PtahMigration

PtahMigration is a namespaced resource in operator.ptah.run, served as v1alpha1. kubectl knows it as ptahmigrations, or ptahm for short.

This page is generated from the API types by make docs-reference. The shipped CRDs carry no descriptions, so this is where the field documentation lives.

Examples

A PtahMigration runs an ordered sequence and records what it ran. Where a PtahSchema compares a declaration against the database, this one asks the database which versions it already has and applies the rest in order.

The smallest resource that runs

An artifact holding the sequence, the policy it must satisfy, and the database to run it against. spec.policy.apply defaults to OnApproval: the resource reads the history, plans the versions that are missing, and waits.

apiVersion: operator.ptah.run/v1alpha1
kind: PtahMigration
metadata:
  name: orders
  namespace: application
spec:
  target:
    engine: PostgreSQL
    coordinationKey: production/application-primary
    urlFrom:
      name: application-database
      key: url
  artifact:
    ociRef: oci://ghcr.io/example/orders-migrations:1.4.0
    verificationPolicyFrom:
      name: ptah-migration-verification-policy
      key: policy.yaml

From a ConfigMap, with no registry

The migration directory is a set of keys in a ConfigMap in the same namespace. A key cannot hold “/”, so items names the file each key becomes, and a key the list leaves out is not part of the sequence. The manager copies the selected files into an immutable snapshot that the history read and the Apply both check against its content digest; there is no verification policy. Whoever may write the ConfigMap may change what runs, so grant it as you grant this resource.

apiVersion: operator.ptah.run/v1alpha1
kind: PtahMigration
metadata:
  name: inventory
  namespace: application
spec:
  target:
    engine: PostgreSQL
    coordinationKey: production/inventory-primary
    urlFrom:
      name: inventory-database
      key: url
  artifact:
    configMap:
      name: inventory-migrations
      items:
        - key: 0000000001-up
          path: 0000000001_create_items.up.sql
        - key: 0000000001-down
          path: 0000000001_create_items.down.sql
        - key: 0000000002-up
          path: 0000000002_add_item_sku.up.sql

From a tag of a Git repository, over SSH

The migration directory is a directory of a Git repository at the commit a tag names. The fetch never trusts a host key on first use, so an ssh:// repository names its known hosts. The Secret inventory-deploy-key holds sshPrivateKey, host: git.example.com and knownHostsSHA256, the digest of the known-hosts file the key may be used with.

apiVersion: operator.ptah.run/v1alpha1
kind: PtahMigration
metadata:
  name: inventory
  namespace: application
spec:
  target:
    engine: PostgreSQL
    coordinationKey: production/inventory-primary
    urlFrom:
      name: inventory-database
      key: url
  artifact:
    git:
      url: ssh://git@git.example.com/acme/inventory.git
      ref:
        tag: v1.4.0
      path: db/migrations
      authFrom:
        name: inventory-deploy-key
      transport:
        knownHostsFrom:
          name: git-example-known-hosts
          key: known_hosts

Beside a PtahSchema, over one database

Both resources live in one namespace, name the same coordinationKey and set sharedRealm, so they take turns under one lease rather than running at once. The operator checks that a person decided to share; it cannot check that the areas they write to are really disjoint.

apiVersion: operator.ptah.run/v1alpha1
kind: PtahMigration
metadata:
  name: orders
  namespace: application
spec:
  target:
    engine: PostgreSQL
    coordinationKey: production/application-primary
    sharedRealm: true
    urlFrom:
      name: application-database
      key: url
  artifact:
    ociRef: oci://ghcr.io/example/orders-migrations@sha256:2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae
    verificationPolicyFrom:
      name: ptah-migration-verification-policy
      key: policy.yaml
  policy:
    # A migration artifact carries arbitrary SQL, and no analyzer calls
    # arbitrary SQL safe, so the conservative setting is also the default.
    apply: OnApproval
    # The wait for the database's own migration lock. This is not the
    # Kubernetes Lease: two controllers that never run at the same time still
    # need the database to serialize them.
    lockTimeout: 5m
  interval: 10m
  execution:
    activeDeadlineSeconds: 900
    serviceAccountName: ptah-execution

An engine that will not run DDL inside a transaction

MySQL commits implicitly on DDL, so a file that fails halfway leaves what ran in place. transactionMode: none says that plainly instead of promising a rollback the engine will not perform.

There is no setting that makes such a failure recover on its own. The operator records what it cannot account for in status.unresolvedRun and stops, and a person decides what the interrupted file did before anything runs against that database again, then says so with a PtahMigrationRunAcknowledgment; Operations has the procedure. A checkpoint is not that answer either – it decides where a new database starts, not what an interrupted one has run.

apiVersion: operator.ptah.run/v1alpha1
kind: PtahMigration
metadata:
  name: orders
  namespace: application
spec:
  target:
    engine: MySQL
    coordinationKey: production/orders-primary
    urlFrom:
      name: orders-database
      key: url
  artifact:
    ociRef: oci://ghcr.io/example/orders-migrations:1.4.0
    verificationPolicyFrom:
      name: ptah-migration-verification-policy
      key: policy.yaml
  policy:
    apply: OnApproval
    transactionMode: none
  suspend: false

A database another namespace manages too

A key reaches no further than its namespace, so a database that resources in two namespaces manage is named by a PtahRealm an administrator created instead. realmRef replaces coordinationKey; a target names one or the other. The realm has to list this resource’s namespace, or the resource is refused with reason RealmNotAuthorized and runs nothing, and a realm that allows sharing still needs sharedRealm from every claimant.

apiVersion: operator.ptah.run/v1alpha1
kind: PtahMigration
metadata:
  name: reporting-views
  namespace: reporting
spec:
  target:
    engine: PostgreSQL
    realmRef:
      name: production-application-primary
    sharedRealm: true
    urlFrom:
      name: application-database-reporting
      key: url
  artifact:
    ociRef: oci://ghcr.io/example/reporting-migrations:2.0.1
    verificationPolicyFrom:
      name: ptah-migration-verification-policy
      key: policy.yaml

In a namespace with a service mesh or a policy engine

A migration’s Pods are held to their Job template the way a schema’s are, and podMetadata is the same declaration: the annotation that opts the Pods out of sidecar injection, and the label a policy engine requires. A Pod refused anyway is reported as Progressing=False with reason PodAdmissionRefused. Execution has the contract.

apiVersion: operator.ptah.run/v1alpha1
kind: PtahMigration
metadata:
  name: orders
  namespace: application
spec:
  target:
    engine: PostgreSQL
    coordinationKey: production/application-primary
    urlFrom:
      name: application-database
      key: url
  artifact:
    ociRef: oci://ghcr.io/example/orders-migrations:1.4.0
    verificationPolicyFrom:
      name: ptah-migration-verification-policy
      key: policy.yaml
  execution:
    podMetadata:
      labels:
        acme.example/team: platform
      annotations:
        sidecar.istio.io/inject: "false"

spec

Field	Type	What it does
spec.artifact	object, required	This resource requires: where artifact.verificationPolicyFrom is set, artifact.verificationPolicyFrom must name a required ConfigMap key; where artifact.transport and artifact.transport.caFrom are set, artifact.transport.caFrom must name a required ConfigMap key. Artifact is the migration directory this history is matched against: an OCI artifact, a ConfigMap or a Git repository. It reuses the schema path’s source contract: fetching it never hands a registry or Git credential to the process that runs SQL.
spec.artifact.configMap	object	ConfigMap selects files from a ConfigMap in this resource’s namespace. Whoever may write that ConfigMap may change the desired state, exactly as whoever may write this resource can: Kubernetes RBAC on the namespace is what this source is trusted by. The manager copies the selected files into an immutable snapshot, and every operation reads the snapshot.
spec.artifact.configMap.items	[]object, required	Items are the keys that become files, and the file each one becomes. A key cannot hold “/”, so a nested directory is spelled out here. A key the list does not name is not part of the source, and editing it changes nothing. A schema selects exactly one file, whose extension tells Ptah its format; a migration directory selects up to 1,000.
spec.artifact.configMap.items[].key	string, required	Key in the ConfigMap’s data or binaryData.
spec.artifact.configMap.items[].path	string, required	Path is the file the key becomes: relative, separated by “/”, with no empty, “.” or “..” element, no backslash and no control character. An element longer than 255 bytes, or a path that is a file and a directory at once, is refused when the source is read.
spec.artifact.configMap.name	string, required	Name of the ConfigMap, in this resource’s namespace.
spec.artifact.git	object	Git selects a file or a directory of one commit of a Git repository. The manager never reads the repository or its credential: a Job’s fetch container fetches the commit through Ptah, and every later operation fetches the same commit again and refuses any other content.
spec.artifact.git.authFrom	object	AuthFrom names the Secret the fetch container reads the credential from. The manager never reads it.
spec.artifact.git.authFrom.name	string, required	Name of the Secret, in this resource’s namespace.
spec.artifact.git.path	string, required	Path is what the commit’s tree selects: the schema file, or the migration directory, where “.” is the root. Relative, separated by “/”, with no empty or “..” element, no backslash and no control character.
spec.artifact.git.ref	object, required	Ref says which commit: a branch or a tag, polled at the resource’s interval, or a commit.
spec.artifact.git.ref.branch	string	Branch is read at its tip, again at every interval.
spec.artifact.git.ref.commit	string	Commit is one commit, by its full 40-character id, which Ptah asks the server for by that id. Unless a branch or tag points at it, Ptah asks only a server that says it gives commits by id; on any other, Resolve refuses the commit once its branch moves past it. A tag holds one commit on every server.
spec.artifact.git.ref.tag	string	Tag is read at the commit it names, again at every interval.
spec.artifact.git.transport	object	Transport pins whom the fetch talks to: the CA an https:// server’s certificate chains to, or the host keys an ssh:// server presents.
spec.artifact.git.transport.caFrom	object	CAFrom selects the only roots an https:// server’s certificate may chain to. With authFrom, its Secret must hold caSHA256 with the selected bytes’ digest.
spec.artifact.git.transport.caFrom.key	string, required	The key to select from the ConfigMap’s Data field. Keys in the BinaryData field are not currently propagated to container env vars.
spec.artifact.git.transport.caFrom.name	string, default ``	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
spec.artifact.git.transport.caFrom.optional	boolean	Specify whether the ConfigMap or its key must be defined
spec.artifact.git.transport.knownHostsFrom	object	KnownHostsFrom selects the host keys an ssh:// server may present; a fetch never trusts a key on first use. With authFrom, its Secret must hold knownHostsSHA256 with the selected bytes’ digest.
spec.artifact.git.transport.knownHostsFrom.key	string, required	The key to select from the ConfigMap’s Data field. Keys in the BinaryData field are not currently propagated to container env vars.
spec.artifact.git.transport.knownHostsFrom.name	string, default ``	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
spec.artifact.git.transport.knownHostsFrom.optional	boolean	Specify whether the ConfigMap or its key must be defined
spec.artifact.git.url	string, required	URL of the repository: https:// or ssh://, with no credential, query or fragment.
spec.artifact.ociRef	string	OCIRef is a desired-schema artifact reference. It may name a tag or a digest; every later operation receives only the resolved digest.
spec.artifact.registryAuthFrom	object	RegistryAuthFrom names the Secret an operation Pod reads the registry credential from. The process that runs SQL never receives it.
spec.artifact.registryAuthFrom.dockerConfigJSONKey	string, default .dockerconfigjson	DockerConfigJSONKey is the Secret key holding a Docker config document.
spec.artifact.registryAuthFrom.mode	string, one of Environment, DockerConfigJSON, default Environment	Mode says how the credential reaches the executor: as environment variables, or as a Docker config file.
spec.artifact.registryAuthFrom.name	string, required	Name of the Secret the registry credential is read from. The manager never reads it; the operation Pod does.
spec.artifact.registryAuthFrom.passwordKey	string, default password	PasswordKey is the Secret key holding the password.
spec.artifact.registryAuthFrom.tokenKey	string, default token	TokenKey is the Secret key holding a bearer token, where one is used instead of a username and password.
spec.artifact.registryAuthFrom.usernameKey	string, default username	Environment mode supports username/password or an identity token. Keys are optional so a single Secret shape can use either credential form. UsernameKey is the Secret key holding the username.
spec.artifact.sourcePolicyFrom	object	SourcePolicyFrom names the immutable ConfigMap holding what a team refuses for a ConfigMap or Git source: the hosts a Git source may name, the ConfigMaps a ConfigMap source may name, and the most the selected files may hold. A plan binds the policy’s object and bytes, so another policy retires it. An OCI source has its verification policy instead, and the API refuses this beside ociRef.
spec.artifact.sourcePolicyFrom.key	string, required	The key to select from the ConfigMap’s Data field. Keys in the BinaryData field are not currently propagated to container env vars.
spec.artifact.sourcePolicyFrom.name	string, default ``	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
spec.artifact.sourcePolicyFrom.optional	boolean	Specify whether the ConfigMap or its key must be defined
spec.artifact.transport	object	This resource requires: where artifact.transport and artifact.transport.caFrom are set, artifact.transport.caFrom must name a required ConfigMap key. Transport is how the registry is reached: plain HTTP, a custom CA.
spec.artifact.transport.caFrom	object	This resource requires: where artifact.transport and artifact.transport.caFrom are set, artifact.transport.caFrom must name a required ConfigMap key. CAFrom selects a custom CA bundle. When registryAuthFrom is present, that same Secret must contain caSHA256 with the exact lowercase SHA-256 digest of the selected bytes.
spec.artifact.transport.caFrom.key	string, required	This resource requires: where artifact.transport and artifact.transport.caFrom are set, artifact.transport.caFrom must name a required ConfigMap key. The key to select from the ConfigMap’s Data field. Keys in the BinaryData field are not currently propagated to container env vars.
spec.artifact.transport.caFrom.name	string, default ``	This resource requires: where artifact.transport and artifact.transport.caFrom are set, artifact.transport.caFrom must name a required ConfigMap key. Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
spec.artifact.transport.caFrom.optional	boolean	This resource requires: where artifact.transport and artifact.transport.caFrom are set, artifact.transport.caFrom must name a required ConfigMap key. Specify whether the ConfigMap or its key must be defined
spec.artifact.transport.plainHTTP	boolean, default false	PlainHTTP is intended only for explicitly trusted test or air-gapped networks. HTTPS remains the default. When registryAuthFrom is present, its Secret must also contain allowPlainHTTP with the exact value “true”.
spec.artifact.verificationPolicyFrom	object	This resource requires: where artifact.verificationPolicyFrom is set, artifact.verificationPolicyFrom must name a required ConfigMap key. VerificationPolicyFrom names the immutable ConfigMap holding the policy the artifact must satisfy. Editing it retires the plans computed under the previous version rather than letting them apply. It is required with ociRef and refused with configMap and git: its rules are about OCI artifacts, and a policy nothing evaluates would read as a gate.
spec.artifact.verificationPolicyFrom.key	string, required	This resource requires: where artifact.verificationPolicyFrom is set, artifact.verificationPolicyFrom must name a required ConfigMap key. The key to select from the ConfigMap’s Data field. Keys in the BinaryData field are not currently propagated to container env vars.
spec.artifact.verificationPolicyFrom.name	string, default ``	This resource requires: where artifact.verificationPolicyFrom is set, artifact.verificationPolicyFrom must name a required ConfigMap key. Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
spec.artifact.verificationPolicyFrom.optional	boolean	This resource requires: where artifact.verificationPolicyFrom is set, artifact.verificationPolicyFrom must name a required ConfigMap key. Specify whether the ConfigMap or its key must be defined
spec.execution	object, default {}	This resource requires: where execution, execution.connectTimeout and execution.activeDeadlineSeconds are set, execution.connectTimeout must not exceed execution.activeDeadlineSeconds; where policy, policy.lockTimeout, execution and execution.activeDeadlineSeconds are set, policy.lockTimeout must not exceed execution.activeDeadlineSeconds. Execution shapes the Job a run happens in: its deadlines, its resources and the scheduling it inherits.
spec.execution.activeDeadlineSeconds	integer, default 900	This resource requires: where execution, execution.connectTimeout and execution.activeDeadlineSeconds are set, execution.connectTimeout must not exceed execution.activeDeadlineSeconds; where policy, policy.lockTimeout, execution and execution.activeDeadlineSeconds are set, policy.lockTimeout must not exceed execution.activeDeadlineSeconds. ActiveDeadlineSeconds is how long one operation Job may run before Kubernetes ends it. An apply that hits this leaves an uncertain outcome, which returns to observation rather than to a replay.
spec.execution.affinity	object	Affinity is scheduling affinity for those Pods.
spec.execution.affinity.nodeAffinity	object	Describes node affinity scheduling rules for the pod.
spec.execution.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding “weight” to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.
spec.execution.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference	object, required	A node selector term, associated with the corresponding weight.
spec.execution.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions	[]object	A list of node selector requirements by node’s labels.
spec.execution.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].key	string, required	The label key that the selector applies to.
spec.execution.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].operator	string, required	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
spec.execution.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
spec.execution.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchFields	[]object	A list of node selector requirements by node’s fields.
spec.execution.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchFields[].key	string, required	The label key that the selector applies to.
spec.execution.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchFields[].operator	string, required	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
spec.execution.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchFields[].values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
spec.execution.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight	integer, required	Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
spec.execution.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution	object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.
spec.execution.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms	[]object, required	Required. A list of node selector terms. The terms are ORed.
spec.execution.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions	[]object	A list of node selector requirements by node’s labels.
spec.execution.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].key	string, required	The label key that the selector applies to.
spec.execution.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].operator	string, required	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
spec.execution.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
spec.execution.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchFields	[]object	A list of node selector requirements by node’s fields.
spec.execution.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchFields[].key	string, required	The label key that the selector applies to.
spec.execution.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchFields[].operator	string, required	Represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
spec.execution.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchFields[].values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
spec.execution.affinity.podAffinity	object	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding “weight” to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm	object, required	Required. A pod affinity term, associated with the corresponding weight.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchExpressions[].key	string, required	key is the label key that the selector applies to.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchExpressions[].operator	string, required	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchExpressions[].values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchLabels	object	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key in (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key notin (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaceSelector.matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaceSelector.matchExpressions[].key	string, required	key is the label key that the selector applies to.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaceSelector.matchExpressions[].operator	string, required	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaceSelector.matchExpressions[].values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaceSelector.matchLabels	object	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.topologyKey	string, required	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
spec.execution.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight	integer, required	weight associated with matching the corresponding podAffinityTerm, in the range 1-100.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution	[]object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchExpressions[].key	string, required	key is the label key that the selector applies to.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchExpressions[].operator	string, required	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchExpressions[].values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchLabels	object	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key in (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key notin (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaceSelector.matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaceSelector.matchExpressions[].key	string, required	key is the label key that the selector applies to.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaceSelector.matchExpressions[].operator	string, required	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaceSelector.matchExpressions[].values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaceSelector.matchLabels	object	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.
spec.execution.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[].topologyKey	string, required	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
spec.execution.affinity.podAntiAffinity	object	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting “weight” from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm	object, required	Required. A pod affinity term, associated with the corresponding weight.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchExpressions[].key	string, required	key is the label key that the selector applies to.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchExpressions[].operator	string, required	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchExpressions[].values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchLabels	object	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key in (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key notin (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaceSelector.matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaceSelector.matchExpressions[].key	string, required	key is the label key that the selector applies to.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaceSelector.matchExpressions[].operator	string, required	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaceSelector.matchExpressions[].values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaceSelector.matchLabels	object	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.topologyKey	string, required	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
spec.execution.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight	integer, required	weight associated with matching the corresponding podAffinityTerm, in the range 1-100.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution	[]object	If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector	object	A label query over a set of resources, in this case pods. If it’s null, this PodAffinityTerm matches with no Pods.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchExpressions[].key	string, required	key is the label key that the selector applies to.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchExpressions[].operator	string, required	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchExpressions[].values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].labelSelector.matchLabels	object	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key in (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn’t set.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with labelSelector as key notin (value) to select the group of existing pods which pods will be taken into consideration for the incoming pod’s pod (anti) affinity. Keys that don’t exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn’t set.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means “this pod’s namespace”. An empty selector ({}) matches all namespaces.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaceSelector.matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaceSelector.matchExpressions[].key	string, required	key is the label key that the selector applies to.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaceSelector.matchExpressions[].operator	string, required	operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaceSelector.matchExpressions[].values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaceSelector.matchLabels	object	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is “key”, the operator is “In”, and the values array contains only “value”. The requirements are ANDed.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means “this pod’s namespace”.
spec.execution.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[].topologyKey	string, required	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
spec.execution.connectTimeout	string, default 10s	This resource requires: where execution, execution.connectTimeout and execution.activeDeadlineSeconds are set, execution.connectTimeout must not exceed execution.activeDeadlineSeconds. ConnectTimeout bounds opening the database connection, so an unreachable database fails in seconds rather than holding the Job to its deadline.
spec.execution.failureRetryInterval	string, default 30s	FailureRetryInterval is how long the controller waits after a failed operation before trying the same one again.
spec.execution.imagePullSecrets	[]object	ImagePullSecrets are the pull Secrets those Pods use.
spec.execution.imagePullSecrets[].name	string, default ``	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
spec.execution.nodeSelector	object	NodeSelector restricts where operation Pods may be scheduled.
spec.execution.podMetadata	object	PodMetadata is what an operation Pod carries for the cluster around it: a service mesh’s opt-out annotation, the label a policy engine requires, a team’s own bookkeeping. Every operation Pod this resource dispatches carries exactly these labels and annotations beside the operator’s own, and the admission snapshot binds them: a Pod that arrives with more, fewer or different metadata is refused, so nothing unplanned runs beside the database credential. Keys under ptah.run, kubernetes.io and k8s.io are refused, so the operator’s own labels, the Job controller’s and the built-in admission plugins’ cannot be redeclared, and nothing here can select an operation Pod into an object the operator owns. Unset, nothing changes.
spec.execution.podMetadata.annotations	object	Annotations are added to every operation Pod beside the operator’s own.
spec.execution.podMetadata.labels	object	Labels are added to every operation Pod beside the operator’s own.
spec.execution.priorityClassName	string	PriorityClassName is the scheduling priority they run at.
spec.execution.resources	object	Resources are the requests and limits of the container that runs SQL.
spec.execution.resources.claims	[]object	Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This field depends on the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers.
spec.execution.resources.claims[].name	string, required	Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.
spec.execution.resources.claims[].request	string	Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.
spec.execution.resources.limits	object	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
spec.execution.resources.requests	object	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
spec.execution.runtimeClassName	string	RuntimeClassName selects the container runtime they use. The admission snapshot records what the cluster resolved, so a class that changed under a claim is refused rather than run.
spec.execution.serviceAccountName	string	ServiceAccountName is the identity operation Pods run as. It is theirs rather than the manager’s, and it needs no Kubernetes permission at all.
spec.execution.tolerations	[]object	Tolerations are the taints those Pods tolerate.
spec.execution.tolerations[].effect	string	Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
spec.execution.tolerations[].key	string	Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.
spec.execution.tolerations[].operator	string	Operator represents a key’s relationship to the value. Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
spec.execution.tolerations[].tolerationSeconds	integer	TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.
spec.execution.tolerations[].value	string	Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.
spec.interval	string, default 10m	Interval is the cadence for resolving a mutable tag and re-reading the history.
spec.policy	object, default {}	This resource requires: where policy, policy.lockTimeout, execution and execution.activeDeadlineSeconds are set, policy.lockTimeout must not exceed execution.activeDeadlineSeconds. Policy decides what may run without a person: the apply mode, the approval requirement, and the locks a run takes.
spec.policy.apply	string, one of Never, OnApproval, Always, default OnApproval	Apply defaults to OnApproval. A migration artifact carries arbitrary SQL, and no analyzer classifies arbitrary SQL as safe, so the conservative setting is the default one rather than the one an operator opts into.
spec.policy.lockTimeout	string, default 5m	This resource requires: where policy, policy.lockTimeout, execution and execution.activeDeadlineSeconds are set, policy.lockTimeout must not exceed execution.activeDeadlineSeconds. LockTimeout bounds the wait for the database’s own migration lock. It is the lock the engine takes, not the Kubernetes Lease: two controllers that never run at the same time still need the database to serialize them.
spec.policy.transactionMode	string, one of file, none	TransactionMode is how Ptah is asked to wrap the run: “file” for one transaction per migration file, “none” to wrap nothing. The spellings are Ptah’s own. Unset passes no mode and Ptah chooses. There is no default here on purpose: one would change how every stored resource already runs, and would pin this API to a value Ptah is free to move. A MySQL-family database refuses “file” whenever an interceptor is installed, so this is a requirement to check against the target rather than a preference. The migration lifecycle section of the architecture reference says what the operator does with the answer.
spec.suspend	boolean, default false	Suspend prevents new Jobs. A Job already applying is observed to a terminal result: a migration that is running is never abandoned, because the database would be left in a state nothing recorded.
spec.target	object, required	This resource requires: target.urlFrom must name a required Secret key. Target is the database this sequence runs against, named through a Secret the manager never reads.
spec.target.coordinationKey	string	CoordinationKey is a non-secret, stable identifier for the physical database, scoped to this resource’s namespace. Every resource in the namespace that can reach the same database through an alias, proxy, or different credential must use exactly the same key. The same key in another namespace is another realm: a resource elsewhere can neither block this one nor take turns with it by choosing the same string. A database more than one namespace manages is named with realmRef instead, which an administrator has to grant. Exactly one of coordinationKey and realmRef is set.
spec.target.engine	string, required	Engine is the database this target speaks. An engine outside the supported set is refused with a condition rather than attempted.
spec.target.realmRef	object	RealmRef names the cluster-scoped PtahRealm this database belongs to. The realm, not this resource, decides whether the claim is allowed: a resource whose namespace the realm does not list, or whose engine it does not name, is refused with reason RealmNotAuthorized and runs nothing, and it is not counted against the resources the realm does admit. Exactly one of coordinationKey and realmRef is set.
spec.target.realmRef.name	string, required	Name is the PtahRealm’s name.
spec.target.sharedRealm	boolean, default false	SharedRealm declares that this resource manages only part of the database its realm names, and that every other resource managing that database has declared the same. It defaults to false. A realm more than one resource claims is refused while any claimant leaves it false – including the resource that did declare it. A PtahRealm with sharing Exclusive refuses a second claimant whatever this says. Deleting a resource leaves the realm, and so does suspending it; resuming puts it back, and the conflict is refused then, before any Job. What is verified is the declaration, never the disjointness: nothing can tell whether two sets of arbitrary SQL touch the same rows. The concurrency section of the architecture reference says why taking turns is not enough.
spec.target.urlFrom	object, required	This resource requires: target.urlFrom must name a required Secret key. URLFrom names the Secret key holding the connection URL. The manager has no permission to read it: the operation Pod resolves it, and the URL never reaches status, an Event or a command line.
spec.target.urlFrom.key	string, required	This resource requires: target.urlFrom must name a required Secret key. The key of the secret to select from. Must be a valid secret key.
spec.target.urlFrom.name	string, default ``	This resource requires: target.urlFrom must name a required Secret key. Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
spec.target.urlFrom.optional	boolean	This resource requires: target.urlFrom must name a required Secret key. Specify whether the Secret or its key must be defined

status

Field	Type	What it does
status.activeOperation	object	ActiveOperation is the claim the controller is currently carrying out, and nil when nothing is in flight.
status.activeOperation.actor	string	Actor is the name this Apply writes to the database’s own migration log: the username admission stamped on the approval ApprovalRef names, or, under apply: Always, a fixed name that says no person approved. The value is personal data when it names a person, and the run writes it to the target database. It is percent-encoded so that every character set stores it and the kubelet expands nothing in it: each byte outside 0x20-0x7E, and % and $, are %XX, and a name over the bound is cut between characters and ends in “…”. The rest of printable ASCII reads unchanged, and the schema refuses any other form. The claim keeps its own copy so the Job it builds stays the same whatever happens to the approval afterwards. A claim written by a release without this field has none, and its Job sets no actor, so a later manager still builds the Job that release dispatched and adopts it.
status.activeOperation.admissionSnapshot	object	AdmissionSnapshot is the Pod envelope resolved before dispatch and bound into the Job and its Pod template. It is what lets Pod admission permit the built-in mutations that are modeled and safe while refusing any other change to what the Pod executes. A migration Pod is judged by the same envelope as a schema Pod, because it is the same kind of Pod.
status.activeOperation.admissionSnapshot.alwaysPullImagesEnabled	boolean, required	AlwaysPullImagesEnabled records whether kube-apiserver runs the AlwaysPullImages admission plugin, which rewrites every imagePullPolicy to Always.
status.activeOperation.admissionSnapshot.defaultNotReadyTolerationSeconds	integer, required	DefaultNotReadyTolerationSeconds is that plugin’s not-ready value.
status.activeOperation.admissionSnapshot.defaultTolerationsEnabled	boolean, required	DefaultTolerationsEnabled records whether kube-apiserver runs the DefaultTolerationSeconds admission plugin. It and the two values below say what that plugin does, so a toleration the Pod did not ask for is recognized rather than refused.
status.activeOperation.admissionSnapshot.defaultUnreachableTolerationSeconds	integer, required	DefaultUnreachableTolerationSeconds is that plugin’s unreachable value.
status.activeOperation.admissionSnapshot.digest	string, required	Digest covers this whole snapshot, so a Pod can be checked against it without re-reading the cluster objects it describes.
status.activeOperation.admissionSnapshot.extendedResourceTolerationEnabled	boolean, required	ExtendedResourceTolerationEnabled records whether kube-apiserver runs the ExtendedResourceToleration admission plugin, which adds a toleration per extended resource a Pod requests.
status.activeOperation.admissionSnapshot.limitRanges	[]object	LimitRanges are the namespace defaults that would be applied to the Pod.
status.activeOperation.admissionSnapshot.limitRanges[].defaultLimits	object	DefaultLimits are the limits it would add.
status.activeOperation.admissionSnapshot.limitRanges[].defaultRequests	object	DefaultRequests are the requests it would add to a container that asks for none.
status.activeOperation.admissionSnapshot.limitRanges[].object	object, required	Object is the LimitRange this was read from.
status.activeOperation.admissionSnapshot.limitRanges[].object.name	string, required	Name of the cluster object this snapshot was read from.
status.activeOperation.admissionSnapshot.limitRanges[].object.resourceVersion	string, required	ResourceVersion is opaque, but bounded here so hostile metadata cannot make the status object grow without limit.
status.activeOperation.admissionSnapshot.limitRanges[].object.uid	string, required	UID it had, so a recreated object is a different one.
status.activeOperation.admissionSnapshot.priorityClass	object, required	PriorityClass is the scheduling priority it resolved to.
status.activeOperation.admissionSnapshot.priorityClass.name	string	Name is that class, as the Pod requests it.
status.activeOperation.admissionSnapshot.priorityClass.object	object	Object is the PriorityClass this was read from, where a class was named.
status.activeOperation.admissionSnapshot.priorityClass.object.name	string, required	Name of the cluster object this snapshot was read from.
status.activeOperation.admissionSnapshot.priorityClass.object.resourceVersion	string, required	ResourceVersion is opaque, but bounded here so hostile metadata cannot make the status object grow without limit.
status.activeOperation.admissionSnapshot.priorityClass.object.uid	string, required	UID it had, so a recreated object is a different one.
status.activeOperation.admissionSnapshot.priorityClass.preemptionPolicy	string, one of Never, PreemptLowerPriority	PreemptionPolicy is what that class says about preempting others.
status.activeOperation.admissionSnapshot.priorityClass.value	integer, required	Value is the priority it resolved to.
status.activeOperation.admissionSnapshot.runtimeClass	object	RuntimeClass is the container runtime it resolved to, where one is named.
status.activeOperation.admissionSnapshot.runtimeClass.handler	string, required	Handler is the runtime handler it names.
status.activeOperation.admissionSnapshot.runtimeClass.nodeSelector	object	NodeSelector is the scheduling the class forces.
status.activeOperation.admissionSnapshot.runtimeClass.object	object, required	Object is the RuntimeClass this was read from, by name and UID.
status.activeOperation.admissionSnapshot.runtimeClass.object.name	string, required	Name of the cluster object this snapshot was read from.
status.activeOperation.admissionSnapshot.runtimeClass.object.resourceVersion	string, required	ResourceVersion is opaque, but bounded here so hostile metadata cannot make the status object grow without limit.
status.activeOperation.admissionSnapshot.runtimeClass.object.uid	string, required	UID it had, so a recreated object is a different one.
status.activeOperation.admissionSnapshot.runtimeClass.overhead	object	Overhead is the per-Pod resource overhead the class adds.
status.activeOperation.admissionSnapshot.runtimeClass.overheadDefined	boolean	OverheadDefined distinguishes an absent RuntimeClass overhead stanza from a present but empty one; Kubernetes admission preserves that distinction. OverheadDefined separates a class with no overhead from one whose overhead is zero.
status.activeOperation.admissionSnapshot.runtimeClass.tolerations	[]object	Tolerations are the tolerations it adds.
status.activeOperation.admissionSnapshot.runtimeClass.tolerations[].effect	string	Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
status.activeOperation.admissionSnapshot.runtimeClass.tolerations[].key	string	Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.
status.activeOperation.admissionSnapshot.runtimeClass.tolerations[].operator	string	Operator represents a key’s relationship to the value. Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
status.activeOperation.admissionSnapshot.runtimeClass.tolerations[].tolerationSeconds	integer	TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.
status.activeOperation.admissionSnapshot.runtimeClass.tolerations[].value	string	Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.
status.activeOperation.admissionSnapshot.serviceAccount	object, required	ServiceAccount is the identity the Pod runs as, as it resolved.
status.activeOperation.admissionSnapshot.serviceAccount.imagePullSecrets	[]object	ImagePullSecrets are the pull Secrets it contributes to the Pod.
status.activeOperation.admissionSnapshot.serviceAccount.imagePullSecrets[].name	string, default ``	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
status.activeOperation.admissionSnapshot.serviceAccount.object	object, required	Object is the ServiceAccount the Pod runs as.
status.activeOperation.admissionSnapshot.serviceAccount.object.name	string, required	Name of the cluster object this snapshot was read from.
status.activeOperation.admissionSnapshot.serviceAccount.object.resourceVersion	string, required	ResourceVersion is opaque, but bounded here so hostile metadata cannot make the status object grow without limit.
status.activeOperation.admissionSnapshot.serviceAccount.object.uid	string, required	UID it had, so a recreated object is a different one.
status.activeOperation.admissionSnapshot.templateDigest	string, required	TemplateDigest binds the canonical, API-defaulted pre-admission Job Pod template. The self-referential snapshot annotation and four exact API-server-generated Job identity labels are omitted and validated separately against the current Job name and UID. TemplateDigest covers the Pod template the operator asked for, before the cluster’s own admission had a chance to change it.
status.activeOperation.admissionSnapshot.version	string, required, one of v1	Version is the snapshot format this record was written in.
status.activeOperation.admissionSnapshotRefreshed	boolean	AdmissionSnapshotRefreshed records that this claim’s admission snapshot was resolved a second time, because the Job template this manager builds differed from the one the snapshot recorded before anything was dispatched. That happens once, when a manager release that shares the execution binding takes over an undispatched claim. It happens at most once per claim: a template that differs again comes from a builder that does not build the same Job twice, and the claim is retired instead.
status.activeOperation.approvalRef	object	ApprovalRef is the approval that authorized this Apply, recorded before dispatch so the run is attributable to the decision that permitted it.
status.activeOperation.approvalRef.name	string, required	Name of the referenced object in the same namespace.
status.activeOperation.approvalRef.uid	string, required	UID the object had when the reference was written. An object deleted and recreated under the same name is a different object, and this says so.
status.activeOperation.approvedAt	string	ApprovedAt is when admission stamped it.
status.activeOperation.approvedBy	object	ApprovedBy is the identity admission stamped on that approval, copied when the claim is written so the record of the run can name it after the approval is gone. A claim written by a release without this field has none.
status.activeOperation.approvedBy.groups	[]string	Groups the authenticated user belonged to at that moment.
status.activeOperation.approvedBy.uid	string	UID of that user, where the authenticator provides one.
status.activeOperation.approvedBy.username	string, required	Username the API server authenticated the request as.
status.activeOperation.attempt	integer, required	Attempt counts this claim among the retries of the same operation.
status.activeOperation.coordinationDigest	string	CoordinationDigest is that realm, hashed.
status.activeOperation.dispatchNotAfter	string	DispatchNotAfter and ExecutionNotAfter bound the claim in time.
status.activeOperation.dispatchStarted	boolean	DispatchStarted records that the one permitted Job create attempt was made. An Apply that crossed this boundary is never recreated, because whether it ran is a question for the database rather than for a retry.
status.activeOperation.executionBindingID	string, required	ExecutionBindingID is the epoch this claim was authorized under. A rollout that changes a bound execution component retires the claim rather than letting its Job finish under new semantics.
status.activeOperation.executionNotAfter	string	ExecutionNotAfter is when the authorized run itself expires.
status.activeOperation.id	string, required	ID is this attempt’s identity, distinct from every other attempt of the same operation.
status.activeOperation.inputFingerprint	string, required	InputFingerprint is what the operation was decided from. An input that changed while the Job ran is what makes its result stale rather than wrong.
status.activeOperation.jobName	string, required	JobName is the deterministic name this claim’s Job takes. It is written before the Job is created.
status.activeOperation.jobUID	string	JobUID is the exact Job the claim is bound to, once one exists. A Job with the right name and another UID is a different Job.
status.activeOperation.leaseContinuityLost	boolean	LeaseContinuityLost records that the epoch changed under this claim.
status.activeOperation.leaseDurationSeconds	integer	LeaseDurationSeconds is how long that acquisition was taken for.
status.activeOperation.leaseEpoch	string	LeaseEpoch is the database lock acquisition this claim was authorized under, and LeaseDurationSeconds how long that acquisition was taken for. A result produced across an epoch change is discarded rather than read: the lock it held was somebody else’s by then.
status.activeOperation.planFingerprint	string	PlanFingerprint is that plan’s spec.fingerprint, copied when the claim is written so the record of the run can name it after the plan is gone. A claim written by a release without this field has none.
status.activeOperation.planRef	object	PlanRef is the immutable plan an Apply carries out.
status.activeOperation.planRef.name	string, required	Name of the referenced object in the same namespace.
status.activeOperation.planRef.uid	string, required	UID the object had when the reference was written. An object deleted and recreated under the same name is a different object, and this says so.
status.activeOperation.retryNotBefore	string	RetryNotBefore is when a retried attempt may be dispatched. A retry carries the delay the resource asked for, and carrying it here rather than in a requeue is what makes it survive a restart and an early Job or watch event: those re-enter reconciliation at once, and a delay that lived only in a requeue would be lost with the queue. Absent on a first attempt, which waits for nothing.
status.activeOperation.source	object	Source is the credential-free artifact binding this operation uses: the resolved digest and the selectors needed to fetch it. Every operation after Resolve carries one, so a newer generation cannot send newly selected credentials to the old artifact’s registry.
status.activeOperation.source.digest	string	Digest is that digest on its own.
status.activeOperation.source.git	object	Git is the commit a Git source resolved to, where to fetch it from, and the content it must give.
status.activeOperation.source.git.authFrom	object	AuthFrom names the credential Secret. It is a selector, never the credential.
status.activeOperation.source.git.authFrom.name	string, required	Name of the Secret, in this resource’s namespace.
status.activeOperation.source.git.commit	string, required	Commit is the full id of the commit.
status.activeOperation.source.git.contentDigest	string, required	ContentDigest is the content digest of the selected files.
status.activeOperation.source.git.path	string, required	Path is what the commit’s tree selects.
status.activeOperation.source.git.ref	object, required	Ref is the branch or tag that named the commit when it resolved, or the commit itself. A fetch reads the commit by the ref while the ref still points at it.
status.activeOperation.source.git.ref.branch	string	Branch is read at its tip, again at every interval.
status.activeOperation.source.git.ref.commit	string	Commit is one commit, by its full 40-character id, which Ptah asks the server for by that id. Unless a branch or tag points at it, Ptah asks only a server that says it gives commits by id; on any other, Resolve refuses the commit once its branch moves past it. A tag holds one commit on every server.
status.activeOperation.source.git.ref.tag	string	Tag is read at the commit it names, again at every interval.
status.activeOperation.source.git.transport	object	Transport pins the server.
status.activeOperation.source.git.transport.caFrom	object	CAFrom selects the only roots an https:// server’s certificate may chain to. With authFrom, its Secret must hold caSHA256 with the selected bytes’ digest.
status.activeOperation.source.git.transport.caFrom.key	string, required	The key to select from the ConfigMap’s Data field. Keys in the BinaryData field are not currently propagated to container env vars.
status.activeOperation.source.git.transport.caFrom.name	string, default ``	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
status.activeOperation.source.git.transport.caFrom.optional	boolean	Specify whether the ConfigMap or its key must be defined
status.activeOperation.source.git.transport.knownHostsFrom	object	KnownHostsFrom selects the host keys an ssh:// server may present; a fetch never trusts a key on first use. With authFrom, its Secret must hold knownHostsSHA256 with the selected bytes’ digest.
status.activeOperation.source.git.transport.knownHostsFrom.key	string, required	The key to select from the ConfigMap’s Data field. Keys in the BinaryData field are not currently propagated to container env vars.
status.activeOperation.source.git.transport.knownHostsFrom.name	string, default ``	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
status.activeOperation.source.git.transport.knownHostsFrom.optional	boolean	Specify whether the ConfigMap or its key must be defined
status.activeOperation.source.git.url	string, required	URL of the repository.
status.activeOperation.source.registryAuthFrom	object	RegistryAuthFrom names the Secret an operation Pod reads the registry credential from. It is a selector, never the credential.
status.activeOperation.source.registryAuthFrom.dockerConfigJSONKey	string, default .dockerconfigjson	DockerConfigJSONKey is the Secret key holding a Docker config document.
status.activeOperation.source.registryAuthFrom.mode	string, one of Environment, DockerConfigJSON, default Environment	Mode says how the credential reaches the executor: as environment variables, or as a Docker config file.
status.activeOperation.source.registryAuthFrom.name	string, required	Name of the Secret the registry credential is read from. The manager never reads it; the operation Pod does.
status.activeOperation.source.registryAuthFrom.passwordKey	string, default password	PasswordKey is the Secret key holding the password.
status.activeOperation.source.registryAuthFrom.tokenKey	string, default token	TokenKey is the Secret key holding a bearer token, where one is used instead of a username and password.
status.activeOperation.source.registryAuthFrom.usernameKey	string, default username	Environment mode supports username/password or an identity token. Keys are optional so a single Secret shape can use either credential form. UsernameKey is the Secret key holding the username.
status.activeOperation.source.resolvedReference	string	ResolvedReference is the artifact with its tag replaced by a digest.
status.activeOperation.source.snapshot	object	Snapshot is the immutable ConfigMap a ConfigMap source’s files were copied into, and the content it must hold.
status.activeOperation.source.snapshot.contentDigest	string, required	ContentDigest is the content digest of the selected files: the SHA-256 of a manifest with one line per file, sorted by path, naming the file’s SHA-256, its size and its path.
status.activeOperation.source.snapshot.name	string, required	Name of the snapshot ConfigMap, in the resource’s namespace.
status.activeOperation.source.snapshot.schemaFile	string	SchemaFile is the path, inside the snapshot, of the one file a schema reads. A migration reads the whole directory and leaves it empty.
status.activeOperation.source.snapshot.uid	string, required	UID the snapshot had when it was bound. A snapshot deleted and written again under the same name is another object.
status.activeOperation.source.transport	object	Transport is how the registry is reached: plain HTTP, a custom CA.
status.activeOperation.source.transport.caFrom	object	CAFrom selects a custom CA bundle. When registryAuthFrom is present, that same Secret must contain caSHA256 with the exact lowercase SHA-256 digest of the selected bytes.
status.activeOperation.source.transport.caFrom.key	string, required	The key to select from the ConfigMap’s Data field. Keys in the BinaryData field are not currently propagated to container env vars.
status.activeOperation.source.transport.caFrom.name	string, default ``	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
status.activeOperation.source.transport.caFrom.optional	boolean	Specify whether the ConfigMap or its key must be defined
status.activeOperation.source.transport.plainHTTP	boolean, default false	PlainHTTP is intended only for explicitly trusted test or air-gapped networks. HTTPS remains the default. When registryAuthFrom is present, its Secret must also contain allowPlainHTTP with the exact value “true”.
status.activeOperation.startedAt	string, required	StartedAt is when the claim was written, which is before the Job exists.
status.activeOperation.target	object	Target is the key-free database binding, and CoordinationDigest the realm the operation serializes against.
status.activeOperation.target.engine	string, required	Engine is the database this binding speaks.
status.activeOperation.target.urlFrom	object, required	URLFrom is the Secret key the operation Pod reads the URL from.
status.activeOperation.target.urlFrom.key	string, required	The key of the secret to select from. Must be a valid secret key.
status.activeOperation.target.urlFrom.name	string, default ``	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
status.activeOperation.target.urlFrom.optional	boolean	Specify whether the Secret or its key must be defined
status.activeOperation.type	string, required, one of Resolve, Verify, History, Apply	Type is the operation this claim authorizes.
status.artifact	object	Artifact is the resolved, credential-free artifact binding every later operation of this cycle uses. A tag resolves once; the digest is what travels.
status.artifact.digest	string	Digest is that digest on its own.
status.artifact.git	object	Git is the commit a Git source resolved to, where to fetch it from, and the content it must give.
status.artifact.git.authFrom	object	AuthFrom names the credential Secret. It is a selector, never the credential.
status.artifact.git.authFrom.name	string, required	Name of the Secret, in this resource’s namespace.
status.artifact.git.commit	string, required	Commit is the full id of the commit.
status.artifact.git.contentDigest	string, required	ContentDigest is the content digest of the selected files.
status.artifact.git.path	string, required	Path is what the commit’s tree selects.
status.artifact.git.ref	object, required	Ref is the branch or tag that named the commit when it resolved, or the commit itself. A fetch reads the commit by the ref while the ref still points at it.
status.artifact.git.ref.branch	string	Branch is read at its tip, again at every interval.
status.artifact.git.ref.commit	string	Commit is one commit, by its full 40-character id, which Ptah asks the server for by that id. Unless a branch or tag points at it, Ptah asks only a server that says it gives commits by id; on any other, Resolve refuses the commit once its branch moves past it. A tag holds one commit on every server.
status.artifact.git.ref.tag	string	Tag is read at the commit it names, again at every interval.
status.artifact.git.transport	object	Transport pins the server.
status.artifact.git.transport.caFrom	object	CAFrom selects the only roots an https:// server’s certificate may chain to. With authFrom, its Secret must hold caSHA256 with the selected bytes’ digest.
status.artifact.git.transport.caFrom.key	string, required	The key to select from the ConfigMap’s Data field. Keys in the BinaryData field are not currently propagated to container env vars.
status.artifact.git.transport.caFrom.name	string, default ``	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
status.artifact.git.transport.caFrom.optional	boolean	Specify whether the ConfigMap or its key must be defined
status.artifact.git.transport.knownHostsFrom	object	KnownHostsFrom selects the host keys an ssh:// server may present; a fetch never trusts a key on first use. With authFrom, its Secret must hold knownHostsSHA256 with the selected bytes’ digest.
status.artifact.git.transport.knownHostsFrom.key	string, required	The key to select from the ConfigMap’s Data field. Keys in the BinaryData field are not currently propagated to container env vars.
status.artifact.git.transport.knownHostsFrom.name	string, default ``	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
status.artifact.git.transport.knownHostsFrom.optional	boolean	Specify whether the ConfigMap or its key must be defined
status.artifact.git.url	string, required	URL of the repository.
status.artifact.registryAuthFrom	object	RegistryAuthFrom names the Secret an operation Pod reads the registry credential from. It is a selector, never the credential.
status.artifact.registryAuthFrom.dockerConfigJSONKey	string, default .dockerconfigjson	DockerConfigJSONKey is the Secret key holding a Docker config document.
status.artifact.registryAuthFrom.mode	string, one of Environment, DockerConfigJSON, default Environment	Mode says how the credential reaches the executor: as environment variables, or as a Docker config file.
status.artifact.registryAuthFrom.name	string, required	Name of the Secret the registry credential is read from. The manager never reads it; the operation Pod does.
status.artifact.registryAuthFrom.passwordKey	string, default password	PasswordKey is the Secret key holding the password.
status.artifact.registryAuthFrom.tokenKey	string, default token	TokenKey is the Secret key holding a bearer token, where one is used instead of a username and password.
status.artifact.registryAuthFrom.usernameKey	string, default username	Environment mode supports username/password or an identity token. Keys are optional so a single Secret shape can use either credential form. UsernameKey is the Secret key holding the username.
status.artifact.resolvedReference	string	ResolvedReference is the artifact with its tag replaced by a digest.
status.artifact.snapshot	object	Snapshot is the immutable ConfigMap a ConfigMap source’s files were copied into, and the content it must hold.
status.artifact.snapshot.contentDigest	string, required	ContentDigest is the content digest of the selected files: the SHA-256 of a manifest with one line per file, sorted by path, naming the file’s SHA-256, its size and its path.
status.artifact.snapshot.name	string, required	Name of the snapshot ConfigMap, in the resource’s namespace.
status.artifact.snapshot.schemaFile	string	SchemaFile is the path, inside the snapshot, of the one file a schema reads. A migration reads the whole directory and leaves it empty.
status.artifact.snapshot.uid	string, required	UID the snapshot had when it was bound. A snapshot deleted and written again under the same name is another object.
status.artifact.transport	object	Transport is how the registry is reached: plain HTTP, a custom CA.
status.artifact.transport.caFrom	object	CAFrom selects a custom CA bundle. When registryAuthFrom is present, that same Secret must contain caSHA256 with the exact lowercase SHA-256 digest of the selected bytes.
status.artifact.transport.caFrom.key	string, required	The key to select from the ConfigMap’s Data field. Keys in the BinaryData field are not currently propagated to container env vars.
status.artifact.transport.caFrom.name	string, default ``	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
status.artifact.transport.caFrom.optional	boolean	Specify whether the ConfigMap or its key must be defined
status.artifact.transport.plainHTTP	boolean, default false	PlainHTTP is intended only for explicitly trusted test or air-gapped networks. HTTPS remains the default. When registryAuthFrom is present, its Secret must also contain allowPlainHTTP with the exact value “true”.
status.conditions	[]object	Conditions are the readable verdicts: whether the artifact resolved and verified, whether the database was reachable, whether a plan is ready, whether an approval is required, and whether the sequence is in sync.
status.conditions[].lastTransitionTime	string, required	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
status.conditions[].message	string, required	message is a human readable message indicating details about the transition. This may be an empty string.
status.conditions[].observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
status.conditions[].reason	string, required	reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
status.conditions[].status	string, required, one of True, False, Unknown	status of the condition, one of True, False, Unknown.
status.conditions[].type	string, required	type of condition in CamelCase or in foo.example.com/CamelCase.
status.configMap	object	ConfigMap is the source ConfigMap status.artifact.snapshot was copied from, for a ConfigMap source: its name, UID and the resourceVersion that was read.
status.configMap.name	string, required	Name of the ConfigMap.
status.configMap.resourceVersion	string, required	ResourceVersion is the version that was read. An edit to a key the source does not select moves it and changes no content.
status.configMap.uid	string, required	UID of the ConfigMap. Another ConfigMap under the same name is another source, and retires a plan computed from this one.
status.executionBinding	object	ExecutionBinding is what this resource’s plans and approvals are bound to: the components that decide what a run means. It is the same contract the schema path publishes, because the question it answers is the same one: a rollout that changed any of them has to invalidate a plan rather than execute it under new semantics. A manager upgrade that changes none of them leaves it, and every plan and approval, as they were.
status.executionBinding.controllerStateVersion	integer, required	ControllerStateVersion versions manager-side reconciliation semantics independently of the data-plane runner protocol.
status.executionBinding.epoch	string, required	Epoch is this binding’s identity. It changes whenever a component below changes, a rollback to identical versions included, so evidence from before such a rollout is historical rather than current.
status.executionBinding.executorImage	string, required	ExecutorImage is the digest-pinned image carrying that build.
status.executionBinding.ptahVersion	string, required	PtahVersion is the Ptah build this epoch executes with.
status.executionBinding.runnerProtocolVersion	integer, required	RunnerProtocolVersion is the runner protocol this epoch binds: what the runner enforces inside the Pod and the result frame it returns.
status.history	object	History is the last reading of the database’s own revision table.
status.history.appliedCount	integer, required	AppliedCount and PendingCount describe the artifact against this history.
status.history.checkpointVersion	integer	CheckpointVersion is the checkpoint covering the versions below it, and zero where none applies. It stays set after the bootstrap has run: the coverage is what keeps those versions applied rather than pending.
status.history.contractVersion	integer, required	ContractVersion is the version of Ptah’s status document this summary was read from. A version the controller does not know is refused before the database is touched rather than read as if it meant the same thing.
status.history.currentVersion	integer, required	CurrentVersion is the highest version the revision table records.
status.history.dirty	boolean	Dirty reports a revision row a failed or interrupted run left behind. Nothing applies while one exists.
status.history.fingerprint	string, required	Fingerprint is this exact reading of the revision table. A plan names it as its premise, and a history that moved between planning and execution invalidates the plan rather than being applied to.
status.history.modifiedVersions	[]integer	ModifiedVersions names applied migrations whose files no longer account for them. It is the refusal a versioned workflow exists to make, so the versions are published rather than summarized.
status.history.observedAt	string, required	ObservedAt is when the history was read.
status.history.outOfOrderVersions	[]integer	OutOfOrderVersions names migrations the artifact carries below a version the database has already applied. Linear execution refuses them, so the versions are published rather than counted: what a person decides here depends on which migration arrived late.
status.history.pendingCount	integer, required	PendingCount is how many the artifact still has to apply, as Ptah selects them rather than as a subtraction of the two counts.
status.history.revisions	[]object	Revisions are the newest rows of the revision table, newest first: which migration each records, the checksum it recorded, when it was written and how long the migration ran. At most MaxMigrationRevisions are kept, so a list that long may leave older rows out. No SQL and no error text is read into them.
status.history.revisions[].appliedAt	string	AppliedAt is when the row was written.
status.history.revisions[].checksum	string	Checksum is what the row recorded when the migration ran. A dirty row records none.
status.history.revisions[].description	string	Description is the migration’s own, from its file name.
status.history.revisions[].executionMillis	integer	ExecutionMillis is how long the migration ran, in whole milliseconds. A revision table too old to record a duration leaves it absent rather than zero.
status.history.revisions[].state	string, required, one of applied, modified, dirty	State is applied, modified when the file no longer accounts for the row, or dirty when a run left it unfinished.
status.history.revisions[].version	integer, required	Version is the migration the row records.
status.history.targetIdentityDigest	string, required	TargetIdentityDigest is the credential-free identity of the database this history was read from, as the executor derived it. A plan that was made against one database is never executed against another.
status.journal	object	Journal is the bounded record of this migration’s significant lifecycle events.
status.journal.coveredSince	string, required	CoveredSince is the instant from which the journal is complete: when a manager that keeps a journal first wrote this resource’s status, moved forward past the newest entry a bound has since dropped. A reader states the period the journal covers from it and assumes nothing before, though the entries of a plan nothing has carried out yet can be older.
status.journal.entries	[]object	Entries are the events, oldest first. There are at most 64, and none is more than 30 days older than the newest, apart from the plan nothing has carried out yet: the entry that published it and the newest approval of it stay until something carries it out or another plan is published.
status.journal.entries[].acknowledgedBy	string	AcknowledgedBy is the user admission stamped on that acknowledgment, cut to the first 512 characters where the name is longer.
status.journal.entries[].acknowledgment	string	Acknowledgment names the acknowledgment that settled an unresolved run.
status.journal.entries[].appliedVersions	integer	AppliedVersions is how many migrations a run recorded applied.
status.journal.entries[].approval	string	Approval names the approval an Apply consumed. A name can be used again by a later decision, so it does not say which object it was: ApprovalUID does.
status.journal.entries[].approvalRequired	boolean	ApprovalRequired reports a published PtahSchema plan that asked for a person’s approval when it was published.
status.journal.entries[].approvalUID	string	ApprovalUID is the UID of that approval. An entry a release before this field wrote has none: it is incomplete evidence, and is not to be joined to an object that holds the name today.
status.journal.entries[].approver	string	Approver is the user admission stamped on that approval, cut to the first 512 characters where the name is longer.
status.journal.entries[].at	string, required	At is when the event happened. For an Apply, a run or a failed attempt it is when that ended.
status.journal.entries[].authorization	string, one of Approval, Policy	Authorization is what allowed a PtahMigration’s run.
status.journal.entries[].count	integer	Count is how many attempts an OperationFailed entry stands for. A single failure has none.
status.journal.entries[].destructive	boolean	Destructive reports a published PtahSchema plan that destroys data.
status.journal.entries[].failure	object	Failure is where a run stopped, as status.lastRun.failure said.
status.journal.entries[].failure.errorNumber	integer	ErrorNumber is MySQL’s own error number, zero on every other protocol.
status.journal.entries[].failure.sqlState	string	SQLState is the SQLSTATE the database answered with, empty when it gave none.
status.journal.entries[].failure.statement	integer, required	Statement is the position of the failed statement in that migration, counting from one.
status.journal.entries[].failure.statements	integer, required	Statements is how many statements that migration has.
status.journal.entries[].failure.version	integer, required	Version is the migration the run stopped in.
status.journal.entries[].jobName	string	JobName is the Job a PtahMigration’s run ran as. It is absent when no Job was confirmed.
status.journal.entries[].jobUID	string	JobUID is that Job’s UID, which outlives the Job and tells it from a later Job that takes the name.
status.journal.entries[].lastAt	string	LastAt is the latest attempt an OperationFailed entry folds. A single failure has none.
status.journal.entries[].operation	string, one of Resolve, Verify, Observe, Plan, History, Apply	Operation is the operation that failed, when one was claimed.
status.journal.entries[].operationID	string	OperationID is the Apply claim a PtahMigration’s RunFinished, Verified or RunAcknowledged entry concerns. It is what joins them: entries of one execution carry the same one, and neither their order nor their times are the join. ApprovalUID is what joins an ApprovalAccepted entry to the run that consumed it, since a claim withdrawn before dispatch leaves the approval to the next one. An entry a release before this field wrote has none.
status.journal.entries[].outcome	string, one of Succeeded, Failed, Partial, Unknown, UpToDate, InSync, DriftRemains, Superseded, Pending, Blocked	Outcome is how an Apply, a proof or a run ended. On a PtahMigration’s Verified entry it is what the reading after the run found, and on a RunAcknowledged entry how the run that person settled ended.
status.journal.entries[].plan	string	Plan names the plan the event concerns.
status.journal.entries[].planFingerprint	string	PlanFingerprint is the spec.fingerprint of the plan a PtahMigration’s run carried out, when the claim recorded it.
status.journal.entries[].planUID	string	PlanUID is the UID of a PtahMigration’s plan.
status.journal.entries[].reason	string	Reason is the condition reason the failure set. It is a code, never the message: a message can carry what status must not.
status.journal.entries[].replaced	string	Replaced names the plan a published PtahSchema plan took the place of: one a person could approve, or had approved, and that never ran. A PlanStale Warning reports the same replacement, and an Event can be lost.
status.journal.entries[].startedAt	string	StartedAt is when an Apply or a run began.
status.journal.entries[].statements	integer	Statements is how many statements a published PtahSchema plan holds.
status.journal.entries[].type	string, required, one of PlanPublished, ApprovalAccepted, ApplyFinished, Verified, RunFinished, RunAcknowledged, OperationFailed	Type is the kind of event.
status.lastReadRequest	string	LastReadRequest is the last value of the operator.ptah.run/read-requested-at annotation the controller answered, so an answered request is not answered again. A value longer than MaxReadRequestLength is recorded as its SHA-256 digest, and a value that is not an RFC 3339 instant is recorded with a Warning Event and starts nothing.
status.lastRun	object	LastRun is the evidence of the most recent execution, kept across later reconciliations so an operator can see what happened without the Job.
status.lastRun.appliedVersions	[]integer	AppliedVersions names the selected migrations the history recorded afterwards, so a migration the history already held is not reported as this run’s work.
status.lastRun.artifactDigest	string	ArtifactDigest is the OCI artifact the run read its files from.
status.lastRun.authorization	object	Authorization is what allowed the run: a person’s approval, or the resource’s own policy.
status.lastRun.authorization.approvalRef	object	ApprovalRef is the approval the run consumed.
status.lastRun.authorization.approvalRef.name	string, required	Name of the referenced object in the same namespace.
status.lastRun.authorization.approvalRef.uid	string, required	UID the object had when the reference was written. An object deleted and recreated under the same name is a different object, and this says so.
status.lastRun.authorization.approvedAt	string	ApprovedAt is when admission stamped it.
status.lastRun.authorization.approver	object	Approver is the identity admission stamped on it.
status.lastRun.authorization.approver.groups	[]string	Groups the authenticated user belonged to at that moment.
status.lastRun.authorization.approver.uid	string	UID of that user, where the authenticator provides one.
status.lastRun.authorization.approver.username	string, required	Username the API server authenticated the request as.
status.lastRun.authorization.kind	string, required, one of Approval, Policy	Kind is Approval or Policy.
status.lastRun.dispatchedBy	object	DispatchedBy is the manager that built and dispatched the run’s Job, read from the Job’s Pod template when the run was harvested. The plan the run carried out names the manager that published it, which a later release sharing the execution binding need not be. It is absent when the run was settled without its Job.
status.lastRun.dispatchedBy.controllerImage	string, required	ControllerImage is the digest-pinned manager image.
status.lastRun.dispatchedBy.controllerRevision	string, required	ControllerRevision is the source revision the manager was built from.
status.lastRun.dispatchedBy.runnerImage	string, required	RunnerImage is the digest-pinned runner image the manager installed in the task Pod.
status.lastRun.executionBindingID	string	ExecutionBindingID is the execution epoch the claim was authorized under.
status.lastRun.failure	object	Failure is where a failed or partial run stopped, when a statement reached the database and failed there. It is what Message says in words, for a reader that should not depend on their wording.
status.lastRun.failure.errorNumber	integer	ErrorNumber is MySQL’s own error number, zero on every other protocol.
status.lastRun.failure.sqlState	string	SQLState is the SQLSTATE the database answered with, empty when it gave none.
status.lastRun.failure.statement	integer, required	Statement is the position of the failed statement in that migration, counting from one.
status.lastRun.failure.statements	integer, required	Statements is how many statements that migration has.
status.lastRun.failure.version	integer, required	Version is the migration the run stopped in.
status.lastRun.finishedAt	string	FinishedAt is when its result was read. An unfinished run has none.
status.lastRun.jobName	string	JobName and JobUID identify the execution this evidence came from. The UID is what makes a replacement Job with the same name a different run.
status.lastRun.jobUID	string	JobUID is that Job’s UID.
status.lastRun.message	string	Message is a safe explanation. It never carries database rows, and never carries the SQL a migration ran.
status.lastRun.operationID	string	OperationID is the Apply claim that ran. It is what makes two executions of a byte-identical plan two runs. A run a release without this field recorded has none, and neither that nor anything else below is guessed for it.
status.lastRun.outcome	string, required, one of UpToDate, Applied, Failed, Partial, Unknown	Outcome is the verdict Ptah read from the revision table.
status.lastRun.planFingerprint	string	PlanFingerprint is that plan’s spec.fingerprint when the claim was written, which binds the sequence, the history it was computed against, the source, the policy, the target and the execution binding. It is absent for a claim a release without the field wrote.
status.lastRun.planRef	object	PlanRef is the immutable plan the run carried out. The plan store reuses a byte-identical plan, so it says what was planned and not which execution this was: OperationID does. It pins the plan, as the pruning guide lists: it outlives a plan somebody deleted, or a prune with a list of pins from before this field, and then names bytes nothing holds, which a retention audit reports as a missing plan.
status.lastRun.planRef.name	string, required	Name of the referenced object in the same namespace.
status.lastRun.planRef.uid	string, required	UID the object had when the reference was written. An object deleted and recreated under the same name is a different object, and this says so.
status.lastRun.source	object	Source is the source the run read its files from, for a ConfigMap or a Git commit.
status.lastRun.source.contentDigest	string, required	ContentDigest is the content digest of the files the plan was computed from.
status.lastRun.source.kind	string, required, one of ConfigMap, Git	Kind of source the plan was computed from.
status.lastRun.source.policy	object	Policy is the source policy the source was checked against, when the resource names one.
status.lastRun.source.policy.digest	string, required	Digest is “sha256:” and the SHA-256 of the policy document.
status.lastRun.source.policy.uid	string, required	UID of the policy ConfigMap. Another ConfigMap under the same name is another policy.
status.lastRun.source.revision	string, required	Revision is the source object the files were read from. For a ConfigMap it is the ConfigMap’s UID: an edit to a key the source does not select keeps the plan, while another ConfigMap, or the same name deleted and created again, retires it even when the files match. For Git it is “sha256:” and the SHA-256 of the repository URL and the selected path, joined by a newline: another repository or another path retires the plan even when the files match, while a commit that leaves the selected files as they were keeps it, as an edit to an unselected key keeps a ConfigMap’s.
status.lastRun.startedAt	string, required	StartedAt is when the run began.
status.lastRun.targetIdentityDigest	string	TargetIdentityDigest is the credential-free identity of the database the run’s result named. That is the database it opened, unless it refused before its child started because its Secret had moved: then it is the one the Secret held, which the run did not touch. A run that left no result names none, since it may have run nowhere, or against whatever its Secret held by then.
status.lastRun.verification	object	Verification is the first reading of this run’s database after the run ended. What a run claims and what the revision table holds are two statements, and this records the second. It is absent until that reading, for a run that named no database, since no reading can then be said to be of it, and for a run a release without this field recorded.
status.lastRun.verification.currentVersion	integer, required	CurrentVersion is the highest version that reading recorded.
status.lastRun.verification.historyFingerprint	string, required	HistoryFingerprint is that reading of the revision table.
status.lastRun.verification.observedAt	string, required	ObservedAt is when the history was read.
status.lastRun.verification.result	string, required, one of InSync, Pending, Blocked	Result is what the reading found.
status.nextReconciliationTime	string	NextReconciliationTime is when the controller intends to look again.
status.observedGeneration	integer	ObservedGeneration is the spec generation this status describes.
status.pendingLockRelease	object	PendingLockRelease is a database-realm Lease this resource still owes back, kept whole so the release survives the process that owed it. The release is written here in the same status patch that clears the claim holding the Lease, and removed only once a release has succeeded, so a manager that stops in between hands the realm back on its next pass instead of leaving every other claimant to wait out the full lease. It is never written for a run that may still be executing. A Lease under a live executor is the one thing the Lease exists to prevent, and such a Lease is left to expire rather than recorded as owed.
status.pendingLockRelease.coordinationDigest	string, required	CoordinationDigest is the realm whose lock is still to be released.
status.pendingLockRelease.leaseDurationSeconds	integer, required	LeaseDurationSeconds is how long it was taken for.
status.pendingLockRelease.leaseEpoch	string, required	LeaseEpoch identifies that acquisition, so a release cannot free a lock somebody else acquired in the meantime.
status.pendingLockRelease.operationID	string, required	OperationID is the operation that took it.
status.phase	string, one of Pending, Resolving, Verifying, Reading, Planning, AwaitingApproval, Blocked, Applying, VerifyingHistory, InSync, Suspended, Failed	Phase is where the resource stands. It is a summary for a reader: the conditions below are what a decision reads.
status.plan	object	Plan names the immutable plan object the controller published for the current pending sequence, and is cleared once that sequence is gone.
status.plan.name	string, required	Name of the referenced object in the same namespace.
status.plan.uid	string, required	UID the object had when the reference was written. An object deleted and recreated under the same name is a different object, and this says so.
status.resolvedRun	object	ResolvedRun is how the most recent unresolved run was settled, and who settled it when a person did. It stays until the next one is settled.
status.resolvedRun.acknowledgedBy	object	AcknowledgedBy is the identity admission stamped on that acknowledgment.
status.resolvedRun.acknowledgedBy.groups	[]string	Groups the authenticated user belonged to at that moment.
status.resolvedRun.acknowledgedBy.uid	string	UID of that user, where the authenticator provides one.
status.resolvedRun.acknowledgedBy.username	string, required	Username the API server authenticated the request as.
status.resolvedRun.acknowledgmentRef	object	AcknowledgmentRef is the PtahMigrationRunAcknowledgment that settled it, when a person did.
status.resolvedRun.acknowledgmentRef.name	string, required	Name of the referenced object in the same namespace.
status.resolvedRun.acknowledgmentRef.uid	string, required	UID the object had when the reference was written. An object deleted and recreated under the same name is a different object, and this says so.
status.resolvedRun.operationID	string, required	OperationID is the Apply attempt the settled record named.
status.resolvedRun.outcome	string, required, one of UpToDate, Applied, Failed, Partial, Unknown	Outcome is what that record said.
status.resolvedRun.resolution	string, required, one of HistoryRead, Acknowledged	Resolution is what settled it.
status.resolvedRun.resolvedAt	string, required	ResolvedAt is when the controller settled it.
status.sourcePolicy	object	SourcePolicy is the source policy the last resolution was checked against, when the spec names one.
status.sourcePolicy.digest	string, required	Digest is “sha256:” and the SHA-256 of the policy document.
status.sourcePolicy.uid	string, required	UID of the policy ConfigMap. Another ConfigMap under the same name is another policy.
status.unresolvedRun	object	UnresolvedRun is the execution nobody could account for, and is absent while there is none. It is written when a run ends Partial or Unknown, and removed only when a read-only reading of the same database finds nothing of this artifact left to apply, or when a PtahMigrationRunAcknowledgment names its operationID. While it is here nothing is planned and nothing runs, whatever the conditions happen to say. The manager keeps a copy in the operator.ptah.run/unresolved-run annotation, written before this field and removed after it, so a restore that drops status restores the record from metadata.
status.unresolvedRun.dispatchedBy	object	DispatchedBy is the manager that built and dispatched the run’s Job, as status.lastRun recorded it. It is absent when the run was settled without its Job.
status.unresolvedRun.dispatchedBy.controllerImage	string, required	ControllerImage is the digest-pinned manager image.
status.unresolvedRun.dispatchedBy.controllerRevision	string, required	ControllerRevision is the source revision the manager was built from.
status.unresolvedRun.dispatchedBy.runnerImage	string, required	RunnerImage is the digest-pinned runner image the manager installed in the task Pod.
status.unresolvedRun.jobName	string	JobName and JobUID identify the execution. The UID is what makes a replacement Job with the same name a different run.
status.unresolvedRun.jobUID	string	JobUID is that Job’s UID.
status.unresolvedRun.operationID	string, required	OperationID is the Apply claim that ran, so this record names one attempt rather than the resource in general.
status.unresolvedRun.outcome	string, required, one of UpToDate, Applied, Failed, Partial, Unknown	Outcome is what the run’s own evidence said, and is always Partial or Unknown: Partial committed some of a migration’s statements and not the rest, and Unknown could not be read at all. No other outcome leaves the database in a state nobody can name, so no other outcome is recorded here.
status.unresolvedRun.planRef	object, required	PlanRef names the plan the run was carrying out, which is the work that may have reached the database.
status.unresolvedRun.planRef.name	string, required	Name of the referenced object in the same namespace.
status.unresolvedRun.planRef.uid	string, required	UID the object had when the reference was written. An object deleted and recreated under the same name is a different object, and this says so.
status.unresolvedRun.recordedAt	string, required	RecordedAt is when the controller wrote this record.
status.unresolvedRun.targetIdentityDigest	string	TargetIdentityDigest is the credential-free identity of the database this run’s result named. Where no result frame was read at all – which is most of the ways a run becomes unresolved – it is the database its plan was computed against instead, because that is then the only thing known about where it went. The reading that settles this record has to be of that database: a history read somewhere else says nothing about what this run did.