> ## Documentation Index > Fetch the complete documentation index at: https://private-7c7dfe99-mintlify-8c05c8a2.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # ClickHouse Operator API reference > This document provides detailed API reference for the ClickHouse Operator custom resources. This document provides detailed API reference for the ClickHouse Operator custom resources.

AdditionalPort

AdditionalPort declares one extra TCP port to expose on the ClickHouse Pod and the operator-managed headless Service. | Field | Type | Description | Required | Default | | ------ | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- | | `name` | string | Name uniquely identifies the port within the list. Used as both the container port name and the Service port name.
This must be a DNS\_LABEL. | true | | | `port` | integer | Port is the TCP port number to expose. | true | | Appears in: * [ClickHouseClusterSpec](#clickhouseclusterspec)

CABundleSelector

CABundleSelector selects a key holding a CA bundle from a Secret in the cluster's namespace. | Field | Type | Description | Required | Default | | ------ | ------ | ------------------------------------------------------------------ | -------- | ------- | | `name` | string | The name of the secret in the cluster's namespace to select from. | true | | | `key` | string | The key of the secret to select from. Must be a valid secret key. | false | ca.crt | Appears in: * [ClusterTLSSpec](#clustertlsspec)

ClickHouseCluster

ClickHouseCluster is the Schema for the `clickhouseclusters` API.

API Version and Kind

```yaml theme={null} apiVersion: clickhouse.com/v1alpha1 kind: ClickHouseCluster ``` | Field | Type | Description | Required | Default | | -------- | --------------------------------------------------- | ----------- | -------- | ------- | | `spec` | [ClickHouseClusterSpec](#clickhouseclusterspec) | | true | | | `status` | [ClickHouseClusterStatus](#clickhouseclusterstatus) | | true | | Appears in: * [ClickHouseClusterList](#clickhouseclusterlist)

ClickHouseClusterList

ClickHouseClusterList contains a list of ClickHouseCluster.

API Version and Kind

```yaml theme={null} apiVersion: clickhouse.com/v1alpha1 kind: ClickHouseClusterList ``` | Field | Type | Description | Required | Default | | ------- | --------------------------------------------- | ----------- | -------- | ------- | | `items` | [ClickHouseCluster](#clickhousecluster) array | | true | |

ClickHouseClusterSpec

ClickHouseClusterSpec defines the desired state of ClickHouseCluster. | Field | Type | Description | Required | Default | | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------- | | `replicas` | integer | Number of replicas in the single shard. | false | 3 | | `shards` | integer | Number of shards in the cluster. | false | 1 | | `keeperClusterRef` | [KeeperClusterReference](#keeperclusterreference) | Reference to the KeeperCluster that is used for ClickHouse coordination.
When namespace is omitted, the ClickHouseCluster namespace is used. | true | | | `podTemplate` | [PodTemplateSpec](#podtemplatespec) | Parameters passed to the ClickHouse pod spec. | false | | | `containerTemplate` | [ContainerTemplateSpec](#containertemplatespec) | Parameters passed to the ClickHouse container spec. | false | | | `dataVolumeClaimSpec` | [PersistentVolumeClaimSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#persistentvolumeclaimspec-v1-core) | Specification of persistent storage for ClickHouse data. | false | | | `additionalVolumeClaimTemplates` | [PersistentVolumeClaimTemplate](#persistentvolumeclaimtemplate) array | Additional per-pod PVC templates for JBOD / multi-disk storage.
Each entry is propagated in StatefulSet volumeClaimTemplate, mounted at `/var/lib/clickhouse/disks/` and
added to the generated JBOD storage policy.
The set of disks is fixed at creation. | false | | | `labels` | object (keys:string, values:string) | Additional labels that are added to resources. | false | | | `annotations` | object (keys:string, values:string) | Additional annotations that are added to resources. | false | | | `podDisruptionBudget` | [PodDisruptionBudgetSpec](#poddisruptionbudgetspec) | PodDisruptionBudget configures the PDB created for each shard.
When unset, the operator defaults to maxUnavailable=1 for single-replica
shards and minAvailable=1 for multi-replica shards. | false | | | `settings` | [ClickHouseSettings](#clickhousesettings) | Configuration parameters for ClickHouse server. | false | | | `clusterDomain` | string | ClusterDomain is the Kubernetes cluster domain suffix used for DNS resolution. | false | cluster.local | | `upgradeChannel` | string | UpgradeChannel specifies the release channel for major version upgrade checks.
When empty, only minor updates will be proposed. Allowed values are: stable, lts or specific major.minor version (e.g. 25.8). | false | | | `versionProbeTemplate` | [VersionProbeTemplate](#versionprobetemplate) | VersionProbeTemplate overrides for the version detection Job. | false | | | `externalSecret` | [ExternalSecret](#externalsecret) | ExternalSecret is an optional reference to an externally-managed Secret containing cluster secrets.
The secret must reside in the same namespace as the cluster. | false | | | `additionalPorts` | [AdditionalPort](#additionalport) array | AdditionalPorts declares extra TCP ports to expose on the ClickHouse Pod and the operator-managed headless Service.
The operator only adds the ports to the Kubernetes resources, it does not configure the ClickHouse server to listen on them. | false | | Appears in: * [ClickHouseCluster](#clickhousecluster)

ClickHouseClusterStatus

ClickHouseClusterStatus defines the observed state of ClickHouseCluster. | Field | Type | Description | Required | Default | | ----------------------- | --------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- | | `conditions` | [Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#condition-v1-meta) array | | false | | | `readyReplicas` | integer | ReadyReplicas Total number of replicas ready to serve requests. | false | | | `configurationRevision` | string | ConfigurationRevision indicates target configuration revision for every replica. | true | | | `statefulSetRevision` | string | StatefulSetRevision indicates target StatefulSet revision for every replica. | true | | | `currentRevision` | string | CurrentRevision indicates latest applied ClickHouseCluster spec revision. | true | | | `updateRevision` | string | UpdateRevision indicates latest requested ClickHouseCluster spec revision. | true | | | `observedGeneration` | integer | ObservedGeneration indicates latest generation observed by controller. | true | | | `version` | string | Version indicates the version reported by the container image. | false | | | `versionProbeRevision` | string | VersionProbeRevision is the image hash of the last successful version probe.
When this matches the current image hash, the cached Version is used directly. | false | | Appears in: * [ClickHouseCluster](#clickhousecluster)

ClickHouseSettings

ClickHouseSettings defines ClickHouse server settings options. | Field | Type | Description | Required | Default | | --------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- | | `defaultUserPassword` | [DefaultPasswordSelector](#defaultpasswordselector) | Specifies source and type of the password for `default` ClickHouse user. | false | | | `logger` | [LoggerConfig](#loggerconfig) | Configuration of ClickHouse server logging. | false | | | `tls` | [ClusterTLSSpec](#clustertlsspec) | TLS settings, allows to configure secure endpoints and certificate verification for ClickHouse server. | false | | | `enableDatabaseSync` | boolean | Enables synchronization of ClickHouse databases to the newly created replicas and cleanup of stale replicas
after scale down.
Supports only Replicated and integration databases. | false | true | | `extraConfig` | [RawExtension](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#rawextension-runtime-pkg) | Additional ClickHouse configuration that will be merged with the default one. | false | | | `extraUsersConfig` | [RawExtension](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#rawextension-runtime-pkg) | Additional ClickHouse users configuration that will be merged with the default one. | false | | Appears in: * [ClickHouseClusterSpec](#clickhouseclusterspec)

ClusterTLSSpec

ClusterTLSSpec defines cluster TLS configuration. | Field | Type | Description | Required | Default | | ------------------ | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ------- | | `enabled` | boolean | Enabled indicates whether TLS is enabled, determining if secure ports should be opened. | false | false | | `required` | boolean | Required specifies whether TLS must be enforced for all connections. Disables not secure ports. | false | false | | `serverCertSecret` | [LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#localobjectreference-v1-core) | ServerCertSecret is a reference to a TLS Secret containing the server certificate.
It is expected that the Secret has the same structure as certificates generated by cert-manager,
with the certificate and private key stored under "tls.crt" and "tls.key" keys respectively. | false | | | `caBundle` | [CABundleSelector](#cabundleselector) | CABundle is a reference to a Secret key holding a CA bundle used to verify peer certificates.
If empty, the system trusted CA bundle is used.
Key is defaulted to "ca.crt" if not specified. | false | | Appears in: * [ClickHouseSettings](#clickhousesettings) * [KeeperSettings](#keepersettings)

ConfigMapKeySelector

ConfigMapKeySelector selects a key of a ConfigMap. | Field | Type | Description | Required | Default | | ------ | ------ | -------------------------------------------------------------------- | -------- | ------- | | `name` | string | The name of the ConfigMap in the cluster's namespace to select from. | true | | | `key` | string | The key of the ConfigMap to select from. Must be a valid key. | true | | Appears in: * [DefaultPasswordSelector](#defaultpasswordselector)

ContainerImage

ContainerImage defines a container image with repository, tag or hash. | Field | Type | Description | Required | Default | | ------------ | ------ | --------------------------------------------------------------------------- | -------- | ------- | | `repository` | string | Container image registry name
Example: docker.io/clickhouse/clickhouse | false | | | `tag` | string | Container image tag, mutually exclusive with 'hash'.
Example: 25.3 | false | | | `hash` | string | Container image hash, mutually exclusive with 'tag'. | false | | Appears in: * [ContainerTemplateSpec](#containertemplatespec)

ContainerTemplateSpec

ContainerTemplateSpec describes the container configuration overrides for the cluster's containers. | Field | Type | Description | Required | Default | | ----------------- | ------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- | | `image` | [ContainerImage](#containerimage) | Image is the container image to be deployed. | true | | | `imagePullPolicy` | [PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#pullpolicy-v1-core) | ImagePullPolicy for the image, which defaults to IfNotPresent. | false | | | `resources` | [ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#resourcerequirements-v1-core) | Resources is the resource requirements for the server container.
Applied as a whole: operator defaults are used only when all resource fields are empty. | false | | | `volumeMounts` | [VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#volumemount-v1-core) array | VolumeMounts is the list of volume mounts for the container.
Concatenated with operator-generated mounts. Entries sharing a `mountPath` with an operator
mount are merged into a projected volume. | false | | | `env` | [EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#envvar-v1-core) array | Env is the list of environment variables to set in the container.
Merged with operator defaults by name. | false | | | `securityContext` | [SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#securitycontext-v1-core) | SecurityContext defines the security options the container should be run with.
A non-nil SecurityContext fully replaces operator defaults; the user owns the
entire struct. When nil, operator defaults are preserved.
More info: [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | false | | | `livenessProbe` | [Probe](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#probe-v1-core) | LivenessProbe overrides the operator's default liveness probe. | false | | | `readinessProbe` | [Probe](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#probe-v1-core) | ReadinessProbe overrides the operator's default readiness probe. | false | | Appears in: * [ClickHouseClusterSpec](#clickhouseclusterspec) * [KeeperClusterSpec](#keeperclusterspec)

DefaultPasswordSelector

DefaultPasswordSelector selects the source for the default user's password. | Field | Type | Description | Required | Default | | -------------- | --------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------- | | `passwordType` | string | Type of the provided password. Consider documentation for possible values [https://clickhouse.com/docs/operations/settings/settings-users#user-namepassword](https://clickhouse.com/docs/operations/settings/settings-users#user-namepassword) | true | password | | `secret` | [SecretKeySelector](#secretkeyselector) | Select password value from a Secret key | false | | | `configMap` | [ConfigMapKeySelector](#configmapkeyselector) | Select password value from a ConfigMap key | false | | Appears in: * [ClickHouseSettings](#clickhousesettings)

ExternalSecret

ExternalSecret is a reference to a Secret in the same namespace. | Field | Type | Description | Required | Default | | -------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ------- | | `name` | string | Name of the Secret. | true | | | `policy` | [ExternalSecretPolicy](#externalsecretpolicy) | Policy controls how the operator treats the secret's content.
Observe (default): blocks reconciliation if any required key is missing.
Manage: generates missing required keys into the existing secret. | false | Observe | Appears in: * [ClickHouseClusterSpec](#clickhouseclusterspec)

ExternalSecretPolicy

ExternalSecretPolicy controls how the operator treats the external secret's content. | Field | Description | | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Observe` | ExternalSecretPolicyObserve is the default policy: the operator reads and validates the secret;
reconciliation is blocked if any required key is absent.
Missing required keys and their expected formats are reported via the ExternalSecretValid status condition at runtime.
| | `Manage` | ExternalSecretPolicyManage is the policy where the operator fills in any missing required keys by generating
values for them. The secret is updated but never owned or deleted by the operator.
| Appears in: * [ExternalSecret](#externalsecret)

KeeperCluster

KeeperCluster is the Schema for the `keeperclusters` API.

API Version and Kind

```yaml theme={null} apiVersion: clickhouse.com/v1alpha1 kind: KeeperCluster ``` | Field | Type | Description | Required | Default | | -------- | ------------------------------------------- | ----------- | -------- | ------- | | `spec` | [KeeperClusterSpec](#keeperclusterspec) | | true | | | `status` | [KeeperClusterStatus](#keeperclusterstatus) | | true | | Appears in: * [KeeperClusterList](#keeperclusterlist)

KeeperClusterList

KeeperClusterList contains a list of KeeperCluster.

API Version and Kind

```yaml theme={null} apiVersion: clickhouse.com/v1alpha1 kind: KeeperClusterList ``` | Field | Type | Description | Required | Default | | ------- | ------------------------------------- | ----------- | -------- | ------- | | `items` | [KeeperCluster](#keepercluster) array | | true | |

KeeperClusterReference

KeeperClusterReference identifies the KeeperCluster used by a ClickHouseCluster. | Field | Type | Description | Required | Default | | ----------- | ------ | ---------------------------------------------------------------------------------------------------- | -------- | ------- | | `name` | string | Name of the KeeperCluster resource. | true | | | `namespace` | string | Namespace of the KeeperCluster resource.
When omitted, the ClickHouseCluster namespace is used. | false | | Appears in: * [ClickHouseClusterSpec](#clickhouseclusterspec)

KeeperClusterSpec

KeeperClusterSpec defines the desired state of KeeperCluster. | Field | Type | Description | Required | Default | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------- | | `replicas` | integer | Number of replicas in the cluster | false | 3 | | `podTemplate` | [PodTemplateSpec](#podtemplatespec) | Parameters passed to the Keeper pod spec. | false | | | `containerTemplate` | [ContainerTemplateSpec](#containertemplatespec) | Parameters passed to the Keeper container spec. | false | | | `dataVolumeClaimSpec` | [PersistentVolumeClaimSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#persistentvolumeclaimspec-v1-core) | Specification of persistent storage for ClickHouse Keeper data. | false | | | `labels` | object (keys:string, values:string) | Additional labels that are added to resources. | false | | | `annotations` | object (keys:string, values:string) | Additional annotations that are added to resources. | false | | | `podDisruptionBudget` | [PodDisruptionBudgetSpec](#poddisruptionbudgetspec) | PodDisruptionBudget configures the PDB created for the Keeper cluster.
When unset, the operator defaults to maxUnavailable=replicas/2
(preserving quorum for a 2F+1 cluster); single-replica clusters use maxUnavailable=1. | false | | | `settings` | [KeeperSettings](#keepersettings) | Configuration parameters for ClickHouse Keeper server. | false | | | `clusterDomain` | string | ClusterDomain is the Kubernetes cluster domain suffix used for DNS resolution. | false | cluster.local | | `upgradeChannel` | string | UpgradeChannel specifies the release channel for major version upgrade checks.
When empty, only minor updates will be proposed. Allowed values are: stable, lts or specific major.minor version (e.g. 25.8). | false | | | `versionProbeTemplate` | [VersionProbeTemplate](#versionprobetemplate) | VersionProbeTemplate overrides for the version detection Job.
Deprecated: Keeper version probe Jobs are not used; this field is retained for backward compatibility. | false | | Appears in: * [KeeperCluster](#keepercluster)

KeeperClusterStatus

KeeperClusterStatus defines the observed state of KeeperCluster. | Field | Type | Description | Required | Default | | ----------------------- | --------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- | | `conditions` | [Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#condition-v1-meta) array | | false | | | `readyReplicas` | integer | ReadyReplicas Total number of replicas ready to serve requests. | false | | | `configurationRevision` | string | ConfigurationRevision indicates target configuration revision for every replica. | true | | | `statefulSetRevision` | string | StatefulSetRevision indicates target StatefulSet revision for every replica. | true | | | `currentRevision` | string | CurrentRevision indicates latest applied KeeperCluster spec revision. | true | | | `updateRevision` | string | UpdateRevision indicates latest requested KeeperCluster spec revision. | true | | | `observedGeneration` | integer | ObservedGeneration indicates latest generation observed by controller. | true | | | `version` | string | Version indicates the version reported by the Keeper server. | false | | | `versionProbeRevision` | string | VersionProbeRevision is the image hash of the last successful version probe.
Deprecated: Keeper version probe Jobs are not used; this field is retained for backward compatibility. | false | | Appears in: * [KeeperCluster](#keepercluster)

KeeperSettings

KeeperSettings defines ClickHouse Keeper server configuration. | Field | Type | Description | Required | Default | | ------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | -------- | ------- | | `logger` | [LoggerConfig](#loggerconfig) | Configuration of ClickHouse Keeper server logging. | false | | | `tls` | [ClusterTLSSpec](#clustertlsspec) | TLS settings, allows to configure secure endpoints and certificate verification for ClickHouse Keeper server. | false | | | `extraConfig` | [RawExtension](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#rawextension-runtime-pkg) | Additional ClickHouse Keeper configuration that will be merged with the default one. | false | | Appears in: * [KeeperClusterSpec](#keeperclusterspec)

LoggerConfig

LoggerConfig defines server logging configuration. | Field | Type | Description | Required | Default | | ----------- | ------- | ------------------------------------------ | -------- | ------- | | `logToFile` | boolean | If false then disable all logging to file. | false | true | | `jsonLogs` | boolean | If true, then log in JSON format. | false | false | | `level` | string | Server logger verbosity level. | false | trace | | `size` | string | Maximum log file size. | false | 1000M | | `count` | integer | Maximum number of log files to keep. | false | 50 | Appears in: * [ClickHouseSettings](#clickhousesettings) * [KeeperSettings](#keepersettings)

NamedTemplateMeta

NamedTemplateMeta defines supported metadata settings for template objects that require a name. | Field | Type | Description | Required | Default | | ------------- | ----------------------------------- | ------------------------------------------------------------ | -------- | ------- | | `name` | string | Name is the resource identifier. | true | | | `labels` | object (keys:string, values:string) | Labels are labels applied to the template objects. | false | | | `annotations` | object (keys:string, values:string) | Annotations are annotations applied to the template objects. | false | | Appears in: * [PersistentVolumeClaimTemplate](#persistentvolumeclaimtemplate)

PDBPolicy

PDBPolicy controls whether PodDisruptionBudgets are created. | Field | Description | | ---------- | --------------------------------------------------------------------------------------------------------------------------------------- | | `Enabled` | PDBPolicyEnabled enables PodDisruptionBudgets creation by the operator.
| | `Disabled` | PDBPolicyDisabled disables PodDisruptionBudgets, operator will delete resource with matching labels.
| | `Ignored` | PDBPolicyIgnored ignores PodDisruptionBudgets, operator will not create or delete any PDBs, existing PDBs will be left unchanged.
| Appears in: * [PodDisruptionBudgetSpec](#poddisruptionbudgetspec)

PersistentVolumeClaimTemplate

PersistentVolumeClaimTemplate is a named template for a per-replica PersistentVolumeClaim. | Field | Type | Description | Required | Default | | ---------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ------- | | `metadata` | [NamedTemplateMeta](#namedtemplatemeta) | Refer to Kubernetes API documentation for fields of `metadata`. | true | | | `spec` | [PersistentVolumeClaimSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#persistentvolumeclaimspec-v1-core) | Spec defines the desired characteristics of a volume requested by a pod author.
More info: [https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims](https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims) | true | | Appears in: * [ClickHouseClusterSpec](#clickhouseclusterspec)

PodDisruptionBudgetSpec

PodDisruptionBudgetSpec configures the PDB created for the cluster. Exactly one of MinAvailable or MaxUnavailable may be set. When neither is set, the operator picks a safe default based on replica count. | Field | Type | Description | Required | Default | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- | | `policy` | [PDBPolicy](#pdbpolicy) | Policy controls whether the operator creates PodDisruptionBudgets.
Defaults to "Enabled" when unset. Set it to "Disabled" to skip PDB creation (e.g. for development environments). | false | Enabled | | `minAvailable` | [IntOrString](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#intorstring-intstr-util) | MinAvailable is the minimum number of pods that must remain available during a disruption. | false | | | `maxUnavailable` | [IntOrString](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#intorstring-intstr-util) | MaxUnavailable is the maximum number of pods that can be unavailable during a disruption. | false | | | `unhealthyPodEvictionPolicy` | [UnhealthyPodEvictionPolicyType](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#unhealthypodevictionpolicytype-v1-policy) | UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
should be considered for eviction.
Valid values are "IfReady" and "AlwaysAllow". | false | | Appears in: * [ClickHouseClusterSpec](#clickhouseclusterspec) * [KeeperClusterSpec](#keeperclusterspec)

PodTemplateSpec

PodTemplateSpec describes the pod configuration overrides for the cluster's pods. | Field | Type | Description | Required | Default | | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- | | `terminationGracePeriodSeconds` | integer | Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request.
Value must be non-negative integer. The value zero indicates stop immediately via
the kill signal (no opportunity to shut down).
If this value is nil, the default grace period will be used instead.
The grace period is the duration in seconds after the processes running in the pod are sent
a termination signal and the time when the processes are forcibly halted with a kill signal.
Set this value longer than the expected cleanup time for your process.
Defaults to 30 seconds. | false | | | `topologySpreadConstraints` | [TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#topologyspreadconstraint-v1-core) array | TopologySpreadConstraints describes how a group of pods ought to spread across topology
domains. Scheduler will schedule pods in a way which abides by the constraints.
All topologySpreadConstraints are ANDed.
Merged with operator defaults by `topologyKey`. | false | | | `imagePullSecrets` | [LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#localobjectreference-v1-core) array | ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
If specified, these secrets will be passed to individual puller implementations for them to use.
More info: [https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod](https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod)
Merged with operator defaults by name. | false | | | `nodeSelector` | object (keys:string, values:string) | NodeSelector is a selector which must be true for the pod to fit on a node.
Selector which must match a node's labels for the pod to be scheduled on that node.
More info: [https://kubernetes.io/docs/concepts/configuration/assign-pod-node/](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/) | false | | | `affinity` | [Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#affinity-v1-core) | If specified, the pod's scheduling constraints.
Appended to operator defaults: scheduling term lists are concatenated. | false | | | `tolerations` | [Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#toleration-v1-core) array | If specified, the pod's Tolerations. | false | | | `schedulerName` | string | If specified, the pod will be dispatched by specified scheduler.
If not specified, the pod will be dispatched by default scheduler. | false | | | `serviceAccountName` | string | ServiceAccountName is the name of the ServiceAccount to use to run this pod.
More info: [https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) | false | | | `priorityClassName` | string | PriorityClassName is the name of the PriorityClass to use for the pod. | false | | | `runtimeClassName` | string | RuntimeClassName is the name of the RuntimeClass to use for the pod. | false | | | `volumes` | [Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#volume-v1-core) array | Volumes defines the list of volumes that can be mounted by containers belonging to the pod.
More info: [https://kubernetes.io/docs/concepts/storage/volumes](https://kubernetes.io/docs/concepts/storage/volumes)
Merged with operator defaults by name; a user volume replaces any operator volume with the same name. | false | | | `securityContext` | [PodSecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#podsecuritycontext-v1-core) | SecurityContext holds pod-level security attributes and common container settings.
A non-nil SecurityContext fully replaces operator defaults; the user owns the
entire struct. When nil, operator defaults are preserved. | false | | | `topologyZoneKey` | string | TopologyZoneKey is the key of node labels.
Nodes that have a label with this key and identical values are considered to be in the same topology zone.
Set it to enable default TopologySpreadConstraints and Affinity rules to spread pods across zones.
Recommended to be set to "topology.kubernetes.io/zone" | false | | | `nodeHostnameKey` | string | NodeHostnameKey is the key of node labels.
Nodes that have a label with this key and identical values are considered to be on the same node.
Set it to enable default AntiAffinity rules to spread replicas from the different shards across nodes.
Recommended to be set to "kubernetes.io/hostname" | false | | | `initContainers` | [Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#container-v1-core) array | InitContainers is the list of init containers to run before the main server container starts.
Merged with operator defaults by name.
with the same name. | false | | Appears in: * [ClickHouseClusterSpec](#clickhouseclusterspec) * [KeeperClusterSpec](#keeperclusterspec)

SecretKeySelector

SecretKeySelector selects a key of a Secret. | Field | Type | Description | Required | Default | | ------ | ------ | ------------------------------------------------------------------ | -------- | ------- | | `name` | string | The name of the secret in the cluster's namespace to select from. | true | | | `key` | string | The key of the secret to select from. Must be a valid secret key. | true | | Appears in: * [DefaultPasswordSelector](#defaultpasswordselector)

TemplateMeta

TemplateMeta defines supported metadata settings for template objects. | Field | Type | Description | Required | Default | | ------------- | ----------------------------------- | ------------------------------------------------------------ | -------- | ------- | | `labels` | object (keys:string, values:string) | Labels are labels applied to the template objects. | false | | | `annotations` | object (keys:string, values:string) | Annotations are annotations applied to the template objects. | false | | Appears in: * [VersionProbePodTemplate](#versionprobepodtemplate) * [VersionProbeTemplate](#versionprobetemplate)

VersionProbeContainer

VersionProbeContainer defines container-level overrides for the version probe. Field names and JSON tags match corev1.Container so that SMP merges by name. | Field | Type | Description | Required | Default | | ----------------- | ------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------- | | `name` | string | Name of the container. If empty, the operator sets it to the version probe container name. | true | version-probe | | `resources` | [ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#resourcerequirements-v1-core) | Resources are the compute resource requirements for the version probe container.
Deep-merged with operator defaults via SMP. | false | | | `securityContext` | [SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#securitycontext-v1-core) | SecurityContext defines the security options for the version probe container.
Deep-merged with operator defaults via SMP. | false | | Appears in: * [VersionProbePodSpec](#versionprobepodspec)

VersionProbeJobSpec

VersionProbeJobSpec defines Job-level overrides for the version probe. | Field | Type | Description | Required | Default | | ------------------------- | --------------------------------------------------- | -------------------------------------------------------------------------- | -------- | ------- | | `ttlSecondsAfterFinished` | integer | TTLSecondsAfterFinished limits the lifetime of a completed Job. | false | | | `template` | [VersionProbePodTemplate](#versionprobepodtemplate) | Template describes the pod that will be created for the version probe Job. | false | | Appears in: * [VersionProbeTemplate](#versionprobetemplate)

VersionProbePodSpec

VersionProbePodSpec defines Pod-level overrides for the version probe. Field names and JSON tags match corev1.PodSpec for strategic merge patch compatibility. | Field | Type | Description | Required | Default | | ----------------- | --------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- | | `nodeSelector` | object (keys:string, values:string) | NodeSelector constrains the version probe Pod to nodes with matching labels. | false | | | `tolerations` | [Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#toleration-v1-core) array | Tolerations for the version probe Pod. | false | | | `securityContext` | [PodSecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#podsecuritycontext-v1-core) | SecurityContext holds pod-level security attributes for the version probe Pod. | false | | | `containers` | [VersionProbeContainer](#versionprobecontainer) array | Containers overrides for the version probe Pod.
The name field is optional — the operator fills it with default container.
Additional container with the different name may be specified. | false | | Appears in: * [VersionProbePodTemplate](#versionprobepodtemplate)

VersionProbePodTemplate

VersionProbePodTemplate describes overrides for the version probe Pod. | Field | Type | Description | Required | Default | | ---------- | ------------------------------------------- | --------------------------------------------------------------- | -------- | ------- | | `metadata` | [TemplateMeta](#templatemeta) | Refer to Kubernetes API documentation for fields of `metadata`. | false | | | `spec` | [VersionProbePodSpec](#versionprobepodspec) | Specification of the desired behavior of the version probe Pod. | false | | Appears in: * [VersionProbeJobSpec](#versionprobejobspec)

VersionProbeTemplate

VersionProbeTemplate defines overrides for the version detection Job. The structure mirrors batchv1.JobTemplateSpec, exposing only supported fields. | Field | Type | Description | Required | Default | | ---------- | ------------------------------------------- | --------------------------------------------------------------- | -------- | ------- | | `metadata` | [TemplateMeta](#templatemeta) | Refer to Kubernetes API documentation for fields of `metadata`. | false | | | `spec` | [VersionProbeJobSpec](#versionprobejobspec) | Specification of the desired behavior of the version probe Job. | false | | Appears in: * [ClickHouseClusterSpec](#clickhouseclusterspec) * [KeeperClusterSpec](#keeperclusterspec)