API Reference¶

Packages¶

fleetmanagement.grafana.com/v1alpha1

fleetmanagement.grafana.com/v1alpha1¶

Package v1alpha1 contains API Schema definitions for the fleetmanagement v1alpha1 API group.

Resource Types¶

Collector
CollectorDiscovery
ExternalAttributeSync
Pipeline
PipelineDiscovery
RemoteAttributePolicy
TenantPolicy

AttributeMapping¶

AttributeMapping describes how to project a source record into a (collectorID, attributes) tuple.

Appears in: - ExternalAttributeSyncSpec

Field	Description	Validation
`collectorIDField` string	CollectorIDField is the source field whose value identifies the target collector.	MinLength: 1
`attributeFields` object (keys:string, values:string)	AttributeFields maps an output attribute key to the source field whose value becomes its value. Keys with the reserved "collector." prefix are rejected by the API server (CEL) and the validating webhook.	MaxProperties: 100 MinProperties: 1
`requiredKeys` string array	RequiredKeys is the set of source fields that must be present for a record to be applied. A record missing any required key is skipped (counted in RecordsSeen but not RecordsApplied).	items:MinLength: 1 Optional: {}

AttributeOwnerKind¶

Underlying type: string

AttributeOwnerKind identifies which CR owns a remote-attribute key on a collector. Phase 1 only writes Collector; later phases add the others without breaking the schema.

Validation: - Enum: [Collector RemoteAttributePolicy ExternalAttributeSync]

Appears in: - AttributeOwnership

Field	Description
`Collector`
`RemoteAttributePolicy`
`ExternalAttributeSync`

AttributeOwnership¶

AttributeOwnership records the owner and current value of one remote attribute key.

Appears in: - CollectorStatus

Field	Description	Validation
`key` string	Key is the remote-attribute key.
`ownerKind` AttributeOwnerKind	OwnerKind identifies which kind of CR owns this key.	Enum: [Collector RemoteAttributePolicy ExternalAttributeSync]
`ownerName` string	OwnerName is the namespaced name of the owning CR (in the form "namespace/name").
`value` string	Value is the value last written for this key.

Collector¶

Collector is the Schema for the collectors API.

Field	Description	Validation
`apiVersion` string	`fleetmanagement.grafana.com/v1alpha1`
`kind` string	`Collector`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` CollectorSpec	spec defines the desired state of the Collector.	Required: {}
`status` CollectorStatus	status defines the observed state of the Collector.	Optional: {}

CollectorDiscovery¶

CollectorDiscovery configures a periodic mirror of Fleet Management collectors into the cluster as Collector CRs. The Collector reconciler then manages remote attributes on each mirrored CR; this resource only owns the CR's existence (creation when a collector appears in Fleet, deletion or stale-marking when it disappears).

Field	Description	Validation
`apiVersion` string	`fleetmanagement.grafana.com/v1alpha1`
`kind` string	`CollectorDiscovery`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` CollectorDiscoverySpec	spec defines the desired state.	Required: {}
`status` CollectorDiscoveryStatus	status defines the observed state.	Optional: {}

CollectorDiscoverySpec¶

CollectorDiscoverySpec configures a periodic poll-and-mirror cycle against Fleet Management's ListCollectors. Each Fleet collector that matches the selector becomes a Collector CR in the target namespace.

Appears in: - CollectorDiscovery

Field	Description	Default	Validation
`pollInterval` string	PollInterval is how often the controller calls Fleet's ListCollectors. Webhook-enforced minimum is 1 minute to protect the shared 3 req/s rate limiter.	5m	Optional: {}
`selector` PolicySelector	Selector is the server-side filter passed to ListCollectors. Reuses the PolicySelector shape: matchers AND'd, OR'd with explicit collectorIDs. An empty selector means "match every collector" (server-wide ListCollectors call) — accepted but expensive on large fleets.		Optional: {}
`targetNamespace` string	TargetNamespace is the namespace where mirrored Collector CRs are created. Defaults to this CollectorDiscovery's own namespace. WARNING: pointing this at a different namespace is a privileged, cross-namespace action. The operator creates the mirrored Collector CRs there using its cluster-wide ServiceAccount, so whoever can create a CollectorDiscovery can make the operator write CRs into any namespace (a confused-deputy vector). Restrict CollectorDiscovery creation to platform/admin subjects, and enable --enforce-cross-namespace-discovery-authz to require the requesting user to hold create permission on collectors in the target namespace. See docs/security.md (Cross-namespace authority).		Optional: {}
`includeInactive` boolean	IncludeInactive mirrors Fleet records with markedInactiveAt set. Default false skips them — the typical case is "show me only collectors that are currently expected to ping in".	false	Optional: {}
`policy` DiscoveryPolicy	Policy controls how the controller reacts to Fleet-side changes.		Optional: {}

CollectorDiscoveryStatus¶

CollectorDiscoveryStatus reports the most recent poll outcome.

Appears in: - CollectorDiscovery

Field	Description	Validation
`observedGeneration` integer	ObservedGeneration reflects the most recently observed spec.	Optional: {}
`lastSyncTime` Time	LastSyncTime is the timestamp of the most recent ListCollectors call (success or failure).	Optional: {}
`lastSuccessTime` Time	LastSuccessTime is the timestamp of the most recent ListCollectors call that produced a status update without error.	Optional: {}
`collectorsObserved` integer	CollectorsObserved is the count of collectors returned by the last ListCollectors call (after include-inactive filtering).	Optional: {}
`collectorsManaged` integer	CollectorsManaged is the count of Collector CRs in the target namespace currently labeled as managed by this discovery.	Optional: {}
`staleCollectors` string array	StaleCollectors lists collector IDs whose CR still exists but no longer appears in ListCollectors. Only populated when policy.onCollectorRemoved=Keep.	Optional: {}
`conflicts` DiscoveryConflict array	Conflicts records the most recent cases (up to 100) where the controller could not create or claim a CR due to a name/ownership conflict. When the cap is hit, a TruncatedConflicts condition is set; check events for the full conflict list.	MaxItems: 100 Optional: {}
`conditions` Condition array	Conditions represent the current state of the CollectorDiscovery. See docs/conditions.md for the cross-CRD condition registry.	Optional: {}

CollectorSpec¶

CollectorSpec defines the desired state of a Fleet Management collector.

Note: collectors register themselves with Fleet Management via RegisterCollector — this CR does not create them. spec.id binds the CR to an already-registered collector; if that collector has not yet registered, reconcile will keep retrying and surface the situation in status.

Appears in: - Collector

Field	Description	Validation
`id` string	ID is the Fleet Management collector ID. Required and immutable after creation. Immutability is declared via a CEL rule so the API server enforces it independently of the validating webhook (defence-in-depth and discoverable to schema consumers).	MinLength: 1
`name` string	Name is the optional display name set on the collector in Fleet Management. If empty, the existing server-side name is preserved.	Optional: {}
`enabled` boolean	Enabled toggles the collector in Fleet Management. nil leaves the existing server-side value untouched (so that the operator does not fight a value set elsewhere unless the user explicitly wants to).	Optional: {}
`remoteAttributes` object (keys:string, values:string)	RemoteAttributes managed by this CR. Keys with prefix "collector." are reserved by Fleet Management and rejected by the API server (CEL) and the validating webhook. Each value is capped at 1024 characters by the admission webhook — values are user-facing strings, not configuration blobs, so the cap protects etcd. Removing a key from this map removes it from Fleet (delete-detected via status.attributeOwners).	MaxProperties: 100 Optional: {}

CollectorStatus¶

CollectorStatus reflects observed state from Fleet Management plus the operator's bookkeeping for delete-detection.

Appears in: - Collector

Field	Description	Validation
`observedGeneration` integer	ObservedGeneration reflects the generation of the most recently observed Collector spec.	Optional: {}
`registered` boolean	Registered is true if the collector has been observed in Fleet Management (i.e. it has called RegisterCollector at least once).	Optional: {}
`lastPing` Time	LastPing is the most recent ping timestamp as reported by Fleet Management. May lag relative to actual collector activity.	Optional: {}
`name` string	Name is the display name observed from Fleet Management.	Optional: {}
`enabled` boolean	Enabled is the remote configuration enabled state observed from Fleet Management. nil means Fleet did not return the field.	Optional: {}
`collectorType` CollectorType	CollectorType is the type the collector reported on registration.	Enum: [Alloy OpenTelemetryCollector Unspecified] Optional: {}
`createdAt` Time	CreatedAt is the timestamp when the collector was created in Fleet Management.	Optional: {}
`updatedAt` Time	UpdatedAt is the timestamp when the collector was last updated in Fleet Management.	Optional: {}
`markedInactiveAt` Time	MarkedInactiveAt is the timestamp when Fleet Management marked the collector inactive.	Optional: {}
`localAttributes` object (keys:string, values:string)	LocalAttributes are the attributes the collector reports about itself (e.g. collector.os=linux). Read-only — set by the collector, not the operator.	Optional: {}
`effectiveRemoteAttributes` object (keys:string, values:string)	EffectiveRemoteAttributes is the merged set of remote attributes last successfully written to Fleet Management for this collector. In Phase 1 this is exactly spec.remoteAttributes; later phases add policy and external-sync layers.	Optional: {}
`attributeOwners` AttributeOwnership array	AttributeOwners records which CR owns each remote-attribute key. Used by the controller to detect and remove keys when their owner stops claiming them.	Optional: {}
`conditions` Condition array	Conditions represent the current state of the Collector resource. Standard condition types: - "Ready": Collector successfully reconciled (attributes synced, status mirrored). - "Synced": Last reconciliation succeeded.	Optional: {}

CollectorType¶

Underlying type: string

CollectorType mirrors the Fleet Management collector type enum and is set by the controller from observed state — it is read-only on the spec.

Validation: - Enum: [Alloy OpenTelemetryCollector Unspecified]

Appears in: - CollectorStatus

Field	Description
`Alloy`
`OpenTelemetryCollector`
`Unspecified`

ConfigType¶

Underlying type: string

ConfigType represents the type of collector configuration

Validation: - Enum: [Alloy OpenTelemetryCollector]

Appears in: - PipelineDiscoverySelector - PipelineSpec

Field	Description
`Alloy`	ConfigTypeAlloy represents Grafana Alloy configuration syntax
`OpenTelemetryCollector`	ConfigTypeOpenTelemetryCollector represents OpenTelemetry Collector configuration syntax

DiscoveryConflict¶

DiscoveryConflict records a single conflict between the desired CR and an existing one with the same name.

Appears in: - CollectorDiscoveryStatus

Field	Description	Validation
`collectorID` string	CollectorID is the Fleet collector ID whose mirror CR could not be created. Used as the list-map key.
`crName` string	CRName is the metadata.name the controller computed for the CR.
`reason` DiscoveryConflictReason	Reason classifies the conflict.	Enum: [NotOwnedByDiscovery OwnedByOtherDiscovery NameSanitizationFailed]

DiscoveryConflictReason¶

Underlying type: string

DiscoveryConflictReason enumerates the reasons a discovered CR could not be created or claimed.

Validation: - Enum: [NotOwnedByDiscovery OwnedByOtherDiscovery NameSanitizationFailed]

Appears in: - DiscoveryConflict

Field	Description
`NotOwnedByDiscovery`	DiscoveryConflictNotOwned indicates a Collector CR with the desired name exists but is not labeled as managed by any discovery — likely a manually-created CR. Skipped.
`OwnedByOtherDiscovery`	DiscoveryConflictOwnedByOther indicates a Collector CR with the desired name exists and is labeled as managed by a different CollectorDiscovery. First-write wins; the second discovery skips.
`NameSanitizationFailed`	DiscoveryConflictSanitizeFailed indicates the collector ID could not be sanitized to a valid DNS-1123 name even with the hash suffix (e.g., empty ID after sanitization).

DiscoveryOnConflictAction¶

Underlying type: string

DiscoveryOnConflictAction selects what the controller does when a Collector CR with the desired name already exists and is not labeled as managed by this discovery. v1 only ships Skip; TakeOwnership is reserved for v2 once a clear opt-in path is designed.

Validation: - Enum: [Skip]

Appears in: - DiscoveryPolicy

Field	Description
`Skip`

DiscoveryOnRemovedAction¶

Underlying type: string

DiscoveryOnRemovedAction selects what the CollectorDiscovery controller does when a previously-discovered collector no longer appears in ListCollectors. Keep (default) leaves the CR in place with a stale annotation; Delete removes it (the existing Collector finalizer then issues REMOVE ops to Fleet, which 404s for a vanished collector — net no-op).

Validation: - Enum: [Keep Delete]

Appears in: - DiscoveryPolicy

Field	Description
`Keep`
`Delete`

DiscoveryPolicy¶

DiscoveryPolicy bundles lifecycle decisions the controller respects.

Appears in: - CollectorDiscoverySpec

Field	Description	Default	Validation
`onCollectorRemoved` DiscoveryOnRemovedAction	OnCollectorRemoved chooses the controller's response when a previously-discovered collector no longer appears in ListCollectors.	Keep	Enum: [Keep Delete] Optional: {}
`onConflict` DiscoveryOnConflictAction	OnConflict chooses the controller's response when a Collector CR with the desired name already exists and is not labeled as managed by this discovery. v1 only ships Skip.	Skip	Enum: [Skip] Optional: {}

ExternalAttributeSync¶

ExternalAttributeSync pulls attributes from an external system on a schedule and reflects them onto matched collectors as remote attributes.

Field	Description	Validation
`apiVersion` string	`fleetmanagement.grafana.com/v1alpha1`
`kind` string	`ExternalAttributeSync`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` ExternalAttributeSyncSpec	spec defines the desired state.	Required: {}
`status` ExternalAttributeSyncStatus	status defines the observed state.	Optional: {}

ExternalAttributeSyncSpec¶

ExternalAttributeSyncSpec defines a scheduled external-source pull whose output becomes remote attributes on selected collectors.

Appears in: - ExternalAttributeSync

Field	Description	Default	Validation
`source` ExternalSource	Source identifies the kind and configuration of the external system.
`schedule` string	Schedule is either a Go duration ("5m", "30s") or a cron expression ("/15 * * *"). Required.		MinLength: 1
`selector` PolicySelector	Selector picks the collectors this sync targets. Reuses the PolicySelector shape: matchers AND'd, OR'd with explicit collectorIDs.
`mapping` AttributeMapping	Mapping projects source records into collector attributes.
`allowEmptyResults` boolean	AllowEmptyResults gates the empty-result safety guard. When false (default), a Fetch that returns zero records after a previous run returned at least one is treated as a probable misconfiguration — the previous owned-keys claim is preserved and a Stalled condition is set.	false	Optional: {}

ExternalAttributeSyncStatus¶

ExternalAttributeSyncStatus reflects the controller's view of the most recent fetch.

Appears in: - ExternalAttributeSync

Field	Description	Validation
`observedGeneration` integer	ObservedGeneration reflects the most recently observed spec.	Optional: {}
`lastSyncTime` Time	LastSyncTime is the timestamp of the most recent Fetch attempt.	Optional: {}
`lastSuccessTime` Time	LastSuccessTime is the timestamp of the most recent Fetch that produced a status update. May trail LastSyncTime if the most recent fetch was suppressed by the empty-result guard or failed.	Optional: {}
`recordsSeen` integer	RecordsSeen is the count of records returned by the last fetch.	Optional: {}
`recordsApplied` integer	RecordsApplied is the count of records that produced an attribute update (i.e., passed RequiredKeys and selector).	Optional: {}
`ownedKeys` OwnedKeyEntry array	OwnedKeys is the canonical claim list as of the last successful fetch, capped at 1000 entries. The Collector controller reads this when computing merged desired state. When the cap is hit, a Truncated condition is set — attributes for collectors beyond the cap may not be removed on CR deletion; shard sources with >1000 collectors.	MaxItems: 1000 Optional: {}
`conditions` Condition array	Conditions represent the current state of the ExternalAttributeSync. See docs/conditions.md for the cross-CRD condition registry.	Optional: {}

ExternalSource¶

ExternalSource is the union-typed source configuration referenced by an ExternalAttributeSync. Exactly one of HTTP / SQL must be populated and must match Kind.

Appears in: - ExternalAttributeSyncSpec

Field	Description	Default	Validation
`kind` ExternalSourceKind			Enum: [HTTP SQL]
`http` HTTPSourceSpec
`sql` SQLSourceSpec
`secretRef` SecretReference

ExternalSourceKind¶

Underlying type: string

ExternalSourceKind enumerates the supported external attribute source kinds. Phase 3 ships HTTP; SQL arrives in Phase 4.

Validation: - Enum: [HTTP SQL]

Appears in: - ExternalSource

Field	Description
`HTTP`
`SQL`

HTTPSourceSpec¶

HTTPSourceSpec configures an HTTP/JSON external source.

Appears in: - ExternalSource

Field	Description	Default	Validation
`url` string	URL is the fully-qualified endpoint to fetch records from.		MinLength: 1
`method` string	Method is the HTTP verb to use. Defaults to GET.	GET	Enum: [GET POST] Optional: {}
`recordsPath` string	RecordsPath is a dotted path into the response JSON identifying the array of records. Empty means the response root is the array itself. Examples: "data", "result.items".		Optional: {}

OwnedKeyEntry¶

OwnedKeyEntry records the keys and values this ExternalAttributeSync claims for a specific collector. The Collector controller reads these directly when computing the merged desired state — values flow from this status field (set on each successful Fetch) into Fleet without re-running the source.

Appears in: - ExternalAttributeSyncStatus

Field	Description	Default	Validation
`collectorID` string
`attributes` object (keys:string, values:string)	Attributes maps the attribute key to the value this sync wants on the named collector. Removing a key from this map drops that claim — the Collector controller's diff produces a REMOVE op on the next reconcile.		Optional: {}

Pipeline¶

Pipeline is the Schema for the pipelines API

Field	Description	Validation
`apiVersion` string	`fleetmanagement.grafana.com/v1alpha1`
`kind` string	`Pipeline`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` PipelineSpec	spec defines the desired state of Pipeline	Required: {}
`status` PipelineStatus	status defines the observed state of Pipeline	Optional: {}

PipelineDiscovery¶

PipelineDiscovery configures a periodic import of Fleet Management pipelines into the cluster as Pipeline CRs.

Field	Description	Validation
`apiVersion` string	`fleetmanagement.grafana.com/v1alpha1`
`kind` string	`PipelineDiscovery`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` PipelineDiscoverySpec	spec defines the desired state.	Required: {}
`status` PipelineDiscoveryStatus	status defines the observed state.	Optional: {}

PipelineDiscoveryConflict¶

PipelineDiscoveryConflict records a single conflict between the desired CR and an existing one with the same name.

Appears in: - PipelineDiscoveryStatus

Field	Description	Validation
`pipelineID` string	PipelineID is the Fleet pipeline ID that could not be mirrored. List-map key.
`crName` string	CRName is the metadata.name the controller computed.
`reason` PipelineDiscoveryConflictReason	Reason classifies the conflict.	Enum: [NotOwnedByDiscovery OwnedByOtherDiscovery NameSanitizationFailed]

PipelineDiscoveryConflictReason¶

Underlying type: string

PipelineDiscoveryConflictReason classifies why a Pipeline CR could not be created or claimed.

Validation: - Enum: [NotOwnedByDiscovery OwnedByOtherDiscovery NameSanitizationFailed]

Appears in: - PipelineDiscoveryConflict

Field	Description
`NotOwnedByDiscovery`	PipelineDiscoveryConflictNotOwned indicates a Pipeline CR with the desired name exists but is not labeled as managed by any discovery — likely a manually-created CR. Skipped.
`OwnedByOtherDiscovery`	PipelineDiscoveryConflictOwnedByOther indicates a Pipeline CR with the desired name exists and is labeled as managed by a different PipelineDiscovery. First-write wins; the second discovery skips.
`NameSanitizationFailed`	PipelineDiscoveryConflictSanitizeFailed indicates the pipeline ID could not be sanitized to a valid DNS-1123 name even with the hash suffix (e.g., empty ID after sanitization).

PipelineDiscoveryImportMode¶

Underlying type: string

PipelineDiscoveryImportMode controls whether discovered Pipeline CRs are immediately reconciled to Fleet Management or held read-only.

Validation: - Enum: [Adopt ReadOnly]

Appears in: - PipelineDiscoverySpec

Field	Description
`Adopt`	PipelineDiscoveryImportModeAdopt creates Pipeline CRs that the Pipeline controller reconciles to Fleet Management immediately, except for Grafana-sourced pipelines which are always read-only.
`ReadOnly`	PipelineDiscoveryImportModeReadOnly creates Pipeline CRs annotated with fleetmanagement.grafana.com/import-mode=read-only. The Pipeline controller observes Fleet state without creating or updating the pipeline.

PipelineDiscoveryOnRemovedAction¶

Underlying type: string

PipelineDiscoveryOnRemovedAction controls the response when a discovered pipeline no longer appears in ListPipelines.

Validation: - Enum: [Keep Delete]

Appears in: - PipelineDiscoveryPolicy

Field	Description
`Keep`	PipelineDiscoveryOnRemovedKeep leaves the Pipeline CR in place, marking it with the stale annotation. Default.
`Delete`	PipelineDiscoveryOnRemovedDelete removes the Pipeline CR. The Pipeline finalizer issues a DeletePipeline call; 404 = success for vanished pipelines.

PipelineDiscoveryPolicy¶

PipelineDiscoveryPolicy bundles lifecycle decisions.

Appears in: - PipelineDiscoverySpec

Field	Description	Default	Validation
`onPipelineRemoved` PipelineDiscoveryOnRemovedAction	OnPipelineRemoved chooses the response when a previously-discovered pipeline no longer appears in ListPipelines.	Keep	Enum: [Keep Delete] Optional: {}

PipelineDiscoverySelector¶

PipelineDiscoverySelector filters which Fleet pipelines are imported.

Appears in: - PipelineDiscoverySpec

Field	Description	Default	Validation
`configType` ConfigType	ConfigType limits discovery to pipelines of this type.		Enum: [Alloy OpenTelemetryCollector] Optional: {}
`enabled` boolean	Enabled limits discovery to enabled or disabled pipelines. Omit to discover both.		Optional: {}

PipelineDiscoverySpec¶

PipelineDiscoverySpec configures a periodic poll-and-import cycle against Fleet Management's ListPipelines. Each Fleet pipeline that matches the selector becomes a Pipeline CR in the target namespace.

Appears in: - PipelineDiscovery

Field	Description	Default	Validation
`pollInterval` string	PollInterval is how often the controller calls ListPipelines. Webhook-enforced minimum is 1 minute to protect the shared rate limiter.	5m	Optional: {}
`selector` PipelineDiscoverySelector	Selector filters which Fleet pipelines are imported. An empty selector means "import every pipeline" (server-wide ListPipelines call) — accepted but expensive on large fleets.		Optional: {}
`targetNamespace` string	TargetNamespace is the namespace where discovered Pipeline CRs are created. Defaults to this PipelineDiscovery's own namespace. WARNING: pointing this at a different namespace is a privileged, cross-namespace action. The operator creates the mirrored Pipeline CRs there using its cluster-wide ServiceAccount, so whoever can create a PipelineDiscovery can make the operator write CRs into any namespace (a confused-deputy vector). Restrict PipelineDiscovery creation to platform/admin subjects, and enable --enforce-cross-namespace-discovery-authz to require the requesting user to hold create permission on pipelines in the target namespace. See docs/security.md (Cross-namespace authority).		Optional: {}
`importMode` PipelineDiscoveryImportMode	ImportMode controls whether discovered Pipeline CRs are immediately managed (Adopt) or held read-only (ReadOnly). Individual Pipeline CRs can override this via the fleetmanagement.grafana.com/import-mode=adopt annotation, except Grafana-sourced pipelines which remain read-only.	Adopt	Enum: [Adopt ReadOnly] Optional: {}
`policy` PipelineDiscoveryPolicy	Policy controls lifecycle decisions.		Optional: {}

PipelineDiscoveryStatus¶

PipelineDiscoveryStatus reports the most recent poll outcome.

Appears in: - PipelineDiscovery

Field	Description	Validation
`observedGeneration` integer	ObservedGeneration reflects the most recently observed spec generation.	Optional: {}
`lastSyncTime` Time	LastSyncTime is the timestamp of the most recent ListPipelines call.	Optional: {}
`lastSuccessTime` Time	LastSuccessTime is the timestamp of the most recent successful poll.	Optional: {}
`pipelinesObserved` integer	PipelinesObserved is the count returned by the last ListPipelines call.	Optional: {}
`pipelinesManaged` integer	PipelinesManaged is the count of Pipeline CRs labeled as managed by this discovery.	Optional: {}
`stalePipelines` string array	StalePipelines lists pipeline IDs whose CR still exists but no longer appears in ListPipelines. Only populated when policy.onPipelineRemoved=Keep.	Optional: {}
`conflicts` PipelineDiscoveryConflict array	Conflicts records cases (up to 100) where a CR could not be created due to a name/ownership conflict. When the cap is hit, a TruncatedConflicts condition is set; check events for the full list.	MaxItems: 100 Optional: {}
`conditions` Condition array	Conditions represent the current state of the PipelineDiscovery.	Optional: {}

PipelineSource¶

PipelineSource defines the origin source of the pipeline

Appears in: - PipelineSpec - PipelineStatus

Field	Description	Default	Validation
`type` SourceType	Type specifies the source type (Git, Terraform, Grafana, Kubernetes, Unspecified). Kubernetes is deprecated and kept only for backwards compatibility.		Enum: [Git Terraform Grafana Kubernetes Unspecified] Optional: {}
`namespace` string	Namespace provides additional context about the source For Git: repository name or URL For Terraform: workspace or module name For Grafana: automated workflow namespace		Optional: {}

PipelineSpec¶

PipelineSpec defines the desired state of Pipeline

Appears in: - Pipeline

PipelineStatus¶

PipelineStatus defines the observed state of Pipeline.

Appears in: - Pipeline

Field	Description	Default	Validation
`name` string	Name is the pipeline's unique identifier in Fleet Management. If not specified, metadata.name is used. The name must not contain whitespace or control characters and is capped at 253 characters (Fleet Management imposes no limit on the name itself; this is an operator-side sanity bound, double-checked by the validating webhook). When the operator runs with name scoping enabled (--pipeline-name-scope=namespace, or the fleetmanagement.grafana.com/name-scope=namespace annotation on this Pipeline), the Fleet name is prefixed with "." so that pipelines in different namespaces cannot collide. Discovered and read-only pipelines keep their Fleet-assigned name. See docs/runbooks/pipeline-name-scope-migration.md.		MaxLength: 253 Optional: {}
`contents` string	Contents of the pipeline configuration (Alloy or OpenTelemetry Collector config)		MinLength: 1 Required: {}
`matchers` string array	Matchers to assign pipeline to collectors. Uses Prometheus Alertmanager syntax: key=value, key!=value, key=~regex, key!~regex. A maximum of 100 matchers may be set per pipeline; the cap exists to bound validation and matching cost across the fleet (Fleet Management evaluates matchers on every collector poll). Each matcher is independently capped at 200 characters by the API server (OpenAPI maxLength) and double-checked by the validating webhook.		MaxItems: 100 items:MaxLength: 200 items:MinLength: 1 Optional: {}
`enabled` boolean	Enabled indicates whether the pipeline is enabled for collectors	true	Optional: {}
`configType` ConfigType	ConfigType specifies the type of configuration (Alloy or OpenTelemetryCollector)	Alloy	Enum: [Alloy OpenTelemetryCollector] Optional: {}
`source` PipelineSource	Source specifies the origin of the pipeline (Git, Terraform, Grafana, etc.) Used for tracking and grouping pipelines by their source		Optional: {}
`paused` boolean	Paused suspends operator reconciliation. When true, the Pipeline controller does not create or update this resource in Fleet Management. Read-only ownership for discovered pipelines is represented by the fleetmanagement.grafana.com/import-mode annotation, not by this field.	false	Optional: {}

Field	Description	Validation
`id` string	ID is the server-assigned pipeline ID from Fleet Management	Optional: {}
`syncedName` string	SyncedName is the pipeline name currently present in Fleet Management. It is used to detect a name change (e.g. when name scoping is toggled) so the controller can migrate the pipeline instead of orphaning it.	Optional: {}
`observedGeneration` integer	ObservedGeneration reflects the generation of the most recently observed Pipeline spec	Optional: {}
`createdAt` Time	CreatedAt is the timestamp when the pipeline was created in Fleet Management	Optional: {}
`updatedAt` Time	UpdatedAt is the timestamp when the pipeline was last updated in Fleet Management	Optional: {}
`source` PipelineSource	Source is the source observed from Fleet Management.	Optional: {}
`revisionId` string	RevisionID is the current revision ID from Fleet Management	Optional: {}
`conditions` Condition array	Conditions represent the current state of the Pipeline resource. Standard condition types: - "Ready": Pipeline is successfully synced to Fleet Management - "Synced": Last reconciliation succeeded The status of each condition is one of True, False, or Unknown.	Optional: {}

PolicySelector¶

PolicySelector picks the Collectors a RemoteAttributePolicy applies to.

A Collector matches the selector if it satisfies all Matchers (AND-ed together) OR its ID appears in CollectorIDs. An empty selector matches nothing — this is intentional defensive behavior so a partially-written Policy never accidentally targets every collector.

Appears in: - CollectorDiscoverySpec - ExternalAttributeSyncSpec - RemoteAttributePolicySpec

Field	Description	Default	Validation
`matchers` string array	Matchers in Prometheus Alertmanager syntax (=, !=, =~, !~), evaluated against the matched Collector's local attributes plus its ID under the synthetic key "collector.id". A maximum of 100 matchers may be set per selector; the cap exists to bound validation cost and keep `kubectl describe` output readable. Each matcher is independently capped at 200 characters by the API server (OpenAPI maxLength) and double-checked by the validating webhook.		MaxItems: 100 items:MaxLength: 200 items:MinLength: 1 Optional: {}
`collectorIDs` string array	CollectorIDs is an explicit list of collector IDs this policy targets. OR'd with Matchers — a Collector matches if its ID appears here, even if the Matchers would otherwise reject it.		MaxItems: 1000 items:MinLength: 1 Optional: {}

RemoteAttributePolicy¶

RemoteAttributePolicy applies a bulk set of remote attributes to every Collector matched by its selector.

Field	Description	Validation
`apiVersion` string	`fleetmanagement.grafana.com/v1alpha1`
`kind` string	`RemoteAttributePolicy`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` RemoteAttributePolicySpec	spec defines the desired state of the Policy.	Required: {}
`status` RemoteAttributePolicyStatus	status defines the observed state of the Policy.	Optional: {}

RemoteAttributePolicySpec¶

RemoteAttributePolicySpec defines a bulk attribute assignment to all collectors matched by a selector. Within a single Collector, this layer's values are overridden by the Collector CR's own spec.RemoteAttributes — the Policy is a default, the Collector CR is an override.

Appears in: - RemoteAttributePolicy

Field	Description	Default	Validation
`selector` PolicySelector
`attributes` object (keys:string, values:string)	Attributes applied to every matched collector. Reserved-prefix keys ("collector.") are rejected by the API server (CEL) and the validating webhook.		MaxProperties: 100 MinProperties: 1
`priority` integer	Priority breaks ties when multiple policies match the same collector and set the same key — higher Priority wins. Equal-priority ties are broken alphabetically by namespaced name to keep behavior deterministic across reconciliations.	0	Optional: {}

RemoteAttributePolicyStatus¶

RemoteAttributePolicyStatus reflects the controller's view of which collectors this policy is currently applied to.

Appears in: - RemoteAttributePolicy

Field	Description	Validation
`observedGeneration` integer	ObservedGeneration reflects the generation of the most recently observed Policy spec.	Optional: {}
`matchedCollectorIDs` string array	MatchedCollectorIDs is a capped sample (up to 1000) of the sorted collector IDs currently matched by this policy's selector. For the authoritative count, see MatchedCount. When the cap is hit, a Truncated condition is set on the status.	MaxItems: 1000 Optional: {}
`matchedCount` integer	MatchedCount is the number of collectors currently matched by this policy. Maintained alongside MatchedCollectorIDs to back a typed printer column without requiring kubectl to coerce a string array into an integer.	Optional: {}
`conditions` Condition array	Conditions represent the current state of the Policy. See docs/conditions.md for the cross-CRD condition registry.	Optional: {}

SQLSourceSpec¶

SQLSourceSpec configures a generic SQL external source. Reserved for Phase 4; the type is exposed now so existing CRDs remain forward-compatible.

Appears in: - ExternalSource

Field	Description	Default	Validation
`driver` string	Driver names the database/sql driver. Phase 4 will register "postgres" and "mysql".		Optional: {}
`query` string	Query is the SQL query to execute. Must SELECT at minimum the CollectorIDField and every AttributeFields source column.		MinLength: 1 Optional: {}

SourceType¶

Underlying type: string

SourceType represents the origin source of the pipeline

Validation: - Enum: [Git Terraform Grafana Kubernetes Unspecified]

Appears in: - PipelineSource

Field	Description
`Git`	SourceTypeGit indicates pipeline originated from Git repository
`Terraform`	SourceTypeTerraform indicates pipeline originated from Terraform
`Grafana`	SourceTypeGrafana indicates pipeline originated from an automated Grafana Cloud workflow, such as Instrumentation Hub. Grafana-sourced pipelines are read-only from this operator's perspective.
`Kubernetes`	SourceTypeKubernetes indicates pipeline originated from this Kubernetes operator. Deprecated: Fleet Management does not expose a Kubernetes source enum; this value is accepted for compatibility but is not sent to Fleet by new reconciles.
`Unspecified`	SourceTypeUnspecified indicates pipeline source is not specified

SubjectAccessReviewer¶

Underlying type: interface{Create(ctx context.Context, sar *k8s.io/api/authorization/v1.SubjectAccessReview) (*k8s.io/api/authorization/v1.SubjectAccessReview, error)}

SubjectAccessReviewer decouples the discovery webhooks from the concrete Kubernetes clientset. It is the consumer-side interface for the SubjectAccessReview check that closes the cross-namespace "confused deputy" escalation: the operator must confirm that the user creating a PipelineDiscovery / CollectorDiscovery may itself write the mirrored CRs into the requested target namespace, rather than borrowing the operator's cluster-wide ServiceAccount permissions.

Implementations must treat a nil receiver as a no-op so callers can pass nil when cross-namespace authorization enforcement is disabled, mirroring the existing MatcherChecker nil pattern.

Appears in: - PipelineDiscoveryValidator

TenantPolicy¶

TenantPolicy declares which K8s subjects are required to scope their Fleet Management CR matchers to a specific set of allowed matchers. It implements the missing per-tenant authorization layer that Fleet Management's API does not provide natively, by leveraging K8s RBAC group membership at admission time. Cluster-scoped because tenant boundaries are a platform-admin concern; standard K8s RBAC on this CRD itself controls who can create or modify policies.

Field	Description	Validation
`apiVersion` string	`fleetmanagement.grafana.com/v1alpha1`
`kind` string	`TenantPolicy`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` TenantPolicySpec	spec defines the desired tenant policy.	Required: {}
`status` TenantPolicyStatus	status defines the observed state of the policy.	Optional: {}

TenantPolicySpec¶

TenantPolicySpec binds K8s subjects to a set of required matchers. When tenant-policy enforcement is enabled on the manager, validating webhooks for Pipeline / RemoteAttributePolicy / ExternalAttributeSync resources require that the requesting user (after subject match) include at least one of the union of RequiredMatchers from every matching policy in their CR's matcher set.

Appears in: - TenantPolicy

Field	Description	Validation
`subjects` Subject array	Subjects this policy applies to. A subject matches the admission request when its Kind+Name (and Namespace, for ServiceAccount) line up with admission.Request.UserInfo. Reuses rbacv1.Subject so cluster admins can copy bindings from existing RoleBindings.	MinItems: 1
`requiredMatchers` string array	RequiredMatchers is the set of matchers (Prometheus Alertmanager syntax: key=value, key!=value, key=~regex, key!~regex) that the CR's matcher set must contain at least one of. Multiple matching policies contribute to the union of allowed matchers — the CR satisfies the check by including ANY one element of that union. A maximum of 100 required matchers may be set per policy; the cap exists to bound admission cost across many concurrent CR writes. Each matcher is independently capped at 200 characters by the API server (OpenAPI maxLength) and double-checked by the validating webhook.	MaxItems: 100 MinItems: 1 items:MaxLength: 200
`namespaceSelector` LabelSelector	NamespaceSelector limits this policy to CRs in matching namespaces. If nil, the policy applies in every namespace. Selectors are evaluated against namespace labels via the standard metav1.LabelSelector semantics.	Optional: {}

TenantPolicyStatus¶

TenantPolicyStatus reflects the controller's view of a TenantPolicy.

Conditions written by the TenantPolicy reconciler:

Valid: True when every required matcher and selector parses; False with reason ParseError when any required matcher or selector is malformed.
Ready: True when Valid=True; otherwise False.

Appears in: - TenantPolicy

Field	Description	Validation
`observedGeneration` integer	ObservedGeneration tracks the last spec generation reconciled.	Optional: {}
`boundSubjectCount` integer	BoundSubjectCount is the number of subjects (groups + users + service accounts) currently declared by spec.subjects. Maintained alongside the array so a typed printer column does not need to coerce a slice into an integer.	Optional: {}
`conditions` Condition array	Conditions describe the policy's current state.	Optional: {}