API Reference

Packages

• konfidence.cloud/v1alpha1

konfidence.cloud/v1alpha1

Package v1alpha1 contains API Schema definitions for the konfidence v1alpha1 API group.

Resource Types

• ActivationTaskExecution
• ActivationTaskExecutionList
• ActivationTaskRegistration
• ActivationTaskRegistrationList
• ArtifactDeployment
• ArtifactDeploymentList
• Landscape
• LandscapeList
• Project
• ProjectList
• Stage
• StageConfiguration
• StageConfigurationList
• StageList
• StageVersion
• StageVersionList
• StageVersionUsage
• StageVersionUsageList
• TaskExecution
• TaskExecutionList
• VectorActivation
• VectorActivationList
• VectorAssignment
• VectorAssignmentList
• VectorData
• VectorDataList
• VectorDeployment
• VectorDeploymentList
• VectorMigration
• VectorMigrationList
• VectorPromotion
• VectorPromotionConfig
• VectorPromotionConfigList
• VectorPromotionList
• VectorTemplate
• VectorTemplateList

ActivationTaskExecution

ActivationTaskExecution is the Schema for the ActivationTaskExecutions API

Appears in:

• ActivationTaskExecutionList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	ActivationTaskExecution
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.		Optional: {}
spec ActivationTaskExecutionSpec	spec defines the desired state of ActivationTaskExecution		Required: {}
status ActivationTaskExecutionStatus	status defines the observed state of ActivationTaskExecution		Optional: {}

ActivationTaskExecutionList

ActivationTaskExecutionList contains a list of ActivationTaskExecution

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	ActivationTaskExecutionList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items ActivationTaskExecution array

ActivationTaskExecutionSpec

ActivationTaskExecutionSpec defines the desired state of ActivationTaskExecution

Appears in:

• ActivationTaskExecution

Field	Description	Default	Validation
type string
spec RawExtension
vectorActivation string	VectorActivation is a temporary field that contains the name of the associated vectorActivation

ActivationTaskExecutionStatus

ActivationTaskExecutionStatus defines the observed state of ActivationTaskExecution.

Appears in:

• ActivationTaskExecution

Field	Description	Default	Validation
conditions Condition array

ActivationTaskRegistration

ActivationTaskRegistration is the Schema for the activationtaskregistrations API

Appears in:

• ActivationTaskRegistrationList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	ActivationTaskRegistration
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.		Optional: {}
spec ActivationTaskRegistrationSpec	spec defines the desired state of ActivationTaskRegistration		Required: {}
status ActivationTaskRegistrationStatus	status defines the observed state of ActivationTaskRegistration		Optional: {}

ActivationTaskRegistrationList

ActivationTaskRegistrationList contains a list of ActivationTaskRegistration

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	ActivationTaskRegistrationList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items ActivationTaskRegistration array

ActivationTaskRegistrationSpec

ActivationTaskRegistrationSpec defines the desired state of ActivationTaskRegistration

Appears in:

• ActivationTaskRegistration

Field	Description	Default	Validation
type string	INSERT ADDITIONAL SPEC FIELDS - desired state of cluster Important: Run "make" to regenerate code after modifying this file The following markers will use OpenAPI v3 schema to validate the value More info: https://book.kubebuilder.io/reference/markers/crd-validation.html
spec RawExtension
succeeds string array
precedes string array

ActivationTaskRegistrationStatus

ActivationTaskRegistrationStatus defines the observed state of ActivationTaskRegistration.

Appears in:

• ActivationTaskRegistration

Field	Description	Default	Validation
conditions Condition array	conditions represent the current state of the ActivationTaskRegistration resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. Standard condition types include: - "Available": the resource is fully functional - "Progressing": the resource is being created or updated - "Degraded": the resource failed to reach or maintain its desired state The status of each condition is one of True, False, or Unknown.		Optional: {}

ArtifactDeployment

ArtifactDeployment is the Schema for the artifactdeployments API.

Appears in:

• ArtifactDeploymentList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	ArtifactDeployment
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ArtifactDeploymentSpec	Spec defines the desired state of the ArtifactDeployment and is immutable after it has been set		Optional: {}
status ArtifactDeploymentStatus

ArtifactDeploymentList

ArtifactDeploymentList contains a list of ArtifactDeployment.

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	ArtifactDeploymentList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items ArtifactDeployment array

ArtifactDeploymentSpec

ArtifactDeploymentSpec defines the desired state of an ArtifactDeployment. It describes the artifact to be deployed, optional post-deployment tasks, and optional metadata derived from an OCM ComponentVersion. A deployer interprets the specification according to the artifact type in Manifest.Type.

Appears in:

• ArtifactDeployment

Field	Description	Default	Validation
manifest ArtifactManifest	Manifest contains information about the artifact itself and the deployer implementation responsible for handling it.
taskManifests TaskManifest array	TaskManifests describes optional post-deployment tasks (commonly used for vector migrations such as database schema updates). Tasks are executed after the artifact has been deployed and may form a dependency graph via DependsOn.
component OCMComponent	Component contains OCM metadata associated with the artifact. This is a simplified mapping of the OCM ComponentVersion.

ArtifactDeploymentStatus

ArtifactDeploymentStatus defines the observed state of ArtifactDeployment.

Appears in:

• ArtifactDeployment

Field	Description	Default	Validation
observedGeneration integer	ObservedGeneration is the last observed generation.		Optional: {}
conditions Condition array	Conditions describes the state of the deployment lifecycle. The following conditions are expected: - ArtifactFetched: the artifact was successfully retrieved - ArtifactDeployed: the artifact was successfully deployed - AppHealthy: the deployer reports the workload as healthy Conditions progress in a linear order: ArtifactFetched -> ArtifactDeployed -> AppHealthy		Optional: {}
deploymentResult DeploymentResult array	DeploymentResults captures structured outputs produced by the deployer during the deployment process—such as computed DNS names, service endpoints, generated configuration, or other workload-specific details. Results should be treated as immutable for a given generation and may be consumed by later stages of a vector rollout (e.g., routing configuration). Each result must have a unique Name.		Optional: {}

ArtifactManifest

ArtifactManifest describes the content of the artifact, thus it determines the deployer implementation responsible for handling it.

Appears in:

• ArtifactDeploymentSpec
• VectorAssignmentSpec

Field	Description	Default	Validation
type string	Type specifies the deployer that should handle this artifact (e.g., "cloud.konfidence.flux.helm", or any custom deployer type). Deployers implement their own interpretation of the artifact's contents.
allowReuse boolean	AllowReuse indicates whether the deployed artifact instance may be shared across multiple VectorDeployments. Reuse allows more efficient resource consumption but requires the artifact to be independent of vector-specific runtime context.

Component

Component defines a component of a VectorTemplate. A struct is used for future expansion.

Appears in:

• VectorTemplateSpec

Field	Description	Default	Validation
name string

CredentialRef

CredentialRef references a Secret in the same namespace as the holding resource.

Appears in:

• OCMCredentials

Field	Description	Default	Validation
name string			MinLength: 1

Credentials

Credentials holds credentials for various purposes — for example OCM repository access and signing/verification key material.

Appears in:

• StageConfigurationSpec
• VectorPromotionConfigSpec
• VectorTemplateSpec

Field	Description	Default	Validation
ocm OCMCredentials			Optional: {}

DeploymentResult

DeploymentResult contains a single output produced by a deployer. These results are used to transport information from the deployer to later phases of the vector lifecycle.

Appears in:

• ArtifactDeploymentStatus
• VectorDataSpec
• VectorDeploymentStatus

Field	Description	Default	Validation
name string	Name is a unique identifier for the result within an ArtifactDeploymentStatus.
type string	Type describes the structure contained in Spec. Each deployer may define multiple result types.
spec RawExtension	Spec contains deployer-specific structured data. Its format is determined by the Type field.

GlobMatch

Underlying type: string

GlobMatch is a claim-value match pattern using glob semantics, where "" matches any run of characters (for example "repo:konfidence-project/").

Validation:

• MaxLength: 512

Appears in:

• JWKSSubject

JWKSSubject

JWKSSubject matches a workload token issued by a trusted OIDC provider, narrowed to a required audience and at least one token claim.

Appears in:

• Subject

Field	Description	Default	Validation
endpoint string	Endpoint is the OIDC discovery endpoint (the provider's ".well-known/openid-configuration" URL) used to resolve the signing keys that the presented token is verified against.		MaxLength: 2048 Pattern: ^https://.*$
audience string	Audience is the value the token's "aud" claim must carry. It is required so that a token minted for a different service cannot be replayed against Konfidence: the token is accepted only if it was issued for this audience.		MaxLength: 512 MinLength: 1
claims object (keys:string, values:GlobMatch)	Claims narrows the match to tokens whose claims match the given patterns. It maps a claim name (for example "sub", "repository" or "ref") to a glob pattern the claim value must match; all listed claims must match (AND). At least one claim is required so a subject cannot inadvertently match every token a provider issues.		MaxProperties: 32 MinProperties: 1

Landscape

Landscape is the Schema for the landscapes API. A Landscape owns a dedicated namespace that serves as a deployment target for vectors. Landscapes must be created in project namespaces. The landscape name is capped at 46 characters so the derived namespace name stays within the 63-character Kubernetes limits.

Appears in:

• LandscapeList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	Landscape
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec LandscapeSpec
status LandscapeStatus

LandscapeList

LandscapeList contains a list of Landscape.

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	LandscapeList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items Landscape array

LandscapeSpec

LandscapeSpec defines the desired state of Landscape.

The transition rule catches namespace being set or unset after creation; changing a set namespace is caught by the field-level rule. The two rules are split to stay within the CEL cost budget of the schema.

Appears in:

• Landscape

Field	Description	Default	Validation
displayName string	DisplayName is the human-readable name of the landscape, shown in user interfaces. It does not affect the namespace name or any label, and it may be changed at any time.		MaxLength: 253 MinLength: 1 Optional: {}
namespace string	Namespace overrides the name of the namespace created for this landscape. When unset it defaults to kden-l-<landscape-name>-<hash>. It is immutable once the Landscape exists, because the namespace and everything it holds are bound to this name.		MaxLength: 63 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ Optional: {}

LandscapeStatus

LandscapeStatus defines the observed state of Landscape.

Appears in:

• Landscape

Field	Description	Default	Validation
conditions Condition array
namespace string	Namespace is the name of the namespace managed for this landscape.		Optional: {}
projectName string	ProjectName is the name of the project this landscape belongs to, derived from the namespace where the Landscape CR was created.		Optional: {}

LocalArtifactDeploymentReference

LocalArtifactDeploymentReference holds a reference to an ArtifactDeployment in the same namespace.

Appears in:

• VectorAssignmentSpec
• VectorDeploymentStatus

Field	Description	Default	Validation
name string	Name is the name of the ArtifactDeployment. Required.
collisionCount integer	CollisionCount salts the ArtifactDeployment name hash to recover from a (rare) hash collision with a different artifact. nil and 0 both mean "no salt" and yield the original, unsalted name. Once bumped it is permanent for this artifact slot. Mirrors Deployment.Status.CollisionCount.		Optional: {}

LocalObjectReference

LocalObjectReference references an object by name within the same namespace as the parent.

Appears in:

• VectorDeploymentStatus

Field	Description	Default	Validation
name string	Name of the referenced object.

LocalVectorAssignmentReference

LocalVectorAssignmentReference holds a reference to a VectorAssignment in the same namespace.

Appears in:

• VectorDeploymentStatus

Field	Description	Default	Validation
name string	Name is the name of the VectorAssignment. Required.

LocalVectorDeploymentReference

LocalVectorDeploymentReference holds a reference to a VectorDeployment in the same namespace.

Appears in:

• VectorAssignmentSpec

Field	Description	Default	Validation
name string	Name is the name of the VectorDeployment. Required.

OCMComponent

OCMComponent is a wrapper around the OCM ComponentVersion. It can be used to attach additional metadata to an ArtifactDeployment. The component may include one or more OCM resources.

Appears in:

• ArtifactDeploymentSpec

Field	Description	Default	Validation
name string	Name is the OCM ComponentVersion name.
version string	Version is the OCM ComponentVersion version.		Optional: {}
resources OCMResource array	Resources contains OCM resources belonging to this component. The structure is intentionally generic to support the requirements of deployers targeting different runtimes.		Optional: {}

OCMCredentials

OCMCredentials lists Secrets holding .ocmconfig or .dockerconfigjson data. All references are same-namespace.

Appears in:

• Credentials

Field	Description	Default	Validation
refs CredentialRef array			MinItems: 1

OCMResource

OCMResource represents a single resource of an OCM ComponentVersion. The content and type are deployer-specific and opaque to the API.

Appears in:

• OCMComponent

Field	Description	Default	Validation
name string	Name is the resource name.
content RawExtension	Content holds raw resource data, typically an embedded manifest, file, or binary payload.
type string	Type describes the resource type, following OCM conventions.

Project

Project is the Schema for the projects API. A Project owns a dedicated namespace that stores the project's resources. The project name is capped at 56 characters so the derived namespace name and label values stay within the 63-character Kubernetes limits.

Appears in:

• ProjectList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	Project
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ProjectSpec
status ProjectStatus

ProjectList

ProjectList contains a list of Project.

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	ProjectList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items Project array

ProjectSpec

ProjectSpec defines the desired state of Project.

The transition rule catches namespace being set or unset after creation; changing a set namespace is caught by the field-level rule. The two rules are split to stay within the CEL cost budget of the schema.

Appears in:

• Project

Field	Description	Default	Validation
displayName string	DisplayName is the human-readable name of the project, shown in user interfaces. It does not affect the namespace name or any label, and it may be changed at any time.		MaxLength: 253 MinLength: 1 Optional: {}
namespace string	Namespace overrides the name of the namespace created for this project. When unset it defaults to kden-p-<project-name>. It is immutable once the Project exists, because the namespace and everything it holds are bound to this name.		MaxLength: 63 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ Optional: {}
roleBindings object (keys:string, values:Subjects)	RoleBindings grants project roles to callers. It maps a role name to the list of subjects that hold that role; a caller holds the role if any subject in the list matches (OR). The role names are a fixed, well-known set for now (for example "admin", "pm", "dev"), but the field is a map so the set can be extended without a schema change. See the Project multi-tenancy ADR for the meaning of each role and the authorization flow. RoleBindings is currently schema-only: no authorization is enforced yet.		MaxProperties: 32 Optional: {}

ProjectStatus

ProjectStatus defines the observed state of Project.

Appears in:

• Project

Field	Description	Default	Validation
conditions Condition array
namespace string	Namespace is the name of the namespace managed for this project.		Optional: {}

SessionSubject

SessionSubject matches an interactive user by group membership.

Appears in:

• Subject

Field	Description	Default	Validation
memberOf string array	MemberOf lists the groups that grant the role. Membership in any one of the listed groups is sufficient to match (OR).		MaxItems: 64 MinItems: 1 items:MaxLength: 253

Sign

Sign lists signatures the controller produces on every descriptor it writes. Absence on a spec disables signing.

Appears in:

• VectorTemplateSpec

Field	Description	Default	Validation
signatures Signature array			MinItems: 1

Signature

Signature pins parameters of one named signature on a component descriptor. Used both for verification (matched against the fetched descriptor) and for signing (overrides defaults of the emitted signature).

Appears in:

• Sign
• Verify

Field	Description	Default	Validation
name string	Name is the unique identifier for this signature.		MinLength: 1
algorithm string	Algorithm specifies the RSA signing algorithm. When omitted, RSASSA-PSS is used. Valid values: RSASSA-PSS, RSASSA-PKCS1-V1_5.		Optional: {}
signatureMediaType string	SignatureMediaType specifies the encoding format for the signature bytes. When omitted, application/x-pem-file (PEM) is used. Valid values: application/x-pem-file, application/vnd.ocm.signature.rsa.pss, application/vnd.ocm.signature.rsa.		Optional: {}
hashAlgorithm string	HashAlgorithm specifies the digest algorithm used when hashing the component descriptor. When omitted, SHA-256 is used. Valid values: SHA-256, SHA-512.		Optional: {}
normalisationAlgorithm string	NormalisationAlgorithm specifies the normalisation scheme applied to the descriptor before hashing. When omitted, jsonNormalisation/v4alpha1 is used. Valid values: jsonNormalisation/v4alpha1.		Optional: {}
issuer string	Issuer pins the expected certificate issuer DN for PEM-encoded signatures. On the sign path the value is stamped into the descriptor alongside the signature, so it is enforced automatically on the verify path even without an explicit pin here. On the verify path, when set, this value overrides whatever the descriptor stored and the handler rejects any signature whose leaf certificate issuer DN does not match. When omitted on both paths the issuer field stays empty and no DN check is performed. Must be non-empty when present.		Optional: {}

Stage

Stage is the Schema for the stages API.

Appears in:

• StageList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	Stage
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec StageSpec
status StageStatus

StageConfiguration

StageConfiguration is the Schema for the stageConfigurations API.

Appears in:

• StageConfigurationList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	StageConfiguration
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec StageConfigurationSpec
status StageConfigurationStatus

StageConfigurationList

StageConfigurationList contains a list of StageConfiguration.

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	StageConfigurationList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items StageConfiguration array

StageConfigurationSpec

StageConfigurationSpec defines the desired state of StageConfiguration.

Appears in:

• StageConfiguration

Field	Description	Default	Validation
name string	Name is the stage name.
vector string	Vector points to the OCM component that contains the deployment vector for this stage.
targetNamespace string	TargetNamespace is the target namespace where the associated stage is created or updated
credentials Credentials	Credentials supplies credentials for OCM repository access and vector verification key material.		Optional: {}
verifyVector Verify	VerifyVector lists candidate signatures evaluated against the fetched vector descriptor. Absence disables vector verification.		Optional: {}

StageConfigurationStatus

StageConfigurationStatus defines the observed state of StageConfiguration.

Appears in:

• StageConfiguration

Field	Description	Default	Validation
conditions Condition array

StageList

StageList contains a list of Stage.

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	StageList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items Stage array

StageReference

StageReference holds a reference to a Stage in the same namespace.

Appears in:

• StageVersionSpec

Field	Description	Default	Validation
name string	Name is the name of the Stage. Required.

StageSpec

StageSpec defines the desired state of Stage.

Appears in:

• Stage

Field	Description	Default	Validation
vector string	Vector points to the OCM component version that contains the deployment vector for this stage.

StageStatus

StageStatus defines the observed state of Stage.

Appears in:

• Stage

Field	Description	Default	Validation
conditions Condition array
vectorHistory string array
latestVectorDeploymentRef TypedObjectReference

StageVersion

StageVersion is the Schema for the stageversions API

Appears in:

• StageVersionList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	StageVersion
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.		Optional: {}
spec StageVersionSpec	Spec defines the desired state of the StageVersion and is immutable after it has been set		Optional: {} Required: {}
status StageVersionStatus	status defines the observed state of StageVersion		Optional: {}

StageVersionList

StageVersionList contains a list of StageVersion

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	StageVersionList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items StageVersion array

StageVersionReference

StageVersionReference holds a reference to a StageVersion in the same namespace.

Appears in:

• StageVersionUsageSpec

Field	Description	Default	Validation
name string	Name is the name of the StageVersion. Required.

StageVersionSpec

StageVersionSpec defines the desired state of StageVersion

Appears in:

• StageVersion

Field	Description	Default	Validation
vector string	Vector points to the OCM component version that contains the deployment vector for this stage.		MinLength: 1
stageGeneration integer	the object generation of the stage that created this stage version		Minimum: 1
stageRef StageReference	stageRef references the Stage this StageVersion belongs to

StageVersionStatus

StageVersionStatus defines the observed state of StageVersion.

Appears in:

• StageVersion

Field	Description	Default	Validation
conditions Condition array

StageVersionUsage

StageVersionUsage is the Schema for the stageversionusages API

Appears in:

• StageVersionUsageList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	StageVersionUsage
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.		Optional: {}
spec StageVersionUsageSpec	spec defines the desired state of StageVersionUsage		ExactlyOneOf: [stageVersionRef stageVersionSelector] Required: {}
status StageVersionUsageStatus	status defines the observed state of StageVersionUsage		Optional: {}

StageVersionUsageList

StageVersionUsageList contains a list of StageVersionUsage

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	StageVersionUsageList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items StageVersionUsage array

StageVersionUsageSpec

StageVersionUsageSpec defines the desired state of StageVersionUsage

Validation:

• ExactlyOneOf: [stageVersionRef stageVersionSelector]

Appears in:

• StageVersionUsage

Field	Description	Default	Validation
reason string	Reason is human-readable description of why this StageVersion is in use, e.g. "executing vector migrations", "latest vector for stage xyz",		Optional: {}
stageVersionRef StageVersionReference	StageVersionRef references a stageVersion		Optional: {}
stageVersionSelector LabelSelector	StageVersionSelector is a label selector to find a StageVersion when name is not provided.		Optional: {}

StageVersionUsageStatus

StageVersionUsageStatus defines the observed state of StageVersionUsage.

Appears in:

• StageVersionUsage

Field	Description	Default	Validation
conditions Condition array
resolvedStageVersions string array	ResolvedStageVersions contains the names of all resolved stageVersion resources specified by either stageVersionRef or StageVersionSelector

Subject

Subject identifies who is granted a role. Exactly one identity source (session or jwks) must be set.

Appears in:

• Subjects

Field	Description	Default	Validation
session SessionSubject	Session matches an interactively authenticated user by group membership, for example a person signed in through the identity provider.		Optional: {}
jwks JWKSSubject	JWKS matches a workload identity presenting a token signed by a trusted OIDC provider, for example a CI pipeline's OIDC token.		Optional: {}

Subjects

Underlying type: Subject

Subjects is the list of subjects that hold a role. A caller holds the role if any subject matches (OR).

Validation:

• MaxItems: 32
• MinItems: 1

Appears in:

• ProjectSpec

Field	Description	Default	Validation
session SessionSubject	Session matches an interactively authenticated user by group membership, for example a person signed in through the identity provider.		Optional: {}
jwks JWKSSubject	JWKS matches a workload identity presenting a token signed by a trusted OIDC provider, for example a CI pipeline's OIDC token.		Optional: {}

TaskExecution

TaskExecution is the Schema for the taskexecutions API

Appears in:

• TaskExecutionList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	TaskExecution
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.		Optional: {}
spec TaskExecutionSpec	spec defines the desired state of TaskExecution		Required: {}
status TaskExecutionStatus	status defines the observed state of TaskExecution		Optional: {}

TaskExecutionList

TaskExecutionList contains a list of TaskExecution

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	TaskExecutionList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items TaskExecution array

TaskExecutionSpec

TaskExecutionSpec defines the desired state of TaskExecution

Appears in:

• TaskExecution

Field	Description	Default	Validation
name string
type string
dependsOn string array
spec RawExtension

TaskExecutionStatus

TaskExecutionStatus defines the observed state of TaskExecution.

Appears in:

• TaskExecution

Field	Description	Default	Validation
conditions Condition array

TaskManifest

TaskManifest defines a post-deployment task that is executed after the artifact has been deployed. Tasks are commonly used for vector migrations (such as database schema changes) but may represent any post-deployment action.

Tasks form a directed acyclic graph (DAG) at the vector level rather than only within a single ArtifactDeployment. A task may depend on tasks belonging to other microservices or artifacts in the same VectorDeployment. These cross-artifact dependencies allow defining a globally ordered migration or transformation workflow.

The controller responsible for the task type interprets the Spec field and performs the execution once all declared dependencies have completed successfully.

Appears in:

• ArtifactDeploymentSpec

Field	Description	Default	Validation
name string	Name uniquely identifies this task within the entire vector. This name may be referenced by other tasks across different artifacts.
type string	Type specifies the task controller or execution runtime (e.g. "k8s-job", or any custom task runtime). Different task types correspond to different task controllers, each interpreting the Spec field according to their own semantics.
dependsOn string array	DependsOn lists names of other tasks that must complete before this task may run. Dependencies may reference tasks within the same artifact or any other artifact that participates in the same VectorDeployment, allowing the formation of a vector-wide DAG.		Optional: {}
spec RawExtension	Spec contains task-specific configuration. The structure depends on the task Type and is interpreted by the corresponding task controller.

VectorActivation

VectorActivation is the Schema for the vectoractivations API

Appears in:

• VectorActivationList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorActivation
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.		Optional: {}
spec VectorActivationSpec	spec defines the desired state of VectorActivation		Required: {}
status VectorActivationStatus	status defines the observed state of VectorActivation		Optional: {}

VectorActivationList

VectorActivationList contains a list of VectorActivation

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorActivationList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items VectorActivation array

VectorActivationSpec

VectorActivationSpec defines the desired state of VectorActivation

Appears in:

• VectorActivation

Field	Description	Default	Validation
stage string
stageVersion string
vector string	Vector points to the OCM component version that contains the deployment vector for this stage.
vectorDeployment string

VectorActivationStatus

VectorActivationStatus defines the observed state of VectorActivation.

Appears in:

• VectorActivation

Field	Description	Default	Validation
conditions Condition array

VectorAssignment

VectorAssignment is the Schema for the vectorassignments API.

A VectorAssignment represents a single binding between a VectorDeployment and an ArtifactDeployment. It enables an n:m mapping where a single artifact may be reused across multiple vectors. These objects are automatically managed by the vector-deployment-controller and reconciled by deployers to apply vector-specific configuration.

Appears in:

• VectorAssignmentList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorAssignment
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec VectorAssignmentSpec	Spec defines the desired state of the VectorAssignment and is immutable after it has been set		Optional: {}
status VectorAssignmentStatus

VectorAssignmentList

VectorAssignmentList contains a list of VectorAssignment.

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorAssignmentList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items VectorAssignment array

VectorAssignmentSpec

VectorAssignmentSpec defines the desired state of a VectorAssignment.

A VectorAssignment represents one logical binding between a VectorDeployment and an ArtifactDeployment. Since a single artifact may be reused across multiple vectors, an n:m relationship exists between vectors and artifacts. VectorAssignment creates a concrete instance of that relationship.

VectorAssignment resources are created automatically during vector rollouts and are typically not authored by users. Deployer implementations reconcile the VectorAssignment to perform vector-specific configuration based on the artifact selected for this vector.

The VectorAssignmentSpec is immutable. If an artifact is replaced or added to a different vector, the old VectorAssignment is deleted and a new one created.

Appears in:

• VectorAssignment

Field	Description	Default	Validation
manifest ArtifactManifest	Manifest contains the ArtifactManifest describing the artifact to be assigned to the vector. This duplicates the manifest stored in the ArtifactDeployment for efficiency: deployers often need to filter or select assignments by artifact type, and embedding the manifest avoids repeated API lookups.
artifactDeploymentRef LocalArtifactDeploymentReference	ArtifactDeploymentRef references the ArtifactDeployment instance that is associated with the vector. The referenced artifact must exist in the same namespace as this VectorAssignment.
vectorDeploymentRef LocalVectorDeploymentReference	VectorDeploymentRef references the VectorDeployment that this artifact is assigned to. This creates the explicit mapping "artifact X belongs to vector Y".

VectorAssignmentStatus

VectorAssignmentStatus defines the observed state of a VectorAssignment.

A VectorAssignment progresses through a simple lifecycle driven by the deployer:

1. VectorAssignment is created by the vector-deployment-controller.
2. deployer reconciles it and configures vector-specific integration
3. VectorAssignmentReadyCondition is set to True

Appears in:

• VectorAssignment

Field	Description	Default	Validation
conditions Condition array	Conditions describes the latest observed state of the assignment. The primary condition is VectorAssignmentReadyCondition, which becomes True once the deployer has finished processing the VectorAssignment.		Optional: {}

VectorConfig

VectorConfig defines feature flags and authored configuration values for a vector.

Appears in:

• VectorTemplateSpec

Field	Description	Default	Validation
features RawExtension	Features define the feature flags.
authored RawExtension	Authored define the authored configuration values.

VectorData

VectorData is the schema for the vectordata API.

Appears in:

• VectorDataList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorData
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec VectorDataSpec			Optional: {}
status VectorDataStatus

VectorDataList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorDataList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items VectorData array

VectorDataSpec

VectorDataSpec is the LCP→landscape-orchestrator contract for vector-scoped data. The vector deployment controller resolves the OCM envelope {features, authored} and aggregates per-AD DeploymentResults; the landscape orchestrator materialises the payload on its target runtime (ConfigMap on K8s, etc.).

Appears in:

• VectorData

Field	Description	Default	Validation
features RawExtension	Features carries the optional "features" subset of the OCM envelope, verbatim JSON.		Optional: {}
authored RawExtension	Authored carries the optional "authored" subset of the OCM envelope, verbatim JSON.		Optional: {}
deploymentResults object (keys:string, values:DeploymentResult)	DeploymentResults aggregated from underlying ArtifactDeployments, keyed <componentName>/<resultName>.		Optional: {}

VectorDataStatus

Appears in:

• VectorData

Field	Description	Default	Validation
conditions Condition array			Optional: {}

VectorDeployment

VectorDeployment is the Schema for the vectordeployments API.

VectorDeployment represents the deployment of an immutable vector of artifacts into a specific environment or stage.

Appears in:

• VectorDeploymentList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorDeployment
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec VectorDeploymentSpec	Spec defines the desired state of the VectorDeployment and is immutable after it has been set		Optional: {}
status VectorDeploymentStatus

VectorDeploymentList

VectorDeploymentList contains a list of VectorDeployment.

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorDeploymentList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items VectorDeployment array

VectorDeploymentSpec

VectorDeploymentSpec defines the desired state of a VectorDeployment.

A VectorDeployment references a deployment vector stored as an OCM ComponentVersion in an OCI registry. The vector describes a complete, immutable set of artifacts and versions that should be deployed as a unit.

The value must always be a fully qualified OCI URL and must resolve to a valid OCM ComponentVersion. The VectorDeployment spec is intended to be immutable. Any substantive change should result in a new VectorDeployment instance rather than updating an existing one.

Appears in:

• VectorDeployment

Field	Description	Default	Validation
vector string	Vector is a fully qualified URL pointing to an OCM ComponentVersion stored in an OCI registry. The referenced component contains the deployment vector, which includes the complete list of artifacts and their versions.

VectorDeploymentStatus

VectorDeploymentStatus represents the observed state of a VectorDeployment as it progresses through the deployment lifecycle.

The lifecycle consists of:

1. Pulling the vector from the OCI registry and parsing its contents -> VectorDownloadedCondition
2. Creating (or re-using) one ArtifactDeployment per artifact in the vector -> ArtifactDeploymentsCreatedCondition
3. Waiting until all ArtifactDeployments have successfully deployed -> VectorDeployedCondition
4. Creating all VectorAssignment resources associated with this vector -> VectorAssignmentsCreatedCondition
5. Creating the VectorData CR with the resolved authored configuration + aggregated DeploymentResults; the runtime-specific implementor then materialises it (e.g. as a ConfigMap on Kubernetes) -> VectorDataCreatedCondition
6. Marking the vector as ready for use once VectorData reports its own Ready=True -> VectorReadyCondition

Appears in:

• VectorDeployment

Field	Description	Default	Validation
conditions Condition array	Conditions represents the current set of status conditions for this vector deployment. These conditions track progress through the lifecycle stages.
resolvedVectorOcm string	ResolvedVectorOcm contains the fully materialized content of the OCM ComponentVersion after it has been downloaded and resolved from the OCI registry. Unlike the Spec.Vector value, which is only a reference (URL), this field stores the actual resolved vector content as provided by OCM, including all artifacts and metadata. It is not a reference but the inlined representation of the component version at reconciliation time.
resultingVectorData LocalObjectReference	ResultingVectorData records the name of the VectorData object created for this VectorDeployment. The VectorData CR is the contract between the vector deployment controller (which resolves the OCM payload) and the runtime-specific implementor (which materialises it on the target runtime). The field is empty until step 5 of the lifecycle has produced the CR. Names are stable across reconciliations.
resultingArtifactDeployments object (keys:string, values:LocalArtifactDeploymentReference)	ResultingArtifactDeployments lists the ArtifactDeployment resources created (or re-used) for this vector. The map key is the component name of the artifact as defined inside the vector. Keys remain stable across reconciliations and re-creations.
resultingVectorAssignments object (keys:string, values:LocalVectorAssignmentReference)	ResultingVectorAssignments lists all VectorAssignment resources created for this vector. VectorAssignments are not re-used like ArtifactDeployments, but instead each VectorDeployment results in a complete new set of assignments. The map key is the component name of the artifact. Keys are stable across reconcilations.
deploymentResults object (keys:string, values:DeploymentResult)	DeploymentResults exposes an aggregated view of the deployment results produced by all underlying ArtifactDeployments. The map key is composed of the component name and the individual result name, ensuring uniqueness.

VectorMigration

VectorMigration is the Schema for the vectormigrations API

Appears in:

• VectorMigrationList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorMigration
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.		Optional: {}
spec VectorMigrationSpec	spec defines the desired state of VectorMigration		Required: {}
status VectorMigrationStatus	status defines the observed state of VectorMigration		Optional: {}

VectorMigrationList

VectorMigrationList contains a list of VectorMigration

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorMigrationList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items VectorMigration array

VectorMigrationSpec

VectorMigrationSpec defines the desired state of VectorMigration

Appears in:

• VectorMigration

Field	Description	Default	Validation
stageVersion string
vector string	Vector points to the OCM component version that contains the deployment vector for this stage.

VectorMigrationStatus

VectorMigrationStatus defines the observed state of VectorMigration.

Appears in:

• VectorMigration

Field	Description	Default	Validation
conditions Condition array

VectorPromotion

VectorPromotion triggers a one-time execution of a promotion flow defined by a VectorPromotionConfig.

Appears in:

• VectorPromotionList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorPromotion
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec VectorPromotionSpec
status VectorPromotionStatus

VectorPromotionConfig

VectorPromotionConfig describes a promotion flow for a vector between a source and a target.

Appears in:

• VectorPromotionConfigList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorPromotionConfig
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec VectorPromotionConfigSpec	Spec defines the desired state of the VectorPromotionConfig.		Optional: {}
status VectorPromotionConfigStatus

VectorPromotionConfigList

VectorPromotionConfigList contains a list of VectorPromotionConfig.

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorPromotionConfigList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items VectorPromotionConfig array

VectorPromotionConfigSpec

VectorPromotionConfigSpec defines the desired state of VectorPromotionConfig.

Appears in:

• VectorPromotionConfig

Field	Description	Default	Validation
source string	Source is the OCM component reference to promote from. This usually points to a version alias (e.g. :latest) that resolves to the component version to be promoted. The format is <registry>//<component-name>:<version>.		MinLength: 1 Pattern: ^[^/].+//.+:.+$
target string	Target is the OCM component reference to promote to. This usually points to a version alias (e.g. :promoted). The actual version string is taken from the source component version. The format is <registry>//<component-name>:<version>.		MinLength: 1 Pattern: ^[^/].+//.+:.+$
credentials Credentials	Credentials supplies credentials for OCM repository access and vector verification key material.		Optional: {}
verifyVector Verify	VerifyVector lists candidate signatures evaluated against the source vector before promotion proceeds. Absence disables vector verification.		Optional: {}

VectorPromotionConfigStatus

VectorPromotionConfigStatus defines the observed state of VectorPromotionConfig.

Appears in:

• VectorPromotionConfig

Field	Description	Default	Validation
lastPromotionConditions Condition array	LastPromotionConditions contains the result of the most recent VectorPromotion execution
lastSuccessfulPromotionConditions Condition array	LastSuccessfulPromotionConditions contains the result of the most recent VectorPromotion execution, that was successful

VectorPromotionList

VectorPromotionList contains a list of VectorPromotion.

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorPromotionList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items VectorPromotion array

VectorPromotionSpec

VectorPromotionSpec defines the desired state of VectorPromotion.

Appears in:

• VectorPromotion

Field	Description	Default	Validation
vectorPromotionConfigRef string	VectorPromotionConfigRef is the name of the VectorPromotionConfig that defines the promotion flow to execute.		MinLength: 1
ttlAfterFinished Duration	TTLAfterFinished defines how long the VectorPromotion should be kept after completion. Once the TTL expires after the promotion reaches a terminal state (Completed or Failed), the resource is eligible for automatic deletion. If no TTL is set, no deletion happens.		Optional: {}

VectorPromotionStatus

VectorPromotionStatus defines the observed state of VectorPromotion.

Appears in:

• VectorPromotion

Field	Description	Default	Validation
conditions Condition array

VectorTemplate

VectorTemplate represents a template for assembling OCM components into an OCM component that represents a vector.

Appears in:

• VectorTemplateList

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorTemplate
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.		Optional: {}
spec VectorTemplateSpec	spec defines the desired state of VectorTemplate		Required: {}
status VectorTemplateStatus	status defines the observed state of VectorTemplate		Optional: {}

VectorTemplateList

VectorTemplateList contains a list of VectorTemplate

Field	Description	Default	Validation
apiVersion string	konfidence.cloud/v1alpha1
kind string	VectorTemplateList
kind string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds		Optional: {}
apiVersion string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources		Optional: {}
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items VectorTemplate array

VectorTemplateSpec

VectorTemplateSpec defines the desired state of VectorTemplate. VectorTemplateSpec defines the components of which a vector is composed. From a VectorTemplate an OCM component is created which contains the latest version of all listed components.

Appears in:

• VectorTemplate

Field	Description	Default	Validation
reconcileInterval Duration	ReconcileInterval defines how often the assembly controller should check for drift. If not set, the controller's default reconcile interval will be used.		Optional: {}
uploadTarget string	UploadTarget defines the target OCM component where the assembled vector will be uploaded.
base string	Base represents an optional base component version to build upon.		Optional: {} Optional: {}
components Component array	Components lists the components to be included in the vector.		MinItems: 1
credentials Credentials	Credentials supplies credentials for OCM repositories and signing/verification key material.		Optional: {}
verifyArtifacts Verify	VerifyArtifacts lists candidate signatures evaluated against every artifact pulled into the assembly. Absence disables artifact verification.		Optional: {}
verifyVector Verify	VerifyVector lists candidate signatures evaluated against any vector the assembly fetches (base or pre-existing upload target). Absence disables vector verification.		Optional: {}
signVector Sign	SignVector lists signatures the controller produces on the emitted vector. Absence disables signing.		Optional: {}
vectorConfig VectorConfig			Optional: {}

VectorTemplateStatus

VectorTemplateStatus defines the observed state of VectorTemplate.

Appears in:

• VectorTemplate

Field	Description	Default	Validation
conditions Condition array

Verify

Verify lists candidate signatures evaluated against every fetched descriptor. Absence on a spec disables verification.

Appears in:

• StageConfigurationSpec
• VectorPromotionConfigSpec
• VectorTemplateSpec

Field	Description	Default	Validation
signatures Signature array			MinItems: 1