | | Optional: \{\}
| + + #### OpenCodeConfig @@ -925,6 +992,7 @@ _Appears in:_ | `provider` _string_ | Provider is the OpenCode provider id from https://models.dev (for example openai, anthropic,
amazon-bedrock, google-vertex, google). Optional.
When the parent AgentRuntime has spec.aiProxy enabled, the harness ignores this field and
autowires provider "plural", routing requests through the Console AI proxy at /ext/ai/v1
using the deploy token. Set spec.config.opencode.model to a bare model id; the harness
prefixes it for proxy routing based on runtime type (for example gpt-5.4 -> openai/gpt-5.4).
When aiProxy is false, this selects the native OpenCode provider block; credentials come from
tokenSecretRef or the provider's usual environment variables. Defaults to plural when omitted.
Use exact models.dev slugs (for example amazon-bedrock, google-vertex, google). | | MaxLength: 128
Optional: \{\}
| | `endpoint` _string_ | Endpoint optionally overrides the provider baseURL in opencode.json.
When omitted, the harness omits baseURL so OpenCode uses the models.dev default for the provider. | | Optional: \{\}
| | `model` _string_ | Model is the LLM model to use. | | Optional: \{\}
| +| `method` _[OpenAiMethod](#openaimethod)_ | Method configures which OpenAI API OpenCode should use.
CHAT selects @ai-sdk/openai-compatible and forces /chat/completions.
RESPONSES selects @ai-sdk/openai and forces /responses.
AUTO preserves the provider default. | | Enum: [CHAT RESPONSES AUTO]
Optional: \{\}
| | `tokenSecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | TokenSecretRef references a Secret containing the API token for OpenCode.
Optional when aiProxy is enabled; authentication uses the Console deploy token instead. | | Optional: \{\}
| | `extraArgs` _string array_ | ExtraArgs args for advanced or experimental CLI flags.
Deprecated: It is being ignored by the agent harness. | | | | `timeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ | Timeout bounds a single opencode run invocation. | | Optional: \{\}
| @@ -951,6 +1019,7 @@ _Appears in:_ | `provider` _string_ | Provider is the OpenCode provider id from https://models.dev. | | | | `endpoint` _string_ | Endpoint API endpoint for the OpenCode service. | | | | `model` _string_ | Model is the LLM model to use. | | | +| `method` _[OpenAiMethod](#openaimethod)_ | Method configures which OpenAI API OpenCode should use. | | | | `token` _string_ | Token is the raw API token for OpenCode. | | | | `timeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ | Timeout bounds a single opencode run invocation. | | Optional: \{\}
| @@ -960,8 +1029,8 @@ _Appears in:_ OpenCodeOpenAICompatibleConfig configures a custom OpenAI-compatible API provider in opencode.json. -The harness writes a provider block with npm @ai-sdk/openai-compatible. Use this for endpoints -that are not listed on https://models.dev (for example LiteLLM, vLLM, or a private gateway). +Use this for endpoints that are not listed on https://models.dev (for example LiteLLM, vLLM, +or a private gateway). When set and the parent AgentRuntime has spec.aiProxy false, spec.config.opencode.provider and spec.config.opencode.endpoint are ignored in favor of this block. @@ -994,6 +1063,7 @@ _Appears in:_ | `apiKeySecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | APIKeySecretRef references an API key. Optional with aiProxy enabled. | | Optional: \{\}
| | `provider` _string_ | Provider is Pi's provider id. Defaults to openai. | | Optional: \{\}
| | `model` _string_ | Model is the model id to use. | | Optional: \{\}
| +| `method` _[OpenAiMethod](#openaimethod)_ | Method configures which OpenAI API Pi should use.
CHAT selects openai-completions and forces /chat/completions.
RESPONSES selects openai-responses and forces /responses.
AUTO preserves the current openai-responses default. | | Enum: [CHAT RESPONSES AUTO]
Optional: \{\}
| | `endpoint` _string_ | Endpoint overrides the OpenAI-compatible provider base URL. | | Optional: \{\}
| | `timeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ | Timeout bounds a single Pi invocation. | | Optional: \{\}
| @@ -1014,6 +1084,7 @@ _Appears in:_ | `apiKey` _string_ | | | | | `provider` _string_ | | | | | `model` _string_ | | | | +| `method` _[OpenAiMethod](#openaimethod)_ | | | | | `endpoint` _string_ | | | | | `timeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ | | | | @@ -1130,6 +1201,24 @@ _Appears in:_ | `requireAnnotations` _object (keys:string, values:string)_ | | | | +#### RepositoryImagePrewarm + + + +RepositoryImagePrewarm configures periodic repository image warming. + + + +_Appears in:_ +- [AgentRuntimeSpec](#agentruntimespec) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `cron` _string_ | Cron is a standard five-field cron expression controlling how often the
repository image is refreshed. | | MinLength: 1
Required: \{\}
| +| `template` _[PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#podtemplatespec-v1-core)_ | Template optionally overrides the secure default warmer pod template. | | Optional: \{\}
| +| `selector` _[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#labelselector-v1-meta)_ | Selector restricts warming to nodes matching this label selector. | | Optional: \{\}
| + + #### SentinelRunJob @@ -1212,6 +1301,7 @@ _Appears in:_ _Appears in:_ - [AgentRunStatus](#agentrunstatus) +- [AgentRuntimeStatus](#agentruntimestatus) - [SentinelRunJobStatus](#sentinelrunjobstatus) - [StackRunJobStatus](#stackrunjobstatus) - [VirtualClusterStatus](#virtualclusterstatus) @@ -1322,3 +1412,50 @@ _Appears in:_ +#### WorkbenchMCPCategory + +_Underlying type:_ _string_ + +WorkbenchMCPCategory is a workbench tool category accepted by the Console MCP endpoint. + +_Validation:_ +- Enum: [metrics logs integration ticketing traces error_tracking infrastructure search scm chat function coding verification observability] + +_Appears in:_ +- [WorkbenchMCPConfig](#workbenchmcpconfig) + +| Field | Description | +| --- | --- | +| `metrics` | | +| `logs` | | +| `integration` | | +| `ticketing` | | +| `traces` | | +| `error_tracking` | | +| `infrastructure` | | +| `search` | | +| `scm` | | +| `chat` | | +| `function` | | +| `coding` | | +| `verification` | | +| `observability` | | + + +#### WorkbenchMCPConfig + + + + + + + +_Appears in:_ +- [AgentRuntimeSpec](#agentruntimespec) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `enabled` _boolean_ | Enabled controls whether workbench tools are available to coding agents. | false | | +| `categories` _[WorkbenchMCPCategory](#workbenchmcpcategory) array_ | Categories limits the exposed workbench tools. When omitted, the default
set is metrics, logs, traces, ticketing, search, scm, and infrastructure. | | Enum: [metrics logs integration ticketing traces error_tracking infrastructure search scm chat function coding verification observability]
Optional: \{\}
| + + diff --git a/pages/api-reference/kubernetes/management-api-reference.md b/pages/api-reference/kubernetes/management-api-reference.md index b2b9f18f..b2943e89 100644 --- a/pages/api-reference/kubernetes/management-api-reference.md +++ b/pages/api-reference/kubernetes/management-api-reference.md @@ -372,6 +372,23 @@ _Appears in:_ | `tokenSecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | TokenSecretRef is a reference to the local secret holding the token to access
the configured AI provider. | | Required: \{\}
| +#### BedrockModelSettings + + + + + + + +_Appears in:_ +- [BedrockSettings](#bedrocksettings) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `modelId` _string_ | ModelID is the foundation model served by the application inference profile. | | Required: \{\}
| +| `inferenceProfileArn` _string_ | InferenceProfileARN is the full ARN of the Bedrock application inference profile. | | Required: \{\}
| + + #### BedrockSettings @@ -388,12 +405,14 @@ _Appears in:_ | `modelId` _string_ | ModelID is the primary AWS Bedrock model or inference profile identifier.
Use a egional inference profile ID with three dot-separated segments (e.g. us.anthropic.claude-3-5-sonnet-20241022-v2:0,
global.anthropic.claude-haiku-4-5-20251001-v1:0). | | Optional: \{\}
| | `toolModelId` _string_ | ToolModelId is the Bedrock model or inference profile for tool calling. Same ID formats as modelId. | | Optional: \{\}
| | `embeddingModel` _string_ | EmbeddingModel is the Bedrock model or inference profile for embeddings. Same ID formats as modelId. | | Optional: \{\}
| +| `endpoint` _[BedrockEndpoint](#bedrockendpoint)_ | Endpoint selects the AWS Bedrock API surface. RUNTIME (the default) uses InvokeModel or
Converse on bedrock-runtime; MANTLE uses the Bedrock Mantle Anthropic/OpenAI-compatible APIs. | RUNTIME | Enum: [RUNTIME MANTLE]
Optional: \{\}
| | `proxyModels` _string array_ | ProxyModels lists additional Bedrock model or inference profile IDs exposed through the Nexus
OpenAI-compatible proxy beyond modelId, toolModelId, and embeddingModel. Same ID formats as modelId. | | Optional: \{\}
| | `region` _string_ | Region is the AWS region the model is hosted in | | Required: \{\}
| | `tokenSecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | TokenSecretRef is a reference to the local secret holding the token to access
the configured AI provider. | | Optional: \{\}
| | `awsAccessKeyId` _string_ | AWS Access Key ID to use for authentication | | Optional: \{\}
| | `awsSecretAccessKeyRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | AWS Secret Access Key to use for authentication | | Optional: \{\}
| | `deployments` _object (keys:string, values:string)_ | Deployments is deprecated for most configurations: prefer regional-prefixed inference profile IDs in
modelId, toolModelId, embeddingModel, or proxyModels (Nexus infers Bifrost aliases automatically).
Still needed when clients use a logical model name that must resolve to a different Bedrock identifier,
for application inference profile resource IDs (use the profile resource suffix, not the full ARN),
or other explicit alias overrides. Maps client-facing model ID to inference profile ID. Example:
\{"anthropic.claude-3-5-sonnet-20241022-v2:0": "us.anthropic.claude-3-5-sonnet-20241022-v2:0"\} | | Optional: \{\}
| +| `modelSettings` _[BedrockModelSettings](#bedrockmodelsettings) array_ | ModelSettings configures per-model Bedrock options, including application inference profiles. | | Optional: \{\}
| #### Binding @@ -2417,6 +2436,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `plural` _boolean_ | Plural enables built-in Plural JWT authentication for this MCP server.
When true, the server will receive a valid Plural JWT token in requests,
allowing it to authenticate and authorize operations within the Plural ecosystem. | | Optional: \{\}
| +| `oauth` _[OAuth2TokenExchange](#oauth2tokenexchange)_ | OAuth configures client credentials token exchange for requests to this server. | | Optional: \{\}
| | `headers` _object (keys:string, values:string)_ | Headers specify custom HTTP headers required for authentication with this MCP server.
This allows integration with servers that use API keys, bearer tokens, or other
header-based authentication schemes. Common examples include "Authorization",
"X-API-Key", or custom authentication headers. | | Optional: \{\}
| @@ -2699,19 +2719,27 @@ _Appears in:_ -OAuth2TokenExchange configures OAuth2 client credentials token endpoint exchange for OpenAI-compatible APIs. +OAuth2TokenExchange configures OAuth2 client credentials token endpoint exchange. _Appears in:_ +- [MCPServerAuthentication](#mcpserverauthentication) - [OpenAISettings](#openaisettings) +- [WorkbenchToolSpec](#workbenchtoolspec) | Field | Description | Default | Validation | | --- | --- | --- | --- | | `enabled` _boolean_ | Enabled turns token exchange on for obtaining access tokens via the configured token endpoint. | | Optional: \{\}
| +| `type` _[OauthTokenExchangeType](#oauthtokenexchangetype)_ | Type selects client secret or signed JWT client assertion authentication. | CLIENT_SECRET | Enum: [CLIENT_SECRET CLIENT_ASSERTION]
Optional: \{\}
| | `tokenUrl` _string_ | TokenURL is the OAuth2 token endpoint URL. | | Optional: \{\}
| | `clientId` _string_ | ClientID is the OAuth2 client identifier. | | Optional: \{\}
| | `clientSecretSecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | ClientSecretSecretRef is a reference to a Kubernetes secret key holding the OAuth2 client secret. | | Optional: \{\}
| +| `privateKeySecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | PrivateKeySecretRef references a PEM-encoded RSA private key used to sign client assertions. | | Optional: \{\}
| +| `keyId` _string_ | KeyID is added to the signed JWT header as kid when configured. | | Optional: \{\}
| +| `audience` _string_ | Audience overrides the JWT aud claim. It defaults to tokenUrl. | | Optional: \{\}
| +| `resource` _string_ | Resource is the OAuth resource parameter requested from the token endpoint. | | Optional: \{\}
| +| `scopes` _string array_ | Scopes are sent as a space-separated OAuth scope parameter. | | Optional: \{\}
| #### OIDCProvider @@ -3324,6 +3352,7 @@ _Appears in:_ | `flows` _[PersonaFlows](#personaflows)_ | Flows controls access to flow-related features and sections.
This includes workbenches, pipelines, and preview environments grouped under flows. | | Optional: \{\}
| | `sidebar` _[PersonaSidebar](#personasidebar)_ | Sidebar configures which navigation items and sections are visible in the main sidebar.
This allows personas to have streamlined navigation focused on their primary workflows
while hiding irrelevant or restricted functionality. | | Optional: \{\}
| | `services` _[PersonaServices](#personaservices)_ | Services controls access to service-specific features and configuration options.
This includes service configuration, secrets management, and other service-level operations. | | Optional: \{\}
| +| `settings` _[PersonaSettings](#personasettings)_ | Settings controls which tabs are visible within the Console settings page.
Tabs are visible by default and can be hidden by explicitly setting them to false. | | Optional: \{\}
| | `ai` _[PersonaAI](#personaai)_ | AI configures access to AI-powered features and capabilities within the Console.
This includes AI-assisted operations, automated suggestions, and other intelligent features. | | Optional: \{\}
| @@ -3411,6 +3440,31 @@ _Appears in:_ | `configuration` _boolean_ | Configuration enables access to service configuration management when set to true.
This includes modifying service deployment settings, environment variables,
and other configuration parameters that affect service behavior. | | Optional: \{\}
| +#### PersonaSettings + + + +PersonaSettings defines the visibility of tabs on the Console settings page. + + + +_Appears in:_ +- [PersonaConfiguration](#personaconfiguration) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `userManagement` _boolean_ | | | Optional: \{\}
| +| `global` _boolean_ | | | Optional: \{\}
| +| `ai` _boolean_ | | | Optional: \{\}
| +| `webhooks` _boolean_ | | | Optional: \{\}
| +| `chatbots` _boolean_ | | | Optional: \{\}
| +| `cloudConnections` _boolean_ | | | Optional: \{\}
| +| `projects` _boolean_ | | | Optional: \{\}
| +| `notifications` _boolean_ | | | Optional: \{\}
| +| `audits` _boolean_ | | | Optional: \{\}
| +| `accessTokens` _boolean_ | | | Optional: \{\}
| + + #### PersonaSidebar @@ -4900,6 +4954,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `email` _string_ | Email address that will be bound to this service account for identification
and authentication purposes. This email serves as the unique identifier
for the service account within the Console API. | | Required: \{\}
Type: string
| +| `allowedScopes` _string array_ | AllowedScopes define the Console API endpoints that can be granted to access
tokens created for this service account. An empty list imposes no restriction. | | Optional: \{\}
| | `scopes` _[ServiceAccountScope](#serviceaccountscope) array_ | Scopes define the access boundaries for this service account, controlling
which Console APIs and resources it can interact with. Each scope can restrict
access to specific API endpoints and resource identifiers, enabling fine-grained
permission control for automated processes. | | Optional: \{\}
| | `tokenExpiry` _string_ | TokenExpiry is the TTL of the access token, e.g. 1h, 1d, 1w | | Optional: \{\}
| | `tokenSecretRef` _[SecretReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretreference-v1-core)_ | TokenSecretRef references a Kubernetes secret that should contain the
authentication token for this service account. This enables secure storage
and management of credentials within the cluster. | | Optional: \{\}
| @@ -6103,6 +6158,7 @@ _Appears in:_ | `opensearch` _[WorkbenchToolOpensearchConfig](#workbenchtoolopensearchconfig)_ | AWS OpenSearch connection (logs). | | Optional: \{\}
| | `prometheus` _[WorkbenchToolPrometheusConfig](#workbenchtoolprometheusconfig)_ | Prometheus connection (metrics). | | Optional: \{\}
| | `loki` _[WorkbenchToolLokiConfig](#workbenchtoollokiconfig)_ | Loki connection (logs). | | Optional: \{\}
| +| `victoriaLogs` _[WorkbenchToolVictoriaLogsConfig](#workbenchtoolvictorialogsconfig)_ | VictoriaLogs connection (logs). | | Optional: \{\}
| | `tempo` _[WorkbenchToolTempoConfig](#workbenchtooltempoconfig)_ | Tempo connection (traces). | | Optional: \{\}
| | `jaeger` _[WorkbenchToolJaegerConfig](#workbenchtooljaegerconfig)_ | Jaeger connection (traces). | | Optional: \{\}
| | `splunk` _[WorkbenchToolSplunkConfig](#workbenchtoolsplunkconfig)_ | Splunk connection (logs). | | Optional: \{\}
| @@ -6116,6 +6172,7 @@ _Appears in:_ | `pagerduty` _[WorkbenchToolPagerdutyConfig](#workbenchtoolpagerdutyconfig)_ | PagerDuty connection (integration). | | Optional: \{\}
| | `teams` _[WorkbenchToolTeamsConfig](#workbenchtoolteamsconfig)_ | Microsoft Teams / Graph connection (integration). | | Optional: \{\}
| | `atlassian` _[WorkbenchToolAtlassianConfig](#workbenchtoolatlassianconfig)_ | Atlassian/jira connection (ticketing). | | Optional: \{\}
| +| `jiraDatacenter` _[WorkbenchToolJiraDatacenterConfig](#workbenchtooljiradatacenterconfig)_ | Jira Data Center connection (ticketing). | | Optional: \{\}
| | `exa` _[WorkbenchToolExaConfig](#workbenchtoolexaconfig)_ | Exa connection (search). | | Optional: \{\}
| | `github` _[WorkbenchToolGithubConfig](#workbenchtoolgithubconfig)_ | GitHub connection (integration). | | Optional: \{\}
| | `gitlab` _[WorkbenchToolGitlabConfig](#workbenchtoolgitlabconfig)_ | GitLab connection (scm). | | Optional: \{\}
| @@ -6312,6 +6369,23 @@ _Appears in:_ | `passwordSecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | Reference to a secret key containing the basic auth password. | | Optional: \{\}
| +#### WorkbenchToolJiraDatacenterConfig + + + +WorkbenchToolJiraDatacenterConfig defines a Jira Data Center connection. + + + +_Appears in:_ +- [WorkbenchToolConfiguration](#workbenchtoolconfiguration) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `url` _string_ | Jira Data Center base URL. | | Required: \{\}
| +| `apiTokenSecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | APITokenSecretRef references a personal access token when OAuth is not used. | | Optional: \{\}
| + + #### WorkbenchToolLambdaConfig @@ -6475,7 +6549,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `name` _string_ | The name of the tool (a-z, 0-9, underscores). If not set, metadata.name is used. | | Optional: \{\}
Pattern: `^[a-z0-9_]+$`
Type: string
| -| `tool` _[WorkbenchToolType](#workbenchtooltype)_ | The type of tool. | | Enum: [HTTP ELASTIC DATADOG PROMETHEUS LOKI TEMPO SENTRY MCP LINEAR ATLASSIAN SPLUNK DYNATRACE CLOUDWATCH AZURE CLOUD JAEGER EXA GITHUB SLACK TEAMS GITLAB BITBUCKET BITBUCKET_DATACENTER AZURE_DEVOPS PAGERDUTY OPENSEARCH LAMBDA CLOUD_RUN AZURE_FUNCTION DOCKER]
Required: \{\}
| +| `tool` _[WorkbenchToolType](#workbenchtooltype)_ | The type of tool. | | Enum: [HTTP ELASTIC DATADOG PROMETHEUS LOKI TEMPO SENTRY MCP LINEAR ATLASSIAN SPLUNK DYNATRACE CLOUDWATCH AZURE CLOUD JAEGER EXA GITHUB SLACK TEAMS GITLAB BITBUCKET BITBUCKET_DATACENTER AZURE_DEVOPS PAGERDUTY OPENSEARCH LAMBDA CLOUD_RUN AZURE_FUNCTION DOCKER VICTORIA_LOGS JIRA JIRA_DATACENTER]
Required: \{\}
| | `categories` _WorkbenchToolCategory array_ | Categories for the tool. | | Optional: \{\}
| | `approval` _boolean_ | Whether this tool requires approval before execution. | | Optional: \{\}
| | `projectRef` _[ObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#objectreference-v1-core)_ | The project for this tool. | | Optional: \{\}
| @@ -6484,6 +6558,7 @@ _Appears in:_ | `scmConnectionRef` _[ObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#objectreference-v1-core)_ | The SCM connection for this tool (e.g. shared Git provider credentials). | | Optional: \{\}
| | `bindings` _[Bindings](#bindings)_ | Bindings define the read and write access policies for this tool. | | Optional: \{\}
| | `configuration` _[WorkbenchToolConfiguration](#workbenchtoolconfiguration)_ | Tool configuration (e.g. HTTP). | | Optional: \{\}
| +| `oauth` _[OAuth2TokenExchange](#oauth2tokenexchange)_ | OAuth configures client credentials token exchange for this tool. | | Optional: \{\}
| | `reconciliation` _[Reconciliation](#reconciliation)_ | | | Optional: \{\}
| @@ -6501,7 +6576,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `url` _string_ | Splunk base URL. | | Required: \{\}
| -| `tokenSecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | Reference to a secret key containing the bearer token. | | Optional: \{\}
| +| `tokenSecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | Reference to a secret key containing the authentication token. | | Optional: \{\}
| +| `tokenType` _[SplunkTokenType](#splunktokentype)_ | Authorization realm used for token authentication. | BEARER | Enum: [BEARER SPLUNK]
Optional: \{\}
| | `username` _string_ | Basic auth username. | | Optional: \{\}
| | `passwordSecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | Reference to a secret key containing the basic auth password. | | Optional: \{\}
| @@ -6544,6 +6620,27 @@ _Appears in:_ | `tenantId` _string_ | Optional tenant id. | | Optional: \{\}
| +#### WorkbenchToolVictoriaLogsConfig + + + +WorkbenchToolVictoriaLogsConfig defines a VictoriaLogs connection. + + + +_Appears in:_ +- [WorkbenchToolConfiguration](#workbenchtoolconfiguration) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `url` _string_ | VictoriaLogs base URL. | | Required: \{\}
| +| `tokenSecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | Reference to a secret key containing the bearer token or api key. | | Optional: \{\}
| +| `username` _string_ | Basic auth username. | | Optional: \{\}
| +| `passwordSecretRef` _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#secretkeyselector-v1-core)_ | Reference to a secret key containing the basic auth password. | | Optional: \{\}
| +| `accountId` _string_ | Optional AccountID tenant header. | | Optional: \{\}
| +| `projectId` _string_ | Optional ProjectID tenant header. | | Optional: \{\}
| + + #### WorkbenchWebhook