AIStor Custom Resource Definition (Stable)

The following page includes the full contents of the AIStor Custom Resource Definition V1 (Stable) CustomResourceDefinition.

API Reference

Packages

aistor.min.io/v1

Package v1 - This page provides a quick automatically generated reference for the AIStor ObjectStore Operator aistor.min.io/v1 CRD.

Resource Types

Cache

Cache holds the configurations parameters for the Cache feature

Appears in:

Field Description Default Validation
enabled boolean Whether to enable the Cache feature.

CertificateConfig

CertificateConfig (certConfig) defines controlling attributes associated with any TLS certificate automatically generated by the AIStor ObjectStore Operator as part of object store creation. These fields have no effect if spec.disableAutocert: true.

Appears in:

Field Description Default Validation
commonName string The CommonName or CN attribute to associate with automatically generated TLS certificates. Optional: {}
organizationName string array Specify one or more OrganizationName or O attributes to associate to automatically generated TLS certificates. Optional: {}
dnsNames string array Specify one or more x.509 Subject Alternative Names (SAN) to associate to automatically generated TLS certificates. AIStor Server pods use SNI to determine which certificate to respond with based on the requested hostname. Optional: {}

CertificateStatus

CertificateStatus keeps track of all the certificates managed by the operator

Appears in:

Field Description Default Validation
autoCertEnabled boolean Registers whether we know if the object store has autocert enabled
customCertificates CustomCertificates Provides the output of the client, minio, andminioCAs custom TLS certificates manually added to the Operator. Optional: {}

Certificates

Certificates describe the fields that are Certificates related

Appears in:

Field Description Default Validation
disableAutoCert boolean Enables using Kubernetes-issued TLS certificates and signing for pods and services in the AIStor ObjectStore.
* Set true to explicitly disable automatic certificate generate.
* Set false (Default) to disable automatic certificate generation. (Default).
If disableAutoCert is set to true and .certificates.server is omitted, the AIStor ObjectStore deploys without TLS enabled.		 Optional: {}
config CertificateConfig Enables setting the CommonName, Organization, and dnsName attributes for all TLS certificates automatically generated by the ObjectStore Operator. Configuring this object has no effect if disableAutoCert is true. Optional: {}
server LocalCertificateReference array Enables Certificates with SNI support on each AIStor pod in the object store. If server is omitted and disableAutoCert is set to true, the AIStor ObjectStore deploys without TLS enabled.
Specify an array of Kubernetes Certificates secrets. The AIStor ObjectStore Operator copies the specified certificates to every AIStor server pod in the object store. When the AIStor pod/service responds to a Certificates connection request, it uses SNI to select the certificate with matching subjectAlternativeName.
Each element in the server array is an object containing the following fields:
* - name - The name of the Kubernetes secret containing the TLS certificate.
* - type - Specify kubernetes.io/tls		 Optional: {}
trustedCAs LocalCertificateReference array Allows AIStor server pods to verify client TLS certificates signed by a Certificate Authority not in the pod’s trust store.
Specify an array of Kubernetes Certificates secrets. The AIStor ObjectStore Operator copies the specified certificates to every AIStor server pod in the object store.
Each element in the trustedCAs array is an object containing the following fields:
* - name - The name of the Kubernetes secret containing the Certificate Authority.
* - type - Specify kubernetes.io/tls (when certificate is in the tls.crt) or cert-manager.io/v1 (when certificate is in the ca.crt)		 Optional: {}
KESClient LocalCertificateReference Enables mTLS authentication between the AIStor ObjectStore pods and MinIO KES. Required for enabling connectivity between the AIStor ObjectStore and MinIO KES.
Specify a Kubernetes Certificates secret. The MinIO Operator copies the specified certificate to every MinIO server pod in the object store. The secret must contain the following fields:
* name - The name of the Kubernetes secret containing the TLS certificate.
* type - Specify kubernetes.io/tls
The specified certificate must correspond to an identity on the KES server. See the KES Wiki https://github.com/minio/kes/wiki/Configuration#policy-configuration.
If deploying KES with the AIStor ObjectStore Operator, include the hash of the certificate as part of the «k8s-api-github-com-minio-operator-pkg-apis-minio-min-io-v2-kesconfig,kes» object specification.		 Optional: {}
client LocalCertificateReference array The secret must contain the following fields:
* name - The name of the Kubernetes secret containing the TLS certificate.
* type - Specify kubernetes.io/tls		 Optional: {}
certExpiryAlertThreshold integer Is the minimum number of days to expiry before an alert for an expiring certificate is fired. Optional: {}

CustomCertificateConfig

CustomCertificateConfig (customCertificateConfig) provides attributes associated of the TLS certificates manually added to the Operator as part of object store creation. These fields contain no data if there are no custom TLS certificates.

Appears in:

Field Description Default Validation
certName string Output one or more CertName attributes associated with the manually provided TLS certificates. Optional: {}
domains string array Output one or more Domains attributes associated with the manually provided TLS certificates. Optional: {}
expiry string Output one or more Expiry attributes associated with the manually provided TLS certificates. Optional: {}
expiresIn string Output one or more ExpiresIn attributes associated with the manually provided TLS certificates. Optional: {}
serialNo string Output one or more SerialNo attributes associated with the manually provided TLS certificates. Optional: {}

CustomCertificates

CustomCertificates (customCertificates) provides groupings of the TLS certificates manually added to the Operator as part of object store creation. These fields contain no data if there are no custom TLS certificates.

Appears in:

Field Description Default Validation
client CustomCertificateConfig array Client Optional: {}
minio CustomCertificateConfig array Minio Optional: {}
minioCAs CustomCertificateConfig array Certificate Authorities Optional: {}

Domains

Domains (domains) - List of domains used to access the object store from outside the kubernetes clusters. this will only configure AIStor for the domains listed, but external DNS configuration is still needed. The listed domains should include schema and port if any is used, i.e. https://minio.domain.com:8123

Appears in:

Field Description Default Validation
minio string array List of Domains used by AIStor. This will enable DNS style access to the object store where the bucket name is
inferred from a subdomain in the domain.
console string Domain used to expose the MinIO Console, this will configure the redirect on MinIO when visiting from the browser
If Console is exposed via a subpath, the domain should include it, i.e. https://console.domain.com:8123/subpath/

Encryption

Encryption configures encryption for the tenant if a KMS is present in the specified namespace/name

Appears in:

Field Description Default Validation
name string
namespace string
enclave string Enclave to be used for this tenant Optional: {}
identitySecret LocalObjectReference Reference a secret with the Identity to the enclave that is to be used for this tenant Optional: {}

FeatureStatus

FeatureStatus represents the status of a feature, which can be complex in the future, so we are using a struct to avoid painful migrations

Appears in:

Field Description Default Validation
enabled boolean Enabled is a boolean that tells if the feature is enabled or not

Features

Features (features) - Object describing which AIStor features to enable/disable in the AIStor ObjectStore.

Appears in:

Field Description Default Validation
bucketDNS boolean Specify true to allow clients to access buckets using the DNS path <bucket>.minio.default.svc.cluster.local. Defaults to false. Optional: {}
domains Domains Specify a list of domains used to access MinIO and Console. Optional: {}

FirewallSpec

FirewallSpec holds the configuration for the firewall sidecar

Appears in:

Field Description Default Validation
enabled boolean Whether to enable the Firewall feature.
image string Image The container image to use for Firewall. Optional: {}
imagePullPolicy PullPolicy The pull policy for the container image. Specify one of the following:
* Always
* Never
* IfNotPresent (Default)
Refer to the Kubernetes documentation for details https://kubernetes.io/docs/concepts/containers/images#updating-images		 Optional: {}
configuration LocalObjectReference Name of ConfigMap containing the Cache config Optional: {}

HealthStatus

Underlying type: string

HealthStatus represents whether the object store is healthy, with decreased service or offline

Appears in:

Field Description
green HealthStatusGreen indicates a healthy object store: all drives online
yellow HealthStatusYellow indicates a decreased resilience object store, some drives offline
red HealthStatusRed indicates the object store is offline, or lost write quorum

KESConfig

KESConfig (kes) defines the configuration of the https://github.com/minio/kes[MinIO Key Encryption Service] (KES) StatefulSet deployed as part of the MinIO ObjectStore. KES supports Server-Side Encryption of objects using an external Key Management Service (KMS).

Appears in:

Field Description Default Validation
replicas integer Specify the number of replica KES pods to deploy in the object store. Optional: {}
image string The container image to use for deploying MinIO KES. Optional: {}
imagePullPolicy PullPolicy The pull policy for the KES container image. Specify one of the following:
* Always
* Never
* IfNotPresent (Default)
Refer to the Kubernetes documentation for details https://kubernetes.io/docs/concepts/containers/images#updating-images		 Optional: {}
serviceAccountName string The https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/[Kubernetes Service Account] to use for running MinIO KES pods created as part of the ObjectStore. Optional: {}
kesSecret LocalObjectReference Specifies a Kubernetes opaque secret which contains environment variables to use for setting up the MinIO KES service. Required: {}
externalCertSecret LocalCertificateReference Enables Certificates with SNI support on each MinIO KES pod in the object store. If externalCertSecret is omitted and spec.disableAutoCert is set to true, MinIO KES pods deploy without TLS enabled.
Specify a Kubernetes Certificates secret.
The AIStor ObjectStore Operator copies the specified certificate to every MinIO pod in the object store. When the AIStor pod/service responds to a Certificates connection request, it uses SNI to select the certificate with matching subjectAlternativeName.
Specify an object containing the following fields:
* - name - The name of the Kubernetes secret containing the TLS certificate.
* - type - Specify kubernetes.io/tls		 Optional: {}
clientCertSecret LocalCertificateReference Specify a Kubernetes Certificates secret containing a custom root Certificate Authority and x.509 certificate to use for performing mTLS authentication with an external Key Management Service, such as Hashicorp Vault.
Specify an object containing the following fields:
* - name - The name of the Kubernetes secret containing the Certificate Authority and x.509 Certificate.
* - type - Specify kubernetes.io/tls		 Optional: {}
trustedCAs LocalCertificateReference array Allows KES pods to verify client TLS certificates signed by a Certificate Authority not in the pod’s trust store.
Specify an array of Kubernetes Certificates secrets.
The AIStor ObjectStore Operator copies the specified certificates to every KES pod in the object store.
Each element in the trustedCAs array is an object containing the following fields:
* - name - The name of the Kubernetes secret containing the Certificate Authority.
* - type - Specify kubernetes.io/tls (when the certificate is in tls.crt) or cert-manager.io/v1 (when the certificate is in ca.crt)		 Optional: {}
gcpCredentialSecretName string Specify the GCP default credentials to be used for KES to authenticate to GCP key store Optional: {}
gcpWorkloadIdentityPool string Specify the name of the workload identity pool (This is required for generating service account token) Optional: {}
annotations object (keys:string, values:string) If provided, use these annotations for KES Object Meta annotations Optional: {}
labels object (keys:string, values:string) If provided, use these labels for KES Object Meta labels Optional: {}
resources ResourceRequirements Object specification for specifying CPU and memory resources allocation or limits in the KES pods. Optional: {}
nodeSelector object (keys:string, values:string) The filter to select on which nodes to deploy MinIO KES pods. The Operator only selects those nodes whose labels match the specified selector.
See the Kubernetes documentation on https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ for more information.		 Optional: {}
tolerations Toleration array Specify one or more Kubernetes tolerations to apply to MinIO KES pods. Optional: {}
affinity Affinity Specify node affinity, pod affinity, and pod anti-affinity for the KES pods. Optional: {}
topologySpreadConstraints TopologySpreadConstraint array Specify one or more Kubernetes Topology Spread Constraints to apply to KES pods. Optional: {}
keyName string If provided, use this as the name of the key that KES creates on the KMS backend Optional: {}
securityContext PodSecurityContext Specify the Security Context of MinIO KES pods. The Operator supports only the following pod security fields:
* fsGroup
* fsGroupChangePolicy
* runAsGroup
* runAsNonRoot
* runAsUser
* seLinuxOptions		 Optional: {}
containerSecurityContext SecurityContext Specify the Security Context of MinIO KES pods.
env EnvVar array If provided, environment variables are added to the KES deployment. Optional: {}

LocalCertificateReference

LocalCertificateReference Contains a Kubernetes secret containing TLS certificates or Certificate Authority files for use with enabling TLS in the AIStor ObjectStore.

Appears in:

Field Description Default Validation
name string The name of the Kubernetes secret containing the TLS certificate or Certificate Authority file. Required: {}
type string The type of Kubernetes secret. Specify kubernetes.io/tls Optional: {}

Logging

Logging describes Logging for AIStor Object Stores.

Appears in:

Field Description Default Validation
json boolean
anonymous boolean
quiet boolean

ObjectStore

ObjectStore is kubernetes native object storage for AI.

Appears in:

Field Description Default Validation
apiVersion string aistor.min.io/v1
kind string ObjectStore
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
scheduler ObjectStoreScheduler
spec ObjectStoreSpec The root field for AIStor ObjectStore object. Required: {}

ObjectStoreScheduler

ObjectStoreScheduler Object describing Kubernetes Scheduler to use for deploying the MinIO ObjectStore.

Appears in:

Field Description Default Validation
name string Specify the name of the Kubernetes scheduler to be used to schedule ObjectStore pods Required: {}

ObjectStoreSpec

ObjectStoreSpec (spec) defines the configuration of a MinIO ObjectStore object.

The following parameters are specific to the aistor.min.io/v1 AIStor CRD API spec.

Appears in:

Field Description Default Validation
pools Pool array Array of objects describing each AIStor server pool deployed in the AIStor ObjectStore.
Each pool consists of a set of AIStor server pods which “pool” their storage resources for supporting object storage and retrieval requests. Each server pool is independent of all others and supports horizontal scaling of available storage resources in the AIStor ObjectStore.
The AIStor ObjectStore spec must have at least one element in the pools array.		 Required: {}
image string Container image to use when deploying minio server pods. Optional: {}
imagePullSecret LocalObjectReference Specify the secret key to use for pulling all images (ObjectStore and sidecars) from a private container registry. Optional: {}
podManagementPolicy PodManagementPolicyType Pod Management Policy for pod created by StatefulSet Optional: {}
env EnvVar array If provided, the AIStor ObjectStore Operator adds the specified environment variables when deploying the ObjectStore resource. Optional: {}
certificates Certificates Settings for Object Store TLS Certificates Optional: {}
mountPath string For AIStor volume (PV). Defaults to /export Optional: {}
subPath string Mount path suffix, this is the directory where MinIO stores data. Default to `""`` (empty) Optional: {}
liveness Probe Probe for AIStor container liveness. Container will be restarted if the probe fails. Optional: {}
readiness Probe Probe for AIStor container readiness. Container will be removed from service endpoints if the probe fails. Optional: {}
startup Probe Probe allows configuring a max grace period for a pod to start before getting traffic routed to it. Optional: {}
lifecycle Lifecycle hooks for container. Optional: {}
features Features Features that can be disabled or enabled.
kes KESConfig Directs the AIStor ObjectStore Operator to deploy the MinIO Key Encryption Service (KES) using the specified configuration.
MinIO KES supports performing server-side encryption of objects on the AIStor ObjectStore.		 Optional: {}
prometheusOperator boolean Directs the AIStor ObjectStore Operator to use prometheus operator.
ObjectStore scrape configuration will be added to prometheus managed by the prometheus-operator.		 Optional: {}
serviceAccountName string The Kubernetes Service Account to use for running AIStor pods created as part of the ObjectStore. Optional: {}
priorityClassName string Indicates the Pod priority and therefore the importance of a Pod relative to other Pods in the cluster.
This is applied to AIStor pods only.
Refer Kubernetes Priority Class https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass.		 Optional: {}
imagePullPolicy PullPolicy The pull policy for the AIStor container image. Specify one of the following:
* Always
* Never
* IfNotPresent (Default)
Refer Kubernetes documentation for details https://kubernetes.io/docs/concepts/containers/images#updating-images		 Optional: {}
sideCars SideCars A list of containers to run as sidecars along every AIStor Pod deployed in the object store. Optional: {}
services Services Directs the Operator to expose the AIStor and/or Console services. Optional: {}
logging Logging Enable JSON, Anonymous logging for AIStor Object Stores. Optional: {}
configuration LocalObjectReference Reference a secret with AIStor environment variables.
The secret must include a key named config.env with exported variables.		 Optional: {}
initContainers Container array Add custom initContainers to AIStor StatefulSet Optional: {}
additionalVolumes Volume array If provided, StatefulSet will add these volumes. You should set the rules for the corresponding volumes and volume mounts. Optional: {}
additionalVolumeMounts VolumeMount array If provided, StatefulSet will add these volumes. You should set the rules for the corresponding volumes and volume mounts. Optional: {}
cache Cache Cache option Optional: {}
firewall FirewallSpec Firewall sidecar options Optional: {}
encryption Encryption Deprecated: This field is deprecated
Enables encryption against an AIStor KMS in a specific namespace		 Optional: {}
sftp SFTP Enables SFTP Optional: {}

PodStatus

PodStatus holds the status of the pods in the object store

Appears in:

Field Description Default Validation
running integer Running is the number of running pods
crashing integer Crashing is the number of pods crashing
pending integer Pending is the number of pods pending

Pool

Pool Defines a MinIO server pool on an ObjectStore. Each pool consists of a set of AIStor server pods. Each server pool is independent of all others and supports horizontal scaling of available storage resources in the AIStor ObjectStore.

Appears in:

Field Description Default Validation
name string Specifies the name of the pool. The AIStor ObjectStore Operator automatically generates the pool name if this field is omitted. MinLength: 1
Required: {}
servers integer The number of AIStor server pods to deploy in the pool. The minimum value is 2. Required: {}
volumesPerServer integer The number of Persistent Volume Claims to generate for each AIStor pod in the pool.
The AIStor ObjectStore Operator requires a minimum of 4 volumes per pool. Specifically, the result of pools.servers X pools.volumesPerServer must be greater than 4.		 Required: {}
volumeClaimTemplate PersistentVolumeClaim Specify the Volume Claims options for the AIStor ObjectStore. Required: {}
resources ResourceRequirements Object specification for specifying CPU and memory or limits in the AIStor Object Store. Optional: {}
nodeSelector object (keys:string, values:string) The filter for the AIStor ObjectStore Operator to apply when selecting which nodes on which to deploy pods in the pool. The Operator only selects those nodes whose labels match the specified selector.
See the Kubernetes documentation on https://kubernetes.io/docs/concepts/configuration/assign-pod-node/.		 Optional: {}
affinity Affinity Specifies node affinity, pod affinity, and pod anti-affinity for pods in the pool. Optional: {}
tolerations Toleration array Specify one or more Kubernetes tolerations to apply to pods deployed in the pool. Optional: {}
topologySpreadConstraints TopologySpreadConstraint array Specify one or more Kubernetes Topology Spread Constraints to apply to pods deployed in the pool. Optional: {}
securityContext PodSecurityContext Specify Security Context of pods in the pool. The AIStor ObjectStore Operator supports only the following pod security fields:
* fsGroup
* fsGroupChangePolicy
* runAsGroup
* runAsNonRoot
* runAsUser		 Optional: {}
containerSecurityContext SecurityContext Specify Security Context of containers in the pool. The AIStor ObjectStore Operator supports only the following container security fields:
* runAsGroup
* runAsNonRoot
* runAsUser		 Optional: {}
annotations object (keys:string, values:string) Specify custom annotations to append to the Pool.
If provided, use these annotations for the Pool Objects Meta annotations (StatefulSet and Pod template)		 Optional: {}
labels object (keys:string, values:string) If provided, use these labels for the Pool Objects Meta annotations (StatefulSet and Pod template) Optional: {}
runtimeClassName string If provided, each pod on the StatefulSet will run with the specified RuntimeClassName.
For more info https://kubernetes.io/docs/concepts/containers/runtime-class/		 Optional: {}

PoolState

Underlying type: string

PoolState represents the state of a pool

Appears in:

Field Description
PoolNotCreated PoolNotCreated of a pool when it’s not even created yet
PoolCreated PoolCreated indicates a pool was created
PoolInitialized PoolInitialized indicates if a pool has been watched to be online

PoolStatus

PoolStatus keeps track of all the pools and their current state

Appears in:

Field Description Default Validation
name string Name of the pool
ssName string
state PoolState
podStatus PodStatus The status of the MinIO pods for the pool Optional: {}

SFTP

SFTP holds the configurations parameters for the SFTP feature

Appears in:

Field Description Default Validation
enabled boolean Whether to enable the SFTP feature.
serviceExternalTrafficPolicy ServiceExternalTrafficPolicy The type of external traffic policy the service exposing the AIStor SFTP service will follow.
If set, the service external traffic policy will be exposed using the specified type.
if omitted, the service will be exposed using the default type Cluster.		 Optional: {}
serviceType ServiceType The type of service to expose SFTP
If set, the SFTP will be exposed using the specified type.
if omitted, the SFTP will be exposed using the default type ClusterIP.		 Optional: {}
nodePort integer The port to expose the SFTP is using a NodePort.
If set, SFTP will be exposed using the specified port.
if omitted, SFTP will be exposed using whatever assigned port by kubernetes.		 Optional: {}
domainName string If specified, SFTP can be accessed using the domain name when exposed Optional: {}

ServiceConfig

ServiceConfig defines the details of how a service is created

Appears in:

Field Description Default Validation
serviceType ServiceType The type of service to expose the AIStor service.
If set, the service will be exposed using the specified type.
if omitted, the service will be exposed using the default type ClusterIP.		 Optional: {}
serviceExternalTrafficPolicy ServiceExternalTrafficPolicy The type of external traffic policy the service exposing the AIStor service will follow.
If set, the service external traffic policy will be exposed using the specified type.
if omitted, the service will be exposed using the default type Cluster.		 Optional: {}
nodePort integer The port to expose the AIStor service is using a NodePort.
If set, the service will be exposed using the specified port.
if omitted, the service will be exposed using whatever assigned port by kubernetes.		 Optional: {}
labels object (keys:string, values:string) If provided, append these labels to the service. Optional: {}
annotations object (keys:string, values:string) If provided, append these annotations to the service. Optional: {}

Services

Services (services) defines the exposure of the MinIO object storage and Console services.

Appears in:

Field Description Default Validation
minio ServiceConfig Directs the Operator to expose the MinIO service. Optional: {}
console ServiceConfig Directs the Operator to expose the AIStor Console service. Optional: {}

SideCars

SideCars (sidecars) defines a list of containers that the Operator attaches to each MinIO server pods in the pool.

Appears in:

Field Description Default Validation
containers Container array List of containers to run inside the Pod Optional: {}
volumeClaimTemplates PersistentVolumeClaim array volumeClaimTemplates is a list of claims that pods are allowed to reference.
The StatefulSet controller is responsible for mapping network identities to
claims in a way that maintains the identity of a pod. Every claim in
this list must have at least one matching (by name) volumeMount in one
container in the template. A claim in this list takes precedence over
any volumes in the template, with the same name.		 Optional: {}
volumes Volume array List of volumes that can be mounted by containers belonging to the pod.
More info: https://kubernetes.io/docs/concepts/storage/volumes		 Optional: {}
resources ResourceRequirements sidecar’s Resource, initcontainer will use that if set. Optional: {}

TierUsage

TierUsage represents the usage from a tier setup by the object store

Appears in:

Field Description Default Validation
Name string Name of the tier
Type string Type of the tier
totalSize integer TotalSize usage of the tier

Usage

Usage is metrics regarding the usage and capacity of the object store

Appears in:

Field Description Default Validation
capacity integer The usage capacity of this object store in bytes. Optional: {}
rawCapacity integer The raw capacity of this object store in bytes. Optional: {}
usage integer Is how much data is managed by MinIO in bytes. Optional: {}
rawUsage integer Is the raw usage on disks in bytes. Optional: {}
tiers TierUsage array Include the usage of individual tiers in the object store Optional: {}