PtahResultRecord

PtahResultRecord is a namespaced resource in operator.ptah.run, served as v1alpha1. kubectl knows it as ptahresultrecords, or ptahresult for short.

This page is generated from the API types by make docs-reference. The shipped CRDs carry no descriptions, so this is where the field documentation lives.

The result transport writes these immutable records. A result up to 256 KiB commits atomically in its intent, which contains its bytes, digest, and operation binding. Larger results use the chunk and completion records shown below. Grant read access only to identities allowed to inspect operation SQL and delivery credentials; ordinary Secret read permission does not grant access to them. Include this resource in the cluster’s encryption-at-rest and restricted backup configuration.

A retired record binds a completed or abandoned attempt to the exact credential or publication intent that proved its identity. Its API-assigned creation time starts the retention window. It prevents issuing credentials or publishing more results for that attempt; it does not erase an acknowledged result or override the resource’s recovery pins. These records are created by the manager. Where the API refuses one, in a terminating namespace or under a full ResourceQuota, the manager deletes the attempt’s intent and credential records in the foreground instead, and their API-assigned deletion time starts the window.

A payload chunk has the following shape. Its publication intent supplies the binding, index, byte length, and digest. Reading a chunk alone does not establish that a complete result was accepted.

apiVersion: operator.ptah.run/v1alpha1
kind: PtahResultRecord
metadata:
  name: example-result-chunk
  namespace: default
spec:
  type: chunk
  data: U0VMRUNUIDE7Cg==

A completion record contains the verified intent and chunk identities. This example illustrates its envelope; its referenced intent and chunk must exist and pass digest checks before a consumer accepts the result.

apiVersion: operator.ptah.run/v1alpha1
kind: PtahResultRecord
metadata:
  name: example-result-complete
  namespace: default
spec:
  type: complete
  data: eyJtYW5pZmVzdFVJRCI6IjZmNGIyYTE4LThjM2UtNGQ1YS1iMWY3LTJlMGM5ZDhhN2I2NCIsIm1hbmlmZXN0RGlnZXN0Ijoic2hhMjU2OmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWEiLCJjaHVua1VJRHMiOlsiN2M5ZTY2NzktNzQyNS00MGRlLTk0NGItZTA3ZmMxZjkwYWU3Il19

spec

Field	Type	What it does
spec.data	string, required	Data is the record’s exact bytes, base64-encoded on the wire. Readers must validate its protocol and digest before using it. Treat every role as confidential: payloads may contain SQL and credentials contain private keys. MaxLength is the base64 length of the 512 KiB record ceiling.
spec.type	string, required, one of credential, intent, chunk, complete, retired	Type identifies the record’s role in credential or result publication. Credential records contain delivery key material; intent, chunk, and completion records contain authenticated operation evidence. Retired records fence delivery and start the evidence retention window.

status

This resource declares no status.