Generated page

Rendered from the Go types in api/ by make docs. Edits here are reverted by the next run; change the types instead.

API Reference¶

Packages¶

gitlab.k8s.alekc.dev/v1beta2

gitlab.k8s.alekc.dev/v1beta2¶

Package v1beta2 contains API Schema definitions for the gitlab v1beta2 API group

Resource Types¶

MultiRunner
Runner

CAKeyRef¶

CAKeyRef points at a single key inside a Secret or ConfigMap.

Appears in: - CASource

Field	Description	Default	Validation
`name` string	Name of the Secret or ConfigMap.		MinLength: 1
`key` string	Key holding the PEM CA bundle. Defaults to "ca.crt" when empty.		Optional: {}

CASource¶

CASource provides a PEM-encoded CA bundle used to verify the GitLab endpoint, both for the operator's own API calls and for the runner's connection. Set at most one of Value, SecretKeyRef, or ConfigMapKeyRef.

Appears in: - MultiRunnerSpec - RunnerSpec

Field	Description	Validation
`value` string	Value is an inline PEM CA bundle, supplied directly in the manifest. Convenient for small bundles; prefer a Secret or ConfigMap ref when the bundle is large or rotated independently of the runner spec.	Optional: {}
`secretKeyRef` CAKeyRef	SecretKeyRef selects a key in a Secret holding the PEM CA bundle.	Optional: {}
`configMapKeyRef` CAKeyRef	ConfigMapKeyRef selects a key in a ConfigMap holding the PEM CA bundle.	Optional: {}

ConcurrencyLimits¶

ConcurrencyLimits are the per-entry budgets, embedded inline in both kinds so the two cannot drift apart. Neither field is defaulted: left unset the key is omitted from config.toml and gitlab-runner applies its own default, so the operator never invents a ceiling the spec does not state.

Appears in: - MultiRunnerEntry - RunnerSpec

Field	Description	Default	Validation
`limit` integer	Limit caps the jobs this entry runs at once. Zero omits the key, and upstream acquireBuild only enforces a limit when it is above zero, so the entry is bounded by Concurrent alone. Both apply, lower wins.		Minimum: 0
`request_concurrency` integer	RequestConcurrency caps job requests in flight to GitLab, not jobs running. Zero omits the key, and upstream GetRequestConcurrency returns max(1, x), so absent means 1 and a raised Limit then fills slowly.		Minimum: 0

GitlabAuth¶

GitlabAuth configures how a runner authenticates to GitLab. GitLab removed the legacy registration-token workflow (deprecated in 16.0, disabled by default from 18.0); runners now authenticate with a runner authentication token (the "glrt-" token). Exactly one of two modes must be provided:

Bring-your-own token: set Token to a runner authentication token created in the GitLab UI or via the API. The operator performs no GitLab API calls and writes the token straight into the runner config.
Managed: set AccessToken to a personal, group, or project access token holding the "create_runner" scope, together with a CreateOptions block. The operator creates the runner through POST /user/runners, stores the returned token, and deletes the runner from GitLab when the object is removed.

Each credential is a TokenSource, so it may be supplied inline (value) or from a Secret key (secret_key_ref, with a configurable key defaulting to "token").

Appears in: - MultiRunnerEntry - RunnerSpec

Field	Description	Validation
`token` TokenSource	Token is the pre-created runner authentication token ("glrt-...") used in bring-your-own mode. Mutually exclusive with the managed CreateOptions.	Optional: {}
`access_token` TokenSource	AccessToken is a personal, group, or project access token with the "create_runner" scope. Required for the managed mode.	Optional: {}
`create_options` RunnerCreateOptions	CreateOptions describes the runner to create. When set, the operator runs in managed mode and owns the runner's lifecycle on GitLab.	Optional: {}

KubernetesAffinity¶

Appears in: - KubernetesConfig

Field	Description	Default	Validation
`node_affinity` KubernetesNodeAffinity
`pod_affinity` KubernetesPodAffinity
`pod_anti_affinity` KubernetesPodAntiAffinity

KubernetesAppArmorProfile¶

KubernetesAppArmorProfile selects the AppArmor profile for pod containers. Requires Kubernetes 1.30 or newer. The runner silently drops a profile it cannot use, so the constraints here are validated at admission instead.

Appears in: - KubernetesContainerSecurityContext - KubernetesPodSecurityContext

Field	Description	Default	Validation
`type` string			Enum: [RuntimeDefault Localhost Unconfined]
`localhost_profile` string

KubernetesCSI¶

Appears in: - KubernetesVolumes

Field	Description	Default	Validation
`name` string
`mount_path` string
`sub_path` string
`driver` string
`fs_type` string
`read_only` boolean
`volume_attributes` object (keys:string, values:string)

KubernetesConfig¶

KubernetesConfig is the kubernetes executor configuration for a runner unit.

Appears in: - MultiRunnerEntry - RunnerSpec

Field	Description	Validation
`host` string
`cert_file` string
`key_file` string
`ca_file` string
`bearer_token_overwrite_allowed` boolean
`bearer_token` string
`image` string
`namespace` string
`namespace_overwrite_allowed` string
`privileged` boolean
`runtime_class_name` string
`allow_privilege_escalation` boolean
`cpu_limit` string
`cpu_limit_overwrite_max_allowed` string
`cpu_request` string
`cpu_request_overwrite_max_allowed` string
`memory_limit` string
`memory_limit_overwrite_max_allowed` string
`memory_request` string
`memory_request_overwrite_max_allowed` string
`ephemeral_storage_limit` string
`ephemeral_storage_limit_overwrite_max_allowed` string
`ephemeral_storage_request` string
`ephemeral_storage_request_overwrite_max_allowed` string
`service_cpu_limit` string
`service_cpu_limit_overwrite_max_allowed` string
`service_cpu_request` string
`service_cpu_request_overwrite_max_allowed` string
`service_memory_limit` string
`service_memory_limit_overwrite_max_allowed` string
`service_memory_request` string
`service_memory_request_overwrite_max_allowed` string
`service_ephemeral_storage_limit` string
`service_ephemeral_storage_limit_overwrite_max_allowed` string
`service_ephemeral_storage_request` string
`service_ephemeral_storage_request_overwrite_max_allowed` string
`helper_cpu_limit` string
`helper_cpu_limit_overwrite_max_allowed` string
`helper_cpu_request` string
`helper_cpu_request_overwrite_max_allowed` string
`helper_memory_limit` string
`helper_memory_limit_overwrite_max_allowed` string
`helper_memory_request` string
`helper_memory_request_overwrite_max_allowed` string
`helper_ephemeral_storage_limit` string
`helper_ephemeral_storage_limit_overwrite_max_allowed` string
`helper_ephemeral_storage_request` string
`helper_ephemeral_storage_request_overwrite_max_allowed` string
`allowed_images` string array
`allowed_pull_policies` string array
`allowed_services` string array
`pull_policy` string array
`node_selector` object (keys:string, values:string)
`node_selector_overwrite_allowed` string
`node_tolerations` object (keys:string, values:string)
`affinity` KubernetesAffinity
`image_pull_secrets` string array
`helper_image` string
`helper_image_flavor` string	HelperImageFlavor selects the OS base for the helper image. Upstream interpolates it into the image tag rather than validating it, so an unrecognised value fails as an ImagePullBackOff on the build pod rather than at admission. Empty means alpine, or concrete under FF_CONCRETE.
`terminationGracePeriodSeconds` integer	Deprecated: no effect since gitlab-runner v17.0.0, which removed the key. A value set here is accepted, rendered into config.toml, then silently dropped by the runner. Set pod_termination_grace_period_seconds and cleanup_grace_period_seconds instead.
`pod_termination_grace_period_seconds` integer	PodTerminationGracePeriodSeconds is the build pod's grace period. Unset means the Kubernetes default of 30s. Before gitlab-runner v17.0.0 an unset grace period meant 0s, so a runner upgraded across that boundary waits 30s where it used to terminate at once.
`cleanup_grace_period_seconds` integer	CleanupGracePeriodSeconds is the DeleteOptions grace period used when tearing down the build pod and its credentials secret after a job. Unset defers to each object's own grace period, which for the pod is pod_termination_grace_period_seconds.
`poll_interval` integer
`poll_timeout` integer
`resource_availability_check_max_attempts` integer
`pod_labels` object (keys:string, values:string)
`pod_labels_overwrite_allowed` string
`scheduler_name` string
`service_account` string
`service_account_overwrite_allowed` string
`pod_annotations` object (keys:string, values:string)
`pod_annotations_overwrite_allowed` string
`pod_security_context` KubernetesPodSecurityContext
`init_permissions_container_security_context` KubernetesContainerSecurityContext
`build_container_security_context` KubernetesContainerSecurityContext
`helper_container_security_context` KubernetesContainerSecurityContext
`service_container_security_context` KubernetesContainerSecurityContext
`volumes` KubernetesVolumes
`host_aliases` KubernetesHostAliases array
`services` Service array
`cap_add` string array
`cap_drop` string array
`dns_policy` string
`dns_config` KubernetesDNSConfig
`container_lifecycle` KubernetesContainerLifecyle
`priority_class_name` string
`context` string
`namespace_per_job` boolean
`pod_cpu_limit` string
`pod_cpu_limit_overwrite_max_allowed` string
`pod_cpu_request` string
`pod_cpu_request_overwrite_max_allowed` string
`pod_memory_limit` string
`pod_memory_limit_overwrite_max_allowed` string
`pod_memory_request` string
`pod_memory_request_overwrite_max_allowed` string
`node_tolerations_overwrite_allowed` string
`helper_image_autoset_arch_and_os` boolean
`logs_base_dir` string
`scripts_base_dir` string
`pod_spec` KubernetesPodSpec array
`allowed_users` string array
`allowed_groups` string array
`automount_service_account_token` boolean
`pod_disruption_budget` boolean
`print_pod_warning_events` boolean
`use_service_account_image_pull_secrets` boolean
`cleanup_resources_timeout` string	A Go duration string such as 5m. The runner's toml decoder parses it into time.Duration, so no bespoke CRD type is needed.	MaxLength: 32 Pattern: `^\+?(0\\|(([0-9]+(\.[0-9]*)?\\|\.[0-9]+)(ns\\|us\\|µs\\|μs\\|ms\\|s\\|m\\|h))+)$`
`retry_limit` integer
`retry_limits` object (keys:string, values:integer)
`retry_backoff_max` integer

KubernetesConfigMap¶

Appears in: - KubernetesVolumes

Field	Description	Default	Validation
`name` string
`mount_path` string
`sub_path` string
`read_only` boolean
`items` object (keys:string, values:string)

KubernetesContainerCapabilities¶

Appears in: - KubernetesContainerSecurityContext

Field	Description	Default	Validation
`add` Capability array
`drop` Capability array

KubernetesContainerLifecyle¶

KubernetesContainerLifecyle exposes PostStart and PreStop only. PostStart is not ordered against the image ENTRYPOINT, and PreStop does not run when the container crashes or exits on its own.

Appears in: - KubernetesConfig

Field	Description	Default	Validation
`post_start` KubernetesLifecycleHandler
`pre_stop` KubernetesLifecycleHandler

KubernetesContainerSecurityContext¶

Appears in: - KubernetesConfig

Field	Description	Default	Validation
`capabilities` KubernetesContainerCapabilities
`privileged` boolean
`run_as_user` integer
`run_as_group` integer
`run_as_non_root` boolean
`read_only_root_filesystem` boolean
`allow_privilege_escalation` boolean
`proc_mount` string
`selinux_type` string
`seccomp_profile` KubernetesSeccompProfile
`app_armor_profile` KubernetesAppArmorProfile

KubernetesDNSConfig¶

Appears in: - KubernetesConfig

Field	Description	Default	Validation
`nameservers` string array
`options` KubernetesDNSConfigOption array
`searches` string array

KubernetesDNSConfigOption¶

Appears in: - KubernetesDNSConfig

Field	Description	Default	Validation
`name` string
`value` string

KubernetesEmptyDir¶

Appears in: - KubernetesVolumes

Field	Description	Default	Validation
`name` string
`mount_path` string
`sub_path` string
`medium` string
`size_limit` string
`mount_propagation` string

KubernetesHostAliases¶

Appears in: - KubernetesConfig

Field	Description	Default	Validation
`ip` string
`hostnames` string array

KubernetesHostPath¶

Appears in: - KubernetesVolumes

Field	Description	Default	Validation
`name` string
`mount_path` string
`sub_path` string
`read_only` boolean
`host_path` string
`mount_propagation` string

KubernetesLifecycleExecAction¶

Appears in: - KubernetesLifecycleHandler

Field	Description	Default	Validation
`command` string array

KubernetesLifecycleHTTPGet¶

Appears in: - KubernetesLifecycleHandler

Field	Description	Default	Validation
`host` string
`http_headers` KubernetesLifecycleHTTPGetHeader array
`path` string
`port` integer
`scheme` string

KubernetesLifecycleHTTPGetHeader¶

Appears in: - KubernetesLifecycleHTTPGet

Field	Description	Default	Validation
`name` string
`value` string

KubernetesLifecycleHandler¶

Appears in: - KubernetesContainerLifecyle

Field	Description	Default	Validation
`exec` KubernetesLifecycleExecAction
`http_get` KubernetesLifecycleHTTPGet
`tcp_socket` KubernetesLifecycleTCPSocket

KubernetesLifecycleTCPSocket¶

Appears in: - KubernetesLifecycleHandler

Field	Description	Default	Validation
`host` string
`port` integer

KubernetesNFS¶

KubernetesNFS is an NFS share mounted into the build pod. Upstream's UnmarshalTOML rejects the volume unless name, mount_path, server and path are all set, so those four are required here rather than optional.

Appears in: - KubernetesVolumes

Field	Description	Default	Validation
`name` string			MinLength: 1
`mount_path` string			MinLength: 1
`sub_path` string
`server` string			MinLength: 1
`path` string			MinLength: 1
`read_only` boolean

KubernetesNodeAffinity¶

Appears in: - KubernetesAffinity

Field	Description	Default	Validation
`required_during_scheduling_ignored_during_execution` NodeSelector
`preferred_during_scheduling_ignored_during_execution` PreferredSchedulingTerm array

KubernetesPVC¶

Appears in: - KubernetesVolumes

Field	Description	Default	Validation
`name` string
`mount_path` string
`sub_path` string
`read_only` boolean
`mount_propagation` string

KubernetesPodAffinity¶

Appears in: - KubernetesAffinity

Field	Description	Default	Validation
`required_during_scheduling_ignored_during_execution` PodAffinityTerm array
`preferred_during_scheduling_ignored_during_execution` WeightedPodAffinityTerm array

KubernetesPodAntiAffinity¶

Appears in: - KubernetesAffinity

Field	Description	Default	Validation
`required_during_scheduling_ignored_during_execution` PodAffinityTerm array
`preferred_during_scheduling_ignored_during_execution` WeightedPodAffinityTerm array

KubernetesPodSecurityContext¶

Appears in: - KubernetesConfig

Field	Description	Default	Validation
`fs_group` integer
`run_as_group` integer
`run_as_non_root` boolean
`run_as_user` integer
`supplemental_groups` integer array
`selinux_type` string
`app_armor_profile` KubernetesAppArmorProfile
`seccomp_profile` KubernetesSeccompProfile

KubernetesPodSpec¶

KubernetesPodSpec is an experimental gitlab-runner option that patches the generated build pod spec. PatchType is one of merge, json, or strategic.

Appears in: - KubernetesConfig

Field	Description	Default	Validation
`name` string
`patch_path` string
`patch` string
`patch_type` string

KubernetesSeccompProfile¶

KubernetesSeccompProfile selects the seccomp profile for pod containers. The runner silently drops a profile it cannot use, so the constraints here are validated at admission instead.

Appears in: - KubernetesContainerSecurityContext - KubernetesPodSecurityContext

Field	Description	Default	Validation
`type` string			Enum: [RuntimeDefault Localhost Unconfined]
`localhost_profile` string

KubernetesSecret¶

Appears in: - KubernetesVolumes

Field	Description	Default	Validation
`name` string
`mount_path` string
`sub_path` string
`read_only` boolean
`items` object (keys:string, values:string)

KubernetesVolumes¶

Appears in: - KubernetesConfig

Field	Description	Default	Validation
`host_path` KubernetesHostPath array
`pvc` KubernetesPVC array
`config_map` KubernetesConfigMap array
`secret` KubernetesSecret array
`empty_dir` KubernetesEmptyDir array
`csi` KubernetesCSI array
`nfs` KubernetesNFS array

LabelSelector¶

Appears in: - PodAffinityTerm

Field	Description	Default	Validation
`match_labels` object (keys:string, values:string)
`match_expressions` NodeSelectorRequirement array

MultiRunner¶

MultiRunner is the Schema for the multirunners API

Field	Description	Default	Validation
`apiVersion` string	`gitlab.k8s.alekc.dev/v1beta2`
`kind` string	`MultiRunner`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` MultiRunnerSpec
`status` MultiRunnerStatus

MultiRunnerEntry¶

Appears in: - MultiRunnerSpec

Field	Description	Validation
`name` string		MinLength: 1
`authentication` GitlabAuth
`executor_config` KubernetesConfig
`environment` string array
`limit` integer	Limit caps the jobs this entry runs at once. Zero omits the key, and upstream acquireBuild only enforces a limit when it is above zero, so the entry is bounded by Concurrent alone. Both apply, lower wins.	Minimum: 0
`request_concurrency` integer	RequestConcurrency caps job requests in flight to GitLab, not jobs running. Zero omits the key, and upstream GetRequestConcurrency returns max(1, x), so absent means 1 and a raised Limit then fills slowly.	Minimum: 0

MultiRunnerSpec¶

MultiRunnerSpec defines the desired state of MultiRunner

Appears in: - MultiRunner

Field	Description	Default	Validation
`concurrent` integer			Minimum: 1
`log_level` string			Enum: [panic fatal error warning info debug]
`log_format` string			Enum: [runner text json]
`check_interval` integer			Minimum: 3
`sentry_dsn` string	SentryDsn Enables tracking of all system level errors to Sentry.
`gitlab_instance_url` string		https://gitlab.com/
`runner_image` string	RunnerImage overrides the gitlab-runner container image. Defaults to DefaultRunnerImage when empty.		Optional: {}
`runner_resources` ResourceRequirements	RunnerResources overrides the resource requests/limits of the runner manager container.		Optional: {}
`runner_image_pull_policy` PullPolicy	RunnerImagePullPolicy overrides the runner container image pull policy.		Enum: [Always Never IfNotPresent] Optional: {}
`runner_security_context` SecurityContext	RunnerSecurityContext overrides the runner manager container security context.		Optional: {}
`runner_env` EnvVar array	RunnerEnv sets extra env vars on the runner manager container, e.g. an outbound HTTP_PROXY. Distinct from Environment, which only reaches job builds via config.toml. Prefer valueFrom for secrets, plain values log verbatim; a fieldRef needs an explicit apiVersion or reconciles forever.		Optional: {}
`runner_node_selector` object (keys:string, values:string)	RunnerNodeSelector constrains the runner manager pod to nodes carrying these labels. Shapes the manager only; executor_config.node_selector places job pods.		Optional: {}
`runner_tolerations` Toleration array	RunnerTolerations lets the runner manager pod schedule onto tainted nodes. Native Kubernetes list shape, not the "key=value": "effect" map that executor_config.node_tolerations takes.		Optional: {}
`runner_affinity` Affinity	RunnerAffinity sets affinity on the runner manager pod. Prefer RunnerNodeSelector for equality matching and reach for this only for In / NotIn / Exists or a soft preference.		Optional: {}
`runner_priority_class_name` string	RunnerPriorityClassName protects the runner manager pod from preemption. A manager killed mid-job loses the jobs it was tracking, so it wants a higher priority than the workloads it shares a node with.		Optional: {}
`caCertificate` CASource	CACertificate, when set, provides a PEM CA bundle used to verify the GitLab endpoint for both the operator's API calls and every runner entry's own connection. Supply it inline (value) or from a Secret or ConfigMap key.		Optional: {}
`entries` MultiRunnerEntry array			MaxItems: 100 MinItems: 1

MultiRunnerStatus¶

MultiRunnerStatus defines the observed state of MultiRunner. The maps are keyed by entry name.

Appears in: - MultiRunner

Field	Description	Validation
`error` string
`runner_ids` object (keys:string, values:integer)	RunnerIDs holds the GitLab numeric id per entry name for managed runners.
`registration_hashes` object (keys:string, values:string)	RegistrationHashes holds the create-options hash per entry name.
`token_expires_at` object (keys:string, values:Time)	TokenExpiresAt holds the managed runner token expiry per entry name.
`observed_generation` integer	ObservedGeneration is the spec generation the controller last acted on.	Optional: {}
`conditions` Condition array	Conditions holds the latest observations of the runner state.	Optional: {}
`ready` boolean
`config_map_version` string

NodeSelector¶

Appears in: - KubernetesNodeAffinity

Field	Description	Default	Validation
`node_selector_terms` NodeSelectorTerm array

NodeSelectorRequirement¶

Appears in: - LabelSelector - NodeSelectorTerm

Field	Description	Default	Validation
`key` string
`operator` string
`values` string array

NodeSelectorTerm¶

Appears in: - NodeSelector - PreferredSchedulingTerm

Field	Description	Default	Validation
`match_expressions` NodeSelectorRequirement array
`match_fields` NodeSelectorRequirement array

PodAffinityTerm¶

Appears in: - KubernetesPodAffinity - KubernetesPodAntiAffinity - WeightedPodAffinityTerm

Field	Description	Default	Validation
`label_selector` LabelSelector
`namespaces` string array
`topology_key` string
`namespace_selector` LabelSelector
`match_label_keys` string array
`mismatch_label_keys` string array

PreferredSchedulingTerm¶

Appears in: - KubernetesNodeAffinity

Field	Description	Default	Validation
`weight` integer
`preference` NodeSelectorTerm

Runner¶

Runner is the Schema for the runners API

Field	Description	Default	Validation
`apiVersion` string	`gitlab.k8s.alekc.dev/v1beta2`
`kind` string	`Runner`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` RunnerSpec
`status` RunnerStatus

RunnerCreateOptions¶

RunnerCreateOptions mirrors the POST /user/runners request body. It is only used in managed mode.

Appears in: - GitlabAuth

Field	Description	Validation
`runner_type` string	RunnerType selects the scope of the runner to create.	Enum: [instance_type group_type project_type]
`group_id` integer	GroupID is required when RunnerType is group_type.	Optional: {}
`project_id` integer	ProjectID is required when RunnerType is project_type.	Optional: {}
`description` string		Optional: {}
`paused` boolean		Optional: {}
`locked` boolean		Optional: {}
`run_untagged` boolean		Optional: {}
`tag_list` string array		Optional: {}
`access_level` string		Optional: {}
`maximum_timeout` integer		Optional: {}
`maintenance_note` string		Optional: {}

RunnerSpec¶

RunnerSpec defines the desired state of Runner

Appears in: - Runner

Field	Description	Default	Validation
`authentication` GitlabAuth	Authentication configures how the runner authenticates to GitLab.
`gitlab_instance_url` string		https://gitlab.com/	Optional: {}
`log_level` string			Enum: [panic fatal error warning info debug]
`concurrent` integer			Minimum: 1
`limit` integer	Limit caps the jobs this entry runs at once. Zero omits the key, and upstream acquireBuild only enforces a limit when it is above zero, so the entry is bounded by Concurrent alone. Both apply, lower wins.		Minimum: 0
`request_concurrency` integer	RequestConcurrency caps job requests in flight to GitLab, not jobs running. Zero omits the key, and upstream GetRequestConcurrency returns max(1, x), so absent means 1 and a raised Limit then fills slowly.		Minimum: 0
`check_interval` integer			Minimum: 3
`log_format` string			Enum: [runner text json]
`executor_config` KubernetesConfig
`environment` string array	Environment contains custom environment variables injected to build environment		Optional: {}
`runner_image` string	RunnerImage overrides the gitlab-runner container image. Defaults to DefaultRunnerImage when empty.		Optional: {}
`runner_resources` ResourceRequirements	RunnerResources overrides the resource requests/limits of the runner manager container.		Optional: {}
`runner_image_pull_policy` PullPolicy	RunnerImagePullPolicy overrides the runner container image pull policy.		Enum: [Always Never IfNotPresent] Optional: {}
`runner_security_context` SecurityContext	RunnerSecurityContext overrides the runner manager container security context.		Optional: {}
`runner_env` EnvVar array	RunnerEnv sets extra env vars on the runner manager container, e.g. an outbound HTTP_PROXY. Distinct from Environment, which only reaches job builds via config.toml. Prefer valueFrom for secrets, plain values log verbatim; a fieldRef needs an explicit apiVersion or reconciles forever.		Optional: {}
`runner_node_selector` object (keys:string, values:string)	RunnerNodeSelector constrains the runner manager pod to nodes carrying these labels. Shapes the manager only; executor_config.node_selector places job pods.		Optional: {}
`runner_tolerations` Toleration array	RunnerTolerations lets the runner manager pod schedule onto tainted nodes. Native Kubernetes list shape, not the "key=value": "effect" map that executor_config.node_tolerations takes.		Optional: {}
`runner_affinity` Affinity	RunnerAffinity sets affinity on the runner manager pod. Prefer RunnerNodeSelector for equality matching and reach for this only for In / NotIn / Exists or a soft preference.		Optional: {}
`runner_priority_class_name` string	RunnerPriorityClassName protects the runner manager pod from preemption. A manager killed mid-job loses the jobs it was tracking, so it wants a higher priority than the workloads it shares a node with.		Optional: {}
`caCertificate` CASource	CACertificate, when set, provides a PEM CA bundle used to verify the GitLab endpoint for both the operator's API calls and the runner's own connection. Supply it inline (value) or from a Secret/ConfigMap key.		Optional: {}

RunnerStatus¶

RunnerStatus defines the observed state of Runner

Appears in: - Runner

Field	Description	Validation
`error` string
`runner_id` integer	RunnerID is the numeric id GitLab assigned to a managed runner created through the access-token path. Zero for bring-your-own-token runners.
`token_expires_at` Time	TokenExpiresAt is GitLab's expiry for a managed runner token, if any.	Optional: {}
`registration_hash` string	RegistrationHash captures the create options that produced the current managed runner; a change forces a recreate.
`config_map_version` string
`observed_generation` integer	ObservedGeneration is the spec generation the controller last acted on.	Optional: {}
`conditions` Condition array	Conditions holds the latest observations of the runner state.	Optional: {}
`ready` boolean	Ready indicates that all runner operations have completed and the object is ready to serve.

SecretKeySelector¶

SecretKeySelector points at a single key inside a Secret in the runner's namespace. It mirrors corev1.SecretKeySelector but makes Key optional so it can default to "token"; the upstream type marks Key required, which would force every reference to spell it out.

Appears in: - TokenSource

Field	Description	Validation
`name` string	Name of the Secret in the runner's namespace.	MinLength: 1
`key` string	Key holding the token. Defaults to "token" when omitted.	Optional: {}
`optional` boolean	Optional, when true, lets a missing secret or key resolve to an empty token instead of failing.	Optional: {}

Service¶

Appears in: - KubernetesConfig

Field	Description	Default	Validation
`name` string
`alias` string
`command` string array
`entrypoint` string array
`environment` string array

TokenSource¶

TokenSource supplies a credential in one of two mutually exclusive ways: an inline literal value, or a reference to a key inside a Kubernetes Secret in the runner's namespace. Exactly one of Value / SecretKeyRef may be set.

Appears in: - GitlabAuth

Field	Description	Default	Validation
`value` string	Value is the literal token. Convenient for testing; prefer SecretKeyRef in production so the token is not stored in the object spec.		Optional: {}
`secret_key_ref` SecretKeySelector	SecretKeyRef reads the token from a Secret in the runner's namespace. The referenced key defaults to "token" when Key is omitted. Optional is honoured: when true, a missing secret or key resolves to an empty token instead of failing.		Optional: {}

WeightedPodAffinityTerm¶

Appears in: - KubernetesPodAffinity - KubernetesPodAntiAffinity

Field	Description	Default	Validation
`weight` integer
`pod_affinity_term` PodAffinityTerm