# API Reference ## Packages * [enterprise.mariadb.com/v1alpha1](#enterprisemariadbcomv1alpha1) ## enterprise.mariadb.com/v1alpha1 Package v1alpha1 contains API Schema definitions for the v1alpha1 API group ### Resource Types * [Backup](#backup) * [Connection](#connection) * [Database](#database) * [ExternalMariaDB](#externalmariadb) * [Grant](#grant) * [MariaDB](#mariadb) * [MaxScale](#maxscale) * [PhysicalBackup](#physicalbackup) * [PointInTimeRecovery](#pointintimerecovery) * [Restore](#restore) * [SqlJob](#sqljob) * [User](#user) #### Affinity Refer to the Kubernetes docs: . *Appears in:* * [AffinityConfig](#affinityconfig) | Field | Description | Default | Validation | | ------------------------------------------------------- | ----------- | ------- | ---------- | | `podAntiAffinity` [*PodAntiAffinity*](#podantiaffinity) | | | | | `nodeAffinity` [*NodeAffinity*](#nodeaffinity) | | | | #### AffinityConfig AffinityConfig defines policies to schedule Pods in Nodes. *Appears in:* * [BackupSpec](#backupspec) * [Exporter](#exporter) * [Job](#job) * [JobPodTemplate](#jobpodtemplate) * [MariaDBPodTemplate](#mariadbpodtemplate) * [MariaDBSpec](#mariadbspec) * [MaxScalePodTemplate](#maxscalepodtemplate) * [MaxScaleSpec](#maxscalespec) * [RestoreSpec](#restorespec) * [SqlJobSpec](#sqljobspec) | Field | Description | Default | Validation | | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `podAntiAffinity` [*PodAntiAffinity*](#podantiaffinity) | | | | | `nodeAffinity` [*NodeAffinity*](#nodeaffinity) | | | | | `antiAffinityEnabled` *boolean* |

AntiAffinityEnabled configures PodAntiAffinity so each Pod is scheduled in a different Node, enabling HA.
Make sure you have at least as many Nodes available as the replicas to not end up with unscheduled Pods.

| | | #### Agent Agent is a sidecar agent that co-operates with mariadb-enterprise-operator. *Appears in:* * [Galera](#galera) * [GaleraSpec](#galeraspec) * [Replication](#replication) * [ReplicationSpec](#replicationspec) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------- | --------------------------------------------- | | `command` *string array* | Command to be used in the Container. | | | | `args` *string array* | Args to be used in the Container. | | | | `env` [*EnvVar*](#envvar) *array* | Env represents the environment variables to be injected in a container. | | | | `envFrom` [*EnvFromSource*](#envfromsource) *array* | EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container. | | | | `volumeMounts` [*VolumeMount*](#volumemount) *array* | VolumeMounts to be used in the Container. | | | | `livenessProbe` [*Probe*](#probe) | LivenessProbe to be used in the Container. | | | | `readinessProbe` [*Probe*](#probe) | ReadinessProbe to be used in the Container. | | | | `startupProbe` [*Probe*](#probe) | StartupProbe to be used in the Container. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `securityContext` [*SecurityContext*](#securitycontext) | SecurityContext holds security configuration that will be applied to a container. | | | | `lifecycle` [*Lifecycle*](#lifecycle) | Lifecycle are actions that the management system should take in response to container lifecycle events. | | | | `image` *string* | Image name to be used by the MariaDB instances. The supported format is `:`. | | | | `imagePullPolicy` [*PullPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#pullpolicy-v1-core) | ImagePullPolicy is the image pull policy. One of `Always`, `Never` or `IfNotPresent`. If not defined, it defaults to `IfNotPresent`. | |

Enum: \[Always Never IfNotPresent]

| | `port` *integer* | Port where the agent will be listening for API connections. | | | | `probePort` *integer* | Port where the agent will be listening for probe connections. | | | | `kubernetesAuth` [*KubernetesAuth*](#kubernetesauth) | KubernetesAuth to be used by the agent container | | | | `basicAuth` [*BasicAuth*](#basicauth) | BasicAuth to be used by the agent container | | | | `gracefulShutdownTimeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | GracefulShutdownTimeout is the time we give to the agent container in order to gracefully terminate in-flight requests. | | | #### AzureBlob *Appears in:* * [BootstrapFrom](#bootstrapfrom) * [PhysicalBackupStorage](#physicalbackupstorage) * [PointInTimeRecoveryStorage](#pointintimerecoverystorage) | Field | Description | Default | Validation | | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------- | | `containerName` *string* | ContainerName is the name of the storage container. | |

Required: {}

| | `serviceURL` *string* | ServiceURL is the full URL for connecting to Azure, usually in the form: http(s)://.blob.core.windows.net/. | |

Required: {}

| | `prefix` *string* | Prefix indicates a folder/subfolder in the container. For example: mariadb/ or mariadb/backups. A trailing slash '/' is added if not provided. | | | | `storageAccountName` *string* | StorageAccountName is the name of the storage account. Pairs with StorageAccountKey for static credential authentication | | | | `storageAccountKey` [*SecretKeySelector*](#secretkeyselector) | StorageAccountKey is a reference to a Secret key containing the Azure Blob Storage Storage account Key. Pairs with StorageAccountKey for static credential authentication | | | | `tls` [*TLSConfig*](#tlsconfig) | TLS provides the configuration required to establish TLS connections with Azure Blob Storage. | | | #### Backup Backup is the Schema for the backups API. It is used to define backup jobs and its storage. | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------- | ---------- | | `apiVersion` *string* | `enterprise.mariadb.com/v1alpha1` | | | | `kind` *string* | `Backup` | | | | `metadata` [*ObjectMeta*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#objectmeta-v1-meta) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec` [*BackupSpec*](#backupspec) | | | | #### BackupContentType *Underlying type:* *string* BackupContentType defines the backup content type. *Appears in:* * [BootstrapFrom](#bootstrapfrom) | Field | Description | | ---------- | ------------------------------------------------------------------------------------------------------------------- | | `Logical` |

BackupContentTypeLogical represents a logical backup created using mariadb-dump.

| | `Physical` |

BackupContentTypePhysical represents a physical backup created using mariadb-backup or a VolumeSnapshot.

| #### BackupSpec BackupSpec defines the desired state of Backup *Appears in:* * [Backup](#backup) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ------------------------------------------------------------ | | `args` *string array* | Args to be used in the Container. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `securityContext` [*SecurityContext*](#securitycontext) | SecurityContext holds security configuration that will be applied to a container. | | | | `podMetadata` [*Metadata*](#metadata) | PodMetadata defines extra metadata for the Pod. | | | | `imagePullSecrets` [*LocalObjectReference*](#localobjectreference) *array* | ImagePullSecrets is the list of pull Secrets to be used to pull the image. | | | | `podSecurityContext` [*PodSecurityContext*](#podsecuritycontext) | SecurityContext holds pod-level security attributes and common container settings. | | | | `serviceAccountName` *string* | ServiceAccountName is the name of the ServiceAccount to be used by the Pods. | | | | `affinity` [*AffinityConfig*](#affinityconfig) | Affinity to be used in the Pod. | | | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector to be used in the Pod. | | | | `tolerations` [*Toleration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) *array* | Tolerations to be used in the Pod. | | | | `priorityClassName` *string* | PriorityClassName to be used in the Pod. | | | | `successfulJobsHistoryLimit` *integer* | SuccessfulJobsHistoryLimit defines the maximum number of successful Jobs to be displayed. | |

Minimum: 0

| | `failedJobsHistoryLimit` *integer* | FailedJobsHistoryLimit defines the maximum number of failed Jobs to be displayed. | |

Minimum: 0

| | `timeZone` *string* | TimeZone defines the timezone associated with the cron expression. | | | | `mariaDbRef` [*MariaDBRef*](#mariadbref) | MariaDBRef is a reference to a MariaDB object. | |

Required: {}

| | `compression` [*CompressAlgorithm*](#compressalgorithm) | Compression algorithm to be used in the Backup. | |

Enum: \[none bzip2 gzip]

| | `stagingStorage` [*StagingStorage*](#stagingstorage) |

StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed.
It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the Backup Job is scheduled.
The staging area gets cleaned up after each backup is completed, consider this for sizing it appropriately.

| | | | `storage` [*BackupStorage*](#backupstorage) | Storage defines the final storage for backups. | |

Required: {}

| | `schedule` [*Schedule*](#schedule) | Schedule defines when the Backup will be taken. | | | | `maxRetention` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

MaxRetention defines the retention policy for backups. Old backups will be cleaned up by the Backup Job.
It defaults to 30 days.

| | | | `databases` *string array* | Databases defines the logical databases to be backed up. If not provided, all databases are backed up. | | | | `ignoreGlobalPriv` *boolean* |

IgnoreGlobalPriv indicates to ignore the mysql.global\_priv in backups.
If not provided, it will default to true when the referred MariaDB instance has Galera enabled and otherwise to false.

| | | | `logLevel` *string* | LogLevel to be used in the Backup Job. It defaults to 'info'. | info |

Enum: \[debug info warn error dpanic panic fatal]

| | `backoffLimit` *integer* | BackoffLimit defines the maximum number of attempts to successfully take a Backup. | | | | `restartPolicy` [*RestartPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#restartpolicy-v1-core) | RestartPolicy to be added to the Backup Pod. | OnFailure |

Enum: \[Always OnFailure Never]

| | `inheritMetadata` [*Metadata*](#metadata) | InheritMetadata defines the metadata to be inherited by children resources. | | | #### BackupStorage BackupStorage defines the final storage for backups. *Appears in:* * [BackupSpec](#backupspec) | Field | Description | Default | Validation | | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | ------- | ---------- | | `s3` [*S3*](#s3) | S3 defines the configuration to store backups in a S3 compatible storage. | | | | `persistentVolumeClaim` [*PersistentVolumeClaimSpec*](#persistentvolumeclaimspec) | PersistentVolumeClaim is a Kubernetes PVC specification. | | | | `volume` [*StorageVolumeSource*](#storagevolumesource) | Volume is a Kubernetes volume specification. | | | #### BasicAuth BasicAuth refers to the basic authentication mechanism utilized for establishing a connection from the operator to the agent. *Appears in:* * [Agent](#agent) | Field | Description | Default | Validation | | ------------------------------------------------------------------------ | -------------------------------------------------------- | ------- | ---------- | | `enabled` *boolean* | Enabled is a flag to enable BasicAuth | | | | `username` *string* | Username to be used for basic authentication | | | | `passwordSecretKeyRef` [*GeneratedSecretKeyRef*](#generatedsecretkeyref) | PasswordSecretKeyRef to be used for basic authentication | | | #### BootstrapFrom BootstrapFrom defines a source to bootstrap MariaDB from. *Appears in:* * [MariaDBSpec](#mariadbspec) | Field | Description | Default | Validation | | ---------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ------------------------------------------------------------ | | `backupRef` [*TypedLocalObjectReference*](#typedlocalobjectreference) |

BackupRef is reference to a backup object. If the Kind is not specified, a logical Backup is assumed.
This field takes precedence over S3 and Volume sources.

| | | | `volumeSnapshotRef` [*LocalObjectReference*](#localobjectreference) |

VolumeSnapshotRef is a reference to a VolumeSnapshot object.
This field takes precedence over S3 and Volume sources.

| | | | `pointInTimeRecoveryRef` [*LocalObjectReference*](#localobjectreference) |

PointInTimeRecoveryRef is a reference to a PointInTimeRecovery object.
Providing this field implies restoring the PhysicalBackup referenced in the PointInTimeRecovery object and replaying the
archived binary logs up to the point-in-time restoration target, defined by the targetRecoveryTime field.

| | | | `backupContentType` [*BackupContentType*](#backupcontenttype) |

BackupContentType is the backup content type available in the source to bootstrap from.
It is inferred based on the BackupRef and VolumeSnapshotRef fields. If inference is not possible, it defaults to Logical.
Set this field explicitly when using physical backups from S3 or Volume sources.

| |

Enum: \[Logical Physical]

| | `s3` [*S3*](#s3) |

S3 defines the configuration to restore backups from a S3 compatible storage.
This field takes precedence over the Volume source.

| | | | `azureBlob` [*AzureBlob*](#azureblob) |

AzureBlob defines the configuration to restore from Azure Blob compatible storage.
This field takes precedence over the Volume source.

| | | | `volume` [*StorageVolumeSource*](#storagevolumesource) | Volume is a Kubernetes Volume object that contains a backup. | | | | `targetRecoveryTime` [*Time*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#time-v1-meta) |

TargetRecoveryTime is a RFC3339 (1970-01-01T00:00:00Z) date and time that defines the point in time recovery objective.
It is used to determine the closest restoration source in time.

| | | | `stagingStorage` [*StagingStorage*](#stagingstorage) |

StagingStorage defines the temporary storage used to keep external backups and binary logs (i.e. S3) while they are being processed.
It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the Job is scheduled.

| | | | `restoreJob` [*Job*](#job) | RestoreJob defines additional properties for the restoration Job. | | | | `logLevel` *string* | LogLevel to be used in the mariadb-enterprise-operator container of the restoration Job. It defaults to 'info'. | info |

Enum: \[debug info warn error dpanic panic fatal]

| #### CSIVolumeSource Refer to the Kubernetes docs: . *Appears in:* * [MariaDBVolume](#mariadbvolume) * [MariaDBVolumeSource](#mariadbvolumesource) * [StorageVolumeSource](#storagevolumesource) * [Volume](#volume) * [VolumeSource](#volumesource) | Field | Description | Default | Validation | | ---------------------------------------------------------------------- | ----------- | ------- | ---------- | | `driver` *string* | | | | | `readOnly` *boolean* | | | | | `fsType` *string* | | | | | `volumeAttributes` *object (keys:string, values:string)* | | | | | `nodePublishSecretRef` [*LocalObjectReference*](#localobjectreference) | | | | #### CertConfig CertConfig defines parameters to configure a certificate. *Appears in:* * [ExternalTLS](#externaltls) * [MaxScaleTLS](#maxscaletls) * [TLS](#tls) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------- | | `caLifetime` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | CALifetime defines the CA certificate validity. | | | | `certLifetime` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | CertLifetime defines the certificate validity. | | | | `privateKeyAlgorithm` *string* |

PrivateKeyAlgorithm is the algorithm to be used for the CA and leaf certificate private keys.
One of: ECDSA or RSA

| |

Enum: \[ECDSA RSA]

| | `privateKeySize` *integer* |

PrivateKeyAlgorithm is the key size to be used for the CA and leaf certificate private keys.
Supported values: ECDSA(256, 384, 521), RSA(2048, 3072, 4096)

| | | #### CleanupPolicy *Underlying type:* *string* CleanupPolicy defines the behavior for cleaning up a resource. *Appears in:* * [DatabaseSpec](#databasespec) * [GrantSpec](#grantspec) * [MariaDBSpec](#mariadbspec) * [SQLTemplate](#sqltemplate) * [UserSpec](#userspec) | Field | Description | | -------- | ----------------------------------------------------------------------------------------------------------------------- | | `Skip` |

CleanupPolicySkip indicates that the resource will NOT be deleted from the database after the CR is deleted.

| | `Delete` |

CleanupPolicyDelete indicates that the resource will be deleted from the database after the CR is deleted.

| #### CompressAlgorithm *Underlying type:* *string* CompressAlgorithm defines the compression algorithm for a Backup resource. *Appears in:* * [BackupSpec](#backupspec) * [PhysicalBackupSpec](#physicalbackupspec) * [PointInTimeRecoverySpec](#pointintimerecoveryspec) | Field | Description | | ------- | ------------------------------------------------------------------------------------------------------------------ | | `none` |

No compression

| | `bzip2` |

Bzip2 compression. Good compression ratio, but slower compression/decompression speed compared to gzip.

| | `gzip` |

Gzip compression. Good compression/decompression speed, but worse compression ratio compared to bzip2.

| #### ConfigMapKeySelector Refer to the Kubernetes docs: . *Appears in:* * [EnvVarSource](#envvarsource) * [MariaDBSpec](#mariadbspec) * [SqlJobSpec](#sqljobspec) | Field | Description | Default | Validation | | --------------- | ----------- | ------- | ---------- | | `name` *string* | | | | | `key` *string* | | | | #### ConfigMapVolumeSource Refer to the Kubernetes docs: . *Appears in:* * [MariaDBVolume](#mariadbvolume) * [MariaDBVolumeSource](#mariadbvolumesource) * [Volume](#volume) * [VolumeSource](#volumesource) | Field | Description | Default | Validation | | ----------------------- | ----------- | ------- | ---------- | | `name` *string* | | | | | `defaultMode` *integer* | | | | #### Connection Connection is the Schema for the connections API. It is used to configure connection strings for the applications connecting to MariaDB. | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------- | ---------- | | `apiVersion` *string* | `enterprise.mariadb.com/v1alpha1` | | | | `kind` *string* | `Connection` | | | | `metadata` [*ObjectMeta*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#objectmeta-v1-meta) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec` [*ConnectionSpec*](#connectionspec) | | | | #### ConnectionSpec ConnectionSpec defines the desired state of Connection *Appears in:* * [Connection](#connection) | Field | Description | Default | Validation | | ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------- | | `secretName` *string* | SecretName to be used in the Connection. | | | | `secretTemplate` [*SecretTemplate*](#secrettemplate) | SecretTemplate to be used in the Connection. | | | | `healthCheck` [*HealthCheck*](#healthcheck) | HealthCheck to be used in the Connection. | | | | `params` *object (keys:string, values:string)* | Params to be used in the Connection. | | | | `serviceName` *string* | ServiceName to be used in the Connection. | | | | `port` *integer* | Port to connect to. If not provided, it defaults to the MariaDB port or to the first MaxScale listener. | | | | `mariaDbRef` [*MariaDBRef*](#mariadbref) | MariaDBRef is a reference to the MariaDB to connect to. Either MariaDBRef or MaxScaleRef must be provided. | | | | `maxScaleRef` [*ObjectReference*](#objectreference) | MaxScaleRef is a reference to the MaxScale to connect to. Either MariaDBRef or MaxScaleRef must be provided. | | | | `username` *string* | Username to use for configuring the Connection. | |

Required: {}

| | `passwordSecretKeyRef` [*SecretKeySelector*](#secretkeyselector) |

PasswordSecretKeyRef is a reference to the password to use for configuring the Connection.
Either passwordSecretKeyRef or tlsClientCertSecretRef must be provided as client credentials.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

| | | | `tlsClientCertSecretRef` [*LocalObjectReference*](#localobjectreference) |

TLSClientCertSecretRef is a reference to a Kubernetes TLS Secret used as authentication when checking the connection health.
Either passwordSecretKeyRef or tlsClientCertSecretRef must be provided as client credentials.
If not provided, the client certificate provided by the referred MariaDB is used if TLS is enabled.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the client certificate.

| | | | `host` *string* | Host to connect to. If not provided, it defaults to the MariaDB host or to the MaxScale host. | | | | `database` *string* | Database to use when configuring the Connection. | | | #### ConnectionTemplate ConnectionTemplate defines a template to customize Connection objects. *Appears in:* * [ConnectionSpec](#connectionspec) * [ExternalMariaDBSpec](#externalmariadbspec) * [MariaDBSpec](#mariadbspec) * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `secretName` *string* | SecretName to be used in the Connection. | | | | `secretTemplate` [*SecretTemplate*](#secrettemplate) | SecretTemplate to be used in the Connection. | | | | `healthCheck` [*HealthCheck*](#healthcheck) | HealthCheck to be used in the Connection. | | | | `params` *object (keys:string, values:string)* | Params to be used in the Connection. | | | | `serviceName` *string* | ServiceName to be used in the Connection. | | | | `port` *integer* | Port to connect to. If not provided, it defaults to the MariaDB port or to the first MaxScale listener. | | | #### Container Container object definition. *Appears in:* * [MariaDBPodTemplate](#mariadbpodtemplate) * [MariaDBSpec](#mariadbspec) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------- | --------------------------------------------- | | `name` *string* | Name to be given to the container. | | | | `image` *string* | Image name to be used by the container. The supported format is `:`. | |

Required: {}

| | `imagePullPolicy` [*PullPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#pullpolicy-v1-core) | ImagePullPolicy is the image pull policy. One of `Always`, `Never` or `IfNotPresent`. If not defined, it defaults to `IfNotPresent`. | |

Enum: \[Always Never IfNotPresent]

| | `command` *string array* | Command to be used in the Container. | | | | `args` *string array* | Args to be used in the Container. | | | | `env` [*EnvVar*](#envvar) *array* | Env represents the environment variables to be injected in a container. | | | | `volumeMounts` [*VolumeMount*](#volumemount) *array* | VolumeMounts to be used in the Container. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | #### ContainerTemplate ContainerTemplate defines a template to configure Container objects. *Appears in:* * [Agent](#agent) * [InitContainer](#initcontainer) * [MariaDBSpec](#mariadbspec) * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ----------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `command` *string array* | Command to be used in the Container. | | | | `args` *string array* | Args to be used in the Container. | | | | `env` [*EnvVar*](#envvar) *array* | Env represents the environment variables to be injected in a container. | | | | `envFrom` [*EnvFromSource*](#envfromsource) *array* | EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container. | | | | `volumeMounts` [*VolumeMount*](#volumemount) *array* | VolumeMounts to be used in the Container. | | | | `livenessProbe` [*Probe*](#probe) | LivenessProbe to be used in the Container. | | | | `readinessProbe` [*Probe*](#probe) | ReadinessProbe to be used in the Container. | | | | `startupProbe` [*Probe*](#probe) | StartupProbe to be used in the Container. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `securityContext` [*SecurityContext*](#securitycontext) | SecurityContext holds security configuration that will be applied to a container. | | | | `lifecycle` [*Lifecycle*](#lifecycle) | Lifecycle are actions that the management system should take in response to container lifecycle events. | | | #### CooperativeMonitoring *Underlying type:* *string* CooperativeMonitoring enables coordination between multiple MaxScale instances running monitors. See: *Appears in:* * [MaxScaleMonitor](#maxscalemonitor) | Field | Description | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | `majority_of_all` |

CooperativeMonitoringMajorityOfAll requires a lock from the majority of the MariaDB servers, even the ones that are down.

| | `majority_of_running` |

CooperativeMonitoringMajorityOfRunning requires a lock from the majority of the MariaDB servers.

| #### CronJobTemplate CronJobTemplate defines parameters for configuring CronJob objects. *Appears in:* * [BackupSpec](#backupspec) * [SqlJobSpec](#sqljobspec) | Field | Description | Default | Validation | | -------------------------------------- | ----------------------------------------------------------------------------------------- | ------- | --------------------- | | `successfulJobsHistoryLimit` *integer* | SuccessfulJobsHistoryLimit defines the maximum number of successful Jobs to be displayed. | |

Minimum: 0

| | `failedJobsHistoryLimit` *integer* | FailedJobsHistoryLimit defines the maximum number of failed Jobs to be displayed. | |

Minimum: 0

| | `timeZone` *string* | TimeZone defines the timezone associated with the cron expression. | | | #### Database Database is the Schema for the databases API. It is used to define a logical database as if you were running a 'CREATE DATABASE' statement. | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------- | ---------- | | `apiVersion` *string* | `enterprise.mariadb.com/v1alpha1` | | | | `kind` *string* | `Database` | | | | `metadata` [*ObjectMeta*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#objectmeta-v1-meta) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec` [*DatabaseSpec*](#databasespec) | | | | #### DatabaseSpec DatabaseSpec defines the desired state of Database *Appears in:* * [Database](#database) | Field | Description | Default | Validation | | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | ----------------- | ------------------------------- | | `requeueInterval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | RequeueInterval is used to perform requeue reconciliations. | | | | `retryInterval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | RetryInterval is the interval used to perform retries. | | | | `cleanupPolicy` [*CleanupPolicy*](#cleanuppolicy) | CleanupPolicy defines the behavior for cleaning up a SQL resource. | |

Enum: \[Skip Delete]

| | `mariaDbRef` [*MariaDBRef*](#mariadbref) | MariaDBRef is a reference to a MariaDB object. | |

Required: {}

| | `characterSet` *string* | CharacterSet to use in the Database. | utf8 | | | `collate` *string* | Collate to use in the Database. | utf8\_general\_ci | | | `name` *string* | Name overrides the default Database name provided by metadata.name. | |

MaxLength: 80

| #### EmptyDirVolumeSource Refer to the Kubernetes docs: . *Appears in:* * [MariaDBVolume](#mariadbvolume) * [MariaDBVolumeSource](#mariadbvolumesource) * [StorageVolumeSource](#storagevolumesource) * [Volume](#volume) * [VolumeSource](#volumesource) | Field | Description | Default | Validation | | ---------------------------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `medium` [*StorageMedium*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#storagemedium-v1-core) | | | | | `sizeLimit` [*Quantity*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#quantity-resource-api) | | | | #### EnvFromSource Refer to the Kubernetes docs: . *Appears in:* * [Agent](#agent) * [ContainerTemplate](#containertemplate) * [InitContainer](#initcontainer) * [MariaDBSpec](#mariadbspec) * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | -------------------------------------------------------------- | ----------- | ------- | ---------- | | `prefix` *string* | | | | | `configMapRef` [*LocalObjectReference*](#localobjectreference) | | | | | `secretRef` [*LocalObjectReference*](#localobjectreference) | | | | #### EnvVar Refer to the Kubernetes docs: . *Appears in:* * [Agent](#agent) * [Container](#container) * [ContainerTemplate](#containertemplate) * [InitContainer](#initcontainer) * [MariaDBSpec](#mariadbspec) * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ------------------------------------------- | ---------------------------------------------------------- | ------- | ---------- | | `name` *string* | Name of the environment variable. Must be a C\_IDENTIFIER. | | | | `value` *string* | | | | | `valueFrom` [*EnvVarSource*](#envvarsource) | | | | #### EnvVarSource Refer to the Kubernetes docs: . *Appears in:* * [EnvVar](#envvar) | Field | Description | Default | Validation | | ----------------------------------------------------------------- | ----------- | ------- | ---------- | | `fieldRef` [*ObjectFieldSelector*](#objectfieldselector) | | | | | `configMapKeyRef` [*ConfigMapKeySelector*](#configmapkeyselector) | | | | | `secretKeyRef` [*SecretKeySelector*](#secretkeyselector) | | | | #### EphemeralVolumeSource Refer to the Kubernetes docs: . *Appears in:* * [MariaDBVolume](#mariadbvolume) * [MariaDBVolumeSource](#mariadbvolumesource) | Field | Description | Default | Validation | | ------------------------------------------------------------------- | ----------- | ------- | ---------- | | `volumeClaimTemplate` [*VolumeClaimTemplate*](#volumeclaimtemplate) | | | | #### ExecAction Refer to the Kubernetes docs: . *Appears in:* * [LifecycleHandler](#lifecyclehandler) * [Probe](#probe) * [ProbeHandler](#probehandler) | Field | Description | Default | Validation | | ------------------------ | ----------- | ------- | ---------- | | `command` *string array* | | | | #### Exporter Exporter defines a metrics exporter container. *Appears in:* * [MariadbMetrics](#mariadbmetrics) * [MaxScaleMetrics](#maxscalemetrics) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------- | --------------------------------------------- | | `image` *string* | Image name to be used as metrics exporter. The supported format is `:`. | | | | `imagePullPolicy` [*PullPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#pullpolicy-v1-core) | ImagePullPolicy is the image pull policy. One of `Always`, `Never` or `IfNotPresent`. If not defined, it defaults to `IfNotPresent`. | |

Enum: \[Always Never IfNotPresent]

| | `imagePullSecrets` [*LocalObjectReference*](#localobjectreference) *array* | ImagePullSecrets is the list of pull Secrets to be used to pull the image. | | | | `args` *string array* | Args to be used in the Container. | | | | `port` *integer* | Port where the exporter will be listening for connections. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `podMetadata` [*Metadata*](#metadata) | PodMetadata defines extra metadata for the Pod. | | | | `securityContext` [*SecurityContext*](#securitycontext) | SecurityContext holds container-level security attributes. | | | | `podSecurityContext` [*PodSecurityContext*](#podsecuritycontext) | SecurityContext holds pod-level security attributes and common container settings. | | | | `affinity` [*AffinityConfig*](#affinityconfig) | Affinity to be used in the Pod. | | | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector to be used in the Pod. | | | | `tolerations` [*Toleration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) *array* | Tolerations to be used in the Pod. | | | | `priorityClassName` *string* | PriorityClassName to be used in the Pod. | | | #### ExternalMariaDB ExternalMariaDB is the Schema for the external MariaDBs API. It is used to define external MariaDB server. | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------- | ---------- | | `apiVersion` *string* | `enterprise.mariadb.com/v1alpha1` | | | | `kind` *string* | `ExternalMariaDB` | | | | `metadata` [*ObjectMeta*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#objectmeta-v1-meta) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec` [*ExternalMariaDBSpec*](#externalmariadbspec) | | | | #### ExternalMariaDBSpec ExternalMariaDBSpec defines the desired state of an External MariaDB *Appears in:* * [ExternalMariaDB](#externalmariadb) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- | --------------------------------------------- | | `image` *string* |

Image name to be used to perform operations on the external MariaDB, for example, for taking backups.
The supported format is \:\. Only MariaDB official images are supported.
If not provided, the MariaDB image version be inferred by the operator in runtime. The default MariaDB image will be used in this case,

| | | | `imagePullPolicy` [*PullPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#pullpolicy-v1-core) | ImagePullPolicy is the image pull policy. One of `Always`, `Never` or `IfNotPresent`. If not defined, it defaults to `IfNotPresent`. | |

Enum: \[Always Never IfNotPresent]

| | `imagePullSecrets` [*LocalObjectReference*](#localobjectreference) *array* | ImagePullSecrets is the list of pull Secrets to be used to pull the image. | | | | `inheritMetadata` [*Metadata*](#metadata) | InheritMetadata defines the metadata to be inherited by children resources. | | | | `host` *string* | Hostname of the external MariaDB. | |

Required: {}

| | `port` *integer* | Port of the external MariaDB. | 3306 | | | `username` *string* | Username is the username to connect to the external MariaDB. | |

Required: {}

| | `passwordSecretKeyRef` [*SecretKeySelector*](#secretkeyselector) | PasswordSecretKeyRef is a reference to the password to connect to the external MariaDB. | | | | `tls` [*ExternalTLS*](#externaltls) | TLS defines the PKI to be used with the external MariaDB. | | | | `connection` [*ConnectionTemplate*](#connectiontemplate) | Connection defines a template to configure a Connection for the external MariaDB. | | | #### ExternalTLS ExternalTLS defines the TLS configuration for external MariaDB instances. *Appears in:* * [ExternalMariaDBSpec](#externalmariadbspec) | Field | Description | Default | Validation | | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------------------------------------- | | `enabled` *boolean* |

Enabled indicates whether TLS is enabled, determining if certificates should be issued and mounted to the MariaDB instance.
It is enabled by default.

| | | | `required` *boolean* |

Required specifies whether TLS must be enforced for all connections.
User TLS requirements take precedence over this.
It disabled by default.

| | | | `versions` *string array* |

Versions specifies the supported TLS versions for this MariaDB instance.
By default, the MariaDB's default supported versions are used. See: .

| |

items:Enum: \[TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3]

| | `serverCASecretRef` [*LocalObjectReference*](#localobjectreference) |

ServerCASecretRef is a reference to a Secret containing the server certificate authority keypair. It is used to establish trust and issue server certificates.
One of:
- Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates.
- Secret containing only the 'ca.crt' in order to establish trust. In this case, either serverCertSecretRef or serverCertIssuerRef must be provided.
If not provided, a self-signed CA will be provisioned to issue the server certificate.

| | | | `serverCertSecretRef` [*LocalObjectReference*](#localobjectreference) |

ServerCertSecretRef is a reference to a TLS Secret containing the server certificate.
It is mutually exclusive with serverCertIssuerRef.

| | | | `serverCertIssuerRef` [*ObjectReference*](#objectreference) |

ServerCertIssuerRef is a reference to a cert-manager issuer object used to issue the server certificate. cert-manager must be installed previously in the cluster.
It is mutually exclusive with serverCertSecretRef.
By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via serverCASecretRef.

| | | | `serverCertConfig` [*CertConfig*](#certconfig) |

ServerCertConfig allows configuring the server certificates, either issued by the operator or cert-manager.
If not set, the default settings will be used.

| | | | `clientCASecretRef` [*LocalObjectReference*](#localobjectreference) |

ClientCASecretRef is a reference to a Secret containing the client certificate authority keypair. It is used to establish trust and issue client certificates.
One of:
- Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates.
- Secret containing only the 'ca.crt' in order to establish trust. In this case, either clientCertSecretRef or clientCertIssuerRef fields must be provided.
If not provided, a self-signed CA will be provisioned to issue the client certificate.

| | | | `clientCertSecretRef` [*LocalObjectReference*](#localobjectreference) |

ClientCertSecretRef is a reference to a TLS Secret containing the client certificate.
It is mutually exclusive with clientCertIssuerRef.

| | | | `clientCertIssuerRef` [*ObjectReference*](#objectreference) |

ClientCertIssuerRef is a reference to a cert-manager issuer object used to issue the client certificate. cert-manager must be installed previously in the cluster.
It is mutually exclusive with clientCertSecretRef.
By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via clientCASecretRef.

| | | | `clientCertConfig` [*CertConfig*](#certconfig) |

ClientCertConfig allows configuring the client certificates, either issued by the operator or cert-manager.
If not set, the default settings will be used.

| | | | `galeraSSTEnabled` *boolean* |

GaleraSSTEnabled determines whether Galera SST connections should use TLS.
It disabled by default.

| | | | `galeraServerSSLMode` *string* |

GaleraServerSSLMode defines the server SSL mode for a Galera Enterprise cluster.
This field is only supported and applicable for Galera Enterprise >= 10.6 instances.
Refer to the MariaDB Enterprise docs for more detail:

| |

Enum: \[PROVIDER SERVER SERVER\_X509]

| | `galeraClientSSLMode` *string* |

GaleraClientSSLMode defines the client SSL mode for a Galera Enterprise cluster.
This field is only supported and applicable for Galera Enterprise >= 10.6 instances.
Refer to the MariaDB Enterprise docs for more detail:

| |

Enum: \[DISABLED REQUIRED VERIFY\_CA VERIFY\_IDENTITY]

| | `mutual` *boolean* |

Mutual specifies whether TLS must be mutual between server and client for external connections.
When set to false, the client certificate will not be sent during the TLS handshake.
It is enabled by default.

| | | #### Galera Galera allows you to enable multi-master HA via Galera in your MariaDB cluster. *Appears in:* * [MariaDBSpec](#mariadbspec) | Field | Description | Default | Validation | | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------------------- | | `primary` [*PrimaryGalera*](#primarygalera) | Primary is the Galera configuration for the primary node. | | | | `sst` [*SST*](#sst) |

SST is the Snapshot State Transfer used when new Pods join the cluster.
More info: .

| |

Enum: \[rsync mariabackup mysqldump]

| | `availableWhenDonor` *boolean* | AvailableWhenDonor indicates whether a donor node should be responding to queries. It defaults to false. | | | | `galeraLibPath` *string* |

GaleraLibPath is a path inside the MariaDB image to the wsrep provider plugin. It is defaulted if not provided.
More info: .

| | | | `replicaThreads` *integer* |

ReplicaThreads is the number of replica threads used to apply Galera write sets in parallel.
More info: .

| | | | `providerOptions` *object (keys:string, values:string)* |

ProviderOptions is map of Galera configuration parameters.
More info: .

| | | | `agent` [*Agent*](#agent) | Agent is a sidecar agent that co-operates with mariadb-enterprise-operator. | | | | `recovery` [*GaleraRecovery*](#galerarecovery) |

GaleraRecovery is the recovery process performed by the operator whenever the Galera cluster is not healthy.
More info: .

| | | | `initContainer` [*InitContainer*](#initcontainer) | InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator. | | | | `initJob` [*GaleraInitJob*](#galerainitjob) | InitJob defines a Job that co-operates with mariadb-enterprise-operator by performing initialization tasks. | | | | `config` [*GaleraConfig*](#galeraconfig) | GaleraConfig defines storage options for the Galera configuration files. | | | | `clusterName` *string* | ClusterName is the name of the cluster to be used in the Galera config file. | | | | `enabled` *boolean* | Enabled is a flag to enable Galera. | | | #### GaleraConfig GaleraConfig defines storage options for the Galera configuration files. *Appears in:* * [Galera](#galera) * [GaleraSpec](#galeraspec) | Field | Description | Default | Validation | | ------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `reuseStorageVolume` *boolean* |

ReuseStorageVolume indicates that storage volume used by MariaDB should be reused to store the Galera configuration files.
It defaults to false, which implies that a dedicated volume for the Galera configuration files is provisioned.

| | | | `volumeClaimTemplate` [*VolumeClaimTemplate*](#volumeclaimtemplate) | VolumeClaimTemplate is a template for the PVC that will contain the Galera configuration files shared between the InitContainer, Agent and MariaDB. | | | #### GaleraInitJob GaleraInitJob defines a Job used to be used to initialize the Galera cluster. *Appears in:* * [Galera](#galera) * [GaleraSpec](#galeraspec) | Field | Description | Default | Validation | | ----------------------------------------------------------- | --------------------------------------------------------------- | ------- | ---------- | | `metadata` [*Metadata*](#metadata) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | #### GaleraRecovery GaleraRecovery is the recovery process performed by the operator whenever the Galera cluster is not healthy. More info: . *Appears in:* * [Galera](#galera) * [GaleraSpec](#galeraspec) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `enabled` *boolean* | Enabled is a flag to enable GaleraRecovery. | | | | `minClusterSize` [*IntOrString*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#intorstring-intstr-util) |

MinClusterSize is the minimum number of replicas to consider the cluster healthy. It can be either a number of replicas (1) or a percentage (50%).
If Galera consistently reports less replicas than this value for the given 'ClusterHealthyTimeout' interval, a cluster recovery is initiated.
It defaults to '1' replica, and it is highly recommendeded to keep this value at '1' in most cases.
If set to more than one replica, the cluster recovery process may restart the healthy replicas as well.

| | | | `clusterMonitorInterval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | ClusterMonitorInterval represents the interval used to monitor the Galera cluster health. | | | | `clusterHealthyTimeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

ClusterHealthyTimeout represents the duration at which a Galera cluster, that consistently failed health checks,
is considered unhealthy, and consequently the Galera recovery process will be initiated by the operator.

| | | | `clusterBootstrapTimeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

ClusterBootstrapTimeout is the time limit for bootstrapping a cluster.
Once this timeout is reached, the Galera recovery state is reset and a new cluster bootstrap will be attempted.

| | | | `clusterUpscaleTimeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | ClusterUpscaleTimeout represents the maximum duration for upscaling the cluster's StatefulSet during the recovery process. | | | | `clusterDownscaleTimeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | ClusterDownscaleTimeout represents the maximum duration for downscaling the cluster's StatefulSet during the recovery process. | | | | `podRecoveryTimeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | PodRecoveryTimeout is the time limit for recevorying the sequence of a Pod during the cluster recovery. | | | | `podSyncTimeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | PodSyncTimeout is the time limit for a Pod to join the cluster after having performed a cluster bootstrap during the cluster recovery. | | | | `forceClusterBootstrapInPod` *string* |

ForceClusterBootstrapInPod allows you to manually initiate the bootstrap process in a specific Pod.
IMPORTANT: Use this option only in exceptional circumstances. Not selecting the Pod with the highest sequence number may result in data loss.
IMPORTANT: Ensure you unset this field after completing the bootstrap to allow the operator to choose the appropriate Pod to bootstrap from in an event of cluster recovery.

| | | | `job` [*GaleraRecoveryJob*](#galerarecoveryjob) | Job defines a Job that co-operates with mariadb-enterprise-operator by performing the Galera cluster recovery . | | | #### GaleraRecoveryJob GaleraRecoveryJob defines a Job used to be used to recover the Galera cluster. *Appears in:* * [GaleraRecovery](#galerarecovery) | Field | Description | Default | Validation | | ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `metadata` [*Metadata*](#metadata) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `podAffinity` *boolean* | PodAffinity indicates whether the recovery Jobs should run in the same Node as the MariaDB Pods. It defaults to true. | | | #### GaleraSpec GaleraSpec is the Galera desired state specification. *Appears in:* * [Galera](#galera) | Field | Description | Default | Validation | | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------------------- | | `primary` [*PrimaryGalera*](#primarygalera) | Primary is the Galera configuration for the primary node. | | | | `sst` [*SST*](#sst) |

SST is the Snapshot State Transfer used when new Pods join the cluster.
More info: .

| |

Enum: \[rsync mariabackup mysqldump]

| | `availableWhenDonor` *boolean* | AvailableWhenDonor indicates whether a donor node should be responding to queries. It defaults to false. | | | | `galeraLibPath` *string* |

GaleraLibPath is a path inside the MariaDB image to the wsrep provider plugin. It is defaulted if not provided.
More info: .

| | | | `replicaThreads` *integer* |

ReplicaThreads is the number of replica threads used to apply Galera write sets in parallel.
More info: .

| | | | `providerOptions` *object (keys:string, values:string)* |

ProviderOptions is map of Galera configuration parameters.
More info: .

| | | | `agent` [*Agent*](#agent) | Agent is a sidecar agent that co-operates with mariadb-enterprise-operator. | | | | `recovery` [*GaleraRecovery*](#galerarecovery) |

GaleraRecovery is the recovery process performed by the operator whenever the Galera cluster is not healthy.
More info: .

| | | | `initContainer` [*InitContainer*](#initcontainer) | InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator. | | | | `initJob` [*GaleraInitJob*](#galerainitjob) | InitJob defines a Job that co-operates with mariadb-enterprise-operator by performing initialization tasks. | | | | `config` [*GaleraConfig*](#galeraconfig) | GaleraConfig defines storage options for the Galera configuration files. | | | | `clusterName` *string* | ClusterName is the name of the cluster to be used in the Galera config file. | | | #### GeneratedSecretKeyRef GeneratedSecretKeyRef defines a reference to a Secret that can be automatically generated by mariadb-enterprise-operator if needed. *Appears in:* * [BasicAuth](#basicauth) * [MariaDBSpec](#mariadbspec) * [MariadbMetrics](#mariadbmetrics) * [MaxScaleAuth](#maxscaleauth) * [ReplicaReplication](#replicareplication) | Field | Description | Default | Validation | | -------------------- | -------------------------------------------------------------------------------------------------- | ------- | ---------- | | `name` *string* | | | | | `key` *string* | | | | | `generate` *boolean* | Generate indicates whether the Secret should be generated if the Secret referenced is not present. | false | | #### Grant Grant is the Schema for the grants API. It is used to define grants as if you were running a 'GRANT' statement. | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------- | ---------- | | `apiVersion` *string* | `enterprise.mariadb.com/v1alpha1` | | | | `kind` *string* | `Grant` | | | | `metadata` [*ObjectMeta*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#objectmeta-v1-meta) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec` [*GrantSpec*](#grantspec) | | | | #### GrantSpec GrantSpec defines the desired state of Grant *Appears in:* * [Grant](#grant) | Field | Description | Default | Validation | | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | ------- | -------------------------------------- | | `requeueInterval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | RequeueInterval is used to perform requeue reconciliations. | | | | `retryInterval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | RetryInterval is the interval used to perform retries. | | | | `cleanupPolicy` [*CleanupPolicy*](#cleanuppolicy) | CleanupPolicy defines the behavior for cleaning up a SQL resource. | |

Enum: \[Skip Delete]

| | `mariaDbRef` [*MariaDBRef*](#mariadbref) | MariaDBRef is a reference to a MariaDB object. | |

Required: {}

| | `privileges` *string array* | Privileges to use in the Grant. | |

MinItems: 1
Required: {}

| | `database` *string* | Database to use in the Grant. | \* | | | `table` *string* | Table to use in the Grant. | \* | | | `username` *string* | Username to use in the Grant. | |

Required: {}

| | `host` *string* | Host to use in the Grant. It can be localhost, an IP or '%'. | | | | `grantOption` *boolean* | GrantOption to use in the Grant. | false | | #### Gtid *Underlying type:* *string* Gtid indicates which Global Transaction ID (GTID) position mode should be used when connecting a replica to the master. See: . *Appears in:* * [ReplicaReplication](#replicareplication) | Field | Description | | ------------ | ---------------------------------------------------------------------------------------------------------------------------------- | | `CurrentPos` |

GtidCurrentPos indicates the union of gtid\_binlog\_pos and gtid\_slave\_pos will be used when replicating from master.

| | `SlavePos` |

GtidSlavePos indicates that gtid\_slave\_pos will be used when replicating from master.

| #### HTTPGetAction Refer to the Kubernetes docs: . *Appears in:* * [LifecycleHandler](#lifecyclehandler) * [Probe](#probe) * [ProbeHandler](#probehandler) | Field | Description | Default | Validation | | -------------------------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `path` *string* | | | | | `port` [*IntOrString*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#intorstring-intstr-util) | | | | | `host` *string* | | | | | `scheme` [*URIScheme*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#urischeme-v1-core) | | | | #### HealthCheck HealthCheck defines intervals for performing health checks. *Appears in:* * [ConnectionSpec](#connectionspec) * [ConnectionTemplate](#connectiontemplate) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | ------- | ---------- | | `interval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | Interval used to perform health checks. | | | | `retryInterval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | RetryInterval is the interval used to perform health check retries. | | | #### HostPathVolumeSource Refer to the Kubernetes docs: *Appears in:* * [MariaDBVolume](#mariadbvolume) * [MariaDBVolumeSource](#mariadbvolumesource) * [StorageVolumeSource](#storagevolumesource) * [Volume](#volume) * [VolumeSource](#volumesource) | Field | Description | Default | Validation | | --------------- | ----------- | ------- | ---------- | | `path` *string* | | | | | `type` *string* | | | | #### InitContainer InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator. *Appears in:* * [Galera](#galera) * [GaleraSpec](#galeraspec) * [Replication](#replication) * [ReplicationSpec](#replicationspec) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------- | --------------------------------------------- | | `command` *string array* | Command to be used in the Container. | | | | `args` *string array* | Args to be used in the Container. | | | | `env` [*EnvVar*](#envvar) *array* | Env represents the environment variables to be injected in a container. | | | | `envFrom` [*EnvFromSource*](#envfromsource) *array* | EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container. | | | | `volumeMounts` [*VolumeMount*](#volumemount) *array* | VolumeMounts to be used in the Container. | | | | `livenessProbe` [*Probe*](#probe) | LivenessProbe to be used in the Container. | | | | `readinessProbe` [*Probe*](#probe) | ReadinessProbe to be used in the Container. | | | | `startupProbe` [*Probe*](#probe) | StartupProbe to be used in the Container. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `securityContext` [*SecurityContext*](#securitycontext) | SecurityContext holds security configuration that will be applied to a container. | | | | `lifecycle` [*Lifecycle*](#lifecycle) | Lifecycle are actions that the management system should take in response to container lifecycle events. | | | | `image` *string* | Image name to be used by the MariaDB instances. The supported format is `:`. | |

Required: {}

| | `imagePullPolicy` [*PullPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#pullpolicy-v1-core) | ImagePullPolicy is the image pull policy. One of `Always`, `Never` or `IfNotPresent`. If not defined, it defaults to `IfNotPresent`. | |

Enum: \[Always Never IfNotPresent]

| #### Job Job defines a Job used to be used with MariaDB. *Appears in:* * [BootstrapFrom](#bootstrapfrom) * [ReplicaBootstrapFrom](#replicabootstrapfrom) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | ------- | ---------- | | `metadata` [*Metadata*](#metadata) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `affinity` [*AffinityConfig*](#affinityconfig) | Affinity to be used in the Pod. | | | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector to be used in the Pod. | | | | `tolerations` [*Toleration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) *array* | Tolerations to be used in the Pod. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `args` *string array* | Args to be used in the Container. | | | #### JobContainerTemplate JobContainerTemplate defines a template to configure Container objects that run in a Job. *Appears in:* * [BackupSpec](#backupspec) * [PhysicalBackupSpec](#physicalbackupspec) * [RestoreSpec](#restorespec) * [SqlJobSpec](#sqljobspec) | Field | Description | Default | Validation | | ----------------------------------------------------------- | --------------------------------------------------------------------------------- | ------- | ---------- | | `args` *string array* | Args to be used in the Container. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `securityContext` [*SecurityContext*](#securitycontext) | SecurityContext holds security configuration that will be applied to a container. | | | #### JobPodTemplate JobPodTemplate defines a template to configure Container objects that run in a Job. *Appears in:* * [BackupSpec](#backupspec) * [RestoreSpec](#restorespec) * [SqlJobSpec](#sqljobspec) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | ------- | ---------- | | `podMetadata` [*Metadata*](#metadata) | PodMetadata defines extra metadata for the Pod. | | | | `imagePullSecrets` [*LocalObjectReference*](#localobjectreference) *array* | ImagePullSecrets is the list of pull Secrets to be used to pull the image. | | | | `podSecurityContext` [*PodSecurityContext*](#podsecuritycontext) | SecurityContext holds pod-level security attributes and common container settings. | | | | `serviceAccountName` *string* | ServiceAccountName is the name of the ServiceAccount to be used by the Pods. | | | | `affinity` [*AffinityConfig*](#affinityconfig) | Affinity to be used in the Pod. | | | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector to be used in the Pod. | | | | `tolerations` [*Toleration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) *array* | Tolerations to be used in the Pod. | | | | `priorityClassName` *string* | PriorityClassName to be used in the Pod. | | | #### KubernetesAuth KubernetesAuth refers to the Kubernetes authentication mechanism utilized for establishing a connection from the operator to the agent. The agent validates the legitimacy of the service account token provided as an Authorization header by creating a TokenReview resource. *Appears in:* * [Agent](#agent) | Field | Description | Default | Validation | | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `enabled` *boolean* | Enabled is a flag to enable KubernetesAuth | | | | `authDelegatorRoleName` *string* |

AuthDelegatorRoleName is the name of the ClusterRoleBinding that is associated with the "system:auth-delegator" ClusterRole.
It is necessary for creating TokenReview objects in order for the agent to validate the service account token.

| | | #### LabelSelector Refer to the Kubernetes docs: *Appears in:* * [PodAffinityTerm](#podaffinityterm) | Field | Description | Default | Validation | | ---------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `matchLabels` *object (keys:string, values:string)* | | | | | `matchExpressions` [*LabelSelectorRequirement*](#labelselectorrequirement) *array* | | | | #### LabelSelectorRequirement Refer to the Kubernetes docs: *Appears in:* * [LabelSelector](#labelselector) | Field | Description | Default | Validation | | ---------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `key` *string* | | | | | `operator` [*LabelSelectorOperator*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#labelselectoroperator-v1-meta) | | | | | `values` *string array* | | | | #### Lifecycle Refer to the Kubernetes docs: . *Appears in:* * [Agent](#agent) * [ContainerTemplate](#containertemplate) * [InitContainer](#initcontainer) * [MariaDBSpec](#mariadbspec) * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | --------------------------------------------------- | ----------- | ------- | ---------- | | `postStart` [*LifecycleHandler*](#lifecyclehandler) | | | | | `preStop` [*LifecycleHandler*](#lifecyclehandler) | | | | #### LifecycleHandler Refer to the Kubernetes docs: . *Appears in:* * [Lifecycle](#lifecycle) | Field | Description | Default | Validation | | ------------------------------------------- | ----------- | ------- | ---------- | | `exec` [*ExecAction*](#execaction) | | | | | `httpGet` [*HTTPGetAction*](#httpgetaction) | | | | | `sleep` [*SleepAction*](#sleepaction) | | | | #### LocalObjectReference Refer to the Kubernetes docs: . *Appears in:* * [BackupSpec](#backupspec) * [BootstrapFrom](#bootstrapfrom) * [CSIVolumeSource](#csivolumesource) * [ConfigMapKeySelector](#configmapkeyselector) * [ConfigMapVolumeSource](#configmapvolumesource) * [ConnectionSpec](#connectionspec) * [EnvFromSource](#envfromsource) * [Exporter](#exporter) * [ExternalMariaDBSpec](#externalmariadbspec) * [ExternalTLS](#externaltls) * [GeneratedSecretKeyRef](#generatedsecretkeyref) * [JobPodTemplate](#jobpodtemplate) * [MariaDBPodTemplate](#mariadbpodtemplate) * [MariaDBSpec](#mariadbspec) * [MaxScalePodTemplate](#maxscalepodtemplate) * [MaxScaleSpec](#maxscalespec) * [MaxScaleTLS](#maxscaletls) * [PhysicalBackupPodTemplate](#physicalbackuppodtemplate) * [PhysicalBackupSpec](#physicalbackupspec) * [PointInTimeRecoverySpec](#pointintimerecoveryspec) * [ReplicaBootstrapFrom](#replicabootstrapfrom) * [RestoreSource](#restoresource) * [RestoreSpec](#restorespec) * [SecretKeySelector](#secretkeyselector) * [SqlJobSpec](#sqljobspec) * [TLS](#tls) | Field | Description | Default | Validation | | --------------- | ----------- | ------- | ---------- | | `name` *string* | | | | #### MariaDB MariaDB is the Schema for the mariadbs API. It is used to define MariaDB clusters. | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------- | ---------- | | `apiVersion` *string* | `enterprise.mariadb.com/v1alpha1` | | | | `kind` *string* | `MariaDB` | | | | `metadata` [*ObjectMeta*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#objectmeta-v1-meta) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec` [*MariaDBSpec*](#mariadbspec) | | | | #### MariaDBPodTemplate MariaDBPodTemplate defines a template for MariaDB Pods. Refer to the Kubernetes dos: . *Appears in:* * [MariaDBSpec](#mariadbspec) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | ------- | ---------- | | `podMetadata` [*Metadata*](#metadata) | PodMetadata defines extra metadata for the Pod. | | | | `imagePullSecrets` [*LocalObjectReference*](#localobjectreference) *array* | ImagePullSecrets is the list of pull Secrets to be used to pull the image. | | | | `initContainers` [*Container*](#container) *array* | InitContainers to be used in the Pod. | | | | `sidecarContainers` [*Container*](#container) *array* | SidecarContainers to be used in the Pod. | | | | `podSecurityContext` [*PodSecurityContext*](#podsecuritycontext) | SecurityContext holds pod-level security attributes and common container settings. | | | | `serviceAccountName` *string* | ServiceAccountName is the name of the ServiceAccount to be used by the Pods. | | | | `affinity` [*AffinityConfig*](#affinityconfig) | Affinity to be used in the Pod. | | | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector to be used in the Pod. | | | | `tolerations` [*Toleration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) *array* | Tolerations to be used in the Pod. | | | | `volumes` [*MariaDBVolume*](#mariadbvolume) *array* | Volumes to be used in the Pod. | | | | `priorityClassName` *string* | PriorityClassName to be used in the Pod. | | | | `topologySpreadConstraints` [*TopologySpreadConstraint*](#topologyspreadconstraint) *array* | TopologySpreadConstraints to be used in the Pod. | | | | `enableServiceLinks` *boolean* | EnableServiceLinks to be used in the Pod. | | | | `terminationGracePeriodSeconds` *integer* | TerminationGracePeriodSeconds to be used in the Pod. | | | #### MariaDBRef MariaDBRef is a reference to a MariaDB object. *Appears in:* * [BackupSpec](#backupspec) * [ConnectionSpec](#connectionspec) * [DatabaseSpec](#databasespec) * [GrantSpec](#grantspec) * [MaxScaleSpec](#maxscalespec) * [PhysicalBackupSpec](#physicalbackupspec) * [RestoreSpec](#restorespec) * [SqlJobSpec](#sqljobspec) * [UserSpec](#userspec) | Field | Description | Default | Validation | | --------------------- | ---------------------------------------------------------------------------------------------------- | ------- | ---------- | | `name` *string* | | | | | `namespace` *string* | | | | | `kind` *string* | Kind of the referent. | | | | `waitForIt` *boolean* | WaitForIt indicates whether the controller using this reference should wait for MariaDB to be ready. | true | | #### MariaDBSpec MariaDBSpec defines the desired state of MariaDB *Appears in:* * [MariaDB](#mariadb) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | --------------------------------------------- | | `command` *string array* | Command to be used in the Container. | | | | `args` *string array* | Args to be used in the Container. | | | | `env` [*EnvVar*](#envvar) *array* | Env represents the environment variables to be injected in a container. | | | | `envFrom` [*EnvFromSource*](#envfromsource) *array* | EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container. | | | | `volumeMounts` [*VolumeMount*](#volumemount) *array* | VolumeMounts to be used in the Container. | | | | `livenessProbe` [*Probe*](#probe) | LivenessProbe to be used in the Container. | | | | `readinessProbe` [*Probe*](#probe) | ReadinessProbe to be used in the Container. | | | | `startupProbe` [*Probe*](#probe) | StartupProbe to be used in the Container. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `securityContext` [*SecurityContext*](#securitycontext) | SecurityContext holds security configuration that will be applied to a container. | | | | `lifecycle` [*Lifecycle*](#lifecycle) | Lifecycle are actions that the management system should take in response to container lifecycle events. | | | | `podMetadata` [*Metadata*](#metadata) | PodMetadata defines extra metadata for the Pod. | | | | `imagePullSecrets` [*LocalObjectReference*](#localobjectreference) *array* | ImagePullSecrets is the list of pull Secrets to be used to pull the image. | | | | `initContainers` [*Container*](#container) *array* | InitContainers to be used in the Pod. | | | | `sidecarContainers` [*Container*](#container) *array* | SidecarContainers to be used in the Pod. | | | | `podSecurityContext` [*PodSecurityContext*](#podsecuritycontext) | SecurityContext holds pod-level security attributes and common container settings. | | | | `serviceAccountName` *string* | ServiceAccountName is the name of the ServiceAccount to be used by the Pods. | | | | `affinity` [*AffinityConfig*](#affinityconfig) | Affinity to be used in the Pod. | | | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector to be used in the Pod. | | | | `tolerations` [*Toleration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) *array* | Tolerations to be used in the Pod. | | | | `volumes` [*MariaDBVolume*](#mariadbvolume) *array* | Volumes to be used in the Pod. | | | | `priorityClassName` *string* | PriorityClassName to be used in the Pod. | | | | `topologySpreadConstraints` [*TopologySpreadConstraint*](#topologyspreadconstraint) *array* | TopologySpreadConstraints to be used in the Pod. | | | | `enableServiceLinks` *boolean* | EnableServiceLinks to be used in the Pod. | | | | `terminationGracePeriodSeconds` *integer* | TerminationGracePeriodSeconds to be used in the Pod. | | | | `suspend` *boolean* |

Suspend indicates whether the current resource should be suspended or not.
This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.

| false | | | `image` *string* |

Image name to be used by the MariaDB instances. The supported format is \:\.
Only MariaDB official images are supported.

| | | | `imagePullPolicy` [*PullPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#pullpolicy-v1-core) | ImagePullPolicy is the image pull policy. One of `Always`, `Never` or `IfNotPresent`. If not defined, it defaults to `IfNotPresent`. | |

Enum: \[Always Never IfNotPresent]

| | `inheritMetadata` [*Metadata*](#metadata) | InheritMetadata defines the metadata to be inherited by children resources. | | | | `rootPasswordSecretKeyRef` [*GeneratedSecretKeyRef*](#generatedsecretkeyref) | RootPasswordSecretKeyRef is a reference to a Secret key containing the root password. | | | | `rootEmptyPassword` *boolean* | RootEmptyPassword indicates if the root password should be empty. Don't use this feature in production, it is only intended for development and test environments. | | | | `database` *string* | Database is the name of the initial Database. | | | | `username` *string* |

Username is the initial username to be created by the operator once MariaDB is ready.
The initial User will have ALL PRIVILEGES in the initial Database.

| | | | `passwordSecretKeyRef` [*GeneratedSecretKeyRef*](#generatedsecretkeyref) |

PasswordSecretKeyRef is a reference to a Secret that contains the password to be used by the initial User.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

| | | | `passwordHashSecretKeyRef` [*SecretKeySelector*](#secretkeyselector) |

PasswordHashSecretKeyRef is a reference to the password hash to be used by the initial User.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password hash.
It requires the 'strict-password-validation=false' option to be set. See: .

| | | | `passwordPlugin` [*PasswordPlugin*](#passwordplugin) |

PasswordPlugin is a reference to the password plugin and arguments to be used by the initial User.
It requires the 'strict-password-validation=false' option to be set. See: .

| | | | `cleanupPolicy` [*CleanupPolicy*](#cleanuppolicy) | CleanupPolicy defines the behavior for cleaning up the initial User, Database, and Grant created by the operator. | |

Enum: \[Skip Delete]

| | `myCnf` *string* |

MyCnf allows to specify the my.cnf file mounted by Mariadb.
Updating this field will trigger an update to the Mariadb resource.

| | | | `myCnfConfigMapKeyRef` [*ConfigMapKeySelector*](#configmapkeyselector) |

MyCnfConfigMapKeyRef is a reference to the my.cnf config file provided via a ConfigMap.
If not provided, it will be defaulted with a reference to a ConfigMap containing the MyCnf field.
If the referred ConfigMap is labeled with "enterprise.mariadb.com/watch", an update to the Mariadb resource will be triggered when the ConfigMap is updated.

| | | | `timeZone` *string* | TimeZone sets the default timezone. If not provided, it defaults to SYSTEM and the timezone data is not loaded. | | | | `bootstrapFrom` [*BootstrapFrom*](#bootstrapfrom) | BootstrapFrom defines a source to bootstrap from. | | | | `storage` [*Storage*](#storage) | Storage defines the storage options to be used for provisioning the PVCs mounted by MariaDB. | | | | `metrics` [*MariadbMetrics*](#mariadbmetrics) | Metrics configures metrics and how to scrape them. | | | | `tls` [*TLS*](#tls) | TLS defines the PKI to be used with MariaDB. | | | | `replication` [*Replication*](#replication) | Replication configures high availability via replication. This feature is still in alpha, use Galera if you are looking for a more production-ready HA. | | | | `galera` [*Galera*](#galera) | Galera configures high availability via Galera. | | | | `maxScaleRef` [*ObjectReference*](#objectreference) |

MaxScaleRef is a reference to a MaxScale resource to be used with the current MariaDB.
Providing this reference implies delegating high availability tasks such as primary failover to MaxScale.

| | | | `pointInTimeRecoveryRef` [*LocalObjectReference*](#localobjectreference) |

PointInTimeRecoveryRef is a reference to a PointInTimeRecovery resource to be used with the current MariaDB.
Providing this reference implies configuring binary logs in the MariaDB instance and binary log archival in the sidecar agent.

| | | | `replicas` *integer* | Replicas indicates the number of desired instances. | 1 | | | `replicasAllowEvenNumber` *boolean* | disables the validation check for an odd number of replicas. | false | | | `port` *integer* | Port where the instances will be listening for connections. | 3306 | | | `servicePorts` [*ServicePort*](#serviceport) *array* | ServicePorts is the list of additional named ports to be added to the Services created by the operator. | | | | `podDisruptionBudget` [*PodDisruptionBudget*](#poddisruptionbudget) | PodDisruptionBudget defines the budget for replica availability. | | | | `updateStrategy` [*UpdateStrategy*](#updatestrategy) | UpdateStrategy defines how a MariaDB resource is updated. | | | | `service` [*ServiceTemplate*](#servicetemplate) |

Service defines a template to configure the general Service object.
The network traffic of this Service will be routed to all Pods.

| | | | `connection` [*ConnectionTemplate*](#connectiontemplate) |

Connection defines a template to configure the general Connection object.
This Connection provides the initial User access to the initial Database.
It will make use of the Service to route network traffic to all Pods.

| | | | `primaryService` [*ServiceTemplate*](#servicetemplate) |

PrimaryService defines a template to configure the primary Service object.
The network traffic of this Service will be routed to the primary Pod.

| | | | `primaryConnection` [*ConnectionTemplate*](#connectiontemplate) |

PrimaryConnection defines a template to configure the primary Connection object.
This Connection provides the initial User access to the initial Database.
It will make use of the PrimaryService to route network traffic to the primary Pod.

| | | | `secondaryService` [*ServiceTemplate*](#servicetemplate) |

SecondaryService defines a template to configure the secondary Service object.
The network traffic of this Service will be routed to the secondary Pods.

| | | | `secondaryConnection` [*ConnectionTemplate*](#connectiontemplate) |

SecondaryConnection defines a template to configure the secondary Connection object.
This Connection provides the initial User access to the initial Database.
It will make use of the SecondaryService to route network traffic to the secondary Pods.

| | | #### MariaDBVolume Refer to the Kubernetes docs: . *Appears in:* * [MariaDBPodTemplate](#mariadbpodtemplate) * [MariaDBSpec](#mariadbspec) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `emptyDir` [*EmptyDirVolumeSource*](#emptydirvolumesource) | | | | | `nfs` [*NFSVolumeSource*](#nfsvolumesource) | | | | | `csi` [*CSIVolumeSource*](#csivolumesource) | | | | | `hostPath` [*HostPathVolumeSource*](#hostpathvolumesource) | | | | | `persistentVolumeClaim` [*PersistentVolumeClaimVolumeSource*](#persistentvolumeclaimvolumesource) | | | | | `secret` [*SecretVolumeSource*](#secretvolumesource) | | | | | `configMap` [*ConfigMapVolumeSource*](#configmapvolumesource) | | | | | `ephemeral` [*EphemeralVolumeSource*](#ephemeralvolumesource) | | | | | `name` *string* | | | | #### MariaDBVolumeSource Refer to the Kubernetes docs: . *Appears in:* * [MariaDBVolume](#mariadbvolume) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `emptyDir` [*EmptyDirVolumeSource*](#emptydirvolumesource) | | | | | `nfs` [*NFSVolumeSource*](#nfsvolumesource) | | | | | `csi` [*CSIVolumeSource*](#csivolumesource) | | | | | `hostPath` [*HostPathVolumeSource*](#hostpathvolumesource) | | | | | `persistentVolumeClaim` [*PersistentVolumeClaimVolumeSource*](#persistentvolumeclaimvolumesource) | | | | | `secret` [*SecretVolumeSource*](#secretvolumesource) | | | | | `configMap` [*ConfigMapVolumeSource*](#configmapvolumesource) | | | | | `ephemeral` [*EphemeralVolumeSource*](#ephemeralvolumesource) | | | | #### MariadbMetrics MariadbMetrics defines the metrics for a MariaDB. *Appears in:* * [MariaDBSpec](#mariadbspec) | Field | Description | Default | Validation | | ------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `enabled` *boolean* | Enabled is a flag to enable Metrics | | | | `exporter` [*Exporter*](#exporter) | Exporter defines the metrics exporter container. | | | | `serviceMonitor` [*ServiceMonitor*](#servicemonitor) | ServiceMonitor defines the ServiceMonior object. | | | | `username` *string* | Username is the username of the monitoring user used by the exporter. | | | | `passwordSecretKeyRef` [*GeneratedSecretKeyRef*](#generatedsecretkeyref) |

PasswordSecretKeyRef is a reference to the password of the monitoring user used by the exporter.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

| | | #### MaxScale MaxScale is the Schema for the maxscales API. It is used to define MaxScale clusters. | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------- | ---------- | | `apiVersion` *string* | `enterprise.mariadb.com/v1alpha1` | | | | `kind` *string* | `MaxScale` | | | | `metadata` [*ObjectMeta*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#objectmeta-v1-meta) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec` [*MaxScaleSpec*](#maxscalespec) | | | | #### MaxScaleAdmin MaxScaleAdmin configures the admin REST API and GUI. *Appears in:* * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ---------------------- | ------------------------------------------------------------- | ------- | ---------- | | `port` *integer* | Port where the admin REST API and GUI will be exposed. | | | | `guiEnabled` *boolean* | GuiEnabled indicates whether the admin GUI should be enabled. | | | #### MaxScaleAuth MaxScaleAuth defines the credentials required for MaxScale to connect to MariaDB. *Appears in:* * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `generate` *boolean* |

Generate defies whether the operator should generate users and grants for MaxScale to work.
It only supports MariaDBs specified via spec.mariaDbRef.

| | | | `adminUsername` *string* | AdminUsername is an admin username to call the admin REST API. It is defaulted if not provided. | | | | `adminPasswordSecretKeyRef` [*GeneratedSecretKeyRef*](#generatedsecretkeyref) | AdminPasswordSecretKeyRef is Secret key reference to the admin password to call the admin REST API. It is defaulted if not provided. | | | | `deleteDefaultAdmin` *boolean* | DeleteDefaultAdmin determines whether the default admin user should be deleted after the initial configuration. If not provided, it defaults to true. | | | | `metricsUsername` *string* | MetricsUsername is an metrics username to call the REST API. It is defaulted if metrics are enabled. | | | | `metricsPasswordSecretKeyRef` [*GeneratedSecretKeyRef*](#generatedsecretkeyref) | MetricsPasswordSecretKeyRef is Secret key reference to the metrics password to call the admib REST API. It is defaulted if metrics are enabled. | | | | `clientUsername` *string* | ClientUsername is the user to connect to MaxScale. It is defaulted if not provided. | | | | `clientPasswordSecretKeyRef` [*GeneratedSecretKeyRef*](#generatedsecretkeyref) |

ClientPasswordSecretKeyRef is Secret key reference to the password to connect to MaxScale. It is defaulted if not provided.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

| | | | `clientMaxConnections` *integer* |

ClientMaxConnections defines the maximum number of connections that the client can establish.
If HA is enabled, make sure to increase this value, as more MaxScale replicas implies more connections.
It defaults to 30 times the number of MaxScale replicas.

| | | | `serverUsername` *string* | ServerUsername is the user used by MaxScale to connect to MariaDB server. It is defaulted if not provided. | | | | `serverPasswordSecretKeyRef` [*GeneratedSecretKeyRef*](#generatedsecretkeyref) |

ServerPasswordSecretKeyRef is Secret key reference to the password used by MaxScale to connect to MariaDB server. It is defaulted if not provided.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

| | | | `serverMaxConnections` *integer* |

ServerMaxConnections defines the maximum number of connections that the server can establish.
If HA is enabled, make sure to increase this value, as more MaxScale replicas implies more connections.
It defaults to 30 times the number of MaxScale replicas.

| | | | `monitorUsername` *string* | MonitorUsername is the user used by MaxScale monitor to connect to MariaDB server. It is defaulted if not provided. | | | | `monitorPasswordSecretKeyRef` [*GeneratedSecretKeyRef*](#generatedsecretkeyref) |

MonitorPasswordSecretKeyRef is Secret key reference to the password used by MaxScale monitor to connect to MariaDB server. It is defaulted if not provided.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

| | | | `monitorMaxConnections` *integer* |

MonitorMaxConnections defines the maximum number of connections that the monitor can establish.
If HA is enabled, make sure to increase this value, as more MaxScale replicas implies more connections.
It defaults to 30 times the number of MaxScale replicas.

| | | | `syncUsername` *string* | MonitoSyncUsernamerUsername is the user used by MaxScale config sync to connect to MariaDB server. It is defaulted when HA is enabled. | | | | `syncPasswordSecretKeyRef` [*GeneratedSecretKeyRef*](#generatedsecretkeyref) |

SyncPasswordSecretKeyRef is Secret key reference to the password used by MaxScale config to connect to MariaDB server. It is defaulted when HA is enabled.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

| | | | `syncMaxConnections` *integer* |

SyncMaxConnections defines the maximum number of connections that the sync can establish.
If HA is enabled, make sure to increase this value, as more MaxScale replicas implies more connections.
It defaults to 30 times the number of MaxScale replicas.

| | | #### MaxScaleConfig MaxScaleConfig defines the MaxScale configuration. *Appears in:* * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `params` *object (keys:string, values:string)* |

Params is a key value pair of parameters to be used in the MaxScale static configuration file.
Any parameter supported by MaxScale may be specified here. See reference:
.

| | | | `volumeClaimTemplate` [*VolumeClaimTemplate*](#volumeclaimtemplate) | VolumeClaimTemplate provides a template to define the PVCs for storing MaxScale runtime configuration files. It is defaulted if not provided. | | | | `sync` [*MaxScaleConfigSync*](#maxscaleconfigsync) | Sync defines how to replicate configuration across MaxScale replicas. It is defaulted when HA is enabled. | | | #### MaxScaleConfigSync MaxScaleConfigSync defines how the config changes are replicated across replicas. *Appears in:* * [MaxScaleConfig](#maxscaleconfig) | Field | Description | Default | Validation | | -------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `database` *string* | Database is the MariaDB logical database where the 'maxscale\_config' table will be created in order to persist and synchronize config changes. If not provided, it defaults to 'mysql'. | | | | `interval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | Interval defines the config synchronization interval. It is defaulted if not provided. | | | | `timeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | Interval defines the config synchronization timeout. It is defaulted if not provided. | | | #### MaxScaleListener MaxScaleListener defines how the MaxScale server will listen for connections. *Appears in:* * [MaxScaleService](#maxscaleservice) | Field | Description | Default | Validation | | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------- | | `suspend` *boolean* |

Suspend indicates whether the current resource should be suspended or not.
This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.

| false | | | `name` *string* | Name is the identifier of the listener. It is defaulted if not provided | | | | `port` *integer* | Port is the network port where the MaxScale server will listen. | |

Required: {}

| | `protocol` *string* | Protocol is the MaxScale protocol to use when communicating with the client. If not provided, it defaults to MariaDBProtocol. | | | | `params` *object (keys:string, values:string)* |

Params defines extra parameters to pass to the listener.
Any parameter supported by MaxScale may be specified here. See reference:
.

| | | #### MaxScaleMetrics MaxScaleMetrics defines the metrics for a Maxscale. *Appears in:* * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ---------------------------------------------------- | ------------------------------------------------ | ------- | ---------- | | `enabled` *boolean* | Enabled is a flag to enable Metrics | | | | `exporter` [*Exporter*](#exporter) | Exporter defines the metrics exporter container. | | | | `serviceMonitor` [*ServiceMonitor*](#servicemonitor) | ServiceMonitor defines the ServiceMonior object. | | | #### MaxScaleMonitor MaxScaleMonitor monitors MariaDB server instances *Appears in:* * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | -------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------------------------------- | | `suspend` *boolean* |

Suspend indicates whether the current resource should be suspended or not.
This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.

| false | | | `name` *string* | Name is the identifier of the monitor. It is defaulted if not provided. | | | | `module` [*MonitorModule*](#monitormodule) | Module is the module to use to monitor MariaDB servers. It is mandatory when no MariaDB reference is provided. | | | | `interval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | Interval used to monitor MariaDB servers. It is defaulted if not provided. | | | | `cooperativeMonitoring` [*CooperativeMonitoring*](#cooperativemonitoring) | CooperativeMonitoring enables coordination between multiple MaxScale instances running monitors. It is defaulted when HA is enabled. | |

Enum: \[majority\_of\_all majority\_of\_running]

| | `params` *object (keys:string, values:string)* |

Params defines extra parameters to pass to the monitor.
Any parameter supported by MaxScale may be specified here. See reference:
.
Monitor specific parameter are also supported:
.
.

| | | #### MaxScalePodTemplate MaxScalePodTemplate defines a template for MaxScale Pods. *Appears in:* * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | ------- | ---------- | | `podMetadata` [*Metadata*](#metadata) | PodMetadata defines extra metadata for the Pod. | | | | `imagePullSecrets` [*LocalObjectReference*](#localobjectreference) *array* | ImagePullSecrets is the list of pull Secrets to be used to pull the image. | | | | `podSecurityContext` [*PodSecurityContext*](#podsecuritycontext) | SecurityContext holds pod-level security attributes and common container settings. | | | | `serviceAccountName` *string* | ServiceAccountName is the name of the ServiceAccount to be used by the Pods. | | | | `affinity` [*AffinityConfig*](#affinityconfig) | Affinity to be used in the Pod. | | | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector to be used in the Pod. | | | | `tolerations` [*Toleration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) *array* | Tolerations to be used in the Pod. | | | | `priorityClassName` *string* | PriorityClassName to be used in the Pod. | | | | `topologySpreadConstraints` [*TopologySpreadConstraint*](#topologyspreadconstraint) *array* | TopologySpreadConstraints to be used in the Pod. | | | #### MaxScaleServer MaxScaleServer defines a MariaDB server to forward traffic to. *Appears in:* * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------- | | `name` *string* | Name is the identifier of the MariaDB server. | |

Required: {}

| | `address` *string* | Address is the network address of the MariaDB server. | |

Required: {}

| | `port` *integer* | Port is the network port of the MariaDB server. If not provided, it defaults to 3306. | | | | `protocol` *string* | Protocol is the MaxScale protocol to use when communicating with this MariaDB server. If not provided, it defaults to MariaDBBackend. | | | | `maintenance` *boolean* | Maintenance indicates whether the server is in maintenance mode. | | | | `params` *object (keys:string, values:string)* |

Params defines extra parameters to pass to the server.
Any parameter supported by MaxScale may be specified here. See reference:
.

| | | #### MaxScaleService Services define how the traffic is forwarded to the MariaDB servers. *Appears in:* * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------------------------------------------------------------- | | `suspend` *boolean* |

Suspend indicates whether the current resource should be suspended or not.
This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.

| false | | | `name` *string* | Name is the identifier of the MaxScale service. | |

Required: {}

| | `router` [*ServiceRouter*](#servicerouter) | Router is the type of router to use. | |

Enum: \[readwritesplit readconnroute]
Required: {}

| | `listener` [*MaxScaleListener*](#maxscalelistener) | MaxScaleListener defines how the MaxScale server will listen for connections. | |

Required: {}

| | `params` *object (keys:string, values:string)* |

Params defines extra parameters to pass to the service.
Any parameter supported by MaxScale may be specified here. See reference:
.
Router specific parameter are also supported:
.
.

| | | #### MaxScaleSpec MaxScaleSpec defines the desired state of MaxScale. *Appears in:* * [MaxScale](#maxscale) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | --------------------------------------------- | | `command` *string array* | Command to be used in the Container. | | | | `args` *string array* | Args to be used in the Container. | | | | `env` [*EnvVar*](#envvar) *array* | Env represents the environment variables to be injected in a container. | | | | `envFrom` [*EnvFromSource*](#envfromsource) *array* | EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container. | | | | `volumeMounts` [*VolumeMount*](#volumemount) *array* | VolumeMounts to be used in the Container. | | | | `livenessProbe` [*Probe*](#probe) | LivenessProbe to be used in the Container. | | | | `readinessProbe` [*Probe*](#probe) | ReadinessProbe to be used in the Container. | | | | `startupProbe` [*Probe*](#probe) | StartupProbe to be used in the Container. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `securityContext` [*SecurityContext*](#securitycontext) | SecurityContext holds security configuration that will be applied to a container. | | | | `lifecycle` [*Lifecycle*](#lifecycle) | Lifecycle are actions that the management system should take in response to container lifecycle events. | | | | `podMetadata` [*Metadata*](#metadata) | PodMetadata defines extra metadata for the Pod. | | | | `imagePullSecrets` [*LocalObjectReference*](#localobjectreference) *array* | ImagePullSecrets is the list of pull Secrets to be used to pull the image. | | | | `podSecurityContext` [*PodSecurityContext*](#podsecuritycontext) | SecurityContext holds pod-level security attributes and common container settings. | | | | `serviceAccountName` *string* | ServiceAccountName is the name of the ServiceAccount to be used by the Pods. | | | | `affinity` [*AffinityConfig*](#affinityconfig) | Affinity to be used in the Pod. | | | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector to be used in the Pod. | | | | `tolerations` [*Toleration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) *array* | Tolerations to be used in the Pod. | | | | `priorityClassName` *string* | PriorityClassName to be used in the Pod. | | | | `topologySpreadConstraints` [*TopologySpreadConstraint*](#topologyspreadconstraint) *array* | TopologySpreadConstraints to be used in the Pod. | | | | `suspend` *boolean* |

Suspend indicates whether the current resource should be suspended or not.
This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.

| false | | | `mariaDbRef` [*MariaDBRef*](#mariadbref) | MariaDBRef is a reference to the MariaDB that MaxScale points to. It is used to initialize the servers field. | | | | `primaryServer` *string* |

PrimaryServer specifies the desired primary server. Setting this field triggers a switchover operation in MaxScale to the desired server.
This option is only valid when using monitors that support switchover, currently limited to the MariaDB monitor.

| | | | `servers` [*MaxScaleServer*](#maxscaleserver) *array* | Servers are the MariaDB servers to forward traffic to. It is required if 'spec.mariaDbRef' is not provided. | | | | `image` *string* |

Image name to be used by the MaxScale instances. The supported format is \:\.
Only MaxScale official images are supported.

| | | | `imagePullPolicy` [*PullPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#pullpolicy-v1-core) | ImagePullPolicy is the image pull policy. One of `Always`, `Never` or `IfNotPresent`. If not defined, it defaults to `IfNotPresent`. | |

Enum: \[Always Never IfNotPresent]

| | `inheritMetadata` [*Metadata*](#metadata) | InheritMetadata defines the metadata to be inherited by children resources. | | | | `services` [*MaxScaleService*](#maxscaleservice) *array* | Services define how the traffic is forwarded to the MariaDB servers. It is defaulted if not provided. | | | | `monitor` [*MaxScaleMonitor*](#maxscalemonitor) | Monitor monitors MariaDB server instances. It is required if 'spec.mariaDbRef' is not provided. | | | | `admin` [*MaxScaleAdmin*](#maxscaleadmin) | Admin configures the admin REST API and GUI. | | | | `config` [*MaxScaleConfig*](#maxscaleconfig) | Config defines the MaxScale configuration. | | | | `auth` [*MaxScaleAuth*](#maxscaleauth) | Auth defines the credentials required for MaxScale to connect to MariaDB. | | | | `metrics` [*MaxScaleMetrics*](#maxscalemetrics) | Metrics configures metrics and how to scrape them. | | | | `tls` [*MaxScaleTLS*](#maxscaletls) | TLS defines the PKI to be used with MaxScale. | | | | `connection` [*ConnectionTemplate*](#connectiontemplate) | Connection provides a template to define the Connection for MaxScale. | | | | `replicas` *integer* | Replicas indicates the number of desired instances. | 1 | | | `podDisruptionBudget` [*PodDisruptionBudget*](#poddisruptionbudget) | PodDisruptionBudget defines the budget for replica availability. | | | | `updateStrategy` [*StatefulSetUpdateStrategy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#statefulsetupdatestrategy-v1-apps) | UpdateStrategy defines the update strategy for the StatefulSet object. | | | | `kubernetesService` [*ServiceTemplate*](#servicetemplate) | KubernetesService defines a template for a Kubernetes Service object to connect to MaxScale. | | | | `guiKubernetesService` [*ServiceTemplate*](#servicetemplate) | GuiKubernetesService defines a template for a Kubernetes Service object to connect to MaxScale's GUI. | | | | `requeueInterval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | RequeueInterval is used to perform requeue reconciliations. If not defined, it defaults to 10s. | | | #### MaxScaleTLS TLS defines the PKI to be used with MaxScale. *Appears in:* * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | --------------------------------------------------------- | | `enabled` *boolean* |

Enabled indicates whether TLS is enabled, determining if certificates should be issued and mounted to the MaxScale instance.
It is enabled by default when the referred MariaDB instance (via mariaDbRef) has TLS enabled and enforced.

| | | | `adminVersions` *string array* |

Versions specifies the supported TLS versions in the MaxScale REST API.
By default, the MaxScale's default supported versions are used. See:

| |

items:Enum: \[TLSv10 TLSv11 TLSv12 TLSv13 MAX]

| | `serverVersions` *string array* |

ServerVersions specifies the supported TLS versions in both the servers and listeners managed by this MaxScale instance.
By default, the MaxScale's default supported versions are used. See: .

| |

items:Enum: \[TLSv10 TLSv11 TLSv12 TLSv13 MAX]

| | `adminCASecretRef` [*LocalObjectReference*](#localobjectreference) |

AdminCASecretRef is a reference to a Secret containing the admin certificate authority keypair. It is used to establish trust and issue certificates for the MaxScale's administrative REST API and GUI.
One of:
- Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates.
- Secret containing only the 'ca.crt' in order to establish trust. In this case, either adminCertSecretRef or adminCertIssuerRef fields must be provided.
If not provided, a self-signed CA will be provisioned to issue the server certificate.

| | | | `adminCertSecretRef` [*LocalObjectReference*](#localobjectreference) | AdminCertSecretRef is a reference to a TLS Secret used by the MaxScale's administrative REST API and GUI. | | | | `adminCertIssuerRef` [*ObjectReference*](#objectreference) |

AdminCertIssuerRef is a reference to a cert-manager issuer object used to issue the MaxScale's administrative REST API and GUI certificate. cert-manager must be installed previously in the cluster.
It is mutually exclusive with adminCertSecretRef.
By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via adminCASecretRef.

| | | | `adminCertConfig` [*CertConfig*](#certconfig) |

AdminCertConfig allows configuring the admin certificates, either issued by the operator or cert-manager.
If not set, the default settings will be used.

| | | | `listenerCASecretRef` [*LocalObjectReference*](#localobjectreference) |

ListenerCASecretRef is a reference to a Secret containing the listener certificate authority keypair. It is used to establish trust and issue certificates for the MaxScale's listeners.
One of:
- Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates.
- Secret containing only the 'ca.crt' in order to establish trust. In this case, either listenerCertSecretRef or listenerCertIssuerRef fields must be provided.
If not provided, a self-signed CA will be provisioned to issue the listener certificate.

| | | | `listenerCertSecretRef` [*LocalObjectReference*](#localobjectreference) | ListenerCertSecretRef is a reference to a TLS Secret used by the MaxScale's listeners. | | | | `listenerCertIssuerRef` [*ObjectReference*](#objectreference) |

ListenerCertIssuerRef is a reference to a cert-manager issuer object used to issue the MaxScale's listeners certificate. cert-manager must be installed previously in the cluster.
It is mutually exclusive with listenerCertSecretRef.
By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via listenerCASecretRef.

| | | | `listenerCertConfig` [*CertConfig*](#certconfig) |

ListenerCertConfig allows configuring the listener certificates, either issued by the operator or cert-manager.
If not set, the default settings will be used.

| | | | `serverCASecretRef` [*LocalObjectReference*](#localobjectreference) |

ServerCASecretRef is a reference to a Secret containing the MariaDB server CA certificates. It is used to establish trust with MariaDB servers.
The Secret should contain a 'ca.crt' key in order to establish trust.
If not provided, and the reference to a MariaDB resource is set (mariaDbRef), it will be defaulted to the referred MariaDB CA bundle.

| | | | `serverCertSecretRef` [*LocalObjectReference*](#localobjectreference) |

ServerCertSecretRef is a reference to a TLS Secret used by MaxScale to connect to the MariaDB servers.
If not provided, and the reference to a MariaDB resource is set (mariaDbRef), it will be defaulted to the referred MariaDB client certificate (clientCertSecretRef).

| | | | `verifyPeerCertificate` *boolean* |

VerifyPeerCertificate specifies whether the peer certificate's signature should be validated against the CA.
It is disabled by default.

| | | | `verifyPeerHost` *boolean* |

VerifyPeerHost specifies whether the peer certificate's SANs should match the peer host.
It is disabled by default.

| | | | `replicationSSLEnabled` *boolean* |

ReplicationSSLEnabled specifies whether the replication SSL is enabled. If enabled, the SSL options will be added to the server configuration.
It is enabled by default when the referred MariaDB instance (via mariaDbRef) has replication enabled.
If the MariaDB servers are manually provided by the user via the 'servers' field, this must be set by the user as well.

| | | #### Metadata Metadata defines the metadata to added to resources. *Appears in:* * [BackupSpec](#backupspec) * [Exporter](#exporter) * [ExternalMariaDBSpec](#externalmariadbspec) * [GaleraInitJob](#galerainitjob) * [GaleraRecoveryJob](#galerarecoveryjob) * [Job](#job) * [JobPodTemplate](#jobpodtemplate) * [MariaDBPodTemplate](#mariadbpodtemplate) * [MariaDBSpec](#mariadbspec) * [MaxScalePodTemplate](#maxscalepodtemplate) * [MaxScaleSpec](#maxscalespec) * [PhysicalBackupPodTemplate](#physicalbackuppodtemplate) * [PhysicalBackupSpec](#physicalbackupspec) * [PhysicalBackupVolumeSnapshot](#physicalbackupvolumesnapshot) * [RestoreSpec](#restorespec) * [SecretTemplate](#secrettemplate) * [ServiceTemplate](#servicetemplate) * [SqlJobSpec](#sqljobspec) * [VolumeClaimTemplate](#volumeclaimtemplate) | Field | Description | Default | Validation | | --------------------------------------------------- | ---------------------------------------------- | ------- | ---------- | | `labels` *object (keys:string, values:string)* | Labels to be added to children resources. | | | | `annotations` *object (keys:string, values:string)* | Annotations to be added to children resources. | | | #### MonitorModule *Underlying type:* *string* MonitorModule defines the type of monitor module *Appears in:* * [MaxScaleMonitor](#maxscalemonitor) | Field | Description | | ------------ | ----------------------------------------------------------------------------- | | `mariadbmon` |

MonitorModuleMariadb is a monitor to be used with MariaDB servers.

| | `galeramon` |

MonitorModuleGalera is a monitor to be used with Galera servers.

| #### NFSVolumeSource Refer to the Kubernetes docs: . *Appears in:* * [MariaDBVolume](#mariadbvolume) * [MariaDBVolumeSource](#mariadbvolumesource) * [StorageVolumeSource](#storagevolumesource) * [Volume](#volume) * [VolumeSource](#volumesource) | Field | Description | Default | Validation | | -------------------- | ----------- | ------- | ---------- | | `server` *string* | | | | | `path` *string* | | | | | `readOnly` *boolean* | | | | #### NodeAffinity Refer to the Kubernetes docs: *Appears in:* * [Affinity](#affinity) * [AffinityConfig](#affinityconfig) | Field | Description | Default | Validation | | --------------------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `requiredDuringSchedulingIgnoredDuringExecution` [*NodeSelector*](#nodeselector) | | | | | `preferredDuringSchedulingIgnoredDuringExecution` [*PreferredSchedulingTerm*](#preferredschedulingterm) *array* | | | | #### NodeSelector Refer to the Kubernetes docs: *Appears in:* * [NodeAffinity](#nodeaffinity) | Field | Description | Default | Validation | | ------------------------------------------------------------------- | ----------- | ------- | ---------- | | `nodeSelectorTerms` [*NodeSelectorTerm*](#nodeselectorterm) *array* | | | | #### NodeSelectorRequirement Refer to the Kubernetes docs: *Appears in:* * [NodeSelectorTerm](#nodeselectorterm) | Field | Description | Default | Validation | | -------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `key` *string* | | | | | `operator` [*NodeSelectorOperator*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#nodeselectoroperator-v1-core) | | | | | `values` *string array* | | | | #### NodeSelectorTerm Refer to the Kubernetes docs: *Appears in:* * [NodeSelector](#nodeselector) * [PreferredSchedulingTerm](#preferredschedulingterm) | Field | Description | Default | Validation | | -------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `matchExpressions` [*NodeSelectorRequirement*](#nodeselectorrequirement) *array* | | | | | `matchFields` [*NodeSelectorRequirement*](#nodeselectorrequirement) *array* | | | | #### ObjectFieldSelector Refer to the Kubernetes docs: . *Appears in:* * [EnvVarSource](#envvarsource) | Field | Description | Default | Validation | | --------------------- | ----------- | ------- | ---------- | | `apiVersion` *string* | | | | | `fieldPath` *string* | | | | #### ObjectReference Refer to the Kubernetes docs: . *Appears in:* * [ConnectionSpec](#connectionspec) * [MariaDBRef](#mariadbref) * [MariaDBSpec](#mariadbspec) | Field | Description | Default | Validation | | -------------------- | ----------- | ------- | ---------- | | `name` *string* | | | | | `namespace` *string* | | | | #### PasswordPlugin PasswordPlugin defines the password plugin and its arguments. *Appears in:* * [MariaDBSpec](#mariadbspec) * [UserSpec](#userspec) | Field | Description | Default | Validation | | ------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `pluginNameSecretKeyRef` [*SecretKeySelector*](#secretkeyselector) |

PluginNameSecretKeyRef is a reference to the authentication plugin to be used by the User.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the authentication plugin.

| | | | `pluginArgSecretKeyRef` [*SecretKeySelector*](#secretkeyselector) |

PluginArgSecretKeyRef is a reference to the arguments to be provided to the authentication plugin for the User.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the authentication plugin arguments.

| | | #### PersistentVolumeClaimRetentionPolicyType *Underlying type:* *string* PersistentVolumeClaimRetentionPolicyType describes the lifecycle of persistent volume claims. Refer to the Kubernetes docs: . *Appears in:* * [StatefulSetPersistentVolumeClaimRetentionPolicy](#statefulsetpersistentvolumeclaimretentionpolicy) | Field | Description | | -------- | --------------------------------------------------------------------------------------------------------------------- | | `Delete` |

PersistentVolumeClaimRetentionPolicyDelete deletes PVCs when their owning pods or StatefulSet are deleted.

| | `Retain` |

PersistentVolumeClaimRetentionPolicyRetain retains PVCs when their owning pods or StatefulSet are deleted.

| #### PersistentVolumeClaimSpec Refer to the Kubernetes docs: . *Appears in:* * [BackupStorage](#backupstorage) * [PhysicalBackupStorage](#physicalbackupstorage) * [StagingStorage](#stagingstorage) * [VolumeClaimTemplate](#volumeclaimtemplate) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `accessModes` [*PersistentVolumeAccessMode*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#persistentvolumeaccessmode-v1-core) *array* | | | | | `selector` [*LabelSelector*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#labelselector-v1-meta) | | | | | `resources` [*VolumeResourceRequirements*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumeresourcerequirements-v1-core) | | | | | `storageClassName` *string* | | | | #### PersistentVolumeClaimVolumeSource Refer to the Kubernetes docs: . *Appears in:* * [MariaDBVolume](#mariadbvolume) * [MariaDBVolumeSource](#mariadbvolumesource) * [StorageVolumeSource](#storagevolumesource) * [Volume](#volume) * [VolumeSource](#volumesource) | Field | Description | Default | Validation | | -------------------- | ----------- | ------- | ---------- | | `claimName` *string* | | | | | `readOnly` *boolean* | | | | #### PhysicalBackup PhysicalBackup is the Schema for the physicalbackups API. It is used to define physical backup jobs and its storage. | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------- | ---------- | | `apiVersion` *string* | `enterprise.mariadb.com/v1alpha1` | | | | `kind` *string* | `PhysicalBackup` | | | | `metadata` [*ObjectMeta*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#objectmeta-v1-meta) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec` [*PhysicalBackupSpec*](#physicalbackupspec) | | | | #### PhysicalBackupPodTemplate PhysicalBackupPodTemplate defines a template to configure Container objects that run in a PhysicalBackup. *Appears in:* * [PhysicalBackupSpec](#physicalbackupspec) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | ------- | ---------- | | `podMetadata` [*Metadata*](#metadata) | PodMetadata defines extra metadata for the Pod. | | | | `imagePullSecrets` [*LocalObjectReference*](#localobjectreference) *array* | ImagePullSecrets is the list of pull Secrets to be used to pull the image. | | | | `podSecurityContext` [*PodSecurityContext*](#podsecuritycontext) | SecurityContext holds pod-level security attributes and common container settings. | | | | `serviceAccountName` *string* | ServiceAccountName is the name of the ServiceAccount to be used by the Pods. | | | | `tolerations` [*Toleration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) *array* | Tolerations to be used in the Pod. | | | | `priorityClassName` *string* | PriorityClassName to be used in the Pod. | | | #### PhysicalBackupSchedule PhysicalBackupSchedule defines when the PhysicalBackup will be taken. *Appears in:* * [PhysicalBackupSpec](#physicalbackupspec) | Field | Description | Default | Validation | | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `cron` *string* | Cron is a cron expression that defines the schedule. | | | | `suspend` *boolean* | Suspend defines whether the schedule is active or not. | false | | | `immediate` *boolean* | Immediate indicates whether the first backup should be taken immediately after creating the PhysicalBackup. | | | | `onDemand` *string* |

OnDemand is an identifier used to trigger an on-demand backup.
If the identifier is different than the one tracked under status.lastScheduleOnDemand, a new physical backup will be triggered.

| | | | `onPrimaryChange` *boolean* | OnPrimaryChange indicates whether a PhysicalBackup should be scheduled when the referred MariaDB has changed primary Pod. | | | #### PhysicalBackupSpec PhysicalBackupSpec defines the desired state of PhysicalBackup. *Appears in:* * [PhysicalBackup](#physicalbackup) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ------------------------------------------------------------ | | `args` *string array* | Args to be used in the Container. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `securityContext` [*SecurityContext*](#securitycontext) | SecurityContext holds security configuration that will be applied to a container. | | | | `podMetadata` [*Metadata*](#metadata) | PodMetadata defines extra metadata for the Pod. | | | | `imagePullSecrets` [*LocalObjectReference*](#localobjectreference) *array* | ImagePullSecrets is the list of pull Secrets to be used to pull the image. | | | | `podSecurityContext` [*PodSecurityContext*](#podsecuritycontext) | SecurityContext holds pod-level security attributes and common container settings. | | | | `serviceAccountName` *string* | ServiceAccountName is the name of the ServiceAccount to be used by the Pods. | | | | `tolerations` [*Toleration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) *array* | Tolerations to be used in the Pod. | | | | `priorityClassName` *string* | PriorityClassName to be used in the Pod. | | | | `mariaDbRef` [*MariaDBRef*](#mariadbref) | MariaDBRef is a reference to a MariaDB object. | |

Required: {}

| | `target` [*PhysicalBackupTarget*](#physicalbackuptarget) | Target defines in which Pod the physical backups will be taken. It defaults to "Replica", meaning that the physical backups will only be taken in ready replicas. | |

Enum: \[Replica PreferReplica]

| | `compression` [*CompressAlgorithm*](#compressalgorithm) | Compression algorithm to be used in the Backup. | |

Enum: \[none bzip2 gzip]

| | `stagingStorage` [*StagingStorage*](#stagingstorage) |

StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed.
It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the PhysicalBackup Job is scheduled.
The staging area gets cleaned up after each backup is completed, consider this for sizing it appropriately.

| | | | `storage` [*PhysicalBackupStorage*](#physicalbackupstorage) | Storage defines the final storage for backups. | |

Required: {}

| | `schedule` [*PhysicalBackupSchedule*](#physicalbackupschedule) | Schedule defines when the PhysicalBackup will be taken. | | | | `maxRetention` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

MaxRetention defines the retention policy for backups. Old backups will be cleaned up by the Backup Job.
It defaults to 30 days.

| | | | `timeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

Timeout defines the maximum duration of a PhysicalBackup job or snapshot.
If this duration is exceeded, the job or snapshot is considered expired and is deleted by the operator.
A new job or snapshot will then be created according to the schedule.
It defaults to 1 hour.

| | | | `podAffinity` *boolean* |

PodAffinity indicates whether the Jobs should run in the same Node as the MariaDB Pods to be able to attach the PVC.
It defaults to true.

| | | | `backoffLimit` *integer* | BackoffLimit defines the maximum number of attempts to successfully take a PhysicalBackup. | | | | `restartPolicy` [*RestartPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#restartpolicy-v1-core) | RestartPolicy to be added to the PhysicalBackup Pod. | OnFailure |

Enum: \[Always OnFailure Never]

| | `inheritMetadata` [*Metadata*](#metadata) | InheritMetadata defines the metadata to be inherited by children resources. | | | | `successfulJobsHistoryLimit` *integer* | SuccessfulJobsHistoryLimit defines the maximum number of successful Jobs to be displayed. It defaults to 5. | |

Minimum: 0

| | `logLevel` *string* | LogLevel to be used in the PhysicalBackup Job. It defaults to 'info'. | info |

Enum: \[debug info warn error dpanic panic fatal]

| #### PhysicalBackupStorage PhysicalBackupStorage defines the storage for physical backups. *Appears in:* * [PhysicalBackupSpec](#physicalbackupspec) | Field | Description | Default | Validation | | --------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | ------- | ---------- | | `s3` [*S3*](#s3) | S3 defines the configuration to store backups in a S3 compatible storage. | | | | `azureBlob` [*AzureBlob*](#azureblob) | AzureBlob defines the configuration to store backups in a AzureBlob compatible storage. | | | | `persistentVolumeClaim` [*PersistentVolumeClaimSpec*](#persistentvolumeclaimspec) | PersistentVolumeClaim is a Kubernetes PVC specification. | | | | `volume` [*StorageVolumeSource*](#storagevolumesource) | Volume is a Kubernetes volume specification. | | | | `volumeSnapshot` [*PhysicalBackupVolumeSnapshot*](#physicalbackupvolumesnapshot) | VolumeSnapshot is a Kubernetes VolumeSnapshot specification. | | | #### PhysicalBackupTarget *Underlying type:* *string* PhysicalBackupTarget defines in which Pod the physical backups will be taken. *Appears in:* * [PhysicalBackupSpec](#physicalbackupspec) | Field | Description | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `Replica` |

PhysicalBackupTargetReplica indicates that the physical backup will be taken in a ready replica.

| | `PreferReplica` |

PhysicalBackupTargetReplica indicates that the physical backup will preferably be taken in a ready replica.
If no ready replicas are available, physical backups will be taken in the primary.

| #### PhysicalBackupVolumeSnapshot PhysicalBackupVolumeSnapshot defines parameters for the VolumeSnapshots used as physical backups. *Appears in:* * [PhysicalBackupStorage](#physicalbackupstorage) | Field | Description | Default | Validation | | ---------------------------------- | --------------------------------------------------------------------------------- | ------- | ----------------------- | | `metadata` [*Metadata*](#metadata) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `volumeSnapshotClassName` *string* | VolumeSnapshotClassName is the VolumeSnapshot class to be used to take snapshots. | |

Required: {}

| #### PodAffinityTerm Refer to the Kubernetes docs: . *Appears in:* * [PodAntiAffinity](#podantiaffinity) * [WeightedPodAffinityTerm](#weightedpodaffinityterm) | Field | Description | Default | Validation | | ------------------------------------------------- | ----------- | ------- | ---------- | | `labelSelector` [*LabelSelector*](#labelselector) | | | | | `topologyKey` *string* | | | | #### PodAntiAffinity Refer to the Kubernetes docs: . *Appears in:* * [Affinity](#affinity) * [AffinityConfig](#affinityconfig) | Field | Description | Default | Validation | | --------------------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `requiredDuringSchedulingIgnoredDuringExecution` [*PodAffinityTerm*](#podaffinityterm) *array* | | | | | `preferredDuringSchedulingIgnoredDuringExecution` [*WeightedPodAffinityTerm*](#weightedpodaffinityterm) *array* | | | | #### PodDisruptionBudget PodDisruptionBudget is the Pod availability bundget for a MariaDB *Appears in:* * [MariaDBSpec](#mariadbspec) * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------- | ------- | ---------- | | `minAvailable` [*IntOrString*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#intorstring-intstr-util) | MinAvailable defines the number of minimum available Pods. | | | | `maxUnavailable` [*IntOrString*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#intorstring-intstr-util) | MaxUnavailable defines the number of maximum unavailable Pods. | | | #### PodSecurityContext Refer to the Kubernetes docs: *Appears in:* * [BackupSpec](#backupspec) * [Exporter](#exporter) * [JobPodTemplate](#jobpodtemplate) * [MariaDBPodTemplate](#mariadbpodtemplate) * [MariaDBSpec](#mariadbspec) * [MaxScalePodTemplate](#maxscalepodtemplate) * [MaxScaleSpec](#maxscalespec) * [PhysicalBackupPodTemplate](#physicalbackuppodtemplate) * [PhysicalBackupSpec](#physicalbackupspec) * [RestoreSpec](#restorespec) * [SqlJobSpec](#sqljobspec) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `seLinuxOptions` [*SELinuxOptions*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#selinuxoptions-v1-core) | | | | | `runAsUser` *integer* | | | | | `runAsGroup` *integer* | | | | | `runAsNonRoot` *boolean* | | | | | `supplementalGroups` *integer array* | | | | | `fsGroup` *integer* | | | | | `fsGroupChangePolicy` [*PodFSGroupChangePolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#podfsgroupchangepolicy-v1-core) | | | | | `seccompProfile` [*SeccompProfile*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#seccompprofile-v1-core) | | | | | `appArmorProfile` [*AppArmorProfile*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#apparmorprofile-v1-core) | | | | #### PointInTimeRecovery PointInTimeRecovery is the Schema for the pointintimerecoveries API. It contains binlog archival and point-in-time restoration settings. | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------- | ---------- | | `apiVersion` *string* | `enterprise.mariadb.com/v1alpha1` | | | | `kind` *string* | `PointInTimeRecovery` | | | | `metadata` [*ObjectMeta*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#objectmeta-v1-meta) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec` [*PointInTimeRecoverySpec*](#pointintimerecoveryspec) | | | | #### PointInTimeRecoverySpec PointInTimeRecoverySpec defines the desired state of PointInTimeRecovery. It contains binlog archive and point-in-time restoration settings. *Appears in:* * [PointInTimeRecovery](#pointintimerecovery) | Field | Description | Default | Validation | | --------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------- | | `physicalBackupRef` [*LocalObjectReference*](#localobjectreference) | PhysicalBackupRef is a reference to a PhysicalBackup object that will be used as base backup. | |

Required: {}

| | `storage` [*PointInTimeRecoveryStorage*](#pointintimerecoverystorage) | PointInTimeRecoveryStorage is the storage where the point in time recovery data will be stored | |

Required: {}

| | `compression` [*CompressAlgorithm*](#compressalgorithm) |

Compression algorithm to be used for compressing the binary logs.
This field is immutable, it cannot be updated after creation.

| |

Enum: \[none bzip2 gzip]

| | `archiveTimeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

ArchiveTimeout defines the maximum duration for the binary log archival.
If this duration is exceeded, the sidecar agent will log an error and it will be retried in the next archive cycle.
It defaults to 1 hour.

| 1h | | | `strictMode` *boolean* |

StrictMode controls the behavior when a point-in-time restoration cannot reach the exact target time:
When enabled: Returns an error and avoids replaying binary logs if target time is not reached.
When disabled (default): Replays available binary logs until the last recoverable time. It logs logs an error if target time is not reached.

| | | | `archiveInterval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

ArchiveInterval defines the time interval at which the binary logs will be archived.
It defaults to 10 minutes.

| 10m | | | `maxParallel` *integer* |

MaxParallel defines the maximum number of parallel workers, both for archiving and restoring the binary logs.
It defaults to 1.

| 1 |

Minimum: 1

| | `maxRetention` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

MaxRetention defines the retention policy for binary logs. Binary logs older than this duration will be cleaned up when the archival is completed.
It is not set by default, meaning that old binary logs will not be cleaned up.
This field is immutable, it cannot be updated after creation.

| | | #### PointInTimeRecoveryStorage PointInTimeRecoveryStorage stores the different storage options for PITR *Appears in:* * [PointInTimeRecoverySpec](#pointintimerecoveryspec) | Field | Description | Default | Validation | | ------------------------------------- | ----------------------------------------------------------------------- | ------- | ---------- | | `s3` [*S3*](#s3) | S3 is the S3-compatible storage where the binary logs will be kept. | | | | `azureBlob` [*AzureBlob*](#azureblob) | AzureBlob is the Azure Blob Storage where the binary logs will be kept. | | | #### PreferredSchedulingTerm Refer to the Kubernetes docs: *Appears in:* * [NodeAffinity](#nodeaffinity) | Field | Description | Default | Validation | | ---------------------------------------------------- | ----------- | ------- | ---------- | | `weight` *integer* | | | | | `preference` [*NodeSelectorTerm*](#nodeselectorterm) | | | | #### PrimaryGalera PrimaryGalera is the Galera configuration for the primary node. *Appears in:* * [Galera](#galera) * [GaleraSpec](#galeraspec) | Field | Description | Default | Validation | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `podIndex` *integer* | PodIndex is the StatefulSet index of the primary node. The user may change this field to perform a manual switchover. | | | | `autoFailover` *boolean* | AutoFailover indicates whether the operator should automatically update PodIndex to perform an automatic primary failover. | | | #### PrimaryReplication PrimaryReplication is the replication configuration and operation parameters for the primary. *Appears in:* * [Replication](#replication) * [ReplicationSpec](#replicationspec) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `podIndex` *integer* | PodIndex is the StatefulSet index of the primary node. The user may change this field to perform a manual switchover. | | | | `autoFailover` *boolean* |

AutoFailover indicates whether the operator should automatically update PodIndex to perform an automatic primary failover.
It is enabled by default.

| | | | `autoFailoverDelay` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

AutoFailoverDelay indicates the duration before performing an automatic primary failover.
By default, no extra delay is added.

| | | #### Probe Refer to the Kubernetes docs: . *Appears in:* * [Agent](#agent) * [ContainerTemplate](#containertemplate) * [InitContainer](#initcontainer) * [MariaDBSpec](#mariadbspec) * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ------------------------------------------------- | ----------- | ------- | ---------- | | `exec` [*ExecAction*](#execaction) | | | | | `httpGet` [*HTTPGetAction*](#httpgetaction) | | | | | `tcpSocket` [*TCPSocketAction*](#tcpsocketaction) | | | | | `initialDelaySeconds` *integer* | | | | | `timeoutSeconds` *integer* | | | | | `periodSeconds` *integer* | | | | | `successThreshold` *integer* | | | | | `failureThreshold` *integer* | | | | #### ProbeHandler Refer to the Kubernetes docs: . *Appears in:* * [Probe](#probe) | Field | Description | Default | Validation | | ------------------------------------------------- | ----------- | ------- | ---------- | | `exec` [*ExecAction*](#execaction) | | | | | `httpGet` [*HTTPGetAction*](#httpgetaction) | | | | | `tcpSocket` [*TCPSocketAction*](#tcpsocketaction) | | | | #### ReplicaBootstrapFrom ReplicaBootstrapFrom defines the sources for bootstrapping new relicas. *Appears in:* * [ReplicaReplication](#replicareplication) | Field | Description | Default | Validation | | --------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------- | | `physicalBackupTemplateRef` [*LocalObjectReference*](#localobjectreference) |

PhysicalBackupTemplateRef is a reference to a PhysicalBackup object that will be used as template to create a new PhysicalBackup object
used synchronize the data from an up to date replica to the new replica to be bootstrapped.

| |

Required: {}

| | `restoreJob` [*Job*](#job) | RestoreJob defines additional properties for the Job used to perform the restoration. | | | #### ReplicaRecovery ReplicaRecovery defines how the replicas should be recovered after they enter an error state. *Appears in:* * [ReplicaReplication](#replicareplication) | Field | Description | Default | Validation | | ---------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------- | | `enabled` *boolean* | Enabled is a flag to enable replica recovery. | |

Required: {}

| | `errorDurationThreshold` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

ErrorDurationThreshold defines the time duration after which, if a replica continues to report errors,
the operator will initiate the recovery process for that replica.
This threshold applies only to error codes not identified as recoverable by the operator.
Errors identified as recoverable will trigger the recovery process immediately.
It defaults to 5 minutes.

| | | #### ReplicaReplication ReplicaReplication is the replication configuration and operation parameters for the replicas. *Appears in:* * [Replication](#replication) * [ReplicationSpec](#replicationspec) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | --------------------------------------- | | `replPasswordSecretKeyRef` [*GeneratedSecretKeyRef*](#generatedsecretkeyref) |

ReplPasswordSecretKeyRef provides a reference to the Secret to use as password for the replication user.
By default, a random password will be generated.

| | | | `gtid` [*Gtid*](#gtid) |

Gtid indicates which Global Transaction ID (GTID) position mode should be used when connecting a replica to the master.
By default, CurrentPos is used.
See: .

| |

Enum: \[CurrentPos SlavePos]

| | `connectionRetrySeconds` *integer* |

ConnectionRetrySeconds is the number of seconds that the replica will wait between connection retries.
See: .

| | | | `maxLagSeconds` *integer* |

MaxLagSeconds is the maximum number of seconds that replicas are allowed to lag behind the primary.
If a replica exceeds this threshold, it is marked as not ready and read queries will no longer be forwarded to it.
If not provided, it defaults to 0, which means that replicas are not allowed to lag behind the primary (recommended).
Lagged replicas will not be taken into account as candidates for the new primary during failover,
and they will block other operations, such as switchover and upgrade.
This field is not taken into account by MaxScale, you can define the maximum lag as router parameters.
See: .

| | | | `syncTimeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

SyncTimeout defines the timeout for the synchronization phase during switchover and failover operations.
During switchover, all replicas must be synced with the current primary before promoting the new primary.
During failover, the new primary must be synced before being promoted as primary. This implies processing all the events in the relay log.
When the timeout is reached, the operator restarts the operation from the beginning.
It defaults to 10s.
See:

| | | | `bootstrapFrom` [*ReplicaBootstrapFrom*](#replicabootstrapfrom) |

ReplicaBootstrapFrom defines the data sources used to bootstrap new replicas.
This will be used as part of the scaling out and recovery operations, when new replicas are created.
If not provided, scale out and recovery operations will return an error.

| | | | `recovery` [*ReplicaRecovery*](#replicarecovery) |

ReplicaRecovery defines how the replicas should be recovered after they enter an error state.
This process deletes data from faulty replicas and recreates them using the source defined in the bootstrapFrom field.
It is disabled by default, and it requires the bootstrapFrom field to be set.

| | | #### Replication Replication defines replication configuration for a MariaDB cluster. *Appears in:* * [MariaDBSpec](#mariadbspec) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------------- | | `primary` [*PrimaryReplication*](#primaryreplication) | Primary is the replication configuration for the primary node. | | | | `replica` [*ReplicaReplication*](#replicareplication) | ReplicaReplication is the replication configuration for the replica nodes. | | | | `gtidStrictMode` *boolean* |

GtidStrictMode determines whether the GTID strict mode is enabled.
See: .
It is enabled by default.

| | | | `semiSyncEnabled` *boolean* |

SemiSyncEnabled determines whether semi-synchronous replication is enabled.
Semi-synchronous replication requires that at least one replica should have sent an ACK to the primary node
before committing the transaction back to the client.
See:
It is enabled by default

| | | | `semiSyncAckTimeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

SemiSyncAckTimeout for the replica to acknowledge transactions to the primary.
It requires semi-synchronous replication to be enabled.
See:

| | | | `semiSyncWaitPoint` [*WaitPoint*](#waitpoint) |

SemiSyncWaitPoint determines whether the transaction should wait for an ACK after having synced the binlog (AfterSync)
or after having committed to the storage engine (AfterCommit, the default).
It requires semi-synchronous replication to be enabled.
See: .

| |

Enum: \[AfterSync AfterCommit]

| | `syncBinlog` *integer* |

SyncBinlog indicates after how many events the binary log is synchronized to the disk.
See:

| | | | `initContainer` [*InitContainer*](#initcontainer) | InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator. | | | | `agent` [*Agent*](#agent) | Agent is a sidecar agent that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator. | | | | `standaloneProbes` *boolean* |

StandaloneProbes indicates whether to use the default non-HA startup and liveness probes.
It is disabled by default

| | | | `enabled` *boolean* | Enabled is a flag to enable replication. | | | #### ReplicationSpec ReplicationSpec is the replication desired state. *Appears in:* * [Replication](#replication) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------------- | | `primary` [*PrimaryReplication*](#primaryreplication) | Primary is the replication configuration for the primary node. | | | | `replica` [*ReplicaReplication*](#replicareplication) | ReplicaReplication is the replication configuration for the replica nodes. | | | | `gtidStrictMode` *boolean* |

GtidStrictMode determines whether the GTID strict mode is enabled.
See: .
It is enabled by default.

| | | | `semiSyncEnabled` *boolean* |

SemiSyncEnabled determines whether semi-synchronous replication is enabled.
Semi-synchronous replication requires that at least one replica should have sent an ACK to the primary node
before committing the transaction back to the client.
See:
It is enabled by default

| | | | `semiSyncAckTimeout` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) |

SemiSyncAckTimeout for the replica to acknowledge transactions to the primary.
It requires semi-synchronous replication to be enabled.
See:

| | | | `semiSyncWaitPoint` [*WaitPoint*](#waitpoint) |

SemiSyncWaitPoint determines whether the transaction should wait for an ACK after having synced the binlog (AfterSync)
or after having committed to the storage engine (AfterCommit, the default).
It requires semi-synchronous replication to be enabled.
See: .

| |

Enum: \[AfterSync AfterCommit]

| | `syncBinlog` *integer* |

SyncBinlog indicates after how many events the binary log is synchronized to the disk.
See:

| | | | `initContainer` [*InitContainer*](#initcontainer) | InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator. | | | | `agent` [*Agent*](#agent) | Agent is a sidecar agent that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator. | | | | `standaloneProbes` *boolean* |

StandaloneProbes indicates whether to use the default non-HA startup and liveness probes.
It is disabled by default

| | | #### ResourceRequirements Refer to the Kubernetes docs: . *Appears in:* * [Agent](#agent) * [BackupSpec](#backupspec) * [Container](#container) * [ContainerTemplate](#containertemplate) * [Exporter](#exporter) * [GaleraInitJob](#galerainitjob) * [GaleraRecoveryJob](#galerarecoveryjob) * [InitContainer](#initcontainer) * [Job](#job) * [JobContainerTemplate](#jobcontainertemplate) * [MariaDBSpec](#mariadbspec) * [MaxScaleSpec](#maxscalespec) * [PhysicalBackupSpec](#physicalbackupspec) * [RestoreSpec](#restorespec) * [SqlJobSpec](#sqljobspec) #### Restore Restore is the Schema for the restores API. It is used to define restore jobs and its restoration source. | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------- | ---------- | | `apiVersion` *string* | `enterprise.mariadb.com/v1alpha1` | | | | `kind` *string* | `Restore` | | | | `metadata` [*ObjectMeta*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#objectmeta-v1-meta) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec` [*RestoreSpec*](#restorespec) | | | | #### RestoreSource RestoreSource defines a source for restoring a logical backup. *Appears in:* * [RestoreSpec](#restorespec) | Field | Description | Default | Validation | | ---------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `backupRef` [*LocalObjectReference*](#localobjectreference) | BackupRef is a reference to a Backup object. It has priority over S3 and Volume. | | | | `s3` [*S3*](#s3) | S3 defines the configuration to restore backups from a S3 compatible storage. It has priority over Volume. | | | | `volume` [*StorageVolumeSource*](#storagevolumesource) | Volume is a Kubernetes Volume object that contains a backup. | | | | `targetRecoveryTime` [*Time*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#time-v1-meta) |

TargetRecoveryTime is a RFC3339 (1970-01-01T00:00:00Z) date and time that defines the point in time recovery objective.
It is used to determine the closest restoration source in time.

| | | | `stagingStorage` [*StagingStorage*](#stagingstorage) |

StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed.
It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the Restore Job is scheduled.

| | | #### RestoreSpec RestoreSpec defines the desired state of restore *Appears in:* * [Restore](#restore) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ------------------------------------------------------------ | | `args` *string array* | Args to be used in the Container. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `securityContext` [*SecurityContext*](#securitycontext) | SecurityContext holds security configuration that will be applied to a container. | | | | `podMetadata` [*Metadata*](#metadata) | PodMetadata defines extra metadata for the Pod. | | | | `imagePullSecrets` [*LocalObjectReference*](#localobjectreference) *array* | ImagePullSecrets is the list of pull Secrets to be used to pull the image. | | | | `podSecurityContext` [*PodSecurityContext*](#podsecuritycontext) | SecurityContext holds pod-level security attributes and common container settings. | | | | `serviceAccountName` *string* | ServiceAccountName is the name of the ServiceAccount to be used by the Pods. | | | | `affinity` [*AffinityConfig*](#affinityconfig) | Affinity to be used in the Pod. | | | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector to be used in the Pod. | | | | `tolerations` [*Toleration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) *array* | Tolerations to be used in the Pod. | | | | `priorityClassName` *string* | PriorityClassName to be used in the Pod. | | | | `backupRef` [*LocalObjectReference*](#localobjectreference) | BackupRef is a reference to a Backup object. It has priority over S3 and Volume. | | | | `s3` [*S3*](#s3) | S3 defines the configuration to restore backups from a S3 compatible storage. It has priority over Volume. | | | | `volume` [*StorageVolumeSource*](#storagevolumesource) | Volume is a Kubernetes Volume object that contains a backup. | | | | `targetRecoveryTime` [*Time*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#time-v1-meta) |

TargetRecoveryTime is a RFC3339 (1970-01-01T00:00:00Z) date and time that defines the point in time recovery objective.
It is used to determine the closest restoration source in time.

| | | | `stagingStorage` [*StagingStorage*](#stagingstorage) |

StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed.
It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the Restore Job is scheduled.

| | | | `mariaDbRef` [*MariaDBRef*](#mariadbref) | MariaDBRef is a reference to a MariaDB object. | |

Required: {}

| | `database` *string* |

Database defines the logical database to be restored. If not provided, all databases available in the backup are restored.
IMPORTANT: The database must previously exist.

| | | | `logLevel` *string* | LogLevel to be used n the Backup Job. It defaults to 'info'. | info |

Enum: \[debug info warn error dpanic panic fatal]

| | `backoffLimit` *integer* | BackoffLimit defines the maximum number of attempts to successfully perform a Backup. | 5 | | | `restartPolicy` [*RestartPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#restartpolicy-v1-core) | RestartPolicy to be added to the Backup Job. | OnFailure |

Enum: \[Always OnFailure Never]

| | `inheritMetadata` [*Metadata*](#metadata) | InheritMetadata defines the metadata to be inherited by children resources. | | | #### S3 *Appears in:* * [BackupStorage](#backupstorage) * [BootstrapFrom](#bootstrapfrom) * [PhysicalBackupStorage](#physicalbackupstorage) * [PointInTimeRecoveryStorage](#pointintimerecoverystorage) * [RestoreSource](#restoresource) * [RestoreSpec](#restorespec) | Field | Description | Default | Validation | | ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------- | | `bucket` *string* | Bucket is the name Name of the bucket to store backups. | |

Required: {}

| | `endpoint` *string* | Endpoint is the S3 API endpoint without scheme. | |

Required: {}

| | `region` *string* | Region is the S3 region name to use. | | | | `prefix` *string* | Prefix indicates a folder/subfolder in the bucket. For example: mariadb/ or mariadb/backups. A trailing slash '/' is added if not provided. | | | | `accessKeyIdSecretKeyRef` [*SecretKeySelector*](#secretkeyselector) | AccessKeyIdSecretKeyRef is a reference to a Secret key containing the S3 access key id. | | | | `secretAccessKeySecretKeyRef` [*SecretKeySelector*](#secretkeyselector) | AccessKeyIdSecretKeyRef is a reference to a Secret key containing the S3 secret key. | | | | `sessionTokenSecretKeyRef` [*SecretKeySelector*](#secretkeyselector) | SessionTokenSecretKeyRef is a reference to a Secret key containing the S3 session token. | | | | `tls` [*TLSConfig*](#tlsconfig) | TLS provides the configuration required to establish TLS connections with S3. | | | | `ssec` [*SSECConfig*](#ssecconfig) |

SSEC is a reference to a Secret containing the SSE-C (Server-Side Encryption with Customer-Provided Keys) key.
The secret must contain a 32-byte key (256 bits) in the specified key.
This enables server-side encryption where you provide and manage the encryption key.

| | | #### SQLTemplate SQLTemplate defines a template to customize SQL objects. *Appears in:* * [DatabaseSpec](#databasespec) * [GrantSpec](#grantspec) * [UserSpec](#userspec) | Field | Description | Default | Validation | | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | ------- | ------------------------------- | | `requeueInterval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | RequeueInterval is used to perform requeue reconciliations. | | | | `retryInterval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | RetryInterval is the interval used to perform retries. | | | | `cleanupPolicy` [*CleanupPolicy*](#cleanuppolicy) | CleanupPolicy defines the behavior for cleaning up a SQL resource. | |

Enum: \[Skip Delete]

| #### SSECConfig SSECConfig defines the configuration for SSE-C (Server-Side Encryption with Customer-Provided Keys). *Appears in:* * [S3](#s3) | Field | Description | Default | Validation | | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------- | | `customerKeySecretKeyRef` [*SecretKeySelector*](#secretkeyselector) |

CustomerKeySecretKeyRef is a reference to a Secret key containing the SSE-C customer-provided encryption key.
The key must be a 32-byte (256-bit) key encoded in base64.

| |

Required: {}

| #### SST *Underlying type:* *string* SST is the Snapshot State Transfer used when new Pods join the cluster. More info: . *Appears in:* * [Galera](#galera) * [GaleraSpec](#galeraspec) | Field | Description | | ------------- | ------------------------------------------------------------------------------------ | | `rsync` |

SSTRsync is an SST based on rsync.

| | `mariabackup` |

SSTMariaBackup is an SST based on mariabackup. It is the recommended SST.

| | `mysqldump` |

SSTMysqldump is an SST based on mysqldump.

| #### Schedule Schedule contains parameters to define a schedule *Appears in:* * [BackupSpec](#backupspec) * [SqlJobSpec](#sqljobspec) | Field | Description | Default | Validation | | ------------------- | ------------------------------------------------------ | ------- | ----------------------- | | `cron` *string* | Cron is a cron expression that defines the schedule. | |

Required: {}

| | `suspend` *boolean* | Suspend defines whether the schedule is active or not. | false | | #### SecretKeySelector Refer to the Kubernetes docs: . *Appears in:* * [AzureBlob](#azureblob) * [ConnectionSpec](#connectionspec) * [EnvVarSource](#envvarsource) * [ExternalMariaDBSpec](#externalmariadbspec) * [GeneratedSecretKeyRef](#generatedsecretkeyref) * [MariaDBSpec](#mariadbspec) * [PasswordPlugin](#passwordplugin) * [S3](#s3) * [SSECConfig](#ssecconfig) * [SqlJobSpec](#sqljobspec) * [TLSConfig](#tlsconfig) * [UserSpec](#userspec) | Field | Description | Default | Validation | | --------------- | ----------- | ------- | ---------- | | `name` *string* | | | | | `key` *string* | | | | #### SecretTemplate SecretTemplate defines a template to customize Secret objects. *Appears in:* * [ConnectionSpec](#connectionspec) * [ConnectionTemplate](#connectiontemplate) | Field | Description | Default | Validation | | ---------------------------------- | --------------------------------------------------------------- | ------- | ---------- | | `metadata` [*Metadata*](#metadata) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `key` *string* | Key to be used in the Secret. | | | | `format` *string* | Format to be used in the Secret. | | | | `usernameKey` *string* | UsernameKey to be used in the Secret. | | | | `passwordKey` *string* | PasswordKey to be used in the Secret. | | | | `hostKey` *string* | HostKey to be used in the Secret. | | | | `portKey` *string* | PortKey to be used in the Secret. | | | | `databaseKey` *string* | DatabaseKey to be used in the Secret. | | | #### SecretVolumeSource Refer to the Kubernetes docs: . *Appears in:* * [MariaDBVolume](#mariadbvolume) * [MariaDBVolumeSource](#mariadbvolumesource) * [Volume](#volume) * [VolumeSource](#volumesource) | Field | Description | Default | Validation | | ----------------------- | ----------- | ------- | ---------- | | `secretName` *string* | | | | | `defaultMode` *integer* | | | | #### SecurityContext Refer to the Kubernetes docs: . *Appears in:* * [Agent](#agent) * [BackupSpec](#backupspec) * [ContainerTemplate](#containertemplate) * [Exporter](#exporter) * [InitContainer](#initcontainer) * [JobContainerTemplate](#jobcontainertemplate) * [MariaDBSpec](#mariadbspec) * [MaxScaleSpec](#maxscalespec) * [PhysicalBackupSpec](#physicalbackupspec) * [RestoreSpec](#restorespec) * [SqlJobSpec](#sqljobspec) | Field | Description | Default | Validation | | -------------------------------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `capabilities` [*Capabilities*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#capabilities-v1-core) | | | | | `privileged` *boolean* | | | | | `runAsUser` *integer* | | | | | `runAsGroup` *integer* | | | | | `runAsNonRoot` *boolean* | | | | | `readOnlyRootFilesystem` *boolean* | | | | | `allowPrivilegeEscalation` *boolean* | | | | #### ServiceMonitor ServiceMonitor defines a prometheus ServiceMonitor object. *Appears in:* * [MariadbMetrics](#mariadbmetrics) * [MaxScaleMetrics](#maxscalemetrics) | Field | Description | Default | Validation | | ---------------------------- | --------------------------------------------------------------------------- | ------- | ---------- | | `prometheusRelease` *string* | PrometheusRelease is the release label to add to the ServiceMonitor object. | | | | `jobLabel` *string* | JobLabel to add to the ServiceMonitor object. | | | | `interval` *string* | Interval for scraping metrics. | | | | `scrapeTimeout` *string* | ScrapeTimeout defines the timeout for scraping metrics. | | | #### ServicePort Refer to the Kubernetes docs: *Appears in:* * [MariaDBSpec](#mariadbspec) | Field | Description | Default | Validation | | ---------------- | ----------- | ------- | ---------- | | `name` *string* | | | | | `port` *integer* | | | | #### ServiceRouter *Underlying type:* *string* ServiceRouter defines the type of service router. *Appears in:* * [MaxScaleService](#maxscaleservice) | Field | Description | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `readwritesplit` |

ServiceRouterReadWriteSplit splits the load based on the queries. Write queries are performed on master and read queries on the replicas.

| | `readconnroute` |

ServiceRouterReadConnRoute splits the load based on the connections. Each connection is assigned to a server.

| #### ServiceTemplate ServiceTemplate defines a template to customize Service objects. *Appears in:* * [MariaDBSpec](#mariadbspec) * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | --------- | --------------------------------------------------- | | `type` [*ServiceType*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#servicetype-v1-core) | Type is the Service type. One of `ClusterIP`, `NodePort` or `LoadBalancer`. If not defined, it defaults to `ClusterIP`. | ClusterIP |

Enum: \[ClusterIP NodePort LoadBalancer]

| | `metadata` [*Metadata*](#metadata) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `loadBalancerIP` *string* | LoadBalancerIP Service field. | | | | `loadBalancerSourceRanges` *string array* | LoadBalancerSourceRanges Service field. | | | | `externalTrafficPolicy` [*ServiceExternalTrafficPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#serviceexternaltrafficpolicy-v1-core) | ExternalTrafficPolicy Service field. | | | | `sessionAffinity` [*ServiceAffinity*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#serviceaffinity-v1-core) | SessionAffinity Service field. | | | | `allocateLoadBalancerNodePorts` *boolean* | AllocateLoadBalancerNodePorts Service field. | | | | `loadBalancerClass` *string* | LoadBalancerClass Service field. | | | #### SleepAction Refer to the Kubernetes docs: *Appears in:* * [LifecycleHandler](#lifecyclehandler) | Field | Description | Default | Validation | | ------------------- | ----------- | ------- | ---------- | | `seconds` *integer* | | | | #### SqlJob SqlJob is the Schema for the sqljobs API. It is used to run sql scripts as jobs. | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------- | ---------- | | `apiVersion` *string* | `enterprise.mariadb.com/v1alpha1` | | | | `kind` *string* | `SqlJob` | | | | `metadata` [*ObjectMeta*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#objectmeta-v1-meta) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec` [*SqlJobSpec*](#sqljobspec) | | | | #### SqlJobSpec SqlJobSpec defines the desired state of SqlJob *Appears in:* * [SqlJob](#sqljob) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ------------------------------------------ | | `args` *string array* | Args to be used in the Container. | | | | `resources` [*ResourceRequirements*](#resourcerequirements) | Resources describes the compute resource requirements. | | | | `securityContext` [*SecurityContext*](#securitycontext) | SecurityContext holds security configuration that will be applied to a container. | | | | `podMetadata` [*Metadata*](#metadata) | PodMetadata defines extra metadata for the Pod. | | | | `imagePullSecrets` [*LocalObjectReference*](#localobjectreference) *array* | ImagePullSecrets is the list of pull Secrets to be used to pull the image. | | | | `podSecurityContext` [*PodSecurityContext*](#podsecuritycontext) | SecurityContext holds pod-level security attributes and common container settings. | | | | `serviceAccountName` *string* | ServiceAccountName is the name of the ServiceAccount to be used by the Pods. | | | | `affinity` [*AffinityConfig*](#affinityconfig) | Affinity to be used in the Pod. | | | | `nodeSelector` *object (keys:string, values:string)* | NodeSelector to be used in the Pod. | | | | `tolerations` [*Toleration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) *array* | Tolerations to be used in the Pod. | | | | `priorityClassName` *string* | PriorityClassName to be used in the Pod. | | | | `successfulJobsHistoryLimit` *integer* | SuccessfulJobsHistoryLimit defines the maximum number of successful Jobs to be displayed. | |

Minimum: 0

| | `failedJobsHistoryLimit` *integer* | FailedJobsHistoryLimit defines the maximum number of failed Jobs to be displayed. | |

Minimum: 0

| | `timeZone` *string* | TimeZone defines the timezone associated with the cron expression. | | | | `mariaDbRef` [*MariaDBRef*](#mariadbref) | MariaDBRef is a reference to a MariaDB object. | |

Required: {}

| | `schedule` [*Schedule*](#schedule) | Schedule defines when the SqlJob will be executed. | | | | `username` *string* | Username to be impersonated when executing the SqlJob. | |

Required: {}

| | `passwordSecretKeyRef` [*SecretKeySelector*](#secretkeyselector) | UserPasswordSecretKeyRef is a reference to the impersonated user's password to be used when executing the SqlJob. | |

Required: {}

| | `tlsCASecretRef` [*LocalObjectReference*](#localobjectreference) |

TLSCACertSecretRef is a reference toa CA Secret used to establish trust when executing the SqlJob.
If not provided, the CA bundle provided by the referred MariaDB is used.

| | | | `tlsClientCertSecretRef` [*LocalObjectReference*](#localobjectreference) |

TLSClientCertSecretRef is a reference to a Kubernetes TLS Secret used as authentication when executing the SqlJob.
If not provided, the client certificate provided by the referred MariaDB is used.

| | | | `database` *string* | Username to be used when executing the SqlJob. | | | | `dependsOn` [*LocalObjectReference*](#localobjectreference) *array* | DependsOn defines dependencies with other SqlJob objectecs. | | | | `sql` *string* | Sql is the script to be executed by the SqlJob. | | | | `sqlConfigMapKeyRef` [*ConfigMapKeySelector*](#configmapkeyselector) |

SqlConfigMapKeyRef is a reference to a ConfigMap containing the Sql script.
It is defaulted to a ConfigMap with the contents of the Sql field.

| | | | `backoffLimit` *integer* | BackoffLimit defines the maximum number of attempts to successfully execute a SqlJob. | 5 | | | `restartPolicy` [*RestartPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#restartpolicy-v1-core) | RestartPolicy to be added to the SqlJob Pod. | OnFailure |

Enum: \[Always OnFailure Never]

| | `inheritMetadata` [*Metadata*](#metadata) | InheritMetadata defines the metadata to be inherited by children resources. | | | #### StagingStorage StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed. *Appears in:* * [BackupSpec](#backupspec) * [BootstrapFrom](#bootstrapfrom) * [PhysicalBackupSpec](#physicalbackupspec) * [RestoreSource](#restoresource) * [RestoreSpec](#restorespec) | Field | Description | Default | Validation | | --------------------------------------------------------------------------------- | -------------------------------------------------------- | ------- | ---------- | | `persistentVolumeClaim` [*PersistentVolumeClaimSpec*](#persistentvolumeclaimspec) | PersistentVolumeClaim is a Kubernetes PVC specification. | | | | `volume` [*StorageVolumeSource*](#storagevolumesource) | Volume is a Kubernetes volume specification. | | | #### StatefulSetPersistentVolumeClaimRetentionPolicy StatefulSetPersistentVolumeClaimRetentionPolicy describes the lifecycle of PVCs created from volumeClaimTemplates. Refer to the Kubernetes docs: . *Appears in:* * [Storage](#storage) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `whenDeleted` [*PersistentVolumeClaimRetentionPolicyType*](#persistentvolumeclaimretentionpolicytype) | | | | | `whenScaled` [*PersistentVolumeClaimRetentionPolicyType*](#persistentvolumeclaimretentionpolicytype) | | | | #### Storage Storage defines the storage options to be used for provisioning the PVCs mounted by MariaDB. *Appears in:* * [MariaDBSpec](#mariadbspec) | Field | Description | Default | Validation | | -------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `ephemeral` *boolean* | Ephemeral indicates whether to use ephemeral storage in the PVCs. It is only compatible with non HA MariaDBs. | | | | `size` [*Quantity*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#quantity-resource-api) | Size of the PVCs to be mounted by MariaDB. Required if not provided in 'VolumeClaimTemplate'. It supersedes the storage size specified in 'VolumeClaimTemplate'. | | | | `storageClassName` *string* |

StorageClassName to be used to provision the PVCS. It supersedes the 'StorageClassName' specified in 'VolumeClaimTemplate'.
If not provided, the default 'StorageClass' configured in the cluster is used.

| | | | `resizeInUseVolumes` *boolean* |

ResizeInUseVolumes indicates whether the PVCs can be resized. The 'StorageClassName' used should have 'allowVolumeExpansion' set to 'true' to allow resizing.
It defaults to true.

| | | | `waitForVolumeResize` *boolean* |

WaitForVolumeResize indicates whether to wait for the PVCs to be resized before marking the MariaDB object as ready. This will block other operations such as cluster recovery while the resize is in progress.
It defaults to true.

| | | | `volumeClaimTemplate` [*VolumeClaimTemplate*](#volumeclaimtemplate) | VolumeClaimTemplate provides a template to define the PVCs. | | | | `pvcRetentionPolicy` [*StatefulSetPersistentVolumeClaimRetentionPolicy*](#statefulsetpersistentvolumeclaimretentionpolicy) |

PersistentVolumeClaimRetentionPolicy describes the lifecycle of PVCs created from volumeClaimTemplates.
By default, all persistent volume claims are created as needed and retained until manually deleted.
This policy allows the lifecycle to be altered, for example by deleting PVCs when their statefulset is deleted,
or when their pod is scaled down.

| | | #### StorageVolumeSource Refer to the Kubernetes docs: . *Appears in:* * [BackupStorage](#backupstorage) * [BootstrapFrom](#bootstrapfrom) * [MariaDBVolume](#mariadbvolume) * [MariaDBVolumeSource](#mariadbvolumesource) * [PhysicalBackupStorage](#physicalbackupstorage) * [RestoreSource](#restoresource) * [RestoreSpec](#restorespec) * [StagingStorage](#stagingstorage) * [Volume](#volume) * [VolumeSource](#volumesource) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `emptyDir` [*EmptyDirVolumeSource*](#emptydirvolumesource) | | | | | `nfs` [*NFSVolumeSource*](#nfsvolumesource) | | | | | `csi` [*CSIVolumeSource*](#csivolumesource) | | | | | `hostPath` [*HostPathVolumeSource*](#hostpathvolumesource) | | | | | `persistentVolumeClaim` [*PersistentVolumeClaimVolumeSource*](#persistentvolumeclaimvolumesource) | | | | #### SuspendTemplate SuspendTemplate indicates whether the current resource should be suspended or not. *Appears in:* * [MariaDBSpec](#mariadbspec) * [MaxScaleListener](#maxscalelistener) * [MaxScaleMonitor](#maxscalemonitor) * [MaxScaleService](#maxscaleservice) * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `suspend` *boolean* |

Suspend indicates whether the current resource should be suspended or not.
This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.

| false | | #### TCPSocketAction Refer to the Kubernetes docs: . *Appears in:* * [Probe](#probe) * [ProbeHandler](#probehandler) | Field | Description | Default | Validation | | -------------------------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `port` [*IntOrString*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#intorstring-intstr-util) | | | | | `host` *string* | | | | #### TLS TLS defines the PKI to be used with MariaDB. *Appears in:* * [ExternalTLS](#externaltls) * [MariaDBSpec](#mariadbspec) | Field | Description | Default | Validation | | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------------------------------------- | | `enabled` *boolean* |

Enabled indicates whether TLS is enabled, determining if certificates should be issued and mounted to the MariaDB instance.
It is enabled by default.

| | | | `required` *boolean* |

Required specifies whether TLS must be enforced for all connections.
User TLS requirements take precedence over this.
It disabled by default.

| | | | `versions` *string array* |

Versions specifies the supported TLS versions for this MariaDB instance.
By default, the MariaDB's default supported versions are used. See: .

| |

items:Enum: \[TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3]

| | `serverCASecretRef` [*LocalObjectReference*](#localobjectreference) |

ServerCASecretRef is a reference to a Secret containing the server certificate authority keypair. It is used to establish trust and issue server certificates.
One of:
- Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates.
- Secret containing only the 'ca.crt' in order to establish trust. In this case, either serverCertSecretRef or serverCertIssuerRef must be provided.
If not provided, a self-signed CA will be provisioned to issue the server certificate.

| | | | `serverCertSecretRef` [*LocalObjectReference*](#localobjectreference) |

ServerCertSecretRef is a reference to a TLS Secret containing the server certificate.
It is mutually exclusive with serverCertIssuerRef.

| | | | `serverCertIssuerRef` [*ObjectReference*](#objectreference) |

ServerCertIssuerRef is a reference to a cert-manager issuer object used to issue the server certificate. cert-manager must be installed previously in the cluster.
It is mutually exclusive with serverCertSecretRef.
By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via serverCASecretRef.

| | | | `serverCertConfig` [*CertConfig*](#certconfig) |

ServerCertConfig allows configuring the server certificates, either issued by the operator or cert-manager.
If not set, the default settings will be used.

| | | | `clientCASecretRef` [*LocalObjectReference*](#localobjectreference) |

ClientCASecretRef is a reference to a Secret containing the client certificate authority keypair. It is used to establish trust and issue client certificates.
One of:
- Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates.
- Secret containing only the 'ca.crt' in order to establish trust. In this case, either clientCertSecretRef or clientCertIssuerRef fields must be provided.
If not provided, a self-signed CA will be provisioned to issue the client certificate.

| | | | `clientCertSecretRef` [*LocalObjectReference*](#localobjectreference) |

ClientCertSecretRef is a reference to a TLS Secret containing the client certificate.
It is mutually exclusive with clientCertIssuerRef.

| | | | `clientCertIssuerRef` [*ObjectReference*](#objectreference) |

ClientCertIssuerRef is a reference to a cert-manager issuer object used to issue the client certificate. cert-manager must be installed previously in the cluster.
It is mutually exclusive with clientCertSecretRef.
By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via clientCASecretRef.

| | | | `clientCertConfig` [*CertConfig*](#certconfig) |

ClientCertConfig allows configuring the client certificates, either issued by the operator or cert-manager.
If not set, the default settings will be used.

| | | | `galeraSSTEnabled` *boolean* |

GaleraSSTEnabled determines whether Galera SST connections should use TLS.
It disabled by default.

| | | | `galeraServerSSLMode` *string* |

GaleraServerSSLMode defines the server SSL mode for a Galera Enterprise cluster.
This field is only supported and applicable for Galera Enterprise >= 10.6 instances.
Refer to the MariaDB Enterprise docs for more detail:

| |

Enum: \[PROVIDER SERVER SERVER\_X509]

| | `galeraClientSSLMode` *string* |

GaleraClientSSLMode defines the client SSL mode for a Galera Enterprise cluster.
This field is only supported and applicable for Galera Enterprise >= 10.6 instances.
Refer to the MariaDB Enterprise docs for more detail:

| |

Enum: \[DISABLED REQUIRED VERIFY\_CA VERIFY\_IDENTITY]

| #### TLSConfig *Appears in:* * [AzureBlob](#azureblob) * [S3](#s3) | Field | Description | Default | Validation | | ---------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `enabled` *boolean* | Enabled is a flag to enable TLS. | | | | `caSecretKeyRef` [*SecretKeySelector*](#secretkeyselector) |

CASecretKeyRef is a reference to a Secret key containing a CA bundle in PEM format used to establish TLS connections with S3.
By default, the system trust chain will be used, but you can use this field to add more CAs to the bundle.

| | | #### TLSRequirements TLSRequirements specifies TLS requirements for the user to connect. See: . *Appears in:* * [UserSpec](#userspec) | Field | Description | Default | Validation | | ------------------ | --------------------------------------------------------------------------------------------------- | ------- | ---------- | | `ssl` *boolean* | SSL indicates that the user must connect via TLS. | | | | `x509` *boolean* | X509 indicates that the user must provide a valid x509 certificate to connect. | | | | `issuer` *string* | Issuer indicates that the TLS certificate provided by the user must be issued by a specific issuer. | | | | `subject` *string* | Subject indicates that the TLS certificate provided by the user must have a specific subject. | | | #### TopologySpreadConstraint Refer to the Kubernetes docs: . *Appears in:* * [MariaDBPodTemplate](#mariadbpodtemplate) * [MariaDBSpec](#mariadbspec) * [MaxScalePodTemplate](#maxscalepodtemplate) * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `maxSkew` *integer* | | | | | `topologyKey` *string* | | | | | `whenUnsatisfiable` [*UnsatisfiableConstraintAction*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#unsatisfiableconstraintaction-v1-core) | | | | | `labelSelector` [*LabelSelector*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#labelselector-v1-meta) | | | | | `minDomains` *integer* | | | | | `nodeAffinityPolicy` [*NodeInclusionPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#nodeinclusionpolicy-v1-core) | | | | | `nodeTaintsPolicy` [*NodeInclusionPolicy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#nodeinclusionpolicy-v1-core) | | | | | `matchLabelKeys` *string array* | | | | #### TypedLocalObjectReference TypedLocalObjectReference is a reference to a specific object type. *Appears in:* * [BootstrapFrom](#bootstrapfrom) | Field | Description | Default | Validation | | --------------- | --------------------- | ------- | ---------- | | `name` *string* | Name of the referent. | | | | `kind` *string* | Kind of the referent. | | | #### UpdateStrategy UpdateStrategy defines how a MariaDB resource is updated. *Appears in:* * [MariaDBSpec](#mariadbspec) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | ------------------------------------------------------------------------- | | `type` [*UpdateType*](#updatetype) | Type defines the type of updates. One of `ReplicasFirstPrimaryLast`, `RollingUpdate` or `OnDelete`. If not defined, it defaults to `ReplicasFirstPrimaryLast`. | ReplicasFirstPrimaryLast |

Enum: \[ReplicasFirstPrimaryLast RollingUpdate OnDelete Never]

| | `rollingUpdate` [*RollingUpdateStatefulSetStrategy*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#rollingupdatestatefulsetstrategy-v1-apps) | RollingUpdate defines parameters for the RollingUpdate type. | | | | `autoUpdateDataPlane` *boolean* |

AutoUpdateDataPlane indicates whether the Galera data-plane version (agent and init containers) should be automatically updated based on the operator version. It defaults to false.
Updating the operator will trigger updates on all the MariaDB instances that have this flag set to true. Thus, it is recommended to progressively set this flag after having updated the operator.

| | | #### UpdateType *Underlying type:* *string* UpdateType defines the type of update for a MariaDB resource. *Appears in:* * [UpdateStrategy](#updatestrategy) | Field | Description | | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `ReplicasFirstPrimaryLast` |

ReplicasFirstPrimaryLastUpdateType indicates that the update will be applied to all replica Pods first and later on to the primary Pod.
The updates are applied one by one waiting until each Pod passes the readiness probe
i.e. the Pod gets synced and it is ready to receive traffic.

| | `RollingUpdate` |

RollingUpdateUpdateType indicates that the update will be applied by the StatefulSet controller using the RollingUpdate strategy.
This strategy is unaware of the roles that the Pod have (primary or replica) and it will
perform the update following the StatefulSet ordinal, from higher to lower.

| | `OnDelete` |

OnDeleteUpdateType indicates that the update will be applied by the StatefulSet controller using the OnDelete strategy.
The update will be done when the Pods get manually deleted by the user.

| | `Never` |

NeverUpdateType indicates that the StatefulSet will never be updated.
This can be used to roll out updates progressively to a fleet of instances.

| #### User User is the Schema for the users API. It is used to define grants as if you were running a 'CREATE USER' statement. | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------- | ---------- | | `apiVersion` *string* | `enterprise.mariadb.com/v1alpha1` | | | | `kind` *string* | `User` | | | | `metadata` [*ObjectMeta*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#objectmeta-v1-meta) | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec` [*UserSpec*](#userspec) | | | | #### UserSpec UserSpec defines the desired state of User *Appears in:* * [User](#user) | Field | Description | Default | Validation | | --------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ------------------------------- | | `requeueInterval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | RequeueInterval is used to perform requeue reconciliations. | | | | `retryInterval` [*Duration*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta) | RetryInterval is the interval used to perform retries. | | | | `cleanupPolicy` [*CleanupPolicy*](#cleanuppolicy) | CleanupPolicy defines the behavior for cleaning up a SQL resource. | |

Enum: \[Skip Delete]

| | `mariaDbRef` [*MariaDBRef*](#mariadbref) | MariaDBRef is a reference to a MariaDB object. | |

Required: {}

| | `passwordSecretKeyRef` [*SecretKeySelector*](#secretkeyselector) |

PasswordSecretKeyRef is a reference to the password to be used by the User.
If not provided, the account will be locked and the password will expire.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

| | | | `passwordHashSecretKeyRef` [*SecretKeySelector*](#secretkeyselector) |

PasswordHashSecretKeyRef is a reference to the password hash to be used by the User.
If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password hash.
It requires the 'strict-password-validation=false' option to be set. See: .

| | | | `passwordPlugin` [*PasswordPlugin*](#passwordplugin) |

PasswordPlugin is a reference to the password plugin and arguments to be used by the User.
It requires the 'strict-password-validation=false' option to be set. See: .

| | | | `require` [*TLSRequirements*](#tlsrequirements) | Require specifies TLS requirements for the user to connect. See: . | | | | `maxUserConnections` *integer* | MaxUserConnections defines the maximum number of simultaneous connections that the User can establish. | 10 | | | `name` *string* | Name overrides the default name provided by metadata.name. | |

MaxLength: 80

| | `host` *string* | Host related to the User. | |

MaxLength: 255

| #### VolumeClaimTemplate VolumeClaimTemplate defines a template to customize PVC objects. *Appears in:* * [EphemeralVolumeSource](#ephemeralvolumesource) * [GaleraConfig](#galeraconfig) * [MaxScaleConfig](#maxscaleconfig) * [Storage](#storage) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | ------- | ---------- | | `accessModes` [*PersistentVolumeAccessMode*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#persistentvolumeaccessmode-v1-core) *array* | | | | | `selector` [*LabelSelector*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#labelselector-v1-meta) | | | | | `resources` [*VolumeResourceRequirements*](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumeresourcerequirements-v1-core) | | | | | `storageClassName` *string* | | | | | `metadata` [*Metadata*](#metadata) | Refer to Kubernetes API documentation for fields of `metadata`. | | | #### VolumeMount Refer to the Kubernetes docs: . *Appears in:* * [Agent](#agent) * [Container](#container) * [ContainerTemplate](#containertemplate) * [InitContainer](#initcontainer) * [MariaDBSpec](#mariadbspec) * [MaxScaleSpec](#maxscalespec) | Field | Description | Default | Validation | | -------------------- | ------------------------------------- | ------- | ---------- | | `name` *string* | This must match the Name of a Volume. | | | | `readOnly` *boolean* | | | | | `mountPath` *string* | | | | | `subPath` *string* | | | | #### VolumeSource Refer to the Kubernetes docs: . *Appears in:* * [MariaDBVolume](#mariadbvolume) * [MariaDBVolumeSource](#mariadbvolumesource) * [Volume](#volume) | Field | Description | Default | Validation | | ------------------------------------------------------------------------------------------------- | ----------- | ------- | ---------- | | `emptyDir` [*EmptyDirVolumeSource*](#emptydirvolumesource) | | | | | `nfs` [*NFSVolumeSource*](#nfsvolumesource) | | | | | `csi` [*CSIVolumeSource*](#csivolumesource) | | | | | `hostPath` [*HostPathVolumeSource*](#hostpathvolumesource) | | | | | `persistentVolumeClaim` [*PersistentVolumeClaimVolumeSource*](#persistentvolumeclaimvolumesource) | | | | | `secret` [*SecretVolumeSource*](#secretvolumesource) | | | | | `configMap` [*ConfigMapVolumeSource*](#configmapvolumesource) | | | | #### WaitPoint *Underlying type:* *string* WaitPoint defines whether the transaction should wait for ACK before committing to the storage engine. More info: . *Appears in:* * [Replication](#replication) * [ReplicationSpec](#replicationspec) | Field | Description | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `AfterSync` |

WaitPointAfterSync indicates that the primary waits for the replica ACK before committing the transaction to the storage engine.
It trades off performance for consistency.

| | `AfterCommit` |

WaitPointAfterCommit indicates that the primary commits the transaction to the storage engine and waits for the replica ACK afterwards.
It trades off consistency for performance.

| #### WeightedPodAffinityTerm Refer to the Kubernetes docs: . *Appears in:* * [PodAntiAffinity](#podantiaffinity) | Field | Description | Default | Validation | | ------------------------------------------------------- | ----------- | ------- | ---------- | | `weight` *integer* | | | | | `podAffinityTerm` [*PodAffinityTerm*](#podaffinityterm) | | | | --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://mariadb.com/docs/tools/mariadb-enterprise-operator/api-reference.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.