Fission CRD Reference
Fission Custom Resources Definition(CRD) Reference
API Reference
Packages
fission.io/v1
Package v1 contains API Schema definitions for the fission.io v1 API group
Resource Types
- CanaryConfig
- Environment
- FissionTenant
- FissionTenantList
- Function
- FunctionAlias
- FunctionAliasList
- FunctionVersion
- FunctionVersionList
- HTTPTrigger
- KubernetesWatchTrigger
- MessageQueueTrigger
- Package
- TimeTrigger
- Workflow
- WorkflowList
- WorkflowRun
- WorkflowRunList
AliasTargetRecord
AliasTargetRecord is one entry in FunctionAliasStatus.History: a previously resolved target, kept for audit / rollback visibility.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
version string | |||
packageDigest string | |||
switchedAt Time |
AllowedFunctionsPerContainer
Underlying type: string
AllowedFunctionsPerContainer defaults to ‘single’. Related to Fission Workflows
Appears in:
Archive
Archive contains or references a collection of sources or binary files. The CEL rule below deliberately never references self.literal: any access to a byte-format field (even has()) makes the apiserver convert its base64 value for CEL using URL-safe decoding, which rejects any standard-base64 payload containing ‘/’ or ‘+’ — in practice every zipped literal archive. The literal/oci combination is instead rejected by the webhook (Archive.Validate), with the same message.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
type ArchiveType | Type defines how the package is specified: literal, URL, or OCI. Available value: - literal - url - oci | Enum: [ literal url oci] | |
literal integer array | Literal contents of the package. Can be used for encoding packages below TODO (256 KB?) size. | ||
url string | URL references a package. | ||
checksum Checksum | Checksum ensures the integrity of packages referenced by URL. Ignored for literals. | ||
oci OCIArchive | OCI references an OCI image holding the deployment code. Mutually exclusive with Literal and URL. Supported only on PackageSpec.Deployment; PackageSpec.Validate rejects it on Source (source archives feed the builder, which has no OCI pull path). |
ArchiveType
Underlying type: string
ArchiveType is literal, url, or oci, indicating whether the package is specified in the Archive struct or externally.
Appears in:
| Field | Description |
|---|---|
literal | ArchiveTypeLiteral means the package contents are specified in the Literal field of resource itself. |
url | ArchiveTypeUrl means the package contents are at the specified URL. |
oci | ArchiveTypeOCI means the package contents are the filesystem of an OCI image referenced in the OCI field of the resource. |
BuildStatus
Underlying type: string
BuildStatus indicates the current build status of a package.
Appears in:
Builder
Builder is the setting for environment builder. Bounded podspec / container safety rules — see the matching Runtime block above.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
image string | Image for containing the language compilation environment. | ||
command string | (Optional) Default build command to run for this build environment. | ||
container Container | (Optional) Container allows the modification of the deployed builder container using the Kubernetes Container spec. Fission overrides the following fields: - Name - Image; set to the Builder.Image - Command; set to the Builder.Command - TerminationMessagePath - ImagePullPolicy - ReadinessProbe | ||
podspec PodSpec | PodSpec will store the spec of the pod that will be applied to the pod created for the builder |
CanaryConfig
CanaryConfig is for canary deployment of two functions.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | CanaryConfig | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec CanaryConfigSpec | |||
status CanaryConfigStatus |
CanaryConfigSpec
CanaryConfigSpec defines the canary configuration spec
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
trigger string | HTTP trigger that this config references | ||
newfunction string | New version of the function | ||
oldfunction string | Old stable version of the function | ||
weightincrement integer | Weight increment step for function | ||
duration string | Weight increment interval, string representation of time.Duration, ex : 1m, 2h, 2d (default: “2m”) | ||
failurethreshold integer | Threshold in percentage beyond which the new version of the function is considered unstable | ||
failureType FailureType |
CanaryConfigStatus
CanaryConfigStatus represents canary config status
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
status string | |||
conditions Condition array | Conditions represent the latest observations of the canary’s state. |
Checksum
Checksum of package contents when the contents are stored outside the Package struct. Type is the checksum algorithm; “sha256” is the only currently supported one. Sum is hex encoded.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
type ChecksumType | |||
sum string |
ChecksumType
Underlying type: string
ChecksumType specifies the checksum algorithm, such as sha256, used for a checksum.
Appears in:
| Field | Description |
|---|---|
sha256 |
ConfigMapReference
ConfigMapReference is a reference to a kubernetes configmap.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
namespace string | |||
name string | MaxLength: 63 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ | ||
mountPath string | MountPath redirects this configmap’s file projection from the default /configs/ See SecretReference.MountPath for the constraint rationale. |
DestinationRef
DestinationRef routes an async invocation’s result to exactly one target: a Function (invoked async through the same machinery, depth-capped) or a Topic (published to a message queue). Exactly one of Function/Topic must be set. Topic destinations on the built-in statestore provider are supported (RFC-0027); broker types are rejected by the webhook until the egress phase lands.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
function FunctionReference | Function is a same-namespace function destination, invoked asynchronously with the result envelope as its body (depth-capped to stop runaway chains). | ||
topic TopicRef | Topic publishes the result envelope to a message-queue topic. |
Environment
Environment is environment for building and running user functions.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | Environment | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec EnvironmentSpec | |||
status EnvironmentStatus |
EnvironmentReference
EnvironmentReference is a reference to an environment. It is used by both FunctionSpec.Environment and PackageSpec.Environment.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
namespace string | |||
name string | Name of the referenced environment. Optional + omitempty: an unset reference is omitted and its Pattern skipped (a container function has no environment; a Package with an unset environment is admitted and fails later with a clear builder error — the fission CLI still rejects it). When set, it must be a DNS-1123 label. | MaxLength: 63 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ |
EnvironmentSpec
EnvironmentSpec contains with builder, runtime and some other related environment settings.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
version integer | Version is the Environment API version Version “1” allows user to run code snippet in a file, and it’s supported by most of the environments except tensorflow-serving. Version “2” supports downloading and compiling user function if source archive is not empty. Version “3” is almost the same with v2, but you’re able to control the size of pre-warm pool of the environment. | Maximum: 3 Minimum: 1 | |
runtime Runtime | Runtime is configuration for running function, like container image etc. | ||
builder Builder | (Optional) Builder is configuration for builder manager to launch environment builder to build source code into deployable binary. | ||
allowedFunctionsPerContainer AllowedFunctionsPerContainer | (Optional) defaults to ‘single’. Fission workflow uses ‘infinite’ to load multiple functions in one function pod. Available value: - single - infinite | Enum: [single infinite] | |
allowAccessToExternalNetwork boolean | Istio default blocks all egress traffic for safety. To enable accessibility of external network for builder/function pod, set to ’true’. (Optional) defaults to ‘false’ | ||
resources ResourceRequirements | The request and limit CPU/MEM resource setting for poolmanager to set up pods in the pre-warm pool. (Optional) defaults to no limitation. | ||
poolsize integer | The initial pool size for environment | Minimum: 0 | |
terminationGracePeriod integer | The grace time for pod to perform connection draining before termination. The unit is in seconds. A terminating function pod keeps serving for the WHOLE grace window (the preStop hook sleeps through it, then the kubelet kills the pod), so this value is exactly how long every teardown — idle reap, env update roll, upgrade, node drain — takes per pod. 90s covers endpoint propagation (seconds) plus the 60s default function timeout with margin, mirroring the router’s own 75s-drain/90s-grace posture; set it per environment for functions with longer request timeouts. The CRD default below is what makes the documented default true for API-created Environments: nil means “use the default” and the apiserver fills an absent field with 90 at serving time. The pointer is what makes an EXPLICIT 0 (“no drain window, kill instantly”) expressible from typed Go clients: on the previous int64 field, omitempty marshalled 0 as absent and the apiserver served it back as 90, so raw YAML was the only way to say 0. In-process readers must use EffectiveTerminationGracePeriod() (env_validation.go), which mirrors the CRD default for objects that never crossed the apiserver. (Optional) defaults to 90 seconds | 90 | Minimum: 0 |
keeparchive boolean | KeepArchive is used by fetcher to determine if the extracted archive or unarchived file should be placed, which is then used by specialize handler. (This is mainly for the JVM environment because .jar is one kind of zip archive.) | ||
imagepullsecret string | ImagePullSecret is the secret for Kubernetes to pull an image from a private registry. |
EnvironmentStatus
EnvironmentStatus describes the observed state of an Environment.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
observedGeneration integer | |||
conditions Condition array |
ExecutionStrategy
ExecutionStrategy specifies low-level parameters for function execution, such as the number of instances.
MinScale affects the cold start behavior for a function. If MinScale is 0 then the deployment is created on first invocation of function and is good for requests of asynchronous nature. If MinScale is greater than 0 then MinScale number of pods are created at the time of creation of function. This ensures faster response during first invocation at the cost of consuming resources.
MaxScale is the maximum number of pods that function will scale to based on TargetCPUPercent and resources allocated to the function pod.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
ExecutorType ExecutorType | ExecutorType is the executor type of function used. Defaults to “poolmgr”. Available value: - poolmgr - newdeploy - container | ||
MinScale integer | This is only for newdeploy to set up minimum replicas of deployment. | ||
MaxScale integer | This is only for newdeploy to set up maximum replicas of deployment. | ||
TargetCPUPercent integer | Deprecated: use hpaMetrics instead. This is only for executor type newdeploy and container to set up target CPU utilization of HPA. Applicable for executor type newdeploy and container. | ||
SpecializationTimeout integer | This is the timeout setting for executor to wait for pod specialization. | ||
hpaMetrics MetricSpec array | hpaMetrics is the list of metrics used to determine the desired replica count of the Deployment created for the function. Applicable for executor type newdeploy and container. | ||
hpaBehavior HorizontalPodAutoscalerBehavior | hpaBehavior is the behavior of HPA when scaling in up/down direction. Applicable for executor type newdeploy and container. |
ExecutorType
Underlying type: string
ExecutorType is the primary executor for an environment
Appears in:
| Field | Description |
|---|---|
poolmgr | |
newdeploy | |
container |
FailureType
Underlying type: string
FailureType refers to the type of failure
Appears in:
| Field | Description |
|---|---|
status-code | failure type currently supported is http status code. This could be extended in the future. |
FissionTenant
FissionTenant onboards a Kubernetes namespace for Fission. It is the cluster-scoped source of truth the tenant-lifecycle controller reconciles into the live resource-namespace set (and, in later phases, per-namespace RBAC, service accounts, and auth keys). Setting the label fission.io/enabled=true on a Namespace is sugar the controller materializes into one of these. See docs/multiple-namespace/prd.md.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | FissionTenant | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec FissionTenantSpec | |||
status FissionTenantStatus |
FissionTenantList
FissionTenantList is a list of FissionTenants.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | FissionTenantList | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ListMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
items FissionTenant array |
FissionTenantSpec
FissionTenantSpec declares which namespace Fission manages and, optionally, where that tenant’s function and builder workloads run.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
namespace string | Namespace is the Kubernetes namespace this tenant onboards. It is the immutable join key to the live Namespace. | MaxLength: 63 MinLength: 1 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ | |
functionNamespace string | FunctionNamespace, if set, is where this tenant’s function pods and Services run; empty means they run in spec.namespace. Generalizes the deprecated cluster-global FISSION_FUNCTION_NAMESPACE to a per-tenant mapping. | MaxLength: 63 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ | |
builderNamespace string | BuilderNamespace, if set, is where this tenant’s builder pods run; empty means they run in spec.namespace. | MaxLength: 63 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ |
FissionTenantStatus
FissionTenantStatus reports the controller’s progress onboarding the tenant.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
observedGeneration integer | ObservedGeneration is the spec generation the controller last reconciled. | ||
conditions Condition array | Conditions are the latest observations of the tenant’s state: RBACProvisioned, ServiceAccountsReady, AuthKeyProvisioned, WatchActive, and the Ready rollup. |
Function
Function is function runs within environment runtime with given package and secrets/configmaps.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | Function | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec FunctionSpec | |||
status FunctionStatus |
FunctionAlias
FunctionAlias is a mutable, named pointer at one (or, during a weighted rollout, two) FunctionVersion(s) of a Function (RFC-0025). Aliases are what triggers reference in production; moving an alias is how a rollout or rollback happens without touching the trigger.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | FunctionAlias | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec FunctionAliasSpec | |||
status FunctionAliasStatus |
FunctionAliasList
FunctionAliasList is a list of FunctionAliases.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | FunctionAliasList | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ListMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
items FunctionAlias array |
FunctionAliasSpec
Repo convention (types.go:755,778,955): guard BOTH absent and explicit-empty on optional strings.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
functionName string | MaxLength: 63 | ||
version string | Version pins by FunctionVersion name (imperative path). XOR PackageDigest. | ||
packageDigest string | PackageDigest pins declaratively (GitOps): resolved asynchronously to the FunctionVersion that recorded this digest; eventually consistent. | Pattern: ^sha256:[a-f0-9]\{64\}$ | |
weight integer | Weight (0-100) served by the primary target; nil = 100%. | Maximum: 100 Minimum: 0 | |
secondaryVersion string | SecondaryVersion receives 100-Weight. Name-pinned only. |
FunctionAliasStatus
FunctionAliasStatus describes the observed state of a FunctionAlias.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
resolvedVersion string | ResolvedVersion is the FunctionVersion name this alias currently resolves to (always name-pinned, even when Spec.PackageDigest declares the target declaratively). | ||
history AliasTargetRecord array | History is a bounded tail of previously resolved targets, most recent last. | ||
conditions Condition array |
FunctionPackageRef
FunctionPackageRef includes the reference to the package also the entrypoint of package.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
packageref PackageRef | Package reference | ||
functionName string | FunctionName specifies a specific function within the package. This allows functions to share packages, by having different functions within the same package. Fission itself does not interpret this path. It is passed verbatim to build and runtime environments. This is optional: if unspecified, the environment has a default name. |
FunctionReference
FunctionReference refers to a function
Appears in:
- DestinationRef
- HTTPTriggerSpec
- KubernetesWatchTriggerSpec
- MessageQueueTriggerSpec
- TimeTriggerSpec
- WorkflowBranchState
- WorkflowState
| Field | Description | Default | Validation |
|---|---|---|---|
type FunctionReferenceType | Type indicates whether this function reference is by name or selector. For now, the only supported reference type is by “name”. Future reference types: * Function by label or annotation * Branch or tag of a versioned function * A “rolling upgrade” from one version of a function to another Available value: - name - function-weights | Enum: [name function-weights] | |
name string | Name of the function. Bounded to a DNS-1123 label length: the CEL rule on this type needs the schema bound so the apiserver’s cost estimator can price the regex — without it, embedding the type under a map (WorkflowSpec.States) blows the per-CRD cost budget. | MaxLength: 63 | |
alias string | Alias, when set, targets a FunctionAlias by name instead of the live Function directly (RFC-0025): the alias is a movable pointer that the router resolves at request time to whatever FunctionVersion it currently points at, so repointing the alias (e.g. for a canary rollout or a rollback) redirects traffic without touching this reference. Valid only when Type is “name”; mutually exclusive with Version. Empty (the default) preserves today’s behavior: route straight to the live Function. | MaxLength: 63 | |
version string | Version, when set, pins this reference to one FunctionVersion CR by name (RFC-0025) — an immutable published snapshot that never moves, unlike Alias. Valid only when Type is “name”; mutually exclusive with Alias. Empty (the default) preserves today’s behavior: route straight to the live Function. | MaxLength: 63 | |
functionweights object (keys:string, values:integer) | Function Reference by weight. this map contains function name as key and its weight as the value. This is for canary upgrade purpose. |
FunctionReferenceType
Underlying type: string
FunctionReferenceType refers to type of Function
Appears in:
FunctionSpec
FunctionSpec describes the contents of the function. Bounded podspec safety rules — CEL admission gate for the simple pod-level invariants. Per-container SecurityContext checks stay in the webhook (ValidatePodSpecSafety) because iterating containers exceeds the CEL cost budget; the rules here cover only the bounded, cheap cases. The has() guards on each scalar are required: PodSpec’s bool/string fields are json:"…,omitempty" so a zero/empty value is OMITTED from the object, and CEL errors with “no such key” if the rule accesses an absent field.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
environment EnvironmentReference | Environment is the build and runtime environment that this function is associated with. An Environment with this name should exist, otherwise the function cannot be invoked. | ||
package FunctionPackageRef | Reference to a package containing deployment and optionally the source. | ||
secrets SecretReference array | Reference to a list of secrets. | ||
configmaps ConfigMapReference array | Reference to a list of configmaps. | ||
env EnvVar array | Env lists per-function environment variables set on the function’s runtime container: literals, plus key-level references into same-namespace Secrets/ConfigMaps via valueFrom (secretKeyRef / configMapKeyRef only — fieldRef and resourceFieldRef are rejected at admission because poolmgr’s specialize-time injection cannot honor pod-level field refs portably; RFC-0030 §1). Function Env wins over EnvFrom, which wins over the environment podspec’s merged env. Platform-reserved names (FISSION_*, RESOURCE_VERSION_COUNT, and the interpreter/proxy-hijack set) are denied at admission and enforced at injection. Additive and backward compatible. | ||
envFrom EnvFromSource array | EnvFrom projects whole same-namespace Secrets/ConfigMaps into the function’s environment, with an optional prefix; later sources win over earlier ones (Kubernetes semantics), and function Env literals win over all EnvFrom keys. Two phase-1 limits, both inherent to native (kubelet) injection: the kubelet expands envFrom BEFORE container env, so a name the environment podspec sets as a literal still beats an EnvFrom-supplied key of the same name; and reserved platform names appearing as data keys of a referenced object are not filtered (they are unknowable at admission and mutable afterwards) — they are only shadowed by the platform vars actually present on the container. Key-level filtering and full precedence arrive with the poolmgr phase, which resolves values itself. Additive and backward compatible. | ||
resources ResourceRequirements | cpu and memory resources as per K8S standards This is only for newdeploy to set up resource limitation when creating deployment for a function. | ||
InvokeStrategy InvokeStrategy | InvokeStrategy is a set of controls which affect how function executes | ||
functionTimeout integer | FunctionTimeout provides a maximum amount of duration within which a request for a particular function execution should be complete. This is optional. If not specified default value will be taken as 60s | ||
idletimeout integer | IdleTimeout specifies the length of time that a function is idle before the function pod(s) are eligible for deletion. If no traffic to the function is detected within the idle timeout, the executor will then recycle the function pod(s) to release resources. | ||
streaming StreamingConfig | Streaming opts this function into the router’s streaming invocation path: incremental flushing, an idle/max timeout split, and a router-driven pod keepalive for the connection’s lifetime. When nil (the default) the function uses the classic buffered, retry-on-transient-error proxy path with a single FunctionTimeout deadline. Additive and backward compatible. | ||
tool ToolConfig | Tool, when non-nil, advertises this function as a Model Context Protocol (MCP) tool on the fission-bundle –mcpPort server. The MCP server watches Function CRDs and hot-updates its tool list from this field. Presence is the on switch (like Streaming): nil (the default) means the function is never advertised as a tool. Additive and backward compatible. | ||
state StateConfig | State, when non-nil, opts this function into the RFC-0023 keyed-state API: a scoped statesvc keyspace backed by the RFC-0021 statestore, with a per-function token injected at specialization time. Presence is the on switch (like Streaming and Tool): nil (the default) means exactly today’s behavior. Additive and backward compatible. | ||
invocation InvocationConfig | Invocation, when non-nil, tunes RFC-0024 asynchronous invocation (X-Fission-Invoke-Mode: async) for this function: the durable retry policy and the maximum event age before an undelivered invocation is dead-lettered. A function without it still accepts async mode with platform defaults; this field only tunes them. Additive and backward compatible. | ||
concurrency integer | Maximum number of pods to be specialized which will serve requests This is optional. If not specified default value will be taken as 500 | ||
requestsPerPod integer | RequestsPerPod indicates the maximum number of concurrent requests that can be served by a specialized pod This is optional. If not specified default value will be taken as 1 | ||
onceOnly boolean | OnceOnly specifies if specialized pod will serve exactly one request in its lifetime and would be garbage collected after serving that one request This is optional. If not specified default value will be taken as false | ||
retainPods integer | RetainPods specifies the number of specialized pods that should be retained after serving requests This is optional. If not specified default value will be taken as 0 | ||
provisionedConcurrency ProvisionedConcurrencyConfig | ProvisionedConcurrency, when non-nil, opts this function into eager pre-warming of specialized pods (RFC-0026). The executor’s provisioner keeps at least the configured Target specialized pods warm, published to the function’s headless Service, and exempt from the idle reaper. nil (the default) is the classic on-demand cold-start path. Additive and backward compatible. Only valid when InvokeStrategy.ExecutionStrategy.ExecutorType is poolmgr. | ||
versioning VersioningConfig | Versioning, when non-nil, opts this function into RFC-0025 immutable version snapshots and named aliases. Presence is the on switch (like Streaming and Tool): nil (the default) means exactly today’s mutable in-place behavior. Additive and backward compatible. | ||
podspec PodSpec | Podspec specifies podspec to use for executor type container based functions Different arguments mentioned for container based function are populated inside a pod. |
FunctionStatus
FunctionStatus describes the observed state of a Function.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
observedGeneration integer | ObservedGeneration reflects the .metadata.generation that the controller observed when it last updated the status. | ||
provisionedReady integer | ProvisionedReady is the number of warm specialized pods the provisioner is currently maintaining for this function (RFC-0026). Only meaningful when Spec.ProvisionedConcurrency is non-nil. Reported by the executor’s provisioner on each reconcile pass. | ||
provisionedTarget integer | ProvisionedTarget is the effective target the provisioner is currently aiming for (base Target, or a schedule-window override in PR 2). Lets fission fn get show “3/5 provisioned pods ready”. | ||
provisionedSpecTarget integer | ProvisionedSpecTarget is the raw Target from spec (before the namespace cap clamp). When ProvisionedSpecTarget > ProvisionedTarget, the provisioner clamped the target to the namespace cap (executor.provisionedConcurrency.maxPerFunction) and the Provisioned condition carries reason ProvisionedClamped. Lets fission fn getshow the spec-vs-effective divergence. | ||
conditions Condition array | Conditions represent the latest observations of the function’s state. |
FunctionVersion
FunctionVersion is an immutable snapshot of a Function’s spec at publish
time (RFC-0025). Versions are minted by the version-control loop (auto
mode) or fission fn publish (manual mode) and are never mutated after
creation — only garbage collected once unreferenced by any FunctionAlias
and beyond the retain floor. FunctionVersion carries no Status: its
content is fixed at creation, so there is nothing to reconcile.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | FunctionVersion | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec FunctionVersionSpec |
FunctionVersionList
FunctionVersionList is a list of FunctionVersions.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | FunctionVersionList | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ListMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
items FunctionVersion array |
FunctionVersionSpec
FunctionVersionSpec is the immutable snapshot recorded by one publish.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
functionName string | MaxLength: 63 | ||
functionUID UID | FunctionUID and FunctionGeneration pin the executor identity of this snapshot: (UID, Generation) is the pool/cache key (crd.CacheKeyUG), so a version is a generation pin, not a new identity. | ||
functionGeneration integer | |||
sequence integer | Minimum: 1 | ||
snapshot FunctionSpec | Snapshot is the function spec at publish time with Versioning zeroed (never nested) and, for legacy packages, PackageRef repointed at the version-owned snapshot Package. | ||
packageDigest string | PackageDigest pins content: the OCI digest or sha256: | ||
envObservedGeneration integer | Environment observation at publish time (observational, not pinning). | ||
envRuntimeImage string | |||
publishedAt Time |
GatewayParentRef
GatewayParentRef references a Gateway (and optionally a specific listener) that the generated HTTPRoute attaches to. It mirrors the subset of gateway.networking.k8s.io ParentReference that Fission needs.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
name string | Name of the parent Gateway. | ||
namespace string | Namespace of the parent Gateway. Defaults to the router’s namespace when empty. A non-empty, different namespace needs a ReferenceGrant. | ||
sectionName string | SectionName selects a specific listener on the Gateway. Empty attaches to all compatible listeners. | ||
port integer | Port narrows attachment to a specific Gateway listener port. | Maximum: 65535 Minimum: 1 |
GatewayRouteConfig
GatewayRouteConfig is the Gateway-API-specific portion of a RouteConfig.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
parentRefs GatewayParentRef array | ParentRefs are the Gateways the generated HTTPRoute attaches to. The referenced Gateways are owned by the cluster operator (Fission does not create Gateways or GatewayClasses). A cross-namespace parentRef requires a ReferenceGrant in the Gateway’s namespace. |
HTTPTrigger
HTTPTrigger is the trigger invokes user functions when receiving HTTP requests.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | HTTPTrigger | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec HTTPTriggerSpec | |||
status HTTPTriggerStatus |
HTTPTriggerCorsConfig
HTTPTriggerCorsConfig is the per-HTTPTrigger CORS allowlist. It is consumed by the router public listener to attach a CORS middleware to the trigger’s route. Triggers without a CorsConfig receive no Access-Control-* response headers and therefore deny cross-origin browser reads at the Same-Origin Policy layer.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
allowOrigins string array | AllowOrigins is the list of allowed origins (scheme + host + port). Use [""] to allow any origin. Mixing “” with AllowCredentials=true is a configuration error and is rejected by validation; browsers refuse the response in that combination. | ||
allowMethods string array | AllowMethods is the list of HTTP methods echoed in the Access-Control-Allow-Methods preflight response. When empty the trigger’s existing Methods field is used. | ||
allowHeaders string array | AllowHeaders is the list of request headers the browser is allowed to send, echoed in Access-Control-Allow-Headers. | ||
exposeHeaders string array | ExposeHeaders is the list of response headers exposed to the browser, set in Access-Control-Expose-Headers. | ||
allowCredentials boolean | AllowCredentials sets Access-Control-Allow-Credentials. When true, AllowOrigins MUST NOT contain “*”. | ||
maxAge string | MaxAge is the preflight cache lifetime as parsed by time.ParseDuration. Empty means the header is omitted. |
HTTPTriggerSpec
HTTPTriggerSpec is for router to expose user functions at the given URL path.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
host string | Deprecated: the original idea of this field is not for setting Ingress. Since we have IngressConfig now, remove Host after couple releases. | Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)?$ | |
relativeurl string | RelativeURL is the exposed URL for external client to access a function with. | ||
prefix string | Prefix with which functions are exposed. NOTE: Prefix takes precedence over URL/RelativeURL. Note that it does not treat slashes specially ("/foobar/" will be matched by the prefix “/foobar”). | ||
keepPrefix boolean | When function is exposed with Prefix based path, keepPrefix decides whether to keep or trim prefix in URL while invoking function. | ||
method string | Use Methods instead of Method. This field is going to be deprecated in a future release HTTP method to access a function. | Enum: [ GET HEAD POST PUT PATCH DELETE CONNECT OPTIONS TRACE] | |
methods string array | HTTP methods to access a function | items:Enum: [GET HEAD POST PUT PATCH DELETE CONNECT OPTIONS TRACE] | |
invocationMode string | InvocationMode, when “async”, forces every request to this trigger into RFC-0024 asynchronous invocation even without the X-Fission-Invoke-Mode header (webhooks from third parties cannot set headers). "" (the default) leaves the per-request header in control. | Enum: [ async] | |
functionref FunctionReference | FunctionReference is a reference to the target function. | ||
createingress boolean | If CreateIngress is true, router will create an ingress definition. Deprecated: the Kubernetes Ingress API is frozen. Use RouteConfig (with Provider “gateway”) to expose functions through the Gateway API instead. CreateIngress + IngressConfig keep working for the deprecation window but will be removed in a future release. | ||
ingressconfig IngressConfig | IngressConfig for router to set up Ingress. Deprecated: superseded by RouteConfig. See CreateIngress. | ||
routeConfig RouteConfig | RouteConfig declares how the router exposes this trigger through an external route provider (Ingress or the Gateway API). It is the provider-neutral successor to CreateIngress + IngressConfig: when set it takes precedence over those fields. Leave nil to expose the function only through the router’s own URL. | ||
corsConfig HTTPTriggerCorsConfig | CorsConfig configures CORS response headers for browser callers of this trigger. When nil, the router emits no Access-Control-* headers and the browser’s Same-Origin Policy enforces cluster isolation from cross-origin pages (the deny-by-default behaviour). Set this field to allowlist specific origins for SPAs that legitimately call this trigger cross-origin. |
HTTPTriggerStatus
HTTPTriggerStatus describes the observed state of an HTTPTrigger.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
observedGeneration integer | |||
conditions Condition array |
IngressConfig
IngressConfig is for router to set up Ingress. Deprecated: superseded by RouteConfig. The Kubernetes Ingress API is frozen; use RouteConfig with Provider “gateway” for new triggers.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
annotations object (keys:string, values:string) | Annotations will be added to metadata when creating Ingress. | ||
path string | Path is for path matching. The format of path depends on what ingress controller you used. | ||
host string | Host is for ingress controller to apply rules. If host is empty or “*”, the rule applies to all inbound HTTP traffic. | ||
tls string | TLS is for user to specify a Secret that contains TLS key and certificate. The domain name in the key and crt must match the value of Host field. |
InvocationConfig
InvocationConfig tunes RFC-0024 asynchronous invocation for a function. Presence of the enclosing FunctionSpec.Invocation is optional — a function without it still accepts async mode (X-Fission-Invoke-Mode: async) with platform defaults; this struct only tunes them. Field bounds are validated in Go (InvocationConfig.Validate, run at admission via validateForAdmission), not CEL, because metav1.Duration CEL rules are unproven in this CRD. An external dead-letter target is a later RFC-0024 phase.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
retry RetryPolicy | Retry is the durable delivery retry policy. The zero value means platform defaults (a bounded exponential backoff over DefaultMaxAttempts attempts). | ||
maxAge Duration | MaxAge caps how long an invocation may wait for successful delivery, measured from its enqueue time; once exceeded it is dead-lettered with reason “expired”. nil means the platform default. Must be > 0 when set. | ||
onSuccess DestinationRef | OnSuccess, when set, invokes a destination with a Lambda-shaped result envelope after the invocation is delivered successfully (2xx). | ||
onFailure DestinationRef | OnFailure, when set, invokes a destination with the result envelope after the invocation permanently fails (a non-retryable 4xx, the retry budget spent, or MaxAge exceeded). |
InvokeStrategy
InvokeStrategy is a set of controls over how the function executes. It affects the performance and resource usage of the function.
An InvokeStrategy is of one of two types: ExecutionStrategy, which controls low-level parameters such as which ExecutorType to use, when to autoscale, minimum and maximum number of running instances, etc. A higher-level AbstractInvokeStrategy will also be supported; this strategy would specify the target request rate of the function, the target latency statistics, and the target cost (in terms of compute resources).
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
ExecutionStrategy ExecutionStrategy | ExecutionStrategy specifies low-level parameters for function execution, such as the number of instances. | ||
StrategyType StrategyType | StrategyType is the strategy type of function. Now it only supports ’execution’. |
KubernetesWatchTrigger
KubernetesWatchTrigger watches kubernetes resource events and invokes functions.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | KubernetesWatchTrigger | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec KubernetesWatchTriggerSpec | |||
status KubernetesWatchTriggerStatus |
KubernetesWatchTriggerSpec
KubernetesWatchTriggerSpec defines spec of KuberenetesWatchTrigger
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
namespace string | MaxLength: 63 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ | ||
type string | Type of resource to watch (Pod, Service, etc.) | ||
labelselector object (keys:string, values:string) | Resource labels | ||
functionref FunctionReference | The reference to a function for kubewatcher to invoke with when receiving events. |
KubernetesWatchTriggerStatus
KubernetesWatchTriggerStatus describes the observed state of a KubernetesWatchTrigger.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
observedGeneration integer | |||
conditions Condition array |
MessageQueueTrigger
MessageQueueTrigger invokes functions when messages arrive to certain topic that trigger subscribes to.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | MessageQueueTrigger | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec MessageQueueTriggerSpec | |||
status MessageQueueTriggerStatus |
MessageQueueTriggerSpec
MessageQueueTriggerSpec defines a binding from a topic in a message queue to a function.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
functionref FunctionReference | The reference to a function for message queue trigger to invoke with when receiving messages from subscribed topic. | ||
messageQueueType MessageQueueType | Type of message queue (NATS, Kafka, AzureQueue) | ||
topic string | Subscribed topic | ||
respTopic string | Topic for message queue trigger to sent response from function. | ||
errorTopic string | Topic to collect error response sent from function | ||
maxRetries integer | Maximum times for message queue trigger to retry | ||
contentType string | Content type of payload | ||
pollingInterval integer | The period to check each trigger source on every ScaledObject, and scale the deployment up or down accordingly | ||
cooldownPeriod integer | The period to wait after the last trigger reported active before scaling the deployment back to 0 | ||
minReplicaCount integer | Minimum number of replicas KEDA will scale the deployment down to | ||
maxReplicaCount integer | Maximum number of replicas KEDA will scale the deployment up to | ||
metadata object (keys:string, values:string) | Refer to Kubernetes API documentation for fields of metadata. | ||
secret string | Secret name | ||
mqtkind string | Kind of Message Queue Trigger to be created, by default its fission | ||
podspec PodSpec | (Optional) Podspec allows modification of deployed runtime pod with Kubernetes PodSpec The merging logic is briefly described below and detailed MergePodSpec function - Volumes mounts and env variables for function and fetcher container are appended - All additional containers and init containers are appended - Volume definitions are appended - Lists such as tolerations, ImagePullSecrets, HostAliases are appended - Structs are merged and variables from pod spec take precedence |
MessageQueueTriggerStatus
MessageQueueTriggerStatus describes the observed state of a MessageQueueTrigger.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
observedGeneration integer | |||
conditions Condition array |
MessageQueueType
Underlying type: string
MessageQueueType refers to Type of message queue
Appears in:
OCIArchive
OCIArchive references an OCI image whose flattened filesystem contains the deployment code (RFC-0001). The environment runtime image stays the pod’s main container; only how the code reaches the shared volume changes.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
image string | Image is a fully qualified OCI reference: registry/repo:tag[@digest]. | MinLength: 1 | |
imagePullSecrets LocalObjectReference array | ImagePullSecrets are resolved when pulling the image. The fetcher-pull path passes them to the in-fetcher keychain; the image-volume path sets them on pod.Spec.ImagePullSecrets. They must exist in the namespace the function pods run in — the function’s own namespace, or the configured function namespace for default-namespace functions. | ||
subPath string | SubPath points at the deployment root inside the image filesystem, as a clean relative path; empty means the image root. It must be a directory: the image-volume path mounts it via the pod volumeMount subPath, and kubelets reject file subpaths on image volumes. | ||
digest string | Digest is an optional content hash validated on pull. | Pattern: ^sha256:[a-f0-9]\{64\}$ |
Package
Package Think of these as function-level images.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | Package | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec PackageSpec | |||
status PackageStatus | Status indicates the build status of package. |
PackageRef
PackageRef is a reference to the package.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
namespace string | |||
name string | The package reference is optional, so Name is omitempty: when unset it is omitted from the object and the Pattern below is skipped (a function may legitimately have no package). A present name must be a DNS-1123 label. A leaf Pattern (cheap structural validation) is used rather than a spec-level CEL matches() (which would exceed the cost budget). | MaxLength: 63 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ | |
resourceversion string | Including resource version in the reference forces the function to be updated on package update, making it possible to cache the function based on its metadata. |
PackageSpec
PackageSpec includes source/deploy archives and the reference of environment to build the package.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
environment EnvironmentReference | Environment is a reference to the environment for building source archive. | ||
source Archive | Source is the archive contains source code and dependencies file. If the package status is in PENDING state, builder manager will then notify builder to compile source and save the result as deployable archive. | ||
deployment Archive | Deployment is the deployable archive that environment runtime used to run user function. | ||
buildcmd string | BuildCommand is a custom build command that builder used to build the source archive. |
PackageStatus
PackageStatus contains the build status of a package also the build log for examination.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
buildstatus BuildStatus | BuildStatus is the package build status. | pending | Enum: [ pending running succeeded failed none] |
buildlog string | BuildLog stores build log during the compilation. | ||
contentHash string | ContentHash fingerprints the package’s INPUT content (RFC-0029 §3): the source archive when one is present, otherwise the deployment archive. A source package’s deployment is the build’s own product, so folding it in would make every successful build look like a fresh change and rebuild forever. It is what makes a Git-applied Package converge without the CLI: buildermgr compares the spec’s current hash against this one to decide whether the content actually changed, rather than relying on the CLI’s status->pending poke. It also covers packages that never build. A deploy-only or OCI package settles at BuildStatusNone, so the build-success path that re-stamps referencing Functions never runs for it — exactly the digest-pinned-OCI-in-Git golden path. Keying the re-stamp on this hash instead covers both shapes on one code path. An EMPTY value means “not yet recorded” and must never read as “changed”: every package has an empty hash on the first reconcile after this ships, and treating that as a change would rebuild the whole cluster at once. The reconciler seeds it without rebuilding. | ||
lastUpdateTimestamp Time | LastUpdateTimestamp will store the timestamp the package was last updated metav1.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. https://github.com/kubernetes/apimachinery/blob/44bd77c24ef93cd3a5eb6fef64e514025d10d44e/pkg/apis/meta/v1/time.go#L26-L35 | ||
conditions Condition array | Conditions represent the latest observations of the package’s state. |
ProvisionedConcurrencyConfig
ProvisionedConcurrencyConfig opts this function into eager pre-warming of specialized pods (RFC-0026). Presence is the on switch: nil (the default) means the function uses the classic on-demand cold-start path. When non-nil, the executor’s provisioner keeps at least Target specialized pods warm and published to the function’s headless Service, exempt from the idle reaper. Additive and backward compatible.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
target integer | Target is the base number of warm specialized pods to maintain outside any schedule window. Must be >= 1. Schedule windows may override this (see Windows). Bounded by the namespace cap (executor.provisionedConcurrency.maxPerFunction, default 20). | Minimum: 1 | |
windows ProvisionedWindow array | Windows is an optional list of schedule windows that override Target during specific time ranges (RFC-0026 PR 2). Empty in PR 1 — base Target is always in effect. Each window: a cron start expression, a duration, and a window-local target (0 means “un-warm” for the window’s duration). | MaxItems: 32 |
ProvisionedWindow
ProvisionedWindow describes a schedule window that overrides the base ProvisionedConcurrencyConfig.Target during a time range. The window is active from the cron-triggered start for Duration; while active, the effective target is the window’s Target (overlapping windows take the max).
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
name string | Name identifies this window within the function’s ProvisionedConcurrencyConfig.Windows list. Must be unique within the list (listMapKey=name). | MaxLength: 63 MinLength: 1 | |
start string | Start is a cron expression (5-field, robfig/cron, same parser as TimeTrigger) marking when each window instance opens. Prefix with “CRON_TZ= evaluate the schedule in a fixed timezone. Without a CRON_TZ prefix, the schedule is evaluated in the executor process’s local timezone (UTC unless the deployment is configured otherwise) — this is intended behavior, not a default that may change; specify CRON_TZ explicitly if the window must not shift when the executor’s local timezone changes. | MinLength: 1 | |
duration string | Duration is how long each window instance stays open. Format is Go time.ParseDuration (e.g. “12h”, “30m”). Must be > 0. | Pattern: ^[0-9]+(ns|us|µs|ms|s|m|h)$ | |
target integer | Target is the effective target while the window is open. 0 means “un-warm” — provisioned pods are drained for the window’s duration. | Minimum: 0 |
RetryPolicy
RetryPolicy is the async delivery retry policy: the attempt budget and the exponential-backoff schedule between delivery attempts. All fields are optional; a nil field takes the platform default.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
maxAttempts integer | MaxAttempts is the total number of delivery attempts before the invocation is dead-lettered. nil means DefaultMaxAttempts. Must be >= 1 when set. | ||
backoffBase Duration | BackoffBase is the delay before the first retry; it grows exponentially per attempt up to BackoffCap. nil means the platform default. Must be >= 0. | ||
backoffCap Duration | BackoffCap bounds the per-retry backoff. nil means the platform default. Must be >= 0 and >= BackoffBase when both are set. | ||
jitter boolean | Jitter, when non-nil and false, disables the randomized jitter the dispatcher otherwise adds to each backoff to avoid synchronized retries. nil means the platform default (jitter enabled). |
RouteConfig
RouteConfig declares how the router exposes an HTTPTrigger through an external route provider. It is the provider-neutral successor to the deprecated CreateIngress + IngressConfig fields: the router routes it to the matching RouteProvider based on Provider.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
provider RouteProviderType | Provider selects the route provider that reconciles this trigger’s external route. “ingress” creates a networking.k8s.io Ingress (the deprecated path); “gateway” creates a gateway.networking.k8s.io HTTPRoute attached to an operator-managed Gateway. The “gateway” provider must be enabled on the router (GATEWAY_API_ENABLED). | Enum: [ingress gateway] | |
hostnames string array | Hostnames the route matches. For the gateway provider these become the HTTPRoute hostnames; for the ingress provider only the first is used as the Ingress rule host. Empty matches all hosts. | ||
path string | Path is the request path the route matches (must be absolute, start with ‘/’). Defaults to “/” when empty. | ||
annotations object (keys:string, values:string) | Annotations are added to the generated route object (Ingress or HTTPRoute). Use these for implementation-specific configuration understood by your Ingress controller or Gateway implementation. | ||
tls string | TLS names a Secret holding the TLS key and certificate. It applies to the ingress provider only; with the gateway provider TLS termination is configured on the Gateway listener and this field is ignored. | ||
gateway GatewayRouteConfig | Gateway holds Gateway-API-specific configuration. Required (at least one parentRef) when Provider is “gateway”, unless the router is configured with a default Gateway parentRef. |
RouteProviderType
Underlying type: string
RouteProviderType selects how the router exposes an HTTPTrigger externally. It is the type of RouteConfig.Provider; the allowed values are the constants below (also enforced by the field’s kubebuilder Enum marker).
Appears in:
| Field | Description |
|---|---|
ingress | RouteProviderIngress creates a networking.k8s.io Ingress (deprecated). |
gateway | RouteProviderGateway creates a gateway.networking.k8s.io HTTPRoute. |
Runtime
Runtime is the setting for environment runtime. Bounded podspec / container safety rules — CEL admission gate for the simple, bounded fields. Per-container PodSpec.containers iteration stays in the webhook (ValidatePodSpecSafety / ValidateContainerSafety) because it exceeds the CEL cost budget. The has() guards are required because json:"…,omitempty" omits zero/empty values from the object.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
image string | Image for containing the language runtime. | ||
container Container | (Optional) Container allows the modification of the deployed runtime container using the Kubernetes Container spec. Fission overrides the following fields: - Name - Image; set to the Runtime.Image - TerminationMessagePath - ImagePullPolicy You can set either PodSpec or Container, but not both. kubebuilder:validation:XPreserveUnknownFields=true | ||
podspec PodSpec | (Optional) Podspec allows modification of deployed runtime pod with Kubernetes PodSpec The merging logic is briefly described below and detailed MergePodSpec function - Volumes mounts and env variables for function and fetcher container are appended - All additional containers and init containers are appended - Volume definitions are appended - Lists such as tolerations, ImagePullSecrets, HostAliases are appended - Structs are merged and variables from pod spec take precedence You can set either PodSpec or Container, but not both. |
SecretReference
SecretReference is a reference to a kubernetes secret.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
namespace string | |||
name string | MaxLength: 63 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ | ||
mountPath string | MountPath redirects this secret’s file projection from the default /secrets/ the /secrets root (RFC-0030 §4): generic pool pods share a fixed volume set frozen at pool creation, so an arbitrary absolute path is not materializable there, and the container executor applies the same constraint for cross-executor consistency. Empty keeps today’s unaffected. No two secrets on one function may RESOLVE to the same directory (an explicit path colliding with another reference’s default counts): the final segment written is the object’s data key and keys are mutable after admission, so sharing a directory would let one object’s later-added key collide with the other’s file; the fetcher refuses such a write rather than truncating. Honoured on every executor: poolmgr and newdeploy via the fetcher, the container executor via a native projected volume. Not supported on an allowedFunctionsPerContainer:infinite environment, whose pods share one secrets tree across functions. |
StateConfig
StateConfig declares a function’s keyed-state keyspace and quotas (RFC-0023). Presence of the enclosing FunctionSpec.State is the on switch — there is no separate enabled flag, so the in-memory zero value and the stored object never disagree (the same rationale as StreamingConfig).
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
keyspace string | Keyspace names the durable keyspace this function reads and writes. Defaults to the function name; explicit so a function can be renamed without orphaning its data. The charset deliberately excludes ‘:’ and ’#’ — ‘:’ is a token-derivation info-string separator and ‘#’ marks the platform-reserved “ | MaxLength: 63 Pattern: ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$ | |
defaultTTL Duration | DefaultTTL, when set, is applied to writes that carry no explicit TTL. Must be >= 0; zero (or nil) means keys do not expire by default. | ||
maxValueBytes integer | MaxValueBytes caps a single value’s size. 0 means the platform default (DefaultStateMaxValueBytes, 256KiB). Blobs belong in object storage. | Minimum: 0 | |
maxKeys integer | MaxKeys caps the number of live keys in the keyspace, enforced atomically with each write (quota.tla S3). 0 means the platform default (DefaultStateMaxKeys). | Minimum: 0 | |
backend string | Backend selects a named statestore driver for this keyspace. Accepted and validated in v1 but not yet acted on: statesvc serves every keyspace from its single configured driver (per-function backend selection is a documented deferral). | ||
sticky StickyConfig | Sticky, when non-nil, opts the function into sticky routing: the router consistent-hashes the declared request key onto the ready-pod set so one key’s requests land on one pod while the pod set is stable. Best-effort (an optimization, never a correctness dependency — S6): durable truth stays behind the state API. |
StickyConfig
StickyConfig declares how the sticky routing key is extracted from a request. Requests missing the key fall back to the default endpoint pick.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
source StickySource | Source is where to look for the key. | Enum: [header queryparam] | |
name string | Name is the header or query-parameter name holding the key, e.g. “X-Session-Id”. |
StickySource
Underlying type: string
StickySource selects where the router extracts the sticky routing key from an incoming request.
Validation:
- Enum: [header queryparam]
Appears in:
| Field | Description |
|---|---|
header | |
queryparam |
StrategyType
Underlying type: string
StrategyType is the strategy to be used for function execution
Appears in:
StreamingConfig
StreamingConfig controls the router’s streaming behavior for a function. Presence is the on switch: a non-nil Streaming enables the streaming path, nil (the default) is the classic buffered path. There is no separate enabled flag, so the in-memory zero value and the stored object never disagree.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
protocol StreamingProtocol | Protocol hints how the router proxies the response. | auto | Enum: [auto sse chunked websocket] |
idleTimeoutSeconds integer | IdleTimeoutSeconds is the maximum time the router waits without bytes flowing from the function before it aborts the stream; reset on every chunk. 0 means use the package default (DefaultStreamIdleSeconds). | Minimum: 0 | |
maxDurationSeconds integer | MaxDurationSeconds is an optional hard ceiling on total stream lifetime regardless of activity. 0 (the default) means no ceiling — the idle timeout governs. A streaming function does NOT inherit FunctionTimeout as a ceiling; that total-wall-clock cap is exactly what streaming escapes. | Minimum: 0 |
StreamingProtocol
Underlying type: string
StreamingProtocol selects how the router treats the upstream response.
Validation:
- Enum: [auto sse chunked websocket]
Appears in:
| Field | Description |
|---|---|
auto | StreamingAuto flushes immediately and lets the upstream decide the framing (SSE, chunked, or a WebSocket Upgrade); the safe default. |
sse | |
chunked | |
websocket |
TimeTrigger
TimeTrigger invokes functions based on given cron schedule.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | TimeTrigger | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec TimeTriggerSpec | |||
status TimeTriggerStatus |
TimeTriggerSpec
TimeTriggerSpec invokes the specific function at a time or times specified by a cron string.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
cron string | Cron schedule | ||
functionref FunctionReference | The reference to function. Alias is read from the embedded FunctionReference.Alias (RFC-0025) — TimeTriggerSpec has no field of its own for it, so there is exactly one JSON path (spec.functionref.alias) and one Go path (spec.Alias, promoted) for the concept, never two competing ones. The timer publisher (a later RFC-0025 task) reads it the same way timer.go:80 already reads the promoted spec.Name today. | ||
method string | HTTP Method for trigger, ex : GET, POST, PUT, DELETE, HEAD (default: “POST”) | POST | |
subpath string | Subpath to trigger a specific route if function internally supports routing, (default: “/”) | / |
TimeTriggerStatus
TimeTriggerStatus describes the observed state of a TimeTrigger.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
observedGeneration integer | |||
conditions Condition array |
ToolConfig
ToolConfig declares how a Function is exposed as an MCP (Model Context Protocol) tool. The MCP server reuses the function’s existing internal invocation path; this struct only declares the agent-facing tool contract. Presence of the enclosing FunctionSpec.Tool is the on switch — there is no separate enabled flag, so the in-memory zero value and the stored object never disagree (the same rationale as StreamingConfig).
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
description string | Description is the human/agent-facing tool description surfaced in the MCP tools/list response. Required. | ||
inputSchema JSON | InputSchema is the JSON Schema (draft 2020-12) for the tool’s arguments, surfaced verbatim as the MCP tool inputSchema. Stored as raw JSON so the CRD does not constrain the schema shape. When empty the tool advertises an open object schema ({“type”:“object”}). | ||
toolName string | ToolName overrides the advertised tool name. Defaults to " | Pattern: ^[a-zA-Z0-9_-]\{1,64\}$ | |
alias string | Alias, when set, targets a FunctionAlias by name (RFC-0025) instead of the live Function: the MCP registry serves the tool from the alias’s currently-resolved FunctionVersion snapshot, and tools/call is proxied to the “: Empty (the default) preserves today’s behavior. Router/registry-side resolution lands in a later RFC-0025 task — until then this field is accepted but inert. | MaxLength: 63 |
TopicRef
TopicRef is a message-queue topic destination for an async invocation result. Topics are namespace-scoped: the destination publishes to the source function’s namespace (RFC-0024 rule R6).
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
messageQueueType MessageQueueType | MessageQueueType selects the provider: “statestore” (the RFC-0027 built-in, no broker) now; broker types (e.g. kafka) with the egress phase. | ||
topic string | Topic is the topic the result envelope is published to. The schema bounds mirror ValidateTopicName: a stream-safe charset excluding “/” so the topic/ | MaxLength: 249 Pattern: ^[a-zA-Z0-9._-]+$ |
ValidationErrorType
Underlying type: integer
Appears in:
VersioningConfig
VersioningConfig opts a Function into RFC-0025 immutable version snapshots and named aliases.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
mode VersioningMode | Mode auto (default) mints a version on every runtime-affecting update once the referenced package build succeeds; manual mints only on explicit fission fn publish. | auto | Enum: [auto manual] |
retain integer | Retain bounds unaliased version history per function (GC floor 1). Defaults to 10. Alias-referenced versions are never GC’d. | Minimum: 1 |
VersioningMode
Underlying type: string
VersioningMode selects when versions are minted.
Validation:
- Enum: [auto manual]
Appears in:
| Field | Description |
|---|---|
auto | |
manual |
Workflow
Workflow declares a durable state machine whose task states are Fission functions (RFC-0022). The engine executes WorkflowRuns against a snapshot of this spec embedded in the run’s event stream; editing a Workflow never changes in-flight runs.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | Workflow | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec WorkflowSpec | |||
status WorkflowStatus |
WorkflowBranch
WorkflowBranch is one concurrent sub-machine of a Parallel state (or the iterator template of a Map state).
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
startAt string | |||
states object (keys:string, values:WorkflowBranchState) | MaxProperties=20 (vs 100 top-level) keeps the apiserver’s CEL cost estimate for doubly-nested rules under budget — the phase-1 lesson. | MaxProperties: 20 MinProperties: 1 |
WorkflowBranchState
WorkflowBranchState is WorkflowState minus the fan-out fields: nested Parallel/Map is impossible BY TYPE, which is what keeps the CRD schema non-recursive (controller-gen cannot render a self-referential type).
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
type WorkflowStateType | Enum: [Task Choice Parallel Map Wait Succeed Fail] | ||
function FunctionReference | |||
duration Duration | |||
timeout Duration | |||
retry RetryPolicy | |||
catch WorkflowCatchRoute array | |||
choices WorkflowChoiceRule array | |||
default string | |||
inputPath string | |||
resultPath string | |||
outputPath string | |||
next string | |||
end boolean |
WorkflowCatchRoute
WorkflowCatchRoute routes a matched error class to a next state.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
errorType string | ErrorType matches a typed function error ({“errorType”: …} body), a built-in class (Fission.PermanentError, Fission.FunctionError, Fission.Timeout), or Fission.All (matches anything). | ||
next string | |||
resultPath string | ResultPath, when set, merges the error object ({“errorType”: …, “cause”: …}) into the flowing document at this JSONPath, so the catch target still sees the business data (e.g. retry a charge after a grace period). Unset keeps the Step-Functions-parity default: the error object REPLACES the document. |
WorkflowChoiceCondition
WorkflowChoiceCondition is a leaf comparison against the state input. Exactly one operator must be set. Numeric values use resource.Quantity (CRDs cannot carry floats; Quantity accepts YAML numbers and strings).
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
variable string | Variable is a JSONPath into the state’s (shaped) input. Required on every leaf condition — enforced by the webhook, not the schema: this struct is inline-embedded in WorkflowChoiceRule, and a schema-required field would wrongly reject composite (and/or/not) rules that carry no inline leaf. | ||
stringEquals string | |||
numericEquals Quantity | |||
numericGreaterThan Quantity | |||
numericLessThan Quantity | |||
booleanEquals boolean | |||
isPresent boolean | |||
isNull boolean |
WorkflowChoiceRule
WorkflowChoiceRule is one ordered rule of a Choice state: either a leaf condition (inline) or exactly one of And/Or/Not over leaf conditions (depth-1 composition; deeper nesting is additive later).
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
variable string | Variable is a JSONPath into the state’s (shaped) input. Required on every leaf condition — enforced by the webhook, not the schema: this struct is inline-embedded in WorkflowChoiceRule, and a schema-required field would wrongly reject composite (and/or/not) rules that carry no inline leaf. | ||
stringEquals string | |||
numericEquals Quantity | |||
numericGreaterThan Quantity | |||
numericLessThan Quantity | |||
booleanEquals boolean | |||
isPresent boolean | |||
isNull boolean | |||
and WorkflowChoiceCondition array | |||
or WorkflowChoiceCondition array | |||
not WorkflowChoiceCondition | |||
next string | Next names the state to transition to when this rule matches. |
WorkflowList
WorkflowList is a list of Workflows.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | WorkflowList | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ListMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
items Workflow array |
WorkflowRetentionPolicy
WorkflowRetentionPolicy bounds retained history for finished runs.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
maxCount integer | |||
maxAge Duration |
WorkflowRun
WorkflowRun is one execution of a Workflow. Full step history lives in the statestore EventLog stream for the run, never in etcd; status carries a bounded tail for kubectl visibility.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | WorkflowRun | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ObjectMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
spec WorkflowRunSpec | |||
status WorkflowRunStatus |
WorkflowRunEventSummary
WorkflowRunEventSummary is one bounded-tail history entry for kubectl visibility; the full history lives in the statestore EventLog.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
seq integer | |||
type string | |||
state string | |||
attempt integer | |||
at Time | |||
note string |
WorkflowRunList
WorkflowRunList is a list of WorkflowRuns.
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string | fission.io/v1 | ||
kind string | WorkflowRunList | ||
kind string | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
apiVersion string | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
metadata ListMeta | Refer to Kubernetes API documentation for fields of metadata. | ||
items WorkflowRun array |
WorkflowRunPhase
Underlying type: string
WorkflowRunPhase is the run’s coarse lifecycle phase.
Validation:
- Enum: [Pending Running Succeeded Failed Cancelled TimedOut]
Appears in:
| Field | Description |
|---|---|
Pending | |
Running | |
Succeeded | |
Failed | |
Cancelled | |
TimedOut |
WorkflowRunSpec
WorkflowRunSpec identifies the Workflow to execute and the run’s input.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
workflowRef string | WorkflowRef names the Workflow (same namespace) this run executes. | ||
workflowGeneration integer | WorkflowGeneration records (for observability) which Workflow generation this run executes. It is NOT the pinning mechanism: the authoritative spec is the snapshot the engine embeds in the run’s event stream at RunStarted; a Workflow edit or deletion mid-run can neither fork nor strand a run. Set by the CLI; 0 means unknown. | ||
input JSON | Input is the run’s initial input document — ANY JSON value (apiextensionsv1.JSON, not RawExtension: the RawExtension schema is type=object and the apiserver would reject a bare string/array/ number). Webhook-capped at 256KiB (etcd objects cap at ~1.5MiB) — pass larger inputs by reference. |
WorkflowRunStatus
WorkflowRunStatus describes the observed state of a WorkflowRun.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
phase WorkflowRunPhase | Enum: [Pending Running Succeeded Failed Cancelled TimedOut] | ||
activeStates string array | ActiveStates lists the state names currently executing. | ||
startedAt Time | |||
finishedAt Time | |||
output JSON | Output holds the final output inline up to the step-I/O spill threshold — ANY JSON value (see Input for why apiextensionsv1.JSON); larger outputs spill to the statestore KV and OutputRef points there (the CLI dereferences). | ||
outputRef string | |||
errorType string | ErrorType and Cause carry the terminal failure classification so kubectl answers “why did it fail” without the history endpoint. Cause is bounded; the full detail lives in the run history. | ||
cause string | MaxLength: 1024 | ||
recentEvents WorkflowRunEventSummary array | RecentEvents is a bounded (<=20) tail; full history is in the EventLog. | ||
observedGeneration integer | |||
conditions Condition array |
WorkflowSpec
WorkflowSpec is a state machine: states are data, logic lives in functions.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
startAt string | StartAt names the state execution begins at. | ||
states object (keys:string, values:WorkflowState) | States is the state machine graph, keyed by state name. The size bound mirrors validation.MaxWorkflowStates and lets the apiserver’s CEL cost estimator bound rules on nested types. | MaxProperties: 100 MinProperties: 1 | |
defaultRetry RetryPolicy | DefaultRetry applies to Task states that do not set their own Retry. | ||
timeout Duration | Timeout bounds a whole run; expiry fails it with errorType Fission.Timeout. Defaults to 24h (a mis-authored graph or endlessly caught-and-retried loop must not hold an active run forever). | ||
historyRetention WorkflowRetentionPolicy | HistoryRetention bounds stored history (count + age) per finished run. |
WorkflowState
WorkflowState is one state in the machine. Exactly the fields for its Type may be set (enforced at admission).
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
type WorkflowStateType | Enum: [Task Choice Parallel Map Wait Succeed Fail] | ||
function FunctionReference | Function is the Task state’s target. | ||
timeout Duration | Timeout bounds one attempt of a Task invocation. | ||
retry RetryPolicy | Retry overrides the workflow’s DefaultRetry for this Task. | ||
catch WorkflowCatchRoute array | Catch routes a failed Task (retries exhausted, or a permanent error) to another state by matched errorType; first match wins. | ||
choices WorkflowChoiceRule array | Choices are the Choice state’s ordered rules; first match wins. | ||
default string | Default names the state a Choice falls through to when no rule matches; without it, no-match fails the run (Fission.NoChoiceMatched). | ||
branches WorkflowBranch array | Branches are the Parallel state’s concurrent sub-machines (or the Map state’s single iterator template). Branch states cannot nest further fan-out — enforced by the bounded WorkflowBranchState type. | MaxItems: 10 | |
itemsPath string | ItemsPath selects the array a Map state iterates (one branch per element, input = the element). | ||
duration Duration | Duration is how long a Wait state pauses the run — durably: the delay is a statestore Queue message, so a controller restart never loses it (robfig/cron-style absolute schedules stay with the timer subsystem; only durations here). | ||
maxConcurrency integer | MaxConcurrency throttles how many branches execute at once. Zero means the engine default (10) — NOT unbounded: an unthrottled large Map against poolmgr is a self-inflicted cold-start burst. The default is applied by the engine, not the schema: a schema default would stamp the field onto every state type. | Minimum: 0 | |
inputPath string | InputPath/ResultPath/OutputPath shape step I/O with JSONPath (Step Functions semantics; dialect pinned in pkg/workflow/expr). | ||
resultPath string | |||
outputPath string | |||
next string | Next names the state to run after this one; exactly one of Next/End is set on Task states (Succeed/Fail are implicitly terminal). | ||
end boolean |
WorkflowStateType
Underlying type: string
WorkflowStateType enumerates the state kinds the engine executes.
Validation:
- Enum: [Task Choice Parallel Map Wait Succeed Fail]
Appears in:
| Field | Description |
|---|---|
Task | |
Choice | |
Parallel | |
Map | |
Wait | |
Succeed | |
Fail |
WorkflowStatus
WorkflowStatus describes the observed state of a Workflow.
Appears in:
| Field | Description | Default | Validation |
|---|---|---|---|
observedGeneration integer | |||
conditions Condition array |