# Nais Job reference This document describes all possible configuration values in the `Naisjob` spec. ## accessPolicy By default, no traffic is allowed between naisjobs inside the cluster. Configure access policies to explicitly allow communication between naisjobs. This is also used for granting inbound access in the context of Azure AD and TokenX clients. Relevant information: - [https://doc.dev-nais.cloud.nais.io/workloads/explanations/zero-trust/](https://doc.dev-nais.cloud.nais.io/workloads/explanations/zero-trust/) Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > accessPolicy: > inbound: > rules: > - application: app1 > - application: app2 > namespace: q1 > - application: app3 > cluster: dev-gcp > namespace: q2 > - application: '*' > namespace: q3 > - application: app4 > permissions: > scopes: > - custom-scope > - application: app5 > permissions: > roles: > - custom-role > - application: app6 > permissions: > roles: > - custom-role > scopes: > - custom-scope > outbound: > external: > - host: external-application.example.com > - host: non-http-service.example.com > ports: > - port: 9200 > rules: > - application: app1 > - application: app2 > namespace: q1 > - application: app3 > cluster: dev-gcp > namespace: q2 > - application: '*' > namespace: q3 > ``` ### accessPolicy.inbound Configures inbound access for your application. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > accessPolicy: > inbound: > rules: > - application: app1 > - application: app2 > namespace: q1 > - application: app3 > cluster: dev-gcp > namespace: q2 > - application: '*' > namespace: q3 > - application: app4 > permissions: > scopes: > - custom-scope > - application: app5 > permissions: > roles: > - custom-role > - application: app6 > permissions: > roles: > - custom-role > scopes: > - custom-scope > ``` #### accessPolicy.inbound.rules List of Nais applications that may access your application. These settings apply both to Zero Trust network connectivity and token validity for Azure AD and TokenX tokens. Type: `array`
Required: `true`
> **Example** > ```yaml > spec: > accessPolicy: > inbound: > rules: > - application: app1 > - application: app2 > namespace: q1 > - application: app3 > cluster: dev-gcp > namespace: q2 > - application: '*' > namespace: q3 > - application: app4 > permissions: > scopes: > - custom-scope > - application: app5 > permissions: > roles: > - custom-role > - application: app6 > permissions: > roles: > - custom-role > scopes: > - custom-scope > ``` ##### accessPolicy.inbound.rules[].application The application's name. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > accessPolicy: > inbound: > rules: > - application: app1 > - application: app2 > namespace: q1 > - application: app3 > cluster: dev-gcp > namespace: q2 > - application: '*' > namespace: q3 > - application: app4 > permissions: > scopes: > - custom-scope > - application: app5 > permissions: > roles: > - custom-role > - application: app6 > permissions: > roles: > - custom-role > scopes: > - custom-scope > ``` ##### accessPolicy.inbound.rules[].cluster The application's cluster. May be omitted if it should be in the same cluster as your application. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > accessPolicy: > inbound: > rules: > - application: app1 > - application: app2 > namespace: q1 > - application: app3 > cluster: dev-gcp > namespace: q2 > - application: '*' > namespace: q3 > - application: app4 > permissions: > scopes: > - custom-scope > - application: app5 > permissions: > roles: > - custom-role > - application: app6 > permissions: > roles: > - custom-role > scopes: > - custom-scope > ``` ##### accessPolicy.inbound.rules[].namespace The application's namespace. May be omitted if it should be in the same namespace as your application. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > accessPolicy: > inbound: > rules: > - application: app1 > - application: app2 > namespace: q1 > - application: app3 > cluster: dev-gcp > namespace: q2 > - application: '*' > namespace: q3 > - application: app4 > permissions: > scopes: > - custom-scope > - application: app5 > permissions: > roles: > - custom-role > - application: app6 > permissions: > roles: > - custom-role > scopes: > - custom-scope > ``` ### accessPolicy.outbound Configures outbound access for your application. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > accessPolicy: > outbound: > external: > - host: external-application.example.com > - host: non-http-service.example.com > ports: > - port: 9200 > rules: > - application: app1 > - application: app2 > namespace: q1 > - application: app3 > cluster: dev-gcp > namespace: q2 > - application: '*' > namespace: q3 > ``` #### accessPolicy.outbound.external List of external resources that your applications should be able to reach. Type: `array`
Required: `false`
Availability: GCP
> **Example** > ```yaml > spec: > accessPolicy: > outbound: > external: > - host: external-application.example.com > - host: non-http-service.example.com > ports: > - port: 9200 > ``` ##### accessPolicy.outbound.external[].host The *host* that your application should be able to reach, i.e. without the protocol (e.g. `https://`). "Host" and "IPv4" are mutually exclusive Type: `string`
Required: `false`
Pattern: `^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*$`
> **Example** > ```yaml > spec: > accessPolicy: > outbound: > external: > - host: external-application.example.com > - host: non-http-service.example.com > ports: > - port: 9200 > ``` ##### accessPolicy.outbound.external[].ipv4 The IPv4 address that your application should be able to reach. "IPv4" and "Host" are mutually exclusive Type: `string`
Required: `false`
Pattern: `^(([0-9])|([1-9][0-9])|(1([0-9]{2}))|(2[0-4][0-9])|(25[0-5]))((\.(([0-9])|([1-9][0-9])|(1([0-9]{2}))|(2[0-4][0-9])|(25[0-5]))){3})$`
> **Example** > ```yaml > spec: > accessPolicy: > outbound: > external: > - host: external-application.example.com > - host: non-http-service.example.com > ports: > - port: 9200 > ``` ##### accessPolicy.outbound.external[].ports List of port rules for external communication. Must be specified if using protocols other than HTTPS. Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > accessPolicy: > outbound: > external: > - host: external-application.example.com > - host: non-http-service.example.com > ports: > - port: 9200 > ``` ###### accessPolicy.outbound.external[].ports[].port The port used for communication. Type: `integer`
Required: `true`
> **Example** > ```yaml > spec: > accessPolicy: > outbound: > external: > - host: external-application.example.com > - host: non-http-service.example.com > ports: > - port: 9200 > ``` #### accessPolicy.outbound.rules List of Nais applications that your application needs to access. These settings apply to Zero Trust network connectivity. Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > accessPolicy: > outbound: > rules: > - application: app1 > - application: app2 > namespace: q1 > - application: app3 > cluster: dev-gcp > namespace: q2 > - application: '*' > namespace: q3 > ``` ##### accessPolicy.outbound.rules[].application The application's name. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > accessPolicy: > outbound: > rules: > - application: app1 > - application: app2 > namespace: q1 > - application: app3 > cluster: dev-gcp > namespace: q2 > - application: '*' > namespace: q3 > ``` ##### accessPolicy.outbound.rules[].cluster The application's cluster. May be omitted if it should be in the same cluster as your application. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > accessPolicy: > outbound: > rules: > - application: app1 > - application: app2 > namespace: q1 > - application: app3 > cluster: dev-gcp > namespace: q2 > - application: '*' > namespace: q3 > ``` ##### accessPolicy.outbound.rules[].namespace The application's namespace. May be omitted if it should be in the same namespace as your application. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > accessPolicy: > outbound: > rules: > - application: app1 > - application: app2 > namespace: q1 > - application: app3 > cluster: dev-gcp > namespace: q2 > - application: '*' > namespace: q3 > ``` ## activeDeadlineSeconds Once a Naisjob reaches activeDeadlineSeconds, all of its running Pods are terminated and the Naisjob status will become type: Failed with reason: DeadlineExceeded. If set, this takes presedence over BackoffLimit. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > activeDeadlineSeconds: 60 > ``` ## azure Provisions and configures Azure resources. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > azure: > application: > allowAllUsers: true > claims: > groups: > - id: 00000000-0000-0000-0000-000000000000 > enabled: true > ``` ### azure.application Configures an Entra ID client for this application. Relevant information: - [https://doc.dev-nais.cloud.nais.io/auth/entra-id/](https://doc.dev-nais.cloud.nais.io/auth/entra-id/) Type: `object`
Required: `true`
> **Example** > ```yaml > spec: > azure: > application: > allowAllUsers: true > claims: > groups: > - id: 00000000-0000-0000-0000-000000000000 > enabled: true > ``` #### azure.application.allowAllUsers AllowAllUsers grants all users within the tenant access to this application. Relevant information: - [https://doc.dev-nais.cloud.nais.io/auth/entra-id/how-to/secure/#all-users](https://doc.dev-nais.cloud.nais.io/auth/entra-id/how-to/secure/#all-users) Type: `boolean`
Required: `false`
Default value: `false`
> **Example** > ```yaml > spec: > azure: > application: > allowAllUsers: true > ``` #### azure.application.claims Claims defines additional configuration of the emitted claims in tokens returned to the Azure AD application. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > azure: > application: > claims: > groups: > - id: 00000000-0000-0000-0000-000000000000 > ``` ##### azure.application.claims.extra Deprecated. These claims are already included by default; this field is ignored and has no effect. It will be removed in a future release. > **Deprecated** > This feature is deprecated, preserved only for backwards compatibility. Type: `array`
Required: `false`
Allowed values: `NAVident`, `azp_name`
##### azure.application.claims.groups Groups is a list of Azure AD group IDs to be emitted in the `groups` claim in tokens issued by Azure AD. This also assigns groups to the application for access control. Only direct members of the groups are granted access. Relevant information: - [https://doc.dev-nais.cloud.nais.io/auth/entra-id/reference/#groups](https://doc.dev-nais.cloud.nais.io/auth/entra-id/reference/#groups) Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > azure: > application: > claims: > groups: > - id: 00000000-0000-0000-0000-000000000000 > ``` ###### azure.application.claims.groups[].id ID is the actual `object ID` associated with the given group in Azure AD. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > azure: > application: > claims: > groups: > - id: 00000000-0000-0000-0000-000000000000 > ``` #### azure.application.enabled If enabled, provisions an Entra ID application. Type: `boolean`
Required: `true`
Default value: `false`
> **Example** > ```yaml > spec: > azure: > application: > enabled: true > ``` #### azure.application.replyURLs Deprecated, do not use. This is currently only needed if you're implementing logins *without* using sidecar. This field will be removed in a future release. > **Deprecated** > This feature is deprecated, preserved only for backwards compatibility. Type: `array`
Required: `false`
#### azure.application.singlePageApplication Deprecated, do not use. Use sidecar instead. This field is only used if you're implementing logins in a client-side frontend application, which we do not recommend. This field will be removed in a future release. > **Deprecated** > This feature is deprecated, preserved only for backwards compatibility. Type: `boolean`
Required: `false`
## backoffLimit Specify the number of retries before considering a Naisjob as failed Type: `integer`
Required: `false`
Default value: `6`
> **Example** > ```yaml > spec: > backoffLimit: 5 > ``` ## command Override command when starting Docker image. Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > command: > - /app/myapplication > - --param > - value > - --other-param > - other-value > ``` ## completionMode Jobs with fixed completion count - that is, jobs that have non null `.spec.completions` - can have a completion mode. NonIndexed: the Job is considered complete when there have been `.spec.completions` successfully completed Pods. Indexed: the Pods of a Job get an associated completion index from 0 to `.spec.completions-1`. The Job is considered complete when there is one successfully completed Pod for each index. Relevant information: - [https://kubernetes.io/docs/concepts/workloads/controllers/job/#completion-mode](https://kubernetes.io/docs/concepts/workloads/controllers/job/#completion-mode) Type: `enum`
Required: `false`
Default value: `NonIndexed`
Allowed values: `Indexed`, `NonIndexed`
> **Example** > ```yaml > spec: > completionMode: Indexed > ``` ## completions A Job tracks the successful completions. When a specified number of successful completions is reached, the task (ie, Job) is complete. Relevant information: - [https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-patterns](https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-patterns) Type: `integer`
Required: `false`
Default value: `1`
> **Example** > ```yaml > spec: > completions: 1 > ``` ## concurrencyPolicy Specifies how to treat concurrent executions of a job that is created by this Naisjob-cron. Relevant information: - [https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#concurrency-policy](https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#concurrency-policy) Type: `enum`
Required: `false`
Default value: `Allow`
Allowed values: `Allow`, `Forbid`, `Replace`
> **Example** > ```yaml > spec: > concurrencyPolicy: Allow > ``` ## env Custom environment variables injected into your container. It is possible to use [Kubernetes Dependent Environment Variables](https://kubernetes.io/docs/tasks/inject-data-application/define-interdependent-environment-variables/), which allows you to use the value of one environment variable in another. Environment variables set by the platform are defined before the application variables, and can be referenced/overwritten in the application variables. Specify either `value` or `valueFrom`, but not both. Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > env: > - name: MY_CUSTOM_VAR > value: some_value > - name: MY_APPLICATION_NAME > valueFrom: > fieldRef: > fieldPath: metadata.name > ``` ### env[].name Environment variable name. May only contain letters, digits, and the underscore `_` character. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > env: > - name: MY_CUSTOM_VAR > value: some_value > - name: MY_APPLICATION_NAME > valueFrom: > fieldRef: > fieldPath: metadata.name > ``` ### env[].value Environment variable value. Numbers and boolean values must be quoted. Required unless `valueFrom` is specified. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > env: > - name: MY_CUSTOM_VAR > value: some_value > - name: MY_APPLICATION_NAME > valueFrom: > fieldRef: > fieldPath: metadata.name > ``` ### env[].valueFrom Dynamically set environment variables based on fields found in the Pod spec. Relevant information: - [https://kubernetes.io/docs/tasks/inject-data-application/environment-variable-expose-pod-information/](https://kubernetes.io/docs/tasks/inject-data-application/environment-variable-expose-pod-information/) Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > env: > - name: MY_CUSTOM_VAR > value: some_value > - name: MY_APPLICATION_NAME > valueFrom: > fieldRef: > fieldPath: metadata.name > ``` #### env[].valueFrom.fieldRef Type: `object`
Required: `true`
> **Example** > ```yaml > spec: > env: > - name: MY_CUSTOM_VAR > value: some_value > - name: MY_APPLICATION_NAME > valueFrom: > fieldRef: > fieldPath: metadata.name > ``` ##### env[].valueFrom.fieldRef.fieldPath Field value from the `Pod` spec that should be copied into the environment variable. Type: `enum`
Required: `true`
Allowed values: *(empty string)*, `metadata.annotations`, `metadata.labels`, `metadata.name`, `metadata.namespace`, `spec.nodeName`, `spec.serviceAccountName`, `status.hostIP`, `status.podIP`
> **Example** > ```yaml > spec: > env: > - name: MY_CUSTOM_VAR > value: some_value > - name: MY_APPLICATION_NAME > valueFrom: > fieldRef: > fieldPath: metadata.name > ``` ## envFrom EnvFrom exposes all variables in the ConfigMap or Secret resources as environment variables. One of `configMap` or `secret` is required. Environment variables will take the form `KEY=VALUE`, where `key` is the ConfigMap or Secret key. You can specify as many keys as you like in a single ConfigMap or Secret. The ConfigMap and Secret resources must live in the same Kubernetes namespace as the Naisjob resource. Type: `array`
Required: `false`
Availability: team namespaces
> **Example** > ```yaml > spec: > envFrom: > - secret: my-secret-with-envs > - configmap: my-configmap-with-envs > ``` ### envFrom[].configmap Name of the `ConfigMap` where environment variables are specified. Required unless `secret` is set. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > envFrom: > - secret: my-secret-with-envs > - configmap: my-configmap-with-envs > ``` ### envFrom[].secret Name of the `Secret` where environment variables are specified. Required unless `configMap` is set. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > envFrom: > - secret: my-secret-with-envs > - configmap: my-configmap-with-envs > ``` ## failedJobsHistoryLimit Specify how many failed Jobs should be kept. Type: `integer`
Required: `false`
Default value: `1`
> **Example** > ```yaml > spec: > failedJobsHistoryLimit: 2 > ``` ## filesFrom List of ConfigMap or Secret resources that will have their contents mounted into the containers as files. Either `configMap` or `secret` is required. Files will take the path `/`, where `key` is the ConfigMap or Secret key. You can specify as many keys as you like in a single ConfigMap or Secret, and they will all be mounted to the same directory. The ConfigMap and Secret resources must live in the same Kubernetes namespace as the Naisjob resource. Type: `array`
Required: `false`
Availability: team namespaces
> **Example** > ```yaml > spec: > filesFrom: > - configmap: example-files-configmap > mountPath: /var/run/configmaps > - mode: 416 > mountPath: /var/run/secrets > secret: my-secret-file > - emptyDir: > medium: Memory > mountPath: /var/cache > - mountPath: /var/run/pvc > persistentVolumeClaim: pvc-name > ``` ### filesFrom[].configmap Name of the `ConfigMap` that contains files that should be mounted into the container. Required unless `secret` or `persistentVolumeClaim` is set. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > filesFrom: > - configmap: example-files-configmap > mountPath: /var/run/configmaps > - mode: 416 > mountPath: /var/run/secrets > secret: my-secret-file > - emptyDir: > medium: Memory > mountPath: /var/cache > - mountPath: /var/run/pvc > persistentVolumeClaim: pvc-name > ``` ### filesFrom[].emptyDir Specification of an empty directory Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > filesFrom: > - configmap: example-files-configmap > mountPath: /var/run/configmaps > - mode: 416 > mountPath: /var/run/secrets > secret: my-secret-file > - emptyDir: > medium: Memory > mountPath: /var/cache > - mountPath: /var/run/pvc > persistentVolumeClaim: pvc-name > ``` #### filesFrom[].emptyDir.medium Type: `enum`
Required: `false`
Allowed values: `Disk`, `Memory`
> **Example** > ```yaml > spec: > filesFrom: > - configmap: example-files-configmap > mountPath: /var/run/configmaps > - mode: 416 > mountPath: /var/run/secrets > secret: my-secret-file > - emptyDir: > medium: Memory > mountPath: /var/cache > - mountPath: /var/run/pvc > persistentVolumeClaim: pvc-name > ``` ### filesFrom[].mode File permissions for files mounted from a Secret or ConfigMap, e.g. `0640` in octal (`416` in decimal). Defaults to `0644`. Type: `integer`
Required: `false`
Default value: `0644`
Value range: `0`-`511`
> **Example** > ```yaml > spec: > filesFrom: > - configmap: example-files-configmap > mountPath: /var/run/configmaps > - mode: 416 > mountPath: /var/run/secrets > secret: my-secret-file > - emptyDir: > medium: Memory > mountPath: /var/cache > - mountPath: /var/run/pvc > persistentVolumeClaim: pvc-name > ``` ### filesFrom[].mountPath Filesystem path inside the pod where files are mounted. The directory will be created if it does not exist. If the directory exists, any files in the directory will be made unaccessible. Defaults to `/var/run/configmaps/`, `/var/run/secrets`, or `/var/run/pvc/`, depending on which of them is specified. For EmptyDir, MountPath must be set. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > filesFrom: > - configmap: example-files-configmap > mountPath: /var/run/configmaps > - mode: 416 > mountPath: /var/run/secrets > secret: my-secret-file > - emptyDir: > medium: Memory > mountPath: /var/cache > - mountPath: /var/run/pvc > persistentVolumeClaim: pvc-name > ``` ### filesFrom[].persistentVolumeClaim Name of the `PersistentVolumeClaim` that should be mounted into the container. Required unless `configMap` or `secret` is set. This feature requires coordination with the Nais team. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > filesFrom: > - configmap: example-files-configmap > mountPath: /var/run/configmaps > - mode: 416 > mountPath: /var/run/secrets > secret: my-secret-file > - emptyDir: > medium: Memory > mountPath: /var/cache > - mountPath: /var/run/pvc > persistentVolumeClaim: pvc-name > ``` ### filesFrom[].secret Name of the `Secret` that contains files that should be mounted into the container. Required unless `configMap` or `persistentVolumeClaim` is set. If mounting multiple secrets, `mountPath` *MUST* be set to avoid collisions. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > filesFrom: > - configmap: example-files-configmap > mountPath: /var/run/configmaps > - mode: 416 > mountPath: /var/run/secrets > secret: my-secret-file > - emptyDir: > medium: Memory > mountPath: /var/cache > - mountPath: /var/run/pvc > persistentVolumeClaim: pvc-name > ``` ## gcp Type: `object`
Required: `false`
Availability: GCP
> **Example** > ```yaml > spec: > gcp: > bigQueryDatasets: > - cascadingDelete: true > description: Contains big data, supporting big queries, for use in big ideas. > name: my_bigquery_dataset1 > permission: READWRITE > - description: Contains big data, supporting big queries, for use in big ideas. > name: my_bigquery_dataset2 > permission: READ > buckets: > - cascadingDelete: true > lifecycleCondition: > age: 10 > createdBefore: "2020-01-01" > daysSinceCustomTime: 5 > numNewerVersions: 2 > withState: ARCHIVED > name: my-cloud-storage-bucket > publicAccessPrevention: true > retentionPeriodDays: 30 > permissions: > - resource: > apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1 > kind: Project > name: myteam-dev-ab23 > role: roles/cloudsql.client > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ### gcp.bigQueryDatasets Provision BigQuery datasets and give your application's pod mountable secrets for connecting to each dataset. Datasets are immutable and cannot be changed. Relevant information: - [https://cloud.google.com/bigquery/docs](https://cloud.google.com/bigquery/docs) Type: `array`
Required: `false`
Availability: GCP
> **Example** > ```yaml > spec: > gcp: > bigQueryDatasets: > - cascadingDelete: true > description: Contains big data, supporting big queries, for use in big ideas. > name: my_bigquery_dataset1 > permission: READWRITE > - description: Contains big data, supporting big queries, for use in big ideas. > name: my_bigquery_dataset2 > permission: READ > ``` #### gcp.bigQueryDatasets[].cascadingDelete When set to true will delete the dataset, when the application resource is deleted. NB: If no tables exist in the bigquery dataset, it *will* delete the dataset even if this value is set/defaulted to `false`. Default value is `false`. Type: `boolean`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > bigQueryDatasets: > - cascadingDelete: true > description: Contains big data, supporting big queries, for use in big ideas. > name: my_bigquery_dataset1 > permission: READWRITE > - description: Contains big data, supporting big queries, for use in big ideas. > name: my_bigquery_dataset2 > permission: READ > ``` #### gcp.bigQueryDatasets[].description Human-readable description of what this BigQuery dataset contains, or is used for. Will be visible in the GCP Console. Type: `string`
Required: `false`
Immutable: `true`
> **Example** > ```yaml > spec: > gcp: > bigQueryDatasets: > - cascadingDelete: true > description: Contains big data, supporting big queries, for use in big ideas. > name: my_bigquery_dataset1 > permission: READWRITE > - description: Contains big data, supporting big queries, for use in big ideas. > name: my_bigquery_dataset2 > permission: READ > ``` #### gcp.bigQueryDatasets[].name Name of the BigQuery Dataset. The canonical name of the dataset will be `:`. Type: `string`
Required: `true`
Immutable: `true`
Pattern: `^[a-z0-9][a-z0-9_]+$`
> **Example** > ```yaml > spec: > gcp: > bigQueryDatasets: > - cascadingDelete: true > description: Contains big data, supporting big queries, for use in big ideas. > name: my_bigquery_dataset1 > permission: READWRITE > - description: Contains big data, supporting big queries, for use in big ideas. > name: my_bigquery_dataset2 > permission: READ > ``` #### gcp.bigQueryDatasets[].permission Permission level given to application. Type: `enum`
Required: `true`
Immutable: `true`
Allowed values: `READ`, `READWRITE`
> **Example** > ```yaml > spec: > gcp: > bigQueryDatasets: > - cascadingDelete: true > description: Contains big data, supporting big queries, for use in big ideas. > name: my_bigquery_dataset1 > permission: READWRITE > - description: Contains big data, supporting big queries, for use in big ideas. > name: my_bigquery_dataset2 > permission: READ > ``` ### gcp.buckets Provision cloud storage buckets and connect them to your application. Relevant information: - [https://doc.dev-nais.cloud.nais.io/persistence/buckets/](https://doc.dev-nais.cloud.nais.io/persistence/buckets/) Type: `array`
Required: `false`
Availability: GCP
> **Example** > ```yaml > spec: > gcp: > buckets: > - cascadingDelete: true > lifecycleCondition: > age: 10 > createdBefore: "2020-01-01" > daysSinceCustomTime: 5 > numNewerVersions: 2 > withState: ARCHIVED > name: my-cloud-storage-bucket > publicAccessPrevention: true > retentionPeriodDays: 30 > ``` #### gcp.buckets[].cascadingDelete Allows deletion of bucket. Set to true if you want to delete the bucket. Type: `boolean`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > buckets: > - cascadingDelete: true > lifecycleCondition: > age: 10 > createdBefore: "2020-01-01" > daysSinceCustomTime: 5 > numNewerVersions: 2 > withState: ARCHIVED > name: my-cloud-storage-bucket > publicAccessPrevention: true > retentionPeriodDays: 30 > ``` #### gcp.buckets[].lifecycleCondition Conditions for the bucket to use when selecting objects to delete in cleanup. Relevant information: - [https://cloud.google.com/storage/docs/lifecycle](https://cloud.google.com/storage/docs/lifecycle) Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > buckets: > - cascadingDelete: true > lifecycleCondition: > age: 10 > createdBefore: "2020-01-01" > daysSinceCustomTime: 5 > numNewerVersions: 2 > withState: ARCHIVED > name: my-cloud-storage-bucket > publicAccessPrevention: true > retentionPeriodDays: 30 > ``` ##### gcp.buckets[].lifecycleCondition.age Condition is satisfied when the object reaches the specified age in days. These will be deleted. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > buckets: > - cascadingDelete: true > lifecycleCondition: > age: 10 > createdBefore: "2020-01-01" > daysSinceCustomTime: 5 > numNewerVersions: 2 > withState: ARCHIVED > name: my-cloud-storage-bucket > publicAccessPrevention: true > retentionPeriodDays: 30 > ``` ##### gcp.buckets[].lifecycleCondition.createdBefore Condition is satisfied when the object is created before midnight on the specified date. These will be deleted. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > buckets: > - cascadingDelete: true > lifecycleCondition: > age: 10 > createdBefore: "2020-01-01" > daysSinceCustomTime: 5 > numNewerVersions: 2 > withState: ARCHIVED > name: my-cloud-storage-bucket > publicAccessPrevention: true > retentionPeriodDays: 30 > ``` ##### gcp.buckets[].lifecycleCondition.daysSinceCustomTime Condition is satisfied when the specified number of days have passed since the date and time specified in an object's Custom-Time metadata field. Relevant information: - [https://cloud.google.com/storage/docs/lifecycle#dayssincecustomtime](https://cloud.google.com/storage/docs/lifecycle#dayssincecustomtime) - [https://cloud.google.com/storage/docs/metadata#custom-time](https://cloud.google.com/storage/docs/metadata#custom-time) Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > buckets: > - cascadingDelete: true > lifecycleCondition: > age: 10 > createdBefore: "2020-01-01" > daysSinceCustomTime: 5 > numNewerVersions: 2 > withState: ARCHIVED > name: my-cloud-storage-bucket > publicAccessPrevention: true > retentionPeriodDays: 30 > ``` ##### gcp.buckets[].lifecycleCondition.numNewerVersions Condition is satisfied when the object has the specified number of newer versions. The older versions will be deleted. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > buckets: > - cascadingDelete: true > lifecycleCondition: > age: 10 > createdBefore: "2020-01-01" > daysSinceCustomTime: 5 > numNewerVersions: 2 > withState: ARCHIVED > name: my-cloud-storage-bucket > publicAccessPrevention: true > retentionPeriodDays: 30 > ``` ##### gcp.buckets[].lifecycleCondition.withState Condition is satisfied when the object has the specified state. Type: `enum`
Required: `false`
Allowed values: *(empty string)*, `ANY`, `ARCHIVED`, `LIVE`
> **Example** > ```yaml > spec: > gcp: > buckets: > - cascadingDelete: true > lifecycleCondition: > age: 10 > createdBefore: "2020-01-01" > daysSinceCustomTime: 5 > numNewerVersions: 2 > withState: ARCHIVED > name: my-cloud-storage-bucket > publicAccessPrevention: true > retentionPeriodDays: 30 > ``` #### gcp.buckets[].name The name of the bucket Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > gcp: > buckets: > - cascadingDelete: true > lifecycleCondition: > age: 10 > createdBefore: "2020-01-01" > daysSinceCustomTime: 5 > numNewerVersions: 2 > withState: ARCHIVED > name: my-cloud-storage-bucket > publicAccessPrevention: true > retentionPeriodDays: 30 > ``` #### gcp.buckets[].publicAccessPrevention Public access prevention allows you to prevent public access to your bucket. Relevant information: - [https://cloud.google.com/storage/docs/public-access-prevention](https://cloud.google.com/storage/docs/public-access-prevention) Type: `boolean`
Required: `false`
Default value: `false`
> **Example** > ```yaml > spec: > gcp: > buckets: > - cascadingDelete: true > lifecycleCondition: > age: 10 > createdBefore: "2020-01-01" > daysSinceCustomTime: 5 > numNewerVersions: 2 > withState: ARCHIVED > name: my-cloud-storage-bucket > publicAccessPrevention: true > retentionPeriodDays: 30 > ``` #### gcp.buckets[].retentionPeriodDays The number of days to hold objects in the bucket before it is allowed to delete them. Type: `integer`
Required: `false`
Value range: `1`-`36500`
> **Example** > ```yaml > spec: > gcp: > buckets: > - cascadingDelete: true > lifecycleCondition: > age: 10 > createdBefore: "2020-01-01" > daysSinceCustomTime: 5 > numNewerVersions: 2 > withState: ARCHIVED > name: my-cloud-storage-bucket > publicAccessPrevention: true > retentionPeriodDays: 30 > ``` ### gcp.permissions List of *additional* permissions that should be granted to your application for accessing external GCP resources that have not been provisioned through Nais. Type: `array`
Required: `false`
Availability: GCP
> **Example** > ```yaml > spec: > gcp: > permissions: > - resource: > apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1 > kind: Project > name: myteam-dev-ab23 > role: roles/cloudsql.client > ``` #### gcp.permissions[].resource IAM resource to bind the role to. Type: `object`
Required: `true`
> **Example** > ```yaml > spec: > gcp: > permissions: > - resource: > apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1 > kind: Project > name: myteam-dev-ab23 > role: roles/cloudsql.client > ``` ##### gcp.permissions[].resource.apiVersion Kubernetes *APIVersion*. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > gcp: > permissions: > - resource: > apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1 > kind: Project > name: myteam-dev-ab23 > role: roles/cloudsql.client > ``` ##### gcp.permissions[].resource.kind Kubernetes *Kind*. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > gcp: > permissions: > - resource: > apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1 > kind: Project > name: myteam-dev-ab23 > role: roles/cloudsql.client > ``` ##### gcp.permissions[].resource.name Kubernetes *Name*. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > permissions: > - resource: > apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1 > kind: Project > name: myteam-dev-ab23 > role: roles/cloudsql.client > ``` #### gcp.permissions[].role Name of the GCP role to bind the resource to. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > gcp: > permissions: > - resource: > apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1 > kind: Project > name: myteam-dev-ab23 > role: roles/cloudsql.client > ``` ### gcp.sqlInstances Provision database instances and connect them to your application. Only one item allowed in the list. Relevant information: - [https://doc.dev-nais.cloud.nais.io/persistence/postgres/](https://doc.dev-nais.cloud.nais.io/persistence/postgres/) - [https://cloud.google.com/sql/docs/postgres/instance-settings#impact](https://cloud.google.com/sql/docs/postgres/instance-settings#impact) Type: `array`
Required: `false`
Availability: GCP
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].autoBackupHour If specified, run automatic backups of the SQL database at the given hour. Note that this will backup the whole SQL instance, and not separate databases. Restores are done using the Google Cloud Console. Type: `integer`
Required: `false`
Value range: `0`-`23`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].cascadingDelete Remove the entire Postgres server including all data when the Kubernetes resource is deleted. *THIS IS A DESTRUCTIVE OPERATION*! Set cascading delete only when you want to remove data forever. Type: `boolean`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].collation Sort order for `ORDER BY ...` clauses. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].databases List of one database or less(!) that should be created on this Postgres server. If not present, a default database with the same name as the application will be created. Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ##### gcp.sqlInstances[].databases[].envVarPrefix Prefix to add to environment variables made available for database connection. If switching to `envVarPrefix` you need to [reset database credentials](https://docs.nais.io/persistence/cloudsql/how-to/reset-database-credentials/). Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ##### gcp.sqlInstances[].databases[].name Database name. *Be aware that only one database with this name is allowed in a namespace, regardless of which SQLInstance it belongs to* Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ##### gcp.sqlInstances[].databases[].users Add extra users for database access. These users need to be manually given access to database tables. Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ###### gcp.sqlInstances[].databases[].users[].name User name. Type: `string`
Required: `true`
Pattern: `^[_a-zA-Z][-_a-zA-Z0-9]+$`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].diskAutoresize When set to true, GCP will automatically increase storage by XXX for the database when disk usage is above the high water mark. Setting this field to true also disables manual control over disk size, i.e. the `diskSize` parameter will be ignored. Relevant information: - [https://cloud.google.com/sql/docs/postgres/instance-settings#threshold](https://cloud.google.com/sql/docs/postgres/instance-settings#threshold) Type: `boolean`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].diskAutoresizeLimit The maximum size, in GB, to which storage capacity can be automatically increased. The default value is 0, which specifies that there is no limit. Type: `integer`
Required: `false`
Default value: `0`
Value range: `0`-`1000`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].diskSize How much hard drive space to allocate for the SQL server, in gigabytes. This parameter is used when first provisioning a server. Disk size can be changed using this field *only when diskAutoresize is set to false*. Type: `integer`
Required: `false`
Minimum value: `10`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].diskType Disk type to use for storage in the database. Type: `enum`
Required: `false`
Allowed values: `HDD`, `SSD`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].flags Set flags to control the behavior of the instance. Be aware that Nais *does not validate* these flags, so take extra care to make sure the values match against the specification, otherwise your deployment will seemingly work OK, but the database flags will not function as expected. > **Experimental feature** > This feature has not undergone much testing, and is subject to API change, instability, or removal. Relevant information: - [https://cloud.google.com/sql/docs/postgres/flags#list-flags-postgres](https://cloud.google.com/sql/docs/postgres/flags#list-flags-postgres) Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ##### gcp.sqlInstances[].flags[].name Name of the flag. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ##### gcp.sqlInstances[].flags[].value Value of the flag. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].highAvailability When set to true this will set up standby database for failover. Type: `boolean`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].insights Configures query insights which are now default for new sql instances. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ##### gcp.sqlInstances[].insights.enabled True if Query Insights feature is enabled. Type: `boolean`
Required: `false`
Default value: `true`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ##### gcp.sqlInstances[].insights.queryStringLength Maximum query length stored in bytes. Between 256 and 4500. Default to 1024. Type: `integer`
Required: `false`
Default value: `1024`
Value range: `256`-`4500`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ##### gcp.sqlInstances[].insights.recordApplicationTags True if Query Insights will record application tags from query when enabled. Type: `boolean`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ##### gcp.sqlInstances[].insights.recordClientAddress True if Query Insights will record client address when enabled. Type: `boolean`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].maintenance Desired maintenance window for database updates. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ##### gcp.sqlInstances[].maintenance.day Type: `integer`
Required: `true`
Value range: `1`-`7`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ##### gcp.sqlInstances[].maintenance.hour Type: `integer`
Required: `true`
Value range: `0`-`23`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].name The name of the instance, if omitted the application name will be used. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].pointInTimeRecovery Enables point-in-time recovery for sql instances using write-ahead logs. Type: `boolean`
Required: `false`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].retainedBackups Number of daily backups to retain. Defaults to 7 backups. The number of retained backups must be greater or equal to TransactionLogRetentionDays. Relevant information: - [https://cloud.google.com/sql/docs/postgres/backup-recovery/backups](https://cloud.google.com/sql/docs/postgres/backup-recovery/backups) Type: `integer`
Required: `false`
Default value: `7`
Value range: `1`-`365`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].tier Server tier, i.e. how much CPU and memory allocated. Available tiers are `db-f1-micro`, `db-g1-small` and custom `db-custom-CPU-RAM`. Custom instances must specify memory as a multiple of 256 MB and at least 3.75 GB (e.g. `db-custom-1-3840` for 1 cpu, 3840 MB ram). The smallest possible instance is `db-f1-micro`, which is recommended only for development instances. For production workloads, please specify at least `db-custom-1-3840`. Type: `string`
Required: `true`
Pattern: `db-.+`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].transactionLogRetentionDays The number of days of transaction logs gcp retains for point in time restores. Relevant information: - [https://cloud.google.com/sql/docs/mysql/backup-recovery/backups#retention](https://cloud.google.com/sql/docs/mysql/backup-recovery/backups#retention) Type: `integer`
Required: `false`
Default value: `7`
Value range: `1`-`7`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` #### gcp.sqlInstances[].type PostgreSQL version. Relevant information: - [https://cloud.google.com/sql/docs/postgres/instance-settings](https://cloud.google.com/sql/docs/postgres/instance-settings) Type: `enum`
Required: `true`
Allowed values: `POSTGRES_12`, `POSTGRES_13`, `POSTGRES_14`, `POSTGRES_15`, `POSTGRES_16`, `POSTGRES_17`, `POSTGRES_18`
> **Example** > ```yaml > spec: > gcp: > sqlInstances: > - autoBackupHour: 1 > cascadingDelete: true > collation: nb_NO.UTF8 > databases: > - envVarPrefix: DB > name: mydatabase > users: > - name: extra_user > diskAutoresize: true > diskAutoresizeLimit: 60 > diskSize: 30 > diskType: SSD > flags: > - name: max_connections > value: "50" > highAvailability: true > insights: > enabled: true > queryStringLength: 4500 > recordApplicationTags: true > recordClientAddress: true > maintenance: > day: 1 > hour: 4 > name: myinstance > pointInTimeRecovery: true > retainedBackups: 14 > tier: db-f1-micro > transactionLogRetentionDays: 3 > type: POSTGRES_18 > ``` ## image Your Naisjob's Docker image location and tag. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > image: navikt/testapp:69.0.0 > ``` ## kafka Enable Aiven Kafka for your Naisjob. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > kafka: > pool: nav-dev > streams: true > ``` ### kafka.pool Configures your application to access an Aiven Kafka cluster. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > kafka: > pool: nav-dev > ``` ### kafka.streams Allow this app to use kafka streams Relevant information: - [https://doc.dev-nais.cloud.nais.io/persistence/kafka/how-to/internal](https://doc.dev-nais.cloud.nais.io/persistence/kafka/how-to/internal) Type: `boolean`
Required: `false`
Default value: `false`
Availability: GCP
> **Example** > ```yaml > spec: > kafka: > streams: true > ``` ## liveness Many Naisjobs running for long periods of time eventually transition to broken states, and cannot recover except by being restarted. Kubernetes provides liveness probes to detect and remedy such situations. Read more about this over at the [Kubernetes probes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/). Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > liveness: > failureThreshold: 10 > initialDelay: 20 > path: /isalive > periodSeconds: 5 > port: 8080 > timeout: 1 > ``` ### liveness.failureThreshold When a Pod starts, and the probe fails, Kubernetes will try *failureThreshold* times before giving up. Giving up in case of a startup probe means restarting the Pod. Type: `integer`
Required: `false`
Default value: `3`
> **Example** > ```yaml > spec: > liveness: > failureThreshold: 10 > ``` ### liveness.initialDelay Number of seconds after the container has started before startup probes are initiated. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > liveness: > initialDelay: 20 > ``` ### liveness.path HTTP endpoint path that signals 200 OK if the application has started successfully. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > liveness: > path: /isalive > ``` ### liveness.periodSeconds How often (in seconds) to perform the probe. Type: `integer`
Required: `false`
Default value: `10`
> **Example** > ```yaml > spec: > liveness: > periodSeconds: 5 > ``` ### liveness.port Port for the startup probe. Defaults to application port, as defined in `.spec.port`. Type: `integer`
Required: `false`
Default value: `.spec.port`
Value range: `1`-`65535`
> **Example** > ```yaml > spec: > liveness: > port: 8080 > ``` ### liveness.timeout Number of seconds after which the probe times out. Type: `integer`
Required: `false`
Default value: `1`
> **Example** > ```yaml > spec: > liveness: > timeout: 1 > ``` ## maskinporten Configures a Maskinporten client for this Naisjob. See [Maskinporten](https://doc.nais.io/security/auth/maskinporten/) for more details. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > maskinporten: > enabled: true > scopes: > consumes: > - name: skatt:scope.read > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ### maskinporten.enabled If enabled, provisions and configures a Maskinporten client with consumed scopes and/or Exposed scopes with DigDir. Type: `boolean`
Required: `true`
Default value: `false`
Availability: team namespaces
> **Example** > ```yaml > spec: > maskinporten: > enabled: true > ``` ### maskinporten.scopes Schema to configure Maskinporten clients with consumed scopes and/or exposed scopes. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > consumes: > - name: skatt:scope.read > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` #### maskinporten.scopes.consumes This is the Schema for the consumes and exposes API. `consumes` is a list of scopes that your client can request access to. Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > consumes: > - name: skatt:scope.read > ``` ##### maskinporten.scopes.consumes[].name The scope consumed by the application to gain access to an external organization API. Ensure that the NAV organization has been granted access to the scope prior to requesting access. Relevant information: - [https://doc.dev-nais.cloud.nais.io/security/auth/maskinporten/#consume-scopes](https://doc.dev-nais.cloud.nais.io/security/auth/maskinporten/#consume-scopes) Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > consumes: > - name: skatt:scope.read > ``` #### maskinporten.scopes.exposes `exposes` is a list of scopes your application want to expose to other organization where access to the scope is based on organization number. Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ##### maskinporten.scopes.exposes[].accessibleForAll Allow any organization to access the scope. Type: `boolean`
Required: `false`
Default value: `false`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ##### maskinporten.scopes.exposes[].allowedIntegrations Whitelisting of integration's allowed. Default is `maskinporten` Relevant information: - [https://docs.digdir.no/maskinporten_guide_apitilbyder.html#scope-begrensninger](https://docs.digdir.no/maskinporten_guide_apitilbyder.html#scope-begrensninger) Type: `array`
Required: `false`
Default value: `maskinporten`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ##### maskinporten.scopes.exposes[].atMaxAge Max time in seconds for a issued access_token. Default is `30` sec. Type: `integer`
Required: `false`
Default value: `30`
Value range: `30`-`680`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ##### maskinporten.scopes.exposes[].consumers External consumers granted access to this scope and able to request access_token. Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ###### maskinporten.scopes.exposes[].consumers[].name This is a describing field intended for clarity not used for any other purpose. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ###### maskinporten.scopes.exposes[].consumers[].orgno The external business/organization number. Type: `string`
Required: `true`
Pattern: `^\d{9}$`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ##### maskinporten.scopes.exposes[].delegationSource Delegation source for the scope. Default is empty, which means no delegation is allowed. Relevant information: - [https://docs.digdir.no/docs/Maskinporten/maskinporten_func_delegering](https://docs.digdir.no/docs/Maskinporten/maskinporten_func_delegering) Type: `enum`
Required: `false`
Allowed values: `altinn`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ##### maskinporten.scopes.exposes[].enabled If Enabled the configured scope is available to be used and consumed by organizations granted access. Type: `boolean`
Required: `true`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ##### maskinporten.scopes.exposes[].name The actual subscope combined with `Product`. Ensure that `` matches `Pattern`. Type: `string`
Required: `true`
Default value: `false`
Pattern: `^([a-zæøå0-9]+\/?)+(\:[a-zæøå0-9]+)*[a-zæøå0-9]+(\.[a-zæøå0-9]+)*$`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ##### maskinporten.scopes.exposes[].product The product-area your application belongs to e.g. arbeid, helse ... This will be included in the final scope `nav:`. Type: `string`
Required: `true`
Pattern: `^[a-z0-9]+$`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ##### maskinporten.scopes.exposes[].separator Separator is the character that separates `product` and `name` in the final scope: `scope := :` This overrides the default separator. The default separator is `:`. If `name` contains `/`, the default separator is instead `/`. Type: `string`
Required: `false`
Pattern: `^[\/:.]$`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ##### maskinporten.scopes.exposes[].visibility Visibility controls the scope's visibility. Public scopes are visible for everyone. Private scopes are only visible for the organization that owns the scope as well as organizations that have been granted consumer access. Type: `enum`
Required: `false`
Default value: `public`
Allowed values: `private`, `public`
> **Example** > ```yaml > spec: > maskinporten: > scopes: > exposes: > - accessibleForAll: true > allowedIntegrations: > - maskinporten > atMaxAge: 30 > consumers: > - name: KST > orgno: "123456789" > delegationSource: delegation-source > enabled: true > name: scope.read > product: arbeid > separator: ':' > visibility: public > ``` ## observability Configuration options related to application observability. Relevant information: - [https://doc.dev-nais.cloud.nais.io/observability/](https://doc.dev-nais.cloud.nais.io/observability/) Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > observability: > autoInstrumentation: > destinations: > - id: my-destination > enabled: true > runtime: java > logging: > destinations: > - id: my-destination > enabled: true > tracing: > enabled: true > ``` ### observability.autoInstrumentation Auto-instrumentiation for your application using OpenTelemetry for collecting telemetry data such as traces, metrics and logs. Relevant information: - [https://doc.dev-nais.cloud.nais.io/observability/auto-instrumentation/](https://doc.dev-nais.cloud.nais.io/observability/auto-instrumentation/) Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > observability: > autoInstrumentation: > destinations: > - id: my-destination > enabled: true > runtime: java > ``` #### observability.autoInstrumentation.destinations Destinations are where telemetry data should be stored. Relevant information: - [https://doc.dev-nais.cloud.nais.io/observability/reference/auto-config/#destinations](https://doc.dev-nais.cloud.nais.io/observability/reference/auto-config/#destinations) Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > observability: > autoInstrumentation: > destinations: > - id: my-destination > ``` ##### observability.autoInstrumentation.destinations[].id Destination ID. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > observability: > autoInstrumentation: > destinations: > - id: my-destination > ``` #### observability.autoInstrumentation.enabled Enable automatic instrumentation of your application using OpenTelemetry Agent. Type: `boolean`
Required: `false`
> **Example** > ```yaml > spec: > observability: > autoInstrumentation: > enabled: true > ``` #### observability.autoInstrumentation.runtime Application runtime. Supported runtimes are `java`, `nodejs`, `python`, `sdk`. Type: `enum`
Required: `false`
Allowed values: `dotnet`, `java`, `nodejs`, `python`, `sdk`
> **Example** > ```yaml > spec: > observability: > autoInstrumentation: > runtime: java > ``` ### observability.logging Configure logging for your application. Relevant information: - [https://doc.dev-nais.cloud.nais.io/observability/logging/](https://doc.dev-nais.cloud.nais.io/observability/logging/) Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > observability: > logging: > destinations: > - id: my-destination > enabled: true > ``` #### observability.logging.destinations Log destinations for where to forward application logs for persistent storage. Leave empty to use default destinations. Relevant information: - [https://doc.dev-nais.cloud.nais.io/observability/logging/reference/destinations/#destinations](https://doc.dev-nais.cloud.nais.io/observability/logging/reference/destinations/#destinations) Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > observability: > logging: > destinations: > - id: my-destination > ``` ##### observability.logging.destinations[].id Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > observability: > logging: > destinations: > - id: my-destination > ``` #### observability.logging.enabled Enable forwarding of application logs to persistent storage. Type: `boolean`
Required: `false`
Default value: `true`
> **Example** > ```yaml > spec: > observability: > logging: > enabled: true > ``` ## openSearch To get your own OpenSearch instance head over to the IaC-repo to provision each instance. See [navikt/aiven-iac](https://github.com/navikt/aiven-iac) repository. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > openSearch: > access: readwrite > instance: my-open-search-instance > ``` ### openSearch.access Access level for OpenSearch user Type: `enum`
Required: `false`
Default value: `read`
Allowed values: `admin`, `read`, `readwrite`, `write`
> **Example** > ```yaml > spec: > openSearch: > access: readwrite > ``` ### openSearch.instance Configure your application to access your OpenSearch instance. The last part of the name used when creating the instance (ie. opensearch-{team}-{instance}) Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > openSearch: > instance: my-open-search-instance > ``` ## parallelism For running pods in parallel. If it is specified as 0, then the Job is effectively paused until it is increased. Relevant information: - [https://kubernetes.io/docs/concepts/workloads/controllers/job/#controlling-parallelism](https://kubernetes.io/docs/concepts/workloads/controllers/job/#controlling-parallelism) Type: `integer`
Required: `false`
Default value: `1`
> **Example** > ```yaml > spec: > parallelism: 1 > ``` ## postgres Postgres is the deprecated integration with a single legacy Postgres cluster. Use uses.postgres for new integrations. > **Experimental feature** > This feature has not undergone much testing, and is subject to API change, instability, or removal. Type: `object`
Required: `false`
### postgres.clusterName ClusterName is the name of the Postgres cluster. Type: `string`
Required: `true`
Pattern: `^[a-z0-9][a-z0-9-]{1,49}$`
## preStopHook PreStopHook is called immediately before a container is terminated due to an API request or management event such as liveness/startup probe failure, preemption, resource contention, etc. The handler is not called if the container crashes or exits by itself. The reason for termination is passed to the handler. Relevant information: - [https://doc.dev-nais.cloud.nais.io/workloads/explanations/good-practices/#handles-termination-gracefully](https://doc.dev-nais.cloud.nais.io/workloads/explanations/good-practices/#handles-termination-gracefully) - [https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks) Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > preStopHook: > exec: > command: > - ./my > - --shell > - script > http: > path: /internal/stop > port: 8080 > ``` ### preStopHook.exec Command that should be run inside the main container just before the pod is shut down by Kubernetes. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > preStopHook: > exec: > command: > - ./my > - --shell > - script > ``` #### preStopHook.exec.command Command is the command line to execute inside the container before the pod is shut down. The command is not run inside a shell, so traditional shell instructions (pipes, redirects, etc.) won't work. To use a shell, you need to explicitly call out to that shell. If the exit status is non-zero, the pod will still be shut down, and marked as `Failed`. Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > preStopHook: > exec: > command: > - ./my > - --shell > - script > ``` ### preStopHook.http HTTP GET request that is called just before the pod is shut down by Kubernetes. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > preStopHook: > http: > path: /internal/stop > port: 8080 > ``` #### preStopHook.http.path Path to access on the HTTP server. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > preStopHook: > http: > path: /internal/stop > ``` #### preStopHook.http.port Port to access on the container. Defaults to application port, as defined in `.spec.port`. Type: `integer`
Required: `false`
Default value: `.spec.port`
Value range: `1`-`65535`
> **Example** > ```yaml > spec: > preStopHook: > http: > port: 8080 > ``` ## readiness Sometimes, Naisjobs are temporarily unable to serve traffic. For example, an Naisjob might need to load large data or configuration files during startup, or depend on external services after startup. In such cases, you don't want to kill the Naisjob, but you don’t want to send it requests either. Kubernetes provides readiness probes to detect and mitigate these situations. A pod with containers reporting that they are not ready does not receive traffic through Kubernetes Services. Read more about this over at the [Kubernetes readiness documentation](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/). Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > readiness: > failureThreshold: 10 > initialDelay: 20 > path: /isready > periodSeconds: 5 > port: 8080 > timeout: 1 > ``` ### readiness.failureThreshold When a Pod starts, and the probe fails, Kubernetes will try *failureThreshold* times before giving up. Giving up in case of a startup probe means restarting the Pod. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > readiness: > failureThreshold: 10 > ``` ### readiness.initialDelay Number of seconds after the container has started before startup probes are initiated. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > readiness: > initialDelay: 20 > ``` ### readiness.path HTTP endpoint path that signals 200 OK if the application has started successfully. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > readiness: > path: /isready > ``` ### readiness.periodSeconds How often (in seconds) to perform the probe. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > readiness: > periodSeconds: 5 > ``` ### readiness.port Port for the startup probe. Defaults to application port, as defined in `.spec.port`. Type: `integer`
Required: `false`
Default value: `.spec.port`
Value range: `1`-`65535`
> **Example** > ```yaml > spec: > readiness: > port: 8080 > ``` ### readiness.timeout Number of seconds after which the probe times out. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > readiness: > timeout: 1 > ``` ## resources When Containers have [resource requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) specified, the Kubernetes scheduler can make better decisions about which nodes to place pods on. Relevant information: - [https://doc.dev-nais.cloud.nais.io/workloads/explanations/good-practices/#set-reasonable-resource-requests-and-limits](https://doc.dev-nais.cloud.nais.io/workloads/explanations/good-practices/#set-reasonable-resource-requests-and-limits) Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > resources: > limits: > cpu: 500m > memory: 512Mi > requests: > cpu: 200m > memory: 256Mi > ``` ### resources.limits Limit defines the maximum amount of resources a container can use before getting evicted. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > resources: > limits: > cpu: 500m > memory: 512Mi > ``` #### resources.limits.cpu Type: `string`
Required: `false`
Pattern: `^\d+m?$`
> **Example** > ```yaml > spec: > resources: > limits: > cpu: 500m > ``` #### resources.limits.memory Type: `string`
Required: `false`
Default value: `512Mi`
Pattern: `^\d+[KMG]i$`
> **Example** > ```yaml > spec: > resources: > limits: > memory: 512Mi > ``` ### resources.requests Request defines the amount of resources a container is allocated on startup. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > resources: > requests: > cpu: 200m > memory: 256Mi > ``` #### resources.requests.cpu Type: `string`
Required: `false`
Default value: `200m`
Pattern: `^\d+m?$`
> **Example** > ```yaml > spec: > resources: > requests: > cpu: 200m > ``` #### resources.requests.memory Type: `string`
Required: `false`
Default value: `256Mi`
Pattern: `^\d+[KMG]i$`
> **Example** > ```yaml > spec: > resources: > requests: > memory: 256Mi > ``` ## restartPolicy RestartPolicy describes how the container should be restarted. Only one of the following restart policies may be specified. If none of the following policies is specified, the default one is Never. Read more about [Kubernetes handling pod and container failures](https://kubernetes.io/docs/concepts/workloads/controllers/job/#handling-pod-and-container-failures) Type: `enum`
Required: `false`
Default value: `Never`
Allowed values: `Never`, `OnFailure`
> **Example** > ```yaml > spec: > restartPolicy: Never > ``` ## schedule The [Cron](https://en.wikipedia.org/wiki/Cron) schedule for running the Naisjob. If not specified, the Naisjob will be run as a one-shot Job. The timezone for Naisjobs defaults to UTC. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > schedule: '*/5 4 3 2 1' > ``` ## skipCaBundle Whether to skip injection of NAV certificate authority bundle or not. Defaults to false. Type: `boolean`
Required: `false`
> **Example** > ```yaml > spec: > skipCaBundle: true > ``` ## startup Kubernetes uses startup probes to know when a container application has started. If such a probe is configured, it disables liveness and readiness checks until it succeeds, making sure those probes don't interfere with the application startup. This can be used to adopt liveness checks on slow starting containers, avoiding them getting killed by Kubernetes before they are up and running. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > startup: > failureThreshold: 10 > initialDelay: 20 > path: /started > periodSeconds: 5 > port: 8080 > timeout: 1 > ``` ### startup.failureThreshold When a Pod starts, and the probe fails, Kubernetes will try *failureThreshold* times before giving up. Giving up in case of a startup probe means restarting the Pod. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > startup: > failureThreshold: 10 > ``` ### startup.initialDelay Number of seconds after the container has started before startup probes are initiated. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > startup: > initialDelay: 20 > ``` ### startup.path HTTP endpoint path that signals 200 OK if the application has started successfully. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > startup: > path: /started > ``` ### startup.periodSeconds How often (in seconds) to perform the probe. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > startup: > periodSeconds: 5 > ``` ### startup.port Port for the startup probe. Defaults to application port, as defined in `.spec.port`. Type: `integer`
Required: `false`
Default value: `.spec.port`
Value range: `1`-`65535`
> **Example** > ```yaml > spec: > startup: > port: 8080 > ``` ### startup.timeout Number of seconds after which the probe times out. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > startup: > timeout: 1 > ``` ## successfulJobsHistoryLimit Specify how many completed Jobs should be kept. Type: `integer`
Required: `false`
Default value: `3`
> **Example** > ```yaml > spec: > successfulJobsHistoryLimit: 2 > ``` ## terminationGracePeriodSeconds The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. For most jobs, the default is more than enough. Defaults to 30 seconds. Type: `integer`
Required: `false`
Value range: `0`-`180`
> **Example** > ```yaml > spec: > terminationGracePeriodSeconds: 60 > ``` ## timeZone TimeZone for Naisjobs. Defaults to UTC. Only used if Schedule is specified. Specify a valid [IANA timezone](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones). Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > timeZone: Europe/Oslo > ``` ## ttl After the specified TTL, the naisjob will be deleted. Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > ttl: 1h > ``` ## ttlSecondsAfterFinished Specify the number of seconds to wait before removing the Job after it has finished (either Completed or Failed). If the field is unset, this Job won't be cleaned up by the TTL controller after it finishes. Type: `integer`
Required: `false`
> **Example** > ```yaml > spec: > ttlSecondsAfterFinished: 60 > ``` ## uses Uses configures resources used by this Naisjob. Type: `object`
Required: `false`
> **Example** > ```yaml > spec: > uses: > postgres: > - branch: main > envPrefix: MYDB_ > name: my-postgres > role: readwrite > ``` ### uses.postgres Postgres configures access to CloudNativePG Postgres instances in the workload namespace. Each Postgres instance may occur only once. When more than one instance is configured, all but one entry must set a unique envPrefix. Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > uses: > postgres: > - branch: main > envPrefix: MYDB_ > name: my-postgres > role: readwrite > ``` #### uses.postgres[].branch Branch selects an existing local branch of this Postgres. When omitted, access follows the observed active branch. An explicit branch never falls back to another branch when the selected branch is unavailable. Type: `string`
Required: `false`
Pattern: `^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
> **Example** > ```yaml > spec: > uses: > postgres: > - branch: main > envPrefix: MYDB_ > name: my-postgres > role: readwrite > ``` #### uses.postgres[].envPrefix EnvPrefix is prepended verbatim to every environment variable for this Postgres instance. Include a separator such as a trailing underscore when desired. Type: `string`
Required: `false`
Pattern: `^[A-Za-z_][A-Za-z0-9_]*$`
> **Example** > ```yaml > spec: > uses: > postgres: > - branch: main > envPrefix: MYDB_ > name: my-postgres > role: readwrite > ``` #### uses.postgres[].name Name of the Postgres resource in the workload namespace. Type: `string`
Required: `true`
Pattern: `^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
> **Example** > ```yaml > spec: > uses: > postgres: > - branch: main > envPrefix: MYDB_ > name: my-postgres > role: readwrite > ``` #### uses.postgres[].role Role controls the database privileges granted to the workload. Admin access also provisions a separate readwrite credential for ordinary application traffic. Type: `enum`
Required: `false`
Default value: `admin`
Allowed values: `admin`, `read`, `readwrite`
> **Example** > ```yaml > spec: > uses: > postgres: > - branch: main > envPrefix: MYDB_ > name: my-postgres > role: readwrite > ``` ## valkey List of Valkey instances this job needs credentials for. Must be owned by same team. Relevant information: - [https://doc.dev-nais.cloud.nais.io/persistence/valkey/](https://doc.dev-nais.cloud.nais.io/persistence/valkey/) Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > valkey: > - access: readwrite > instance: cache > ``` ### valkey[].access Access level for Valkey user Type: `enum`
Required: `false`
Default value: `read`
Allowed values: `admin`, `read`, `readwrite`, `write`
> **Example** > ```yaml > spec: > valkey: > - access: readwrite > instance: cache > ``` ### valkey[].instance The last part of the name used when creating the instance (ie. valkey-{team}-{instance}) Type: `string`
Required: `false`
> **Example** > ```yaml > spec: > valkey: > - access: readwrite > instance: cache > ``` ## vault Provides secrets management, identity-based access, and encrypting application data for auditing of secrets for applications, systems, and users. Relevant information: - [https://github.com/navikt/vault-iac/tree/master/doc](https://github.com/navikt/vault-iac/tree/master/doc) Type: `object`
Required: `false`
Availability: on-premises
> **Example** > ```yaml > spec: > vault: > enabled: true > paths: > - format: env > kvPath: /kv/preprod/fss/application/namespace > mountPath: /var/run/secrets/nais.io/vault > ``` ### vault.enabled If set to true, fetch secrets from Vault and inject into the pods. Type: `boolean`
Required: `false`
> **Example** > ```yaml > spec: > vault: > enabled: true > ``` ### vault.paths List of secret paths to be read from Vault and injected into the pod's filesystem. Overriding the `paths` array is optional, and will give you fine-grained control over which Vault paths that will be mounted on the file system. By default, the list will contain an entry with `kvPath: /kv////` `mountPath: /var/run/secrets/nais.io/vault` that will always be attempted to be mounted. Type: `array`
Required: `false`
> **Example** > ```yaml > spec: > vault: > paths: > - format: env > kvPath: /kv/preprod/fss/application/namespace > mountPath: /var/run/secrets/nais.io/vault > ``` #### vault.paths[].format Format of the secret that should be processed. Type: `enum`
Required: `false`
Allowed values: *(empty string)*, `env`, `flatten`, `json`, `properties`, `yaml`
> **Example** > ```yaml > spec: > vault: > paths: > - format: env > kvPath: /kv/preprod/fss/application/namespace > mountPath: /var/run/secrets/nais.io/vault > ``` #### vault.paths[].kvPath Path to Vault key/value store that should be mounted into the file system. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > vault: > paths: > - format: env > kvPath: /kv/preprod/fss/application/namespace > mountPath: /var/run/secrets/nais.io/vault > ``` #### vault.paths[].mountPath File system path that the secret will be mounted into. Type: `string`
Required: `true`
> **Example** > ```yaml > spec: > vault: > paths: > - format: env > kvPath: /kv/preprod/fss/application/namespace > mountPath: /var/run/secrets/nais.io/vault > ```