Items is the list of banners to display

Summary is the banner text (5-500 chars, supports Markdown)

Type is the banner type (info, warning, danger)

StartTime is the start time in HH:mm format (required if date fields are set)

EndTime is the end time in HH:mm format (required if date fields are set)

TimeZone is the IANA timezone (optional, defaults to UTC)

Year is the year for one-time banners

Month is the month (1-12)

DayOfWeek is the day of week (0-6, 0=Sunday)

DayOfMonth is the day of month (1-31)

Spec configures the build-service component.

CreateClusterIssuer controls whether cluster issuer resources are created. Defaults to true if not specified.

Data contains structured cluster-wide configuration values. These values will be stored in the "cluster-config" ConfigMap in the "konflux-info" namespace. The ConfigMap keys are stable and part of the public API consumed by PipelineRuns. WARNING: Changing field names or JSON tags is a BREAKING CHANGE that will affect all PipelineRuns reading from the ConfigMap. Field names must remain stable.

DefaultOIDCIssuer is the default OIDC issuer URL.

EnableKeylessSigning determines if pipelines should perform/validate keyless signing. When nil, the key is omitted from the ConfigMap (unset).

FulcioInternalUrl is the internal Fulcio URL.

FulcioExternalUrl is the external Fulcio URL.

RekorInternalUrl is the internal Rekor URL.

RekorExternalUrl is the external Rekor URL.

TufInternalUrl is the internal TUF URL.

TufExternalUrl is the external TUF URL.

TrustifyServerInternalUrl is the internal URL for the Trustify server.

TrustifyServerExternalUrl is the external URL for the Trustify server.

BuildIdentityRegexp is a regex pattern used for matching the identity that signed artifacts as part of the build pipeline.

TrustifyOIDCIssuerUrl is the URL of the OIDC issuer used by Trustification clients.

TektonChainsIdentity is the identity of Tekton Chains used when verifying the signature of attestations produced by Tekton Chains.

Name of the component

Ready indicates if the component is ready

Message provides additional information about the component status

Resources specifies the resource requirements for the container.

Env specifies environment variables for the container.

Replicas is the number of replicas for the controller-manager deployment.

Manager defines customizations for the manager container.

Enabled controls whether the default tenant is created. Defaults to true if not specified.

Replicas is the number of replicas for the dex deployment.

Dex defines customizations for the dex container.

Config defines the Dex IdP configuration parameters.

ApplicationURL is the GitHub App installation URL

Enabled indicates whether image-controller should be deployed. If false or unset, the component CR will not be created.

Enabled indicates if image controller is enabled

Notifications contains notification configurations

Title is the notification title

Event is the event type (e.g., "repo_push", "build_complete")

Method is the notification method (e.g., "webhook", "email")

Config contains method-specific configuration (as JSON). For webhook method, use: {"url": "https://webhook.example.com/endpoint"} For email method, use: {"email": "notifications@example.com"} Example webhook config: config: url: "https://webhook.example.com/build" Example email config: config: email: "team@example.com"

Enabled controls whether an Ingress resource should be created. When nil (unset), defaults to true on OpenShift, false otherwise.

IngressClassName specifies which IngressClass to use for the ingress.

Host is the hostname used as the endpoint for configuring oauth2-proxy, dex, and related components. When set, this hostname is always used regardless of whether ingress is enabled, allowing users who manage their own external routing (e.g., Gateway API, hardware LB) to configure the endpoint without the operator managing an Ingress resource. On OpenShift, if empty, the default ingress domain and naming convention will be used.

Annotations to add to the ingress resource.

TLSSecretName is the name of the Kubernetes TLS secret to use for the ingress. If not specified, TLS will not be configured on the ingress.

NodePortService configures the proxy Service as a NodePort type. When set, the proxy Service will be exposed via NodePort instead of ClusterIP. This is useful for accessing Konflux UI from outside the cluster without an Ingress controller.

Enabled indicates whether the Ingress resource is enabled.

Hostname is the hostname configured for the ingress. This is the actual hostname being used, whether explicitly configured or auto-generated.

URL is the full URL to access the KonfluxUI.

Spec configures the integration-service component.

GitHub contains GitHub integration configuration

SBOMServer contains SBOM server configuration

ImageController contains image controller configuration

Enabled controls whether internal registry resources are deployed. Defaults to false if not specified.

Conditions represent the latest available observations of the KonfluxApplicationAPI state

BuildControllerManager defines customizations for the controller-manager deployment.

Conditions represent the latest available observations of the KonfluxBuildService state

CreateClusterIssuer controls whether cluster issuer resources are created. Defaults to true if not specified. The cluster-Issuer will be used for generating certificates for the Konflux components

Conditions represent the latest available observations of the KonfluxCertManager state

Conditions represent the latest available observations of the KonfluxDefaultTenant state

Foo is an example field of KonfluxEnterpriseContract. Edit konfluxenterprisecontract_types.go to remove/update

Conditions represent the latest available observations of the KonfluxEnterpriseContract state

Conditions represent the latest available observations of the KonfluxImageController state

Spec configures the info component.

PublicInfo defines the configuration for the info.json ConfigMap. If not specified, default development values will be used.

Banner defines the configuration for the banner-content.yaml ConfigMap. If not specified, an empty banner array will be used.

ClusterConfig defines cluster-wide key-value configuration. The key-value pairs will be stored in a ConfigMap named "cluster-config" in the "konflux-info" namespace, readable by all authenticated users. User-provided values take precedence over auto-detected values.

Conditions represent the latest available observations of the KonfluxInfo state

IntegrationControllerManager defines customizations for the controller-manager deployment.

Conditions represent the latest available observations of the KonfluxIntegrationService state

Conditions represent the latest available observations of the KonfluxInternalRegistry state

NamespaceLister defines customizations for the namespace-lister deployment.

Conditions represent the latest available observations of the KonfluxNamespaceLister state

Foo is an example field of KonfluxRBAC. Edit konfluxrbac_types.go to remove/update

Conditions represent the latest available observations of the KonfluxRBAC state

ReleaseControllerManager defines customizations for the controller-manager deployment.

Conditions represent the latest available observations of the KonfluxReleaseService state

SegmentKey is the write key used to authenticate with the Segment API. When not specified, a default key baked into the operator build is used, routing telemetry data to the Konflux dev team's Segment project.

SegmentAPIURL is the base URL of the Segment API endpoint, without "/batch". The operator appends "/batch" to produce the SEGMENT_BATCH_API env var. Example: "https://console.redhat.com/connections/api/v1" When not specified, defaults to "https://api.segment.io/v1". Only plain HTTPS base URLs are supported (no query strings or fragments).

Conditions represent the latest available observations of the KonfluxSegmentBridge state

ImageController configures the image-controller component. The runtime configuration is copied to the KonfluxImageController CR by the operator.

KonfluxUI configures the UI component. The runtime configuration is copied to the KonfluxUI CR by the operator.

KonfluxIntegrationService configures the integration-service component. The runtime configuration is copied to the KonfluxIntegrationService CR by the operator.

KonfluxReleaseService configures the release-service component. The runtime configuration is copied to the KonfluxReleaseService CR by the operator.

KonfluxBuildService configures the build-service component. The runtime configuration is copied to the KonfluxBuildService CR by the operator.

NamespaceLister configures the namespace-lister component. The runtime configuration is copied to the KonfluxNamespaceLister CR by the operator.

KonfluxInfo configures the info component. The runtime configuration is copied to the KonfluxInfo CR by the operator.

CertManager configures the cert-manager component. The runtime configuration is copied to the KonfluxCertManager CR by the operator.

InternalRegistry configures the internal registry component. The runtime configuration is copied to the KonfluxInternalRegistry CR by the operator. Enabling internal registry requires trust-manager to be deployed.

DefaultTenant configures the default tenant component. The default tenant provides a namespace accessible by all authenticated users. The runtime configuration is copied to the KonfluxDefaultTenant CR by the operator.

Telemetry configures the user-facing telemetry component (internally backed by segment-bridge). When enabled, the operator deploys a CronJob that collects anonymized usage data from the cluster and sends it to Segment for analysis. The runtime configuration is copied to the KonfluxSegmentBridge CR by the operator.

Conditions represent the latest available observations of the Konflux state

Components shows the status of individual Konflux components

UIURL is the URL to access the Konflux UI. This is populated from the KonfluxUI status when ingress is enabled.

Spec configures the UI component.

Ingress defines the ingress configuration for KonfluxUI. This affects the proxy, oauth2-proxy, and dex components.

Proxy defines customizations for the proxy deployment.

Dex defines customizations for the dex deployment.

Conditions represent the latest available observations of the KonfluxUI state

Ingress contains the observed state of the Ingress configuration.

Spec configures the namespace-lister component.

Replicas is the number of replicas for the namespace-lister deployment.

NamespaceLister defines customizations for the namespace-lister container.

HTTPSPort is the NodePort to use for the HTTPS port. If not specified, Kubernetes will allocate a port automatically. This is useful for exposing Konflux UI to the outside world without an Ingress controller.

Replicas is the number of replicas for the proxy deployment.

Nginx defines customizations for the nginx container.

OAuth2Proxy defines customizations for the oauth2-proxy container.

Environment is the environment type (development, production, staging)

Visibility is the visibility level (public, private)

Integrations contains integration configuration

StatusPageUrl is the URL to the status page

RBAC contains RBAC role definitions

Name is the ClusterRole name (e.g., "konflux-admin-user-actions")

Description is the role description

DisplayName is the human-readable name displayed in the UI. If not specified, defaults to the Name field.

Spec configures the release-service component.

URL is the SBOM content URL

SBOMSha is the SBOM SHA URL

Enabled controls whether the telemetry CronJob is deployed. Defaults to false if not specified.

Spec configures the telemetry component.